SOLIDserver Administrator Guide-6.0.2

SOLIDserver Administrator
Guide
Version 6.0.2
™
SOLIDserver Administrator Guide
Revision: #84949
Publication date June 21, 2019

Copyright © 2000-2019 EfficientIP
All specifications and information regarding the products in this document are subject to change without notice and should not be
construed as a commitment by EfficientIP. EfficientIP assumes no responsibility or liability for any mistakes or inaccuracies that may
appear in this document. All statements and recommendations in this document are believed to be accurate but are presented without
warranty. Users must take full responsibility for their application of any product.
Table of Contents
About This Guide ............................................................................................................ xvi
Documentation Organization ................................................................................... xvi
Documentation Convention ..................................................................................... xvii
I. Starting .......................................................................................................................... 1
1. Hardware Appliance Specificities ............................................................................ 2
SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000 .................................. 2
SDS-260 .......................................................................................................... 3
SDS-550, SDS-1100 and SDS-2200 .................................................................. 4
SDS-3300 and SDS-Blast Series ....................................................................... 6
2. First Installation ..................................................................................................... 8
Prerequisites .................................................................................................... 8
SDS-50 First Installation .................................................................................... 8
SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000 First Installation ......... 9
SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 and SDS-Blast Series
First Installation ............................................................................................... 11
SOLIDserver Software First Installation from a USB Flash Drive ........................ 17
3. Basic Network Configuration ................................................................................ 18
Setting the Basic Network Configuration Using a Terminal ................................. 18
Resetting the Default Network Settings From the LCD Screen ............................ 22
4. Using SOLIDserver for the First Time .................................................................... 24
Connecting to SOLIDserver ............................................................................. 24
Requesting and Adding a License .................................................................... 25
Defining the Internal Module Setup ................................................................... 26
Configuring SOLIDserver Network and Services ............................................... 27
Creating SOLIDserver Users ............................................................................ 27
5. Understanding the GUI ........................................................................................ 28
SOLIDserver Home Page ................................................................................ 29
Tree View ........................................................................................................ 29
Modules ......................................................................................................... 31
Breadcrumb .................................................................................................... 32
Menu .............................................................................................................. 33
Account Configuration ..................................................................................... 36
Listing Page .................................................................................................... 38
Properties Page .............................................................................................. 53
Charts ............................................................................................................ 55
Wizards .......................................................................................................... 59
Quick Wizards ................................................................................................. 66
Bookmarks ..................................................................................................... 70
Global Search ................................................................................................. 73
Notifications .................................................................................................... 74
6. Building your Dashboards .................................................................................... 77
Gadgets Displayed by Default .......................................................................... 78
Understanding the Gadget Types ..................................................................... 86
Browsing Gadgets ........................................................................................... 89
Creating Gadgets ............................................................................................ 92
Assigning Gadgets to a Dashboard .................................................................. 96
Organizing Gadgets on a Dashboard ................................................................ 99
Displaying or Hiding a Gadget from My Gadgets ............................................. 100
Editing Gadgets ............................................................................................ 100
Granting Other Users Access to the Gadgets .................................................. 103
Enabling or Disabling Gadgets ....................................................................... 104
iii
Deleting Gadgets .......................................................................................... 105

II. System Configuration ................................................................................................. 106
7. Network Configuration ........................................................................................ 107
Configuring Basic IP Addressing on an Interface ............................................. 108
Setting the Routing ........................................................................................ 109
Setting the Hostname .................................................................................... 111
Setting the DNS Resolver .............................................................................. 111
Setting the Firewall ........................................................................................ 112
Setting up a VLAN Interface ........................................................................... 115
Setting up an Ethernet Port Failover ............................................................... 117
Configuring a VIP .......................................................................................... 118
Setting up a VIF ............................................................................................ 121
Configuring a Media Interface ........................................................................ 122
8. Services Configuration ....................................................................................... 123
Handling Services ......................................................................................... 124
Configuring the SSH Remote Account ............................................................ 125
Changing the SFTP/SCP/RSYNC User Account Password .............................. 126
Managing the TFTP Upload Authorizations ..................................................... 126
Configuring the SMTP Relay .......................................................................... 127
Configuring the NTP Server ........................................................................... 128
Managing the HTTPS Certificate .................................................................... 129
Configuring DNS Guardian ............................................................................ 133
Managing the SNMP Service ......................................................................... 134
Downloading the DNS/DHCP/DHCPv6 Configuration File ................................ 136
9. License Management ......................................................................................... 137
Requesting a New Activation Key ................................................................... 137
Activating a New License ............................................................................... 138
III. Imports and Exports .................................................................................................. 139
10. Importing Data from a CSV File ........................................................................ 140
The Import Wizard ......................................................................................... 141
Importing Data to the IPAM ............................................................................ 143
Importing Data to the DHCP .......................................................................... 161
Importing Data to the DNS ............................................................................. 170
Importing Data to NetChange ......................................................................... 172
Importing Data to Device Manager ................................................................. 174
Importing Data to VLAN Manager ................................................................... 177
Importing Data to the Administration Module ................................................... 180
Managing Import Templates ........................................................................... 184
11. Importing IPAM Data ........................................................................................ 185
VitalQIP data ................................................................................................ 185
Nortel NetID data .......................................................................................... 186
12. Importing DHCP Data ...................................................................................... 188
ISC configuration files .................................................................................... 188
Alcatel-Lucent VitalQIP configuration files ....................................................... 189
Microsoft configuration files ............................................................................ 190
Infoblox configuration files .............................................................................. 191
MetaIP configuration files ............................................................................... 192
Nortel NetID configuration files ....................................................................... 193
13. Importing DNS Data ......................................................................................... 195
BIND archive files .......................................................................................... 195
VitalQIP archive files ..................................................................................... 197
14. Exporting Data ................................................................................................. 198
The Export Wizard ........................................................................................ 199
Browsing the Exports Database ..................................................................... 200
iv
Configuring Exports ....................................................................................... 201

Exporting Data To Reimport It Later ................................................................ 203
Managing Scheduled Exports ........................................................................ 207
Managing Scheduled Exports Configuration Files ............................................ 207
Managing Export Templates ........................................................................... 208
IV. IPAM Management .................................................................................................... 209
15. Managing Spaces ............................................................................................ 211
Browsing Spaces .......................................................................................... 211
Adding a Space ............................................................................................. 212
Editing a Space ............................................................................................. 213
Deleting a Space ........................................................................................... 213
Defining a Space as a Group Resource .......................................................... 214
16. Managing Networks ......................................................................................... 215
Browsing Networks ........................................................................................ 215
Adding Networks ........................................................................................... 217
Editing Networks ........................................................................................... 224
Splitting Networks ......................................................................................... 225
Merging Networks ......................................................................................... 226
Moving Networks ........................................................................................... 227
Discovering the Assigned IP Addresses in a Network ...................................... 227
Using Network Map to Display Assigned IP Addresses .................................... 228
Managing or Unmanaging Networks ............................................................... 229
Automating the DNS Records Update ............................................................. 230
Automating the DHCP Statics Reservation ...................................................... 230
Associating Networks With a VLAN ................................................................. 231
Deleting Networks ......................................................................................... 231
Defining a Network as a Group Resource ....................................................... 231
17. Managing Pools ............................................................................................... 233
Browsing Pools ............................................................................................. 233
Adding a Pool ................................................................................................ 234
Reserving a Pool ........................................................................................... 235
Resizing a Pool ............................................................................................. 235
Deleting a Pool .............................................................................................. 236
Defining a Pool as a Group Resource ............................................................. 236
18. Managing IP Addresses ................................................................................... 238
Browsing IP Addresses .................................................................................. 238
Adding an IP Address .................................................................................... 240
Editing an IP Address .................................................................................... 245
Configuring and Managing IP Address Aliases ................................................ 245
Configuring Multiple A Records for an IP Address ............................................ 248
Renaming IPv4 Addresses Massively ............................................................. 250
Moving IP Addresses ..................................................................................... 251
Pinging an IP Address ................................................................................... 253
Deleting an IP Address .................................................................................. 254
Restoring an IP Address ................................................................................ 254
Automating the DNS Records Update From the Page All addresses ................. 255
Automating the DHCP Statics Reservation From the Page All addresses .......... 255
Updating Device Manager From the Page All addresses .................................. 255
19. Setting Up a Transition From IPv4 to IPv6 .......................................................... 257
Transition Specificities ................................................................................... 257
Limitations .................................................................................................... 257
Configuring the IPv4 to IPv6 Transition ............................................................ 258
Activating the IPv4 to IPv6 Transition .............................................................. 259
20. Managing IPAM Templates ............................................................................... 263
v
Creating Template Classes in Class Studio ..................................................... 263

Creating IPAM Templates ............................................................................... 264
Applying a Template ...................................................................................... 269
21. Using VLSM to Manage Your IPAM Network ....................................................... 272
Choosing the Method That Suits Your Needs ................................................... 272
Managing a Space-Based VLSM Organization ................................................ 276
Managing a Network-Based VLSM Organization ............................................. 286
Using the VLSM Hierarchy to Delegate Management ....................................... 289
22. Managing VRF ................................................................................................. 293
Browsing VRFs and Route Targets ................................................................. 293
Managing Virtual Routing and Forwarding ....................................................... 294
Managing VRF Route Targets ......................................................................... 295
V. DHCP Management ................................................................................................... 298
23. Deploying DHCP Smart Architectures ............................................................... 300
Implementing DHCP Smart Architectures ....................................................... 301
DHCP Vendors Compatible with Smart Architectures ....................................... 304
Building a Highly Available Service With Smart Architectures ........................... 305
24. Managing DHCP Smart Architectures ............................................................... 306
Browsing DHCP Smart Architectures .............................................................. 306
Adding a DHCPv4 Smart Architecture ............................................................ 307
Adding a DHCPv6 Smart Architecture ............................................................ 315
Editing a DHCP Smart Architecture ................................................................ 319
Deleting a DHCP Smart Architecture .............................................................. 323
Defining a DHCP Smart Architecture as a Group Resource ............................. 323
25. Managing DHCP Servers ................................................................................. 324
Browsing DHCP Servers ................................................................................ 324
Managing EfficientIP DHCP Servers ............................................................... 326
Managing Agentless Microsoft DHCP Servers ................................................. 329
Managing ISC DHCP Servers ........................................................................ 333
Editing DHCP Servers ................................................................................... 342
Deleting DHCP Servers ................................................................................. 343
Defining a DHCP Server as a Group Resource ............................................... 343
26. Managing DHCP Scopes .................................................................................. 344
Browsing Scopes .......................................................................................... 344
Adding a DHCP Scope .................................................................................. 345
Editing a DHCP Scope .................................................................................. 346
Applying DHCP Options at Scope Level .......................................................... 347
Defining a Specific IPAM Space for a Scope .................................................... 348
Replicating Scope Data in the IPAM ................................................................ 349
Configuring Multiple Scopes for a Network Segment ........................................ 350
Copying or Moving DHCPv4 Scopes ............................................................... 351
Deleting a DHCP Scope ................................................................................ 352
DHCP Relay Agents ...................................................................................... 352
Defining a DHCP Scope as a Group Resource ................................................ 353
27. Managing Fixed Reservations ........................................................................... 354
Managing DHCP Statics ................................................................................ 354
Managing DHCP Groups ............................................................................... 363
28. Managing Dynamic Addressing ......................................................................... 366
Managing DHCP Ranges ............................................................................... 366
Managing DHCP Leases ............................................................................... 374
Restricting Access ......................................................................................... 382
Configuring the PXE ...................................................................................... 385
Preventing IP Address Duplication .................................................................. 387
29. Managing Failover Channels ............................................................................. 389
vi
DHCP Failover Principles and Operational States ............................................ 389

Browsing the DHCP Failover Channels Database ............................................ 392
Getting Familiar with the Failover Channels' Columns ...................................... 392
Switching a DHCP server to Partner-down ...................................................... 394
30. Configuring DHCP Options ............................................................................... 395
Setting DHCP Options ................................................................................... 396
Customizing DHCP Options ........................................................................... 397
DHCP Vendor Class Identifier ........................................................................ 399
Option 82: Relay Agent Information ................................................................ 399
Option 43: Vendor Specific Information ........................................................... 401
31. Monitoring and Reporting DHCP Data ............................................................... 404
Monitoring DHCP Servers From their Properties Page ..................................... 404
Monitoring DHCP Servers From the Page Analytics ......................................... 405
Monitoring DHCP Servers Using Rules ........................................................... 411
Generating DHCP Reports ............................................................................. 412
VI. DNS Management .................................................................................................... 414
32. Deploying DNS Smart Architectures .................................................................. 416
Master/Slave Smart Architecture .................................................................... 416
Multi-Master Smart Architecture ..................................................................... 417
Stealth Smart Architecture ............................................................................. 418
Single-Server Smart Architecture ................................................................... 418
Farm Smart Architecture ................................................................................ 419
33. Managing DNS Smart Architectures .................................................................. 420
Browsing DNS Smart Architectures ................................................................ 420
Adding a DNS Smart Architecture .................................................................. 421
Editing a DNS Smart Architecture .................................................................. 432
Deleting a DNS Smart Architecture ................................................................ 436
Defining a DNS Smart Architecture as a Group Resource ................................ 437
34. Managing DNS Servers .................................................................................... 438
Browsing DNS Servers .................................................................................. 439
Managing EfficientIP DNS Servers ................................................................. 440
Managing Agentless Microsoft DNS Servers ................................................... 444
Managing BIND DNS Servers ........................................................................ 447
Managing Generic DNS Servers .................................................................... 457
Managing Nominum ANS Servers .................................................................. 459
Managing Amazon Route 53 Servers ............................................................. 461
Synchronizing DNS Servers ........................................................................... 469
Editing DNS Servers ...................................................................................... 469
Securing the Management of DNS Servers Using a TSIG Key .......................... 470
Deleting DNS Servers ................................................................................... 471
Defining a DNS Server as a Group Resource .................................................. 472
35. Configuring DNS Servers ................................................................................. 473
Configuring DNS Forwarding at Server Level .................................................. 473
Configuring DNS Recursion at Server Level .................................................... 475
Configuring DNS Notify Messages at Server Level .......................................... 478
Restricting DNS Queries at Server Level ......................................................... 480
Limiting Zone Transfers at Server Level ........................................................... 482
Configuring a Blackhole ................................................................................. 484
Configuring Client Resolver Cache Options at Server Level ............................. 484
Configuring EDNS Options at Server Level ..................................................... 485
Improving the Server Performance ................................................................. 486
Configuring a Sortlist at Server Level .............................................................. 487
Limiting the Number of Responses of a Server ................................................ 488
Configuring DNS64 ....................................................................................... 490
vii
Configuring DNS Sources at Server Level ....................................................... 494

dynamic update on a server ........................................................................... 497
Configuring Access Control Lists For a Server ................................................. 499
Configuring DNS Keys ................................................................................... 501
Including Non-Supported DNS Settings .......................................................... 503
Configuring Anycast DNS .............................................................................. 503
Integrating Cisco Umbrella ............................................................................. 515
36. Managing DNS Views ....................................................................................... 518
Browsing DNS Views ..................................................................................... 518
Adding DNS Views ........................................................................................ 519
Editing DNS Views ........................................................................................ 522
Editing the Order of the Views ........................................................................ 523
Deleting DNS Views ...................................................................................... 523
Defining a DNS View as a Group Resource ..................................................... 524
Going Back to Managing Zones Without Views ................................................ 524
37. Configuring DNS Views .................................................................................... 526
Configuring DNS Forwarding at View Level ..................................................... 526
Configuring DNS Notify Messages at View Level ............................................. 528
Configuring DNS Recursion at View Level ....................................................... 529
Restricting DNS Queries at View Level ........................................................... 531
Limiting Zone Transfer at View Level ............................................................... 534
Configuring Client Resolver Cache Options at View Level ................................ 535
Configuring EDNS Options at View Level ........................................................ 536
Configuring a Sortlist at View Level ................................................................. 537
Configuring DNS Sources at View Level .......................................................... 537
38. Managing DNS Zones ...................................................................................... 542
Browsing DNS Zones .................................................................................... 542
Adding DNS Zones ........................................................................................ 544
Synchronizing DNS Zones ............................................................................. 559
Editing DNS Zones ........................................................................................ 560
Converting DNS Zones .................................................................................. 566
Adding or Removing an NS Record ................................................................ 567
Copying or Moving DNS Zones ...................................................................... 568
Setting Properties on Multiple DNS Zones ...................................................... 568
Forcing the Update of DNS Zones' Content ..................................................... 574
Disabling and Enabling DNS Zones ................................................................ 575
Deleting DNS Zones ...................................................................................... 576
Defining a DNS Zone as a Group Resource .................................................... 576
39. Configuring DNS Zones ................................................................................... 577
Managing DNS Zone Delegation .................................................................... 577
Configuring DNS Forwarding at Zone Level ..................................................... 579
Configuring DNS Notify Messages at Zone Level ............................................. 581
Managing DNS Security ................................................................................ 583
Configuring DNS Sources at Zone Level ......................................................... 587
40. Managing DNS Resource Records .................................................................... 592
Browsing DNS Resource Records .................................................................. 594
Adding Resource Records ............................................................................. 595
Editing Resource Records ............................................................................. 611
Configuring the Delegation at Record Level .................................................... 613
Copying or Moving Records ........................................................................... 615
Changing the Hostname Convention ............................................................... 616
Deleting Resource Records ........................................................................... 616
Load Balancing with Round Robin .................................................................. 617
SPF Record .................................................................................................. 617
viii
41. Implementing Dynamic Update ......................................................................... 619

Configuring Dynamic Update ......................................................................... 619
Configuring Secure Dynamic Update .............................................................. 620
Disabling Dynamic Update and Deleting Keys ................................................. 627
42. DNS Firewall (RPZ) .......................................................................................... 630
Browsing RPZ Zones and Records ................................................................. 631
Adding RPZ Zones ........................................................................................ 632
Editing RPZ Zones ........................................................................................ 634
Converting RPZ Zones .................................................................................. 635
Deleting RPZ Zones ...................................................................................... 636
Managing RPZ Rules .................................................................................... 636
Overriding RPZ Rules .................................................................................... 648
RPZ Limitations ............................................................................................. 649
43. Hybrid DNS Service ......................................................................................... 651
Checking the Compatibility with Hybrid ........................................................... 651
Switching to Hybrid DNS ................................................................................ 654
Forcing Compatibility with Hybrid .................................................................... 657
Switching Back to BIND ................................................................................. 658
Administrating the Backup and Restoration of Hybrid Configurations ................ 659
44. DNS Guardian ................................................................................................. 661
Prerequisites ................................................................................................. 661
Limitations .................................................................................................... 662
Enabling DNS Guardian ................................................................................. 662
Managing DNS Guardian Configuration .......................................................... 663
Managing DNS Guardian Cache .................................................................... 669
Managing DNS Guardian Statistics ................................................................. 677
Managing DNS Guardian Protection ............................................................... 702
Disabling DNS Guardian ................................................................................ 721
45. DNSSEC ......................................................................................................... 722
DNSSEC Records and Chain of Trust ............................................................. 722
Managing a DNSSEC Resolver ...................................................................... 725
Managing an Authoritative DNSSEC Server .................................................... 728
Disabling DNSSEC ........................................................................................ 736
46. HSM ............................................................................................................... 740
Prerequisites ................................................................................................. 740
Limitations .................................................................................................... 741
Browsing HSM Servers .................................................................................. 741
Setting Up the HSM ....................................................................................... 743
Best Practices to Stop Using the HSM ............................................................ 749
47. Monitoring and Reporting DNS Data ................................................................. 752
Monitoring DNS Servers From their Properties Page ....................................... 752
Monitoring DNS Servers From the Page Analytics ........................................... 753
Monitoring DNS Queries and Answers ............................................................ 759
Generating DNS Reports ............................................................................... 761
VII. Global Policies ........................................................................................................ 763
48. Inheritance and Propagation ............................................................................. 764
Prerequisites ................................................................................................. 765
Limitations .................................................................................................... 766
Configuring the Inheritance of a Parameter Value ............................................ 766
Configuring the Propagation of a Parameter Value ........................................... 768
Setting Class Parameters .............................................................................. 769
Reconciling Class Parameters ........................................................................ 770
49. Managing Advanced Properties ........................................................................ 772
Prerequisites ................................................................................................. 773
ix
Browsing Advanced Properties ....................................................................... 773

Selecting the Advanced Properties Displayed by Default .................................. 774
Configuring IPAM Advanced Properties .......................................................... 775
Configuring DHCP Advanced Properties ......................................................... 786
Configuring DNS Advanced Properties ........................................................... 788
Setting Advanced Properties .......................................................................... 790
VIII. NetChange ............................................................................................................. 792
50. Managing Network Devices .............................................................................. 794
Browsing Network Devices ............................................................................. 794
Adding Network Devices ................................................................................ 796
Importing Network Devices Using Discovery Protocols .................................... 797
Enabling or Disabling the 802.1X Authentication Protocol ................................. 799
Editing the SNMP Properties of a Network Device ........................................... 800
Refreshing the Network Devices Database ..................................................... 801
Connecting to a Network Device Via a Console ............................................... 802
Making a Network Device Snapshot ............................................................... 803
Creating Network Devices in Device Manager ................................................. 804
Deleting Network Devices .............................................................................. 804
Defining a Network Device as a Group Resource ............................................ 805
51. Managing Routes ............................................................................................. 806
Prerequisites ................................................................................................. 806
Limitations .................................................................................................... 806
Browsing Routes ........................................................................................... 806
Enabling the Registry Key Required to Display the VRF Routes ........................ 808
52. Managing VLANs ............................................................................................. 809
Browsing VLANs ........................................................................................... 809
Adding a VLAN ............................................................................................. 810
Editing a VLAN .............................................................................................. 811
Deleting a VLAN ............................................................................................ 811
53. Managing Ports ............................................................................................... 812
Browsing Ports .............................................................................................. 813
Enabling or Disabling a Port ........................................................................... 814
Editing a Port Interconnection ........................................................................ 814
Editing a Port Speed and Duplex Mode ........................................................... 815
Updating a Port Description ........................................................................... 816
Managing the 802.1X Authentication on a Port ................................................ 816
Restricting Access to a Port with the Protocol Port-security .............................. 817
Limiting Port Edition Rights to Specific Groups of Users ................................... 820
Configuring VLAN Tagging on a Port ............................................................... 822
Refreshing the Ports Database ....................................................................... 825
54. Managing Configuration Versioning ................................................................... 826
Prerequisites ................................................................................................. 826
Limitations .................................................................................................... 826
Browsing the Configuration Files .................................................................... 826
Managing Connection Profiles ........................................................................ 829
Configuring the Versioning of a Network Device ............................................... 831
Refreshing a Configuration File ...................................................................... 832
Comparing Configuration Files ....................................................................... 834
Monitoring the Configuration Versioning in the Logs ......................................... 835
Downloading Versioning Information ............................................................... 836
Configuring Advanced Versioning Options ....................................................... 837
Disabling Versioning on a Network Device ....................................................... 838
55. Managing Discovered Items .............................................................................. 840
Browsing Discovered Items ............................................................................ 840
x
Refreshing the Discovered Items Database ..................................................... 842

Populating Device Manager ........................................................................... 842
Creating the IP Address of a Discovered Item in the IPAM ................................ 842
Using the History View to Track the Movements of a Specific Device ................. 843
56. Managing Statistics .......................................................................................... 845
Displaying NetChange Statistics ..................................................................... 845
Displaying Network Device Statistics .............................................................. 845
Displaying Port Statistics ................................................................................ 845
57. Monitoring and Tuning ...................................................................................... 847
Generating NetChange Reports ..................................................................... 847
Keeping NetChange Data Up-to-date .............................................................. 847
Synchronizing the Network Devices with a CSV File ........................................ 848
Customizing the Network Devices' Type .......................................................... 849
IX. Workflow .................................................................................................................. 851
58. Granting Access to Workflow Classes ............................................................... 852
59. Managing Outgoing Requests ........................................................................... 853
Browsing Outgoing Requests ......................................................................... 853
Adding Requests for Creation ........................................................................ 854
Adding Requests for Edition ........................................................................... 855
Adding Requests for Deletion ......................................................................... 856
Editing Requests ........................................................................................... 858
Canceling Requests ...................................................................................... 860
60. Managing Incoming Requests ........................................................................... 861
Browsing Incoming Requests ......................................................................... 861
Managing the Requests Content .................................................................... 862
Administrating Requests Using the Default Statuses and Options ..................... 862
Administrating Requests Using Your Own Settings ........................................... 865
61. Executing Requests ......................................................................................... 866
Executing Requests Using the Execute Option ................................................ 866
Executing Requests Using Classes ................................................................ 867
62. Customizing the Requests Administration .......................................................... 871
Editing the Workflow Statuses ........................................................................ 872
Editing the Email Notification Details ............................................................... 874
Adding a Workflow Status .............................................................................. 875
Customized Statuses Best Practices .............................................................. 876
X. Device Manager ........................................................................................................ 878
63. Managing Devices ........................................................................................... 880
Browsing Devices .......................................................................................... 880
Adding Devices ............................................................................................. 881
Duplicating Devices ....................................................................................... 888
Merging Devices ........................................................................................... 888
Deleting Devices ........................................................................................... 889
64. Managing Ports and Interfaces ......................................................................... 890
Browsing Ports and Interfaces ........................................................................ 890
Adding Ports and Interfaces ........................................................................... 891
Editing Ports and Interfaces Properties ........................................................... 898
Tracking Changes on the Page All ports & interfaces ....................................... 902
Deleting Ports and Interfaces ......................................................................... 904
65. Managing the Interaction with the IPAM ............................................................. 905
Assigning IP Addresses to an Interface Using their MAC Address ..................... 905
Managing the IP Addresses / Interfaces Link from the IPAM ............................. 908
Editing the Devices Topology from the IPAM .................................................... 911
66. Rules Impacting Device Manager ...................................................................... 913
DHCP Rules Impacting Device Manager ......................................................... 913
xi
Adding Device Manager Rules ....................................................................... 913

Enabling or Disabling Device Manager Rules .................................................. 914
XI. VLAN Manager ......................................................................................................... 915
67. Managing VLAN Domains ................................................................................. 916
Browsing VLAN Domains ............................................................................... 916
Adding VLAN Domains .................................................................................. 916
Editing VLAN Domains .................................................................................. 917
Deleting VLAN Domains ................................................................................ 918
Defining a VLAN Domain as a Group Resource ............................................... 918
68. Managing VLAN Ranges .................................................................................. 919
Browsing VLAN Ranges ................................................................................. 919
Adding VLAN Ranges .................................................................................... 920
Editing VLAN Ranges .................................................................................... 921
Deleting VLAN Ranges .................................................................................. 922
Defining a VLAN Range as a Group Resource ................................................ 922
69. Managing VLANs ............................................................................................. 923
Browsing VLANs ........................................................................................... 923
Adding VLANs ............................................................................................... 924
Editing VLANs ............................................................................................... 925
Deleting VLANs ............................................................................................. 925
70. Managing the IPAM/VLAN Interaction ................................................................ 926
Displaying the IPAM/VLAN Interaction Advanced Properties ............................. 926
Configuring the IPAM/VLAN Interaction ........................................................... 927
Removing the IPAM/VLAN Interaction ............................................................. 928
XII. Rights Management ................................................................................................. 930
71. Managing Groups ............................................................................................ 931
Browsing Groups of Users ............................................................................. 931
Adding Groups of Users ................................................................................. 932
Editing Groups of Users ................................................................................. 933
Managing the Resources of a Group of Users ................................................. 933
Managing the Permissions of a Group of Users ............................................... 940
Managing the Users of a Group of Users ........................................................ 943
Enabling or Disabling Groups of Users ............................................................ 944
Deleting Groups of Users ............................................................................... 944
72. Managing Users .............................................................................................. 945
Browsing Users ............................................................................................. 945
Adding Users ................................................................................................ 946
Editing Users ................................................................................................ 947
Changing the User Password ......................................................................... 948
Configuring the User Password Complexity ..................................................... 949
Configuring Users Connection Parameters ...................................................... 949
Configuring User Sessions ............................................................................. 951
Enabling or Disabling Users ........................................................................... 952
Generating User Reports ............................................................................... 952
Deleting Users .............................................................................................. 953
73. Managing Authentication Rules ......................................................................... 954
Browsing Authentication Rules ....................................................................... 955
Adding Authentication Rules .......................................................................... 955
Editing Authentication Rules ........................................................................... 961
Enabling or Disabling Authentication Rules ..................................................... 961
Deleting Authentication Rules ........................................................................ 962
XIII. Administration ........................................................................................................ 963
74. High Availability Management ........................................................................... 964
Prerequisites ................................................................................................. 965
xii
Specificities .................................................................................................. 965

Limitations .................................................................................................... 965
Browsing the High Availability Appliances Database ........................................ 965
Configuring SOLIDserver for High Availability Management ............................. 968
Updating the Database of Appliances in High Availability ................................. 971
Monitoring Appliances in High Availability ....................................................... 972
Switching the HA Configuration ...................................................................... 974
Replacing Appliances in High Availability ........................................................ 975
Disabling the HA Configuration ....................................................................... 976
High Availability Advanced Options ................................................................. 977
Troubleshooting Solutions .............................................................................. 981
Frequently Asked Questions .......................................................................... 986
75. Remote Management of Other Appliances ........................................................ 988
Prerequisites ................................................................................................. 988
Specificities .................................................................................................. 988
Configuring SOLIDserver to Remotely Manage Other Appliances ..................... 988
Managing the Network Configuration of a Remote Appliance ........................... 990
Managing the Services Configuration of a Remote Appliance ........................... 990
Monitoring Remote Appliances ....................................................................... 991
Replacing an Appliance Managed Remotely ................................................... 993
Removing Appliances Managed Remotely ...................................................... 994
76. Monitoring ....................................................................................................... 995
Managing Reports ......................................................................................... 995
Managing Alerts .......................................................................................... 1004
Managing the Logs ...................................................................................... 1012
Monitoring the Appliance Statistics ............................................................... 1014
Tracking Sessions ........................................................................................ 1016
Tracking Users ............................................................................................ 1016
Managing SNMP Profiles ............................................................................. 1022
Monitoring Using SNMP ............................................................................... 1023
Displaying Netstat Data ................................................................................ 1039
Sizing the Database Tables .......................................................................... 1040
77. Maintenance .................................................................................................. 1042
Managing Files from the Local Files Listing ................................................... 1042
Using the Maintenance Mode ....................................................................... 1050
Updating the Macros and Rules .................................................................... 1050
Clearing the Appliance Cache ...................................................................... 1051
Troubleshooting ........................................................................................... 1051
Managing Backups and Restoring Configurations .......................................... 1054
Shutting Down and Rebooting ...................................................................... 1059
78. Upgrading ...................................................................................................... 1064
Prerequisites ............................................................................................... 1064
Upgrading an Appliance ............................................................................... 1064
Upgrading Appliances in High Availability ...................................................... 1066
Upgrading Appliances Managed Remotely .................................................... 1073
Troubleshooting the Upgrade ........................................................................ 1074
XIV. Customization ....................................................................................................... 1082
79. Customizing the GUI ...................................................................................... 1083
Customizing SOLIDserver Login Page With an Image .................................... 1083
Customizing SOLIDserver Home Page Welcome Banner ............................... 1085
Customizing the Interface Names and Fields ................................................. 1087
80. Managing Smart Folders ................................................................................ 1089
Browsing Smart Folders ............................................................................... 1089
Adding Smart Folders .................................................................................. 1090
xiii
Editing Smart Folders .................................................................................. 1090

Sharing Smart Folders ................................................................................. 1091
Deleting Smart Folders ................................................................................ 1092
81. Managing IPAM and DHCP IPv6 Labels .......................................................... 1093
Limitations .................................................................................................. 1093
Adding Labels ............................................................................................. 1093
Displaying or Hiding Labels .......................................................................... 1094
Editing Labels ............................................................................................. 1094
Deleting Labels ........................................................................................... 1095
82. Configuring Classes ....................................................................................... 1096
Browsing Class Studio Database .................................................................. 1097
Managing Classes ....................................................................................... 1099
Configuring the Classes' Content .................................................................. 1105
Class Studio Syntax .................................................................................... 1152
Defining a Class as a Group Resource ......................................................... 1153
83. Configuring Custom Databases ....................................................................... 1154
Browsing Custom DB ................................................................................... 1154
Adding a Custom DB ................................................................................... 1155
Editing a Custom DB ................................................................................... 1155
Deleting a Custom DB ................................................................................. 1156
Configuring a Custom DB with Custom Data ................................................. 1156
84. Managing Customization Packages ................................................................. 1158
Browsing the Packages Database ................................................................ 1158
Uploading Packages .................................................................................... 1159
Creating Packages ...................................................................................... 1159
Editing Packages ......................................................................................... 1161
Installing Packages ...................................................................................... 1161
Uninstalling Packages .................................................................................. 1162
Downloading Packages ................................................................................ 1162
Deleting Packages ....................................................................................... 1163
A. Matrices of Network Flows ....................................................................................... 1164
SOLIDserver ....................................................................................................... 1165
IPAM .................................................................................................................. 1166
DHCP ................................................................................................................. 1167
DNS ................................................................................................................... 1168
NetChange ......................................................................................................... 1170
Remote Management .......................................................................................... 1171
B. Multi-Status Messages ............................................................................................. 1172
DHCP Multi-Status Messages .............................................................................. 1172
DNS Multi-Status Messages ................................................................................. 1172
C. Default Gadgets ...................................................................................................... 1174
D. SPX ........................................................................................................................ 1176
Prerequisites ....................................................................................................... 1176
Enabling the SPX Classes ................................................................................... 1176
Enabling the SPX Rules ....................................................................................... 1177
Managing your RIPE Network With SOLIDserver ................................................... 1177
E. DHCP Options ......................................................................................................... 1198
Basic Options ...................................................................................................... 1198
Server Parameters .............................................................................................. 1199
Lease Information Options ................................................................................... 1200
WINS/NetBIOS Options ....................................................................................... 1200
Host IP Options ................................................................................................... 1200
Interface Options ................................................................................................. 1201
Servers Options .................................................................................................. 1202
xiv
BOOTP Compatibility Options .............................................................................. 1203

DHCP Packet Fields Options ................................................................................ 1204
Microsoft DHCP Client Options ............................................................................ 1205
NetWare Client Options ....................................................................................... 1205
NIS/NISplus Options ............................................................................................ 1206
Miscellaneous ..................................................................................................... 1207
Vendor MSFT Options ......................................................................................... 1207
Vendor Nwip Options ........................................................................................... 1207
F. MAC Address Types References ............................................................................... 1208
G. DNS Resource Records Related Fields .................................................................... 1210
H. Advanced Properties ............................................................................................... 1214
I. User Tracking Services Filter ..................................................................................... 1215
J. Class Studio Pre-defined Variables ............................................................................ 1218
K. Configuring RADIUS ................................................................................................ 1221
Configuring FreeRadius ....................................................................................... 1221
Configuring RADIUS with Cisco ACS .................................................................... 1222
Configuring OneTime Password with Token Authentication ..................................... 1223
L. Using Remote Authentication for SSH Connections to SOLIDserver ............................ 1226
Configuring LDAP Authentication for SSH Connections .......................................... 1226
Configuring RADIUS Authentication for SSH Connections ...................................... 1231
M. Configuring Non-Supported Options ......................................................................... 1235
Prerequisites ....................................................................................................... 1236
Limitations .......................................................................................................... 1236
Configuring Non-Supported Firewall Rules ............................................................ 1237
Configuring Non-Supported Apache Settings ........................................................ 1239
Configuring Non-Supported Unbound Settings ...................................................... 1241
Configuring Non-Supported NSD Settings ............................................................. 1243
Configuring Non-Supported BIND Settings ............................................................ 1245
Configuring Non-Supported SNMP Settings .......................................................... 1249
Configuring Non-Supported DHCP Configurations ................................................. 1250
Configuring Non-Supported NTP Settings ............................................................. 1252
Configuring Non-Supported syslog-ng Settings ..................................................... 1253
Configuring Non-Supported PostgreSQL Settings .................................................. 1254
Index .......................................................................................................................... 1255
xv
About This Guide
SOLIDserver is a hardware or software appliance suite that allows to manage from one device
a network at all levels, from the IP addresses to the network devices, through key services, systems
and protocols.
The Administrator Guide describes and details the modules you might have purchased with your
license. This guide does not detail the existing license types and what they may contain or lack.
Note that some configurations described in this document should not be handled by end users
if they do not have previous knowledge of the basic principles of certain protocols and what the
operations imply on the network configuration.
Documentation Organization
The guide is divided into the following parts:
• Starting: the hardware appliances description, the installation of SOLIDserver on hardware

and software, the basic network configuration, the appliance first use procedures, a compre-
hensive presentation of the GUI and how to use gadgets to build your modules' dashboard.
• System Configuration: the system configuration possibilities of an appliance such as the network
configuration or the services.
• Imports and Exports: all the data import and export options available.
• IPAM Management: all the options available to assist you in IP addresses management.
• DHCP Management: all the options available in the DHCP protocol dedicated module.
• DNS Management: all the options available in the DNS protocol dedicated module.
• Global Policies: the options available in all modules: parameters inheritance and propagation,
advanced properties, imports, exports, reports, alerts and Smart Folders.
• NetChange: all the options available in the module NetChange, dedicated to devices connected
to your network.
• Workflow: all the options available in the Workflow dedicated module.
• Device Manager: all the options available in the module Device Manager dedicated to devices,
ports and interfaces personalized management.
• VLAN Manager: all the options available in the module VLAN Manager dedicated to Virtual
Local Area Network personalized management.
• Rights Management: all the options available to manage users, groups of users, their authen-
tication and the operations they can perform.
• Administration: all the options and operations available in the module Administration module
from configuring appliances in high availability or remotely managing them, to monitoring,
maintaining and upgrading the appliance.
• Customization: a description of all the options available in the Administration module to cus-
tomize your appliance: from images, IPv6 labels and Smart Folders to custom databases,
classes and customization packages.
At the end of the guide, you can also find appendices containing further details regarding:
• Matrices of Network Flows details the network flows of the DNS, the DHCP, the IPAM as well
as the High Availability Management or NetChange.
xvi
About This Guide
• Multi-Status Messages contains the existing messages returned bu the column Multi-status.
• Default Gadgets describes the gadgets available by default: their type, purpose and the
dashboard they are displayed when relevant.
• SPX: the Service Provider eXtension module that allows you to manage your RIPE database
from SOLIDserver.
• DHCP Options includes options and parameters from basic options to lease information, host
IP, interfaces, servers, BOOTP, Microsoft, NetWare NIS/NISplus or even vendors options.
• MAC Address Types References displays the reference number, in the GUI, of DHCP statics
supported MAC types.
• DNS Resource Records Related Fields displays the fields that need to be configured when
adding resource record to a zone.
• User Tracking Services Filter details the use of the filters available on the page User tracking.
• Class Studio Pre-defined Variables: provides a table detailing the values available when con-
figuring a pre-defined variable class object.
• Configuring RADIUS: provides procedures to configure FreeRadius and RADIUS with Cisco
ACS and make them compatible with SOLIDserver.
• Using Remote Authentication for SSH Connections to SOLIDserver: provides the configuration
details to use LDAP or RADIUS authentication and grant access to existing LDAP/RADIUS
users to SOLIDserver via SSH.
• Configuring Non-Supported Options: provides advanced configuration details to incorporate
non-supported firewall rules and options for the services Apache, Unbound, NSD, BIND, SNMP,
DHCP, NTP, syslog-ng and PostgreSQL.
Documentation Convention
Each part of this guide is divided into chapters where the available operations are detailed in
procedures. Throughout the guide, you will find the following elements.
Element Description
Procedure All the procedures detail step by step the available configurations and possible operations. They
contain highlighted words and icons matching the Graphical User Interface (GUI).
Name All key words to browse the GUI: page name, wizard title, column name...
BUTTON The buttons in the GUI: OK, EDIT, DELETE, CANCEL, UPDATE, etc.
Menu The menus and their entries. The navigation within menu entries is symbolized by arrows as
such: menu > option > sub-option.
xvii
Part I. Starting
This part details the very first operations to connect to SOLIDserver, for hardware and software appliances
as well as a presentation of the GUI and the modules' dashboard. It contains the following chapters:
• Hardware Appliance Specificities: describes our hardware appliance suite. Depending on the model you
chose, the front panel and available buttons and possible configurations from the hardware appliance
differ.
• First Installation: describes the installation procedure for all hardware models, as detailed in the guide
Configuring SOLIDserver Hardware Appliance that is sent with the appliance itself, and for the USB software
installation.
• Basic Network Configuration: describes how to configure or reset the appliance basic configuration - a
virtual interface, a physical interface, an IP address, a netmask, a gateway and the IP address of the DNS
resolver - through CLI.
• Using SOLIDserver for the First Time: describes the first steps and best practices to follow after setting
SOLIDserver with an IP address: from logging in and configuring the appliance service to creating users.
• Understanding the GUI: describes the default features of SOLIDserver Graphical User Interface. It includes
a presentation of the navigation philosophy, some tips and all the extra functionalities we provide: book-
marks, quick wizards, global search, etc.
• Building Your Dashboards: a description of all the gadgets that you can create/display on the modules'
dashboard, their homepage. You can customize each dashboard to suit your needs, you can build them.
Chapter 1. Hardware Appliance
Specificities
There are different hardware appliances models available:
1. The hardware appliance of SOLIDserver SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-
3000.
2. The hardware appliance of SOLIDserver SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-
3300 and SDS-Blast series (SDS-4000, SDS-5000 and SDS-5500).
SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000

SOLIDserver SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000 front panel allows you
to plug in one or more physical interfaces. It is also possible to plug in a console cable to visualize
the display output on another computer/screen. Using the server panel, you can easily set up
basic network configuration.
the global IPAM company
1 1 2 2 3 4
eth1 eth2 eth3 eth4 rmgmt console

mgmt1 mgmt2 lan1 lan2
Figure 1.1. Front panel ports
eth1/eth2: These ports allow you to plug in one or more cables for the management. To
understand how SOLIDserver manages all physical interfaces, refer to the section System
Configuration.
eth3/eth4: These ports allow you to plug in one or more cables for the network services.
To understand how SOLIDserver manages all physical interfaces, refer to the section System
Configuration.
rmgmt: This port is IPMI and LAN dedicated. The IPMI protocol leverages an out-of-band
network (typically dedicated for server monitoring and management), that provides a flawless
and secure path for mission-critical applications when regular in-band connectivity is lost or
is unresponsive.
console: This port allows you to plug in a console cable to visualize the output on a terminal
device. The console port on SOLIDserver is an asynchronous serial port. The console port
is configured as data terminal equipment (DTE). The console port uses RJ-45 connectors
(Cisco). Adapters are available for connections to PC terminals, modems, or other external
communication equipment. To connect a PC terminal to the console port, use either a RJ-
45-to-RJ-45 rollover cable, a RJ-45-to-DB-25 female DTE adapter or the RJ-45-to-DB-9 fe-
male DTE adapter (labeled "TERMINAL"). The default parameters for the console port are:
• 9600 baud.
• 8 data bits.
• No parity generated or checked.
• 1 stop bit.
• No Flow Control.
2
Hardware Appliance Specificities
You may use the following software:
• Hyper terminal or Putty on Windows.

• minicom on Linux, MacOS, Unix.
• cu on Linux, MacOS, Unix.
1 2 3
reset
4 5
Figure 1.2. Front panel LED, LCD screen and buttons
This LED glows green when the appliance is on.

This LED flashes red when the hard drive processes data.
This LED glows yellow in case of a new information event.
Button to start/stop the server. If you keep the button pushed, the server shuts down directly
- this action is not recommended. If you push the button once, the server shuts down by itself.
Buttons to navigate through the LCD screen menus.
SDS-260
The sections below describe the hardware specificities of the SOLIDserver SDS-260 appliance.
SDS-260 Front Panel

SOLIDserver SDS-260 front panel allows you to set up the access IP address of the iDRAC via
a keyboard/monitor. From the iDRAC interface, you can configure SOLIDserver IP address.
Figure 1.3. Front panel
The On/Off button. It is lit when the appliance is on.

The NMI button. It is inactive on SOLIDserver hardware appliances.
The system identification button locates a particular appliance in a rack: push it to light it up
both at the back and the front of the appliance. Push it again to turn off the lights.
The VGA video connector allows you to connect a monitor to the system.
The health indicator. If the system is on and in good health, the indicator turns solid blue.
The indicator flashes amber if the system is on or in standby, and if any error exists (for
example, a failed fan or hard drive).
The hard drive indicator. The indicator flashes amber if there is a hard drive error.
3
The electrical indicator. The indicator flashes amber if the system experiences an electrical
error (for example, voltage out of range, or a failed power supply unit or voltage regulator).
The temperature indicator. The indicator flashes amber if the system experiences a thermal
error (for example, a temperature out of range or fan failure).
The memory indicator. The indicator flashes amber if a memory error occurs.
The USB ports 1 and 2. They are USB 2.0 compliant.
The information tag. Pull it out to see the hardware service tag and express service tag.
SDS-260 Back Panel

SOLIDserver SDS-260 back panel allows you to connect a power supply, your network devices
and other types of equipment to your appliance.
Figure 1.4. Back panel
The iDRAC serial port allows you to connect a serial device to the system.
The vFlash card slot.
The iDRAC port is dedicated to the remote management of the appliance.
The ethernet connector bge1 allows you to connect network devices to your appliance.
The ethernet connector bge0 serves the same purpose as bge1.
The power supply unit (PSU) allows you to plug the appliance to a power source.
The self-diagnostic button allows you to perform a quick health check on the cabled PSU
of the system.
The AC power supply unit status indicator. When pressing the self-diagnostic button, it turns
green if a valid power source is connected. Otherwise, the PSU is not connected or faulty.
SDS-550, SDS-1100 and SDS-2200

The sections below describe the hardware specificities of the SOLIDserver SDS-550, SDS-1100
and SDS-2200 appliances.
4
SDS-550, SDS-1100, SDS-2200 Front Panel

SOLIDserver SDS-550, SDS-1100, SDS-2200 front panel allows you to set up the IP address of
the iDRAC used to configure SOLIDserver, via an LCD screen or a keyboard/monitor. It also allows
you to display the hardware information.

The LCD menu left button. Moves the cursor back in one-step increments.
The LCD menu selection button. Selects the menu item highlighted by the cursor.
The LCD menu right button. Moves the cursor forward in one-step increments.
The LCD screen used to set up the appliance iDRAC IP address or display hardware inform-
ation
The hot swappable hard drive 1.
SDS-550, SDS-1100, SDS-2200 Back Panel

SOLIDserver SDS-550, SDS-1100 and SDS-2200 back panel allows you to connect a power
supply, your network devices and other types of equipment to your appliance.
The vFlash card slot.
The iDRAC port. It is dedicated to the remote management of the appliance.
5
The ethernet connector igb0 allows you to connect network devices to your appliance.
The ethernet connector igb1 serves the same purpose as igb0.
The power supply unit (respectively PSU1 and PSU2) allow to plug the appliance to a power
source. It is recommended to use both PSUs to prevent connection loss if one fails.
SDS-3300 and SDS-Blast Series

The sections below describe the hardware specificities of the SDS-3300 and SDS-Blast Series
(SDS-4000, SDS-5000 and SDS-5500) appliances.
SDS-3300 and SDS-Blast Series Front Panel

SOLIDserver SDS-3300 and SDS-Blast series (SDS-4000, SDS-5000 and SDS-5500) front
panel allows you to set up the IP address of the iDRAC used to configure SOLIDserver, via an
LCD screen or a keyboard/monitor. It also allows you to display the hardware information.

The LCD menu left button. Moves the cursor back in one-step increments.
The LCD menu selection button. Selects the menu item highlighted by the cursor.
The LCD menu right button. Moves the cursor forward in one-step increments.
The LCD screen used to set up the appliance iDRAC IP address or display hardware inform-
ation.
6

The SD card plug. The card contains SOLIDserver installation image.
The USB port 1. It is USB 2.0 compliant.
SDS-3300 and SDS-Blast Series Back Panel

SOLIDserver SDS-3300 back panel allows you to connect a power supply, your network devices
and other types of equipment to your appliance. For SOLIDserver SDS-Blast Series, it also
provides you with two 10 Gbps optical fiber slots, for a full DNS Guardian protection.

1
The optical slot ix1 allows you to connect a 10 Gbps LC optical connector . It is only available
on SOLIDserver SDS-Blast Series appliances.
The optical slot ix0 serves the same purpose as ix1.
The iDRAC enterprise port. It is dedicated to the remote management of the appliance.
The VGA video connector 1. It allows you to connect a monitor to the system.
The ethernet connector igb0 allows you to connect network devices to your appliance.
The power supply unit 1 (PSU1) allows you to plug the appliance to a power source. It is
recommended to use both PSUs to prevent connection loss if one fails.
The power supply unit 2 (PSU2) serves the same purpose as PSU1.
1
We recommend using SFP+ Intel X520 adapters. For more details on the supported products, refer the Intel website at https://www.in-
tel.com/content/www/us/en/support/articles/000005528/network-and-i-o/ethernet-products.html
7
Chapter 2. First Installation
This chapter is a recollection of the proper first installation of SOLIDserver hardware depending
on your model. You need to follow the procedures it contains during the very first installation of
the hardware appliance or if you reset it to its factory default settings.
Prerequisites
Before using SOLIDserver Graphical User Interface (GUI), you need to connect your device to
the network and configure an IP address for it (i.e. the default gateway configured during the in-
stallation).
The management client is the computer from which you configure and manage SOLIDserver,
make sure you meet the following requirements:
• You must have at least one of the following supported web browsers: Google Chrome, Mozilla
Firefox, Microsoft Internet Explorer, Microsoft Edge or Safari (Mac only). We recommend using
its latest and most stable version.
• You must disable any web browser pop-up blocker for the IP address and domain name con-
figured for your appliance. Otherwise, you cannot manage SOLIDserver properly.
SDS-50 First Installation

SOLIDserver software is already installed on hardware appliances SDS-50, you need to configure
the access IP address of your choice to manage it.
Prerequisites
• A SOLIDserver hardware appliances SDS-50.
• A computer with a serial port.
• A terminal emulator able to connect to a serial port installed on your computer.
Configuring SOLIDserver IP Address

To configure SOLIDserver and the IP address used to access it, you must use a terminal emulator.
To configure SOLIDserver on SDS-50 appliances
1. Plug in the appliance power cable.

2. Plug in the appliance to your computer serial port.
3. Plug in at least one physical interface Ethernet cable to the appliance.
4. Open a terminal emulator and start a session with a Serial connection. When the appliance
has started, the page WELCOME TO SOLIDSERVER opens.
5. Log in using the login root and no password. The configuration window opens, it indicates
the version: SOLIDserver <version>.
6. In the Main Menu, S Quick Start is highlighted.
7. Hit Enter. The page Quick Start - Configure basic network settings opens.
8. Hit Enter to confirm the quick start configuration. The menu Physical interfaces opens.
8
First Installation
9. In the menu Physical Interfaces, select one or several interfaces. [*] indicates which inter-
face(s) is selected. Use the keyboard arrows or the digits to highlight the interface of your
choice and hit the space key to select or deselect an interface.
If you plugged in several physical interfaces Ethernet cables, you are configuring an Ethernet
port failover.
10. Hit Enter to confirm the interface(s) selection. The menu Network configuration opens.
11. Configure the access to SOLIDserver:
• Configure the interface IP address on the line IP: . Hit the down arrow to get to the next
line.
• Configure the interface netmask on the line Netmask: . Hit the down arrow to get to the
next line.
• Configure the interface default gateway on the line Gateway: . Hit the tabulation key to
highlight OK.
12. Hit Enter to confirm your configuration and go back to the Main Menu.
13. The line C Commit modifications to system is highlighted.
14. Hit Enter to save the whole configuration. The window Do you really want to commit
modifications to system? opens.
15. The button Yes is highlighted.
16. Hit Enter to commit your choice. When the configuration is saved, the window Configuration
applied opens.
17. Hit Enter to close the window. The Main Menu is visible again.
18. Hit E to select EXIT and hit Enter. The configuration window closes.
Now your configuration is complete and you can connect to SOLIDserver software using the IP
address you configured. For more details, refer to the chapter Using SOLIDserver for the First
Time.
SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000 First

Installation
These types of SOLIDserver belong to the third generation hardware appliances, their front
panel LCD screen can be used in two ways:
1. To set up the first network configuration.
Once the appliance has booted and is up and running, you have 30 seconds to press any arrow
button to get into the edition mode. Through this mode you can edit the IP address as well as
the netmask and the gateway. By default, the first physical interface is configured (eth1 on the
server panel, called em0 in the system) with an IP address 192.168.1.1/255.255.255.0 and a
gateway set to 0.0.0.0.The configuration of the Basic Network using LCD display can be applied
only on eth1 with one IP address.
2. To visualize the network configuration.
The LCD screen displays at all times the following information when SOLIDserver is running:
the hostname, serial number, IP address, prefix/netmask and gateway. During the very first
configuration, if you let the 30 seconds timer run out, the default configuration is implemented
9
First Installation
and displayed on the screen after 90 seconds. No matter how you configured the appliance,
the LCD screen provides a summary of the key network configuration data.
Prerequisites
• A SOLIDserver hardware appliance SDS-250, SDS-500, SDS-1000, SDS-2000 or SDS-3000.
Configuring SOLIDserver IP Address

From the front panel LCD screen, you can SOLIDserver and the IP address used to access it.
To configure SOLIDserver on SDS-250, SDS-500, SDS-1000, SDS-2000 and

SDS-3000 appliances
1. Plug in an Ethernet cable on Eth1, the default interface configured on SOLIDserver.

2. Turn on SOLIDserver by pushing . During the boot sequence, the LCD screen displays
Device booting.
3. Once SOLIDserver is booted, a 30 seconds countdown is displayed. Press to enter the
setup.
4. Modify the IP address: to move from one octet to the other, press / . To decrease/increase
its value, press / . By default, the IP address is 192.168.1.1 .
5. To commit the new IP address, go to the last position of the menu (on the far right). A new
Menu appears:
• Esc: Cancel the current modification and go back to the menu.

• No: Cancel the current modification and allows you to set a new value.
• Yes: Commit the value. The message Performing appears.
6. Modify the Netmask: to move from one octet to the other, press / . To decrease/increase
its value, press / . By default, the netmask is 255.255.255.0 .
7. To commit the new Netmask, go on the last position of the menu (on the far right). A new
Menu appears:

8. Modify the Gateway: to move from one octet to the other, press / . To decrease/increase
its value, press / . By default, the gateway is 0.0.0.0 .
9. To commit the new Gateway, go on the last position of the menu (on the far right). A new
Menu appears:

10. The basic network configuration is applied.
10
First Installation
address you configured. For more details, refer to the chapter Using SOLIDserver for the First
Time.
Keep in mind that the LCD screen can also be used to reset the hardware default configuration.
For more details, refer to the section Resetting the Default Network Settings From the LCD
Screen.
SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 and

SDS-Blast Series First Installation
These types of SOLIDserver belong to the fourth generation hardware appliances, to the exception
of the SDS-260, the hardware front panel LCD screen can be used in two ways:
1. To set up the iDRAC IP address.
Once the appliance has booted and is up and running, you have 30 seconds to press any arrow
button to get into the edition mode. Through this mode you can edit the IP address, netmask
and gateway. By default, it is configured with the IP address 192.168.0.120/255.255.255.0
and the gateway 192.168.0.0.
2. To visualize the iDRAC IP address and DNS and DHCP basic configuration.
The LCD screen allows you to view at all times the hardware settings: the iDRAC IP (IPv4,
IPv6 and DNS configuration), the error history, the MAC address, the host, model and user
string name, the electric power used and the temperature.
This hardware generation of SOLIDserver comes embedded with a sub-component designed to

remotely manage the appliance. This sub-component is called an iDRAC controller, or Integrated
Remote Access Controller. The iDRAC provides a dedicated management platform from where
you can monitor the hardware appliance itself and configure SOLIDserver software.
For these reasons, the installation of these hardware appliance models requires to:
1. Configure an IP address for the iDRAC.

2. Connect to the iDRAC to configure SOLIDserver access IP address.
3. Once the software installation is over, you need to connect to SOLIDserver, add your license
and set up the software's internal module setup.
Prerequisites
• SOLIDserver hardware appliance SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 or
SDS-Blast series (SDS-4000, SDS-5000 or SDS-5500).
• A browser with the latest version of Java JRE installed.
1. Setting up the iDRAC IP Address

To configure a SOLIDserver software appliance on a hardware appliance SDS-260, SDS-550,
SDS-1100, SDS-2200, SDS-3300 or SDS-Blast series (SDS-4000, SDS-5000 or SDS-5500) you
need to set up an IP address to connect to the hardware appliance iDRAC. Once the iDRAC IP
address is set, you can access it and configure SOLIDserver IP address.
To set up the iDRAC IP address you must:
11
First Installation
1. Make sure you meet the prerequisites.

2. Choose a configuration method:
• Either without LCD screen, using a keyboard and monitor. This is mandatory for SDS-260
appliances. For more details, refer to the section Setting up the iDRAC IP Address Without
LCD Screen.
• Or from the LCD screen. This method can be used on appliances SDS-550 and higher.
For more details, refer to the section Setting up the iDRAC IP Address From the LCD Screen.
Prerequisites
• Plug in the appliance power supply cable(s):

• For appliances SDS-260, you only need to plug in the power cable.
• For appliances SDS-550, SDS-1100, SDS-2200, SDS-3300 and SDS-Blast series (SDS-
4000, SDS-5000 and SDS-5500), you must plug in both power cables.
• Prepare at least two Ethernet cables:
• One is dedicated to the iDRAC configuration.
• The other one is used to set up the appliance physical interfaces.You can set up an Ethernet
port failover with up to 4 cables.
Setting up the iDRAC IP Address Without LCD Screen
For hardware appliances SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 or SDS-Blast

series (SDS-4000, SDS-5000 or SDS-5500), you can configure an access IP address for the
iDRAC using a keyboard and monitor. This is the only method for SDS-260 appliances. Once
the iDRAC IP address is set, you can access it and configure the IP address of your SOLIDserver
appliance.
The iDRAC is already configured with a default IP address - 192.168.0.120, netmask -

255.255.255.0 and gateway - 192.168.0.0. If this IP address is free and accessible on your network,
you do not need to follow the procedure below, you can go straight to the section Configuring
SOLIDserver from the iDRAC.
To set up the iDRAC IP address without LCD screen
1. Plug in the Ethernet cables at the back of the appliance:
a. Plug in one Ethernet cable in the iDRAC plug, on the left-end side of the back panel.
b. Plug in up to four physical interface Ethernet cables.
2. Connect a monitor and keyboard to the appliance.

3. Press the button to turn on the hardware appliance.
4. When the BIOS splash screen appears, hit F2 on your keyboard to enter the system setup.
12
First Installation
F2 = System Setup
F10 = Lifecycle Controller
F11 = BIOS Boot Manager
F12 = PXE Boot
BIOS Revision 2.3.3
Figure 2.1. BIOS splash screen
The window System Setup eventually opens.

5. In the System Setup Main Menu, use the down arrow to highlight iDRAC Settings and hit
Enter. The page iDRAC Settings opens.
6. Use the down arrow to highlight Network and hit Enter. The page iDRAC Settings • Network
opens.
7. Use the down arrow to get to the section IPV4 SETTINGS and, if need be, edit the following
fields:
a. In the field Static IP Address, set the IP address of your choice. You need it to connect
to the iDRAC. The default IP address is 192.168.0.120.
b. In the field Static Gateway, set the gateway of your choice. The default gateway is
192.168.0.0.
c. In the field Static Subnet Mask, set the netmask of your choice. The default netmask is
255.255.255.0.
8. When you have configured the three fields, hit the tabulation key to select the button Back
in the window bottom right corner and hit Enter to get back to the page iDRAC Settings.
9. Hit tabulation to select the button Finish and hit Enter.The window Warning / Saving Changes
/ Settings have changed. Do you want to save the changed? opens.
10. Select Yes and hit Enter. The window Success / Saving Changes / Settings saved success-
fully opens.
11. Hit Enter. The menu System Setup opens.
12. Hit tabulation to highlight the button Finish and hit Enter. The window Warning / Confirm
Exit / Are you sure you want to exit and reboot? opens.
13. Select Yes and hit Enter. The menu closes and the hardware appliance reboots.
Now you can connect to the iDRAC to configure SOLIDserver as detailed in the section Config-
uring SOLIDserver from the iDRAC.
Setting up the iDRAC IP Address From the LCD Screen
For hardware appliances SDS-550, SDS-1100, SDS-2200, SDS-3300 or SDS-Blast series (SDS-
4000, SDS-5000 or SDS-5500), you can set up an access IP address for the iDRAC from the
LCD screen.You cannot use this method for SDS-260 appliances. Once the iDRAC IP address
is set, you can access it and configure the IP address of your SOLIDserver appliance.
13
First Installation
If you already configured the iDRAC IP address using a keyboard and monitor, following the
section Configuring the iDRAC IP address Without LCD Screen, you can go straight to the section
Configuring SOLIDserver from the iDRAC.
The iDRAC is already configured with a default IP address - 192.168.0.120, netmask -

255.255.255.0 and gateway - 192.168.0.0. If this IP address is free and accessible on your network,
you do not need to follow the procedure below, you can go straight to the section Configuring
SOLIDserver from the iDRAC.
To set up the iDRAC IP address from the LCD screen
1. Plug in the Ethernet cables at the back of the appliance:
a. Plug in one Ethernet cable in the iDRAC plug, on the left-end side of the back panel.
b. Plug in up to four physical interface Ethernet cables.
2. Press the button to turn on the hardware appliance. During the boot sequence, the LCD
screen displays System booting. The message disappears once the appliance has booted.
3. Press to display the menu.
4. Press to highlight Setup. Press to enter the Setup menu.
5. iDRAC is highlighted, press . The message Security Notice: Default network credentials
in effect appears.
6. Press to enter the menu. Press twice to highlight Static IP.
7. Press to enter the menu. The default IP address is displayed: IP: 192.168.0.120 . Set the
IP address of your choice:
• Use the arrows and to put the cursor over the digit you want to edit.
• Once the cursor is on the digit you want to edit, press . The cursor blinks.
• Once the cursor blinks, use the arrows to change the digit value and press to commit
the new value.
• Repeat these actions for every digit you want to change.
Once the full IP address matches your needs, press until the cursor highlights >> at the
end of the IP address.
8. Press to commit the IP address. The subnet mask is displayed: Sub: 255.255.255.000 .
Set the netmask of your choice using the technique detailed in step 7.
Once the full netmask matches your needs, press until the cursor highlights >> at the end
of the subnet mask.
9. Press to commit the subnet mask. The gateway is displayed: Gtw: 192.168.000.000 . Set
the gateway of your choice using the technique detailed in step 7.
Once the gateway matches your needs, press until the cursor highlights >> at the end of
the subnet mask.
10. Press to commit the gateway IP address. The DNS configuration menu appears: Setup
DNS: Yes.
14
First Installation
11. Press to highlight No and press to skip the DNS configuration. The screen displays:
Save: Yes | No, Yes is highlighted.
12. Press to save your configuration. The LCD screen is now empty.
Now you can connect to the iDRAC to configure SOLIDserver as detailed in the section Config-
uring SOLIDserver from the iDRAC below.
2. Configuring SOLIDserver from the iDRAC

On SOLIDserver hardware appliances SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300
and SDS-Blast series (SDS-4000, SDS-5000 and SDS-5500) you must configure SOLIDserver
software:
1. Connect to the iDRAC platform, following the procedure To connect to SOLIDserver from the
iDRAC platform.
2. Connect to SOLIDserver using the console available in the iDRAC GUI and configure
SOLIDserver IP address, following the procedure To configure SOLIDserver from the iDRAC
platform.
To connect to SOLIDserver from the iDRAC platform
1. Open any browser that has Java installed, in the URL field type in https://<iDRAC-con-
figured-IP-address>.
2. Accept the certificate. The iDRAC login page opens.
3. In the field Username, type in root.
4. In the field Password, type in calvin.
5. Hit Enter. The iDRAC homepage opens.
6. Launch the Virtual console.
If the iDRAC is in version 8:
a. Tick the box Keep Default Password and click on Continue. The iDRAC homepage
opens: System Summary. It details the hardware information.
b. In the panel Virtual Console Preview, click on Launch.
c. Accept to save the file viewer.jnlp to be able to launch the console.
1
d. Open the file viewer.jnlp .
e. In the pop-up window SecurityWarning, click on Continue.
f. In the pop-up window Do you want to run this application?, click on Run.
g. In the pop-up window Warning-Security, click on Run to accept the certificate. The
console opens.
7. When SOLIDserver installation is complete, the page WELCOME TO SOLIDSERVER appears.
1
If the file .jnlp has not been automatically opened by Java, you have to associate it manually with the file javaws.exe located in the
folder jre\bin of the appropriate Java version.
15
First Installation
Figure 2.2. SOLIDserver login page
If an error message is displayed on the screen, you need to reimage SOLIDserver. For more
details, refer to the guide SOLIDserver_Hardware_4th-Gen_Reimaging-.x.x.x.pdf available
2
on our website .
To configure SOLIDserver from the iDRAC platform
1. From the page WELCOME TO SOLIDSERVER, log in using the login root and no password.
The configuration window opens.
2. In the Main Menu, the line S Quick Start is highlighted.
3. Hit Enter. The page Quick Start - Configure basic network settings opens.
4. Hit Enter to confirm the quick start configuration. The menu Physical interfaces opens.
5. In the menu Physical Interfaces, select one or several interfaces. [*] indicates which inter-
face(s) is selected. Use the keyboard arrows or the digits to highlight the interface of your
choice and hit the space key to select or deselect an interface.
If you have plugged in several physical interfaces Ethernet cables, you are configuring an
Ethernet port failover.
3
The interfaces are named and numbered: bgeX, igbX and/or ixX , where X is a digit. Their
status is displayed between brackets: (active) or (no carrier).
6. Hit Enter to confirm the interface(s) selection. The menu Network configuration opens.
7. Configure the access to SOLIDserver:
a. Configure the interface IP address on the line IP: . Hit the down arrow to get to the next
line.
b. Configure the interface netmask on the line Netmask: . Hit the down arrow to get to
the next line.
c. Configure the interface default gateway on the line Gateway: . Hit the tabulation key
to highlight OK.
8. Hit Enter to confirm your configuration and go back to the Main Menu.
2
At http://www.efficientip.com/services/support/, in the section Products & Documentation. Log in using your credentials. If you do not
have credentials yet, request them at www.efficientip.com/support-access.
3
ixX interfaces correspond to 10 Gb ports.
16
First Installation
10. Hit Enter to save the whole configuration. The window Do you really want to commit
modifications to system? opens.
12. Hit Enter to commit your choice. When the configuration is saved, the window Configuration
applied opens.
13. Hit Enter to close the window. The Main Menu is visible again.
14. Hit E to select EXIT and hit Enter. The configuration window closes.
address you configured.
SOLIDserver Software First Installation from a USB Flash

Drive
If you purchased a SOLIDserver software appliance, the software image can be saved on a USB
flash drive that allows to install it on your own hardware appliance, a non-Efficient IP appliance.
To be able to install SOLIDserver, your hardware appliance must match the following requirements:
Table 2.1. SOLIDserver software installation requirements on your own hardware

SDS-50 SDS-260 SDS-550 SDS-1100 SDS-2200 SDS-3300
VCPU 1 2 2 4 4 8
RAM 2 GB 4 GB 8 GB 8 GB 16 GB 32 GB
Virtual disk size > 32 GB > 32 GB > 32 GB > 64 GB > 64 GB > 64 GB
RAID Controller Any card compatible with FreeBSD version 11.
NIC Any NIC, except if your license includes Guardian; in that case you need an Intel Ethernet i350.
To install SOLIDserver on a hardware appliance using a USB flash drive and SSH
1. Make sure your hardware appliance meets the requirements.

2. Prepare a bootable USB flash drive with SOLIDserver image on it.
3. Plug the USB flash drive in the hardware appliance.
4. Configure the server booting process to make your USB flash drive the first booting device.
5. Install SOLIDserver on the appliance:
a. Select USB KEY ( <your USB flash drive>) INSTALLATION on <your appliance>.
b. Hit Enter to confirm.
c. Select the SOLIDserver image you want to install.
d. Hit Enter to confirm.
e. Select CONFIRM THE INSTALLATION.
f. Hit Enter to confirm. A progress bar appears to display the installation process.
g. Once the installation is completed, hit Enter to reboot the appliance.
6. Put the server HDD back as 1st Drive and 1st Boot Device.
17
Chapter 3. Basic Network Configuration
The basic network configuration goes beyond the first installation Quick Start menu detailed in
the chapter First Installation, and allows you to set a hostname, name the default physical interface,
set IPv4/IPv6 default gateways, etc. for an appliance.
SOLIDserver software and hardware appliances can be configured using a terminal ac-
cessible through Command-Line Interface (CLI). Any appliance provides it:
• Software appliances provide CLI thanks to:

• SOLIDserver IP address that you can use to open a shell session via a terminal emulator.
• A VMware console of you installed SOLIDserver on VMware.
• Hardware appliances provide CLI in different ways, it depends on the model:
• For appliances SDS-50, SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000, you
can:
Plug the hardware serial port to your computer and open a terminal emulator that provides
serial connection sessions.
• For appliances SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 and SDS-Blast series
(SDS-4000, SDS-5000 and SDS-5500), you can:
Connect to the iDRAC GUI and open the virtual console from the page Overview/Virtual
console
• For any appliance, except the SDS-50 you can:
Plug a monitor and keyboard into the hardware appliance VGA and USB ports.
Setting the Basic Network Configuration Using a Terminal

By default there is already an interface configured for SOLIDserver image, it has the IP address
192.168.1.1 and the netmask 255.255.255.0.You can change both according to your need when
configuring the basic network settings or during the first installation.
In the procedure below, we configure a virtual interface, a physical interface, an IP address, a

netmask, a gateway and the IP address of the DNS resolver.
To configure basic network setting through a terminal
1. Connect to SOLIDserver appliance through CLI.

2. Once you are connected, the page WELCOME TO SOLIDserver opens.
18
Basic Network Configuration
Figure 3.1. SOLIDserver login page
3. Log in using the login root and no password. The Main menu appears.
4. The line N Network Configuration is highlighted.
Figure 3.2. Main menu
Hit Enter, the menu Network configuration opens.

5. The line V Virtual interfaces is highlighted.
Figure 3.3. Network configuration
Hit Enter, the menu Virtual interfaces opens.

6. The line 1 DEFAULT_INTERFACE is highlighted.
Figure 3.4. Virtual interfaces
19
Hit Enter, the menu Virtual interface name opens.

7. Edit the interface Name if you want.
Figure 3.5. Virtual interface name
Hit Enter, the menu Physical interfaces opens.

8. In the menu Physical interfaces, select one or several interfaces.
[*] indicates which interface(s) is selected. Use the keyboard arrows or the digits to highlight
the interface of your choice and hit the space key to select or deselect an interface.
If you have plugged in several physical interfaces Ethernet cables, you are configuring an
Ethernet port failover. The interfaces are named and numbered. Their status is displayed
between brackets: (active) or (no carrier).
Figure 3.6. Physical interfaces1
Hit Enter to confirm the interface(s) selection, the menu IP addresses list opens.
9. The line 1 192.168.1.1 255.255.255.0 is highlighted. The IP address 192.168.1.1 and the
netmask 255.255.255.0 are the default values.
Figure 3.7. IP addresses list
Hit Enter, the menu IP addresses configuration opens.

10. Edit the Address and Prefix/Netmask fields according to your needs.
1
The interface name depends on the appliance. In this example, the interfaces name can be found on appliances SDS-250, SDS-500,
SDS-1000, SDS-2000 and SDS-3000.
20
Figure 3.8. IP addresses configuration
Hit Enter to save your changes, the menu IP addresses list menu opens again.
11. Hit the key E to select E EXIT and it Enter. The menu Network configuration opens.
12. Hit G to select G Global configuration.
Figure 3.9. Network configuration
Hit Enter, the menu Global configuration opens.

13. Edit the Hostname if need be. Edit the Default IPv4 gateway and 1st DNS resolver according
to your needs.
Figure 3.10. Global configuration
Hit Enter to save your changes, the menu Network configuration opens again.
14. Hit E to select E EXIT and it Enter. The menu Main menu opens.
21
Figure 3.11. Main menu before saving your configuration
Hit Enter to save the whole configuration.

16. In the confirmation window, the button Yes is highlighted.
Figure 3.12. Confirmation window
Hit Enter to commit your configuration.

17. When the configuration is saved, the window Configuration applied opens.
Hit Enter to close the window. The Main Menu is visible again.
18. Hit E to select E EXIT and it Enter. The configuration window closes, the page SOLIDserver
access is visible again.
Now your configuration is complete and you can access your SOLIDserver through the browser
of your choice. Make sure the browser version complies with the Prerequisites mentioned above.
Resetting the Default Network Settings From the LCD

Screen
If you purchased the hardware appliance SDS-250, SDS-500, SDS-1000, SDS-2000 or SDS-
3000 you can reset the system to its original network configuration parameters from the appliance
LCD screen.
The default configuration of the third generation of SOLIDserver hardware appliances is the fol-
lowing:
• IP address/Netmask: 192.168.1.1 / 255.255.255.0 .

• Gateway: 0.0.0.0 .
• Physical interface: eth1.
Keep in mind that resetting the hardware appliance default configuration automatically re-
boots it.
22
To reset the basic network configuration via LCD
1. If the SOLIDserver is not turned on, push . During the boot sequence, the LCD screen
displays Device booting. Once SOLIDserver is started, a timer is displayed. Press to enter
in the setup.
2. Push until the EXIT menu appears. Then press to enter in the RESET menu. The mes-
sage WARNING: net conf will be lost is displayed.
3. To commit the reset, push . The message Restarting appliance... appears. If you do not
want reset, push to discard.
23
Chapter 4. Using SOLIDserver for the
First Time
When using SOLIDserver for the first time, you need to:
1. Log in.
2. Request and add a license.
3. Define the modules interaction, or internal module setup.
4. Configure SOLIDserver on your network.
5. Create groups of users, add users and set their rights.
Connecting to SOLIDserver
No matter the browser you choose to use, to access SOLIDserver you need to follow the procedure
below.
If you defined a hostname for your SOLIDserver in your DNS, you can use its name in the URL
field rather than the IP address.
To connect to SOLIDserver for the first time
1. Open your browser, in the URL field type in https://<SOLIDserver-configured-IP-address>.

2. Hit Enter. The browser displays a security warning because the default certificate is in use.
Your browser probably identified that the certificate is not from a trusted certifying authority
and that the hostname on the certificate is invalid or does not match the name of the site.
3. Accept the certificate. SOLIDserver login page appears:
ddi.mycorp.com
Login
Password
Figure 4.1. First connection to SOLIDserver
4. In the field Login, type in ipmadmin. The default superuser login.

5. In the field Password, type in admin. The default superuser password.
6. Click on OK . The page Home opens, SOLIDserver homepage.
24
Using SOLIDserver for the First
Time
On the dashboard the gadget System Information indicates that there is No license installed,
you must request a license and add it to manage SOLIDserver.
Requesting and Adding a License

During the first connection, you need to request a license from EfficientIP, who generates it and
sends you a valid activation key that you must add to use SOLIDserver.
Each activation key is unique and specific to one SOLIDserver appliance, you cannot use the
same activation key on several appliances.
To request a license
1. Retrieve the required information:
a. On SOLIDserver page Home, a set of gadgets is visible on the dashboard.

b. In the gadget System Information, click on the link Request license . The wizard Request
license opens.
c. Read the Software License Agreement and click on NEXT . The next page opens.
d. Copy the content of the field Key, you need it to fill out the request license form.
e. Click on OK to close the wizard.
2. Fill out the license request form at http://www.efficientip.com/license-request/:
a. In the fields FIRST NAME, LAST NAME, EMAIL, COMPANY, PHONE NUMBER and
COUNTRY NAME, specify your contact details. All these fields are required.
b. In the field LICENSE PERIOD REQUEST, specify the desired license length: 1 month,
2 months, 3 months, 6 months or Permanent. This field is required.
c. If you selected Permanent, you must fill in the field CONTRACT NUMBER (IF PERMAN-
ENT LICENSE).
d. In the field REQUEST KEY, paste your key. This field is required.
e. In the field NUMBER OF EXTERNAL MANAGED SERVERS (MVSM, IF ANY), specify
the total number of servers - DNS/DHCP/... - you intend to manage from SOLIDserver.
f. In the section OPTIONAL MODULE, tick all the optional modules you might need:
1
NETCHANGE , DEVICE MANAGER, SPX or DNS GUARDIAN.
g. If relevant, fill in the field IF REQUESTER IS OTHER THAN THE END CUSTOMER,
PLEASE PROVIDE YOUR CONTACT INFORMATION (NAME, COMPANY, EMAIL,
PHONE).
h. Click on SUBMIT to send us your information.
Once EfficientIP license team has answered your request and sent you a license key, follow the
procedure below.
To add a license
1. From the EfficientIP email response to your license request, copy the license key.
1
If you do not tick this box, you are using NetChange basic options, or NetChange-IPL.
25
Time
2. Connect to SOLIDserver using the superuser credentials. The page Home opens.
3. In the gadget System Information, click on the link Add license . The wizard License Agreement
opens.
4. Click on NEXT . The page Add a license opens.
5. In the field License, paste the license key.
6. Click on OK to add your license. The page refreshes, in the gadget System Information the
License type is now displayed and all the modules that come with your license are visible.
Defining the Internal Module Setup

Once the license is installed, and before making any further network configurations, we recommend
that you set the Internal module setup.
This setup allows you to enable the interaction between the IPAM, DNS and DHCP modules.
That way you can manage your resources and objects on one page and update them in other
modules.
To configure the internal module setup from the configuration gadget
1. Go to SOLIDserver Home page. Click on the tab if need be.

2. At the bottom of the gadget SOLIDserver Configuration Checklist, on the line Internal
module setup, click on Configuration. The wizard Internal module setup opens.
3. If you want to activate all the module interactions:
a. In the drop-down list Architecture, select IPAM.

b. Tick the box Use DNS.
c. Tick the box Use DHCP.
4. If you only want to activate the DNS, in the drop-down list Architecture, select DNS only.
5. Click on OK to commit your configuration. The wizard closes. SOLIDserver homepage is
visible again, the Internal module setup is marked .
At any point, you can edit the internal module setup through the menu Settings.
To configure the internal module setup using the menu
1. From any page of SOLIDserver, in the menu select Settings > Expert > Internal module
setup.
2. If you want to activate all the behaviors:

3. If you only want to activate the DNS, in the drop-down list Architecture, select DNS only.
4. Click on OK to commit your configuration. The wizard closes.
26
Time
Configuring SOLIDserver Network and Services

Before using SOLIDserver you need to complete its configuration, set the network preferences
and configure and start the relevant services:
1. On the homepage, have a look at the gadget SOLIDserver Configuration Checklist.
What is marked has not been configured yet. Click on the links to configure everything that
suit your needs. For more details, refer to the section SOLIDserver Configuration Checklist in
the chapter Managing Gadgets.
2. On the homepage, have a look at the gadget General Information.
On the first line, you can configure the Services. The services marked are not configured
yet, the ones marked are not started yet, the ones marked are configured and running.
You can click on the configured services name to start or stop them, the name of the services
that are not configured yet provide a link to the page Services configuration. Complete the
configuration of all the services you need, we recommend that you configure an NTP server
and start the service, especially for DHCP and High Availability management. For more details,
refer to the chapter Services Configuration.
The following lines allow to complete the appliance basic network configuration: hostname,
default gateway, default interface, etc. These lines value provide a link toward the page Network
Configuration. For more details, refer to the chapter Network Configuration.
Creating SOLIDserver Users

Being logged as ipmadmin, the superuser, you probably need to add users and set their access
and rights privileges. Within SOLIDserver, users rights and resources depend on the group they
belong to.
The most privileged group is the group admin, to which ipmadmin belongs. The other groups,
even with all the permissions granted, are not able to perform all the operations. If an operation
can only be performed by a user from the group admin, the first step of the procedure specifies
it.
To configure specific users permissions you need to:
1. Create a group of users and configure it with the permissions that suit your needs.
2. Add one or more users to that group.
3. Set authentication rules if these users are not local users.
Once users are created and configured, do not forget to grant them access to the resources you
create if need be. For more details regarding the users and groups management, refer to the
part Rights Management.
27
Chapter 5. Understanding the GUI
SOLIDserver centralizes all the operations in a unified Graphical User Interface (GUI) divided
into modules with common management principles and navigation logic.
All management pages share common elements, detailed in the image below.
Figure 5.1. Common elements on listing pages in the GUI
All the modules share a common structure:
This tab allows to access all the modules from anywhere in the appliance. Click on it to go
back to SOLIDserver Home page. Put your mouse over it to list all your appliance modules
and access the one of your choice.
This wheel button opens the panel Notifications where are listed the operations performed
during the past week. For more details, refer to the section Notifications.
This field allows to look for data within all the modules except Administration. For more details,
refer to the section Global Search.
This star, located at the right end side of the breadcrumb, allows to bookmark pages. For
more details, refer to the section Bookmarks.
This button allows to logout any user session from the GUI. It is accessible from every page.
This panel at the far left can be deployed everywhere within SOLIDserver and allows to
open the Tree view. For more details, refer to the section Tree View.
These toggle buttons are displayed on the pages providing IPv4 and IPv6 management.
The white button indicates the current version displayed, here IPv4. If you click on it, you
display the other version.
This button is visible on the page All networks and provides a shortcut toward the network
addition wizard using the by search.
This button is visible on almost any listing page and provides a shortcut toward the addition
wizard of the object listed on the page.
The question mark is the last entry of the menu, put your mouse over it to access Help or
About. For more details, refer to the section ?.
28
Understanding the GUI
SOLIDserver Home Page

Once you are connected SOLIDserver Home page opens, it contains the welcome banner and
the main dashboard right under the banner. You can access this page from anywhere in the ap-
pliance if you click on the blue tab on the left-end side.
The main dashboard contains one or several gadgets depending on the user connected. For
more details, refer to the section Gadgets Displayed by Default.
Figure 5.2. The main dashboard of the superuser session
Each module has its own dashboard on which you can add the gadgets of your choice. For more
details, refer to the chapter Building Your Dashboards.
You can edit the Home page welcome banner with a different message or even an image. For
more details, refer to the chapter Customizing the GUI.
Tree View
The Tree view is a side panel that allows to display and access the data of some modules. Located
on the left end side, you can open/close it on any page of the GUI. It is composed of six sliding
sections:
DHCP
This section is divided among DHCP servers, DHCP Scopes, DHCPv6 servers and DHCPv6
scopes. Open each type to display and access the servers and scopes you manage in the
module DHCP.
DNS
This section is divided among servers and zones. Open each type to display and access the
servers and zones you manage in the module DNS.
IPAM
This section is divided among the spaces you manage. Open each space sub-section to
display and access the objects it contains in the module IPAM.
29
Smart Folders
This section contains all the smart folders you created, listed in the ASCII alphabetic order.
It provides links toward the objects you configured in these folders and follows the hierarchy
you set. For more details regarding smart folders refer to the chapter Managing Smart Folders.
My Bookmarks
This section contains all the bookmarks you created. They are divided among folders if you
created some. Click on the bookmark name to access the bookmarked page.
Groups
This section lists all the existing groups of users. Click on the group name to access their list
of Resources in the module Administration.
Figure 5.3. Overview of the section IPAM in the Tree view
This icon indicates that a section of the Tree view hierarchy is opened or closed . Click
on it to display or hide its content.
This icon indicates that a branch of the Tree view hierarchy is opened or closed . Click
on it to display or hide its content.
This button allows to refresh a section.
The Tree view panel can be dragged open according to your needs. Double-click on the
right edge of the Tree view to open or close it.
To open the Tree view
1. Under the menu, put your mouse over the left end side of the GUI. The pointer changes
shape, a darker gray line appears.
2. Double click on the line or click and slide to the right. The Tree view opens.
3. Click on the name of the section you want to open. Each final line is a shortcut to the page
listed. If the section does not open if it is empty.
30
To refresh the content of the Tree view
1. Open the Tree view.

2. Next to the name of the section to refresh, click on .
To close the Tree view
1. Put your mouse over the right end side of the Tree view. The pointer changes shape, a
darker gray line appears.
2. Double click on the line or slide it the left. The Tree view closes.
Modules
Each module has a dedicated tab for navigation purposes. When you go from one tab to the
other, the latest page visited is saved and you can open it again when you go back to the tab.
Clicking on the tab when you are already displaying a page from the module opens its homepage,
or dashboard.
Figure 5.4. Overview of the section IPAM dashboard
The tab EfficientIP allows to open the appliance Home page. If you put your mouse over
this tab, you can access all your modules.
The tab in light gray indicates the module you are currently in.
The menu, it contains some options specific to the module. For more details, refer to the
section Menu.
The buttons, under the menu, are all gathered in a light gray area and provide links toward
the module's pages.
The dashboard itself, under the buttons' area, that you can customize with gadgets. The
session of the superuser has a set of gadgets displayed by default on some dashboards.
For more details, refer to the chapter Building Your Dashboards.
31
To open the module homepage using the breadcrumb
1. From any module page, on the left end side of the breadcrumb click on .
2. The module's homepage opens. In the breadcrumb, next to the icon is displayed <module>
dashboard.
To open the module homepage using the tab
1. From any page, click on the module's tab. For instance, from the page All zones, click on
the tab DNS.
2. The module's homepage opens. The breadcrumb indicates the page <module> dashboard,
next to the icon . In our case, DNS dashboard.
Keep in mind that in addition to the buttons on the homepage, the menu Display and the bread-
crumb allow to access the module's pages. For more details, refer to the sections Menu and
Breadcrumb.
Breadcrumb
A navigation bar, called the breadcrumb, is available on all the pages of all modules except Ad-
ministration, where it is only displayed on some pages. It provides direct and hierarchical access
to the module objects.
Figure 5.5. The breadcrumb
The house icon allows to open the homepage of the module. In the procedures of this guide,
it is represented as follows: .
The colored icon represents the page you are currently on, here the page All spaces.
The icons respect the module internal hierarchy: from left to right you will find the highest
level down to the lowest level. The objects displayed in the breadcrumb depend on the page
you are on.
The breadcrumb display provides navigational information, it allows to filter and browse the
content of specific objects in each module. Once the breadcrumb is filtered at a level, it no longer
displays All <objects> but Objects: object name, everything right of this filter is displaying objects
that belong to the object name.
The breadcrumb display also allows to view several levels of hierarchy on a single line. For in-
stance, you can display the content of a specific DNS server and of a specific zone belonging to
that server. In this case, the breadcrumb would contain the name of both objects and provide
access to their properties page.
32
Figure 5.6. Navigational information in the breadcrumb
This display indicates that you are filtering the navigation and browsing the content of the
object mentioned. Here, it indicates that you are displaying the views, zones and records
of the DNS server ns1.mycompany.com.
With the breadcrumb filtered to display the content of the server ns1.mycompany.com,
clicking on the link All views opens the page and displays only the views of that server.
When the breadcrumb is filtered, the object level is a link toward the object listing page.
Here, Zones opens the page All zones and only displays the zones of the server ns1.my-
company.com as there is also a filter at server level. If the breadcrumb was not filtered at
server level, it would list all the zones.
When the breadcrumb is filtered the object name is a link toward its properties page. Here,
clicking on mycompany.com opens its properties page.
With the breadcrumb filtered to display the content of the zone mycompany.com, clicking
on All RRs opens the page and displays only the records of that zone.
Menu
The menu is displayed on every page. Its content differs on each page.
Figure 5.7. The full menu
Keep in mind that the options available vary from one user to the other depending on the rights
they are granted. For more details regarding rights, refer to the part Rights Management.
Add
This menu option is only available on all the listing pages where you can:
• Create objects.
• Import objects.
In the IPAM, the DNS and Device Manager it allows to create and import the objects you manage
on the page as well as the objects they can contain. For instance, you can create DNS zones
from the page All servers or import IP addresses from the page All spaces.
Keep in mind that to import the configuration of a server, the menu is available on the pages All
scopes or All zones of an existing server.
Edit
This menu option is available on all the listing pages of objects that you can edit. It allows to:
• Delete objects.
33
• Synchronize/refresh servers and devices.

• Manage access to the objects for groups of users.
• Perform specific operations on the objects listed.
On the objects' properties page, it allows to modify the panels of the page that you can edit.
Tools
This menu option is available on all the listing pages it allows to:
• Perform advanced operations on the objects listed.

• Perform Expert operations.
On the properties pages, this menu is available only for some specific advanced operations.
Display
This menu option is available on the listing pages of all the modules, except Administration, it
allows to:
• Navigate within a module from page to page.

• Go to the properties page of a container. When you are listing the content of a specific object,
the menu contains the option <object> properties.
• Switch displays: from IPv4 to IPv6 in the IPAM and DHCP, normal to template mode in the
IPAM, hide or show the smart architectures' content in the DNS and DHCP, etc.
• Change the listing template layout, once you created listing templates you must specify the
one you want to use from the menu Display.
It is also available on some properties pages it allows to:
• Go to the properties page of a container. From the properties page of an object, you can go
to its container properties page.
• Go to the listing page of the objects it manages. From the properties page of an object, you
can go to the listing page of all the objects the module hierarchy allows it to manage.
Report
This menu option is available on the listing pages of all the modules where you can:
• Export the list in a CSV, HTML, XML, EXCEL and PDF file.
• Generate a report specific to the data listed.
This menu is available on the properties pages if you can generate a report for the object in
question.
Preferences
This menu option is accessible from any page of SOLIDserver. Its content varies depending on
the page you are on.
From all pages it allows to:
34
• Access the users dedicated customization pages detailed below.

• My Quick Wizards. For more details, refer to the section Quick Wizards.
• My Smart Folders. For more details, refer to the chapter Managing Smart Folders.
• My Bookmarks. For more details, refer to the section Bookmarks.
• My Dashboards, that provides access to the pages Gadgets Library and My Gadgets. For
more details, refer to the chapter Building Your Dashboards.
• Access the connected user account configuration options via My Account. For more details,
refer to the section Account Configuration.
From the listing pages, it allows:
• Create gadgets, the gadget types available depend on the data listed on each page. For more
details, refer to the chapter Building Your Dashboards.
Settings
This menu option is accessible from any page of SOLIDserver. Its content varies depending on
the page you are on.
From all pages it allows to:
• Configure the Internal module setup, it enables the interaction between the main modules,
among which the advanced properties. You can also set it from the gadget SOLIDserver con-
figuration Checklist. For more details, refer to the section Defining the Internal Module Setup.
From the modules' homepage it allows, if relevant, to:
• Manage the listing templates created in the module, from the page Listing Template Manage-
ment.
• Manage the import and export templates created in the module, from the page Import/Export
Template Management.
From the listing pages, it allows to:
• Display the configuration of the class global that applies to the objects listed; via Meta-data.
For more details, regarding classes refer to the chapter Configuring Classes.
• Configure the advanced properties fields you want enabled or displayed in the addition/edition
wizard of your IPAM, DNS or DHCP objects. For more details, refer to the chapter Managing
Advanced Properties.
• Create and edit listing templates of the columns to display on the page; via Listing templates.
For more details, refer to the section Customizing the List Layout.
?
This button, available on the right-end side of the menu, is accessible from any page of SOLID-
server. It allows to:
• Open SOLIDserver Administrator Guide, via Help. The PDF file opens in a new tab of your
browser.You can save it on your computer to access it even when you are no longer connected
to the appliance.
• Open the Software License Agreement, via About.
35
Account Configuration
Each user has the possibility to edit their account once they are connected. From any page, they
can use the menu Preferences to edit their account preferences or they can edit them via the
two default gadgets.
Configuring the Preferences Using the Default Gadgets

Two gadgets allow to edit the connected user preferences:
• My account preferences & configuration, displayed by default on the main dashboard of all
users provides shortcuts to:
• The page Gadgets Library. For more details, refer to the chapter Building Your Dashboards.
• The wizard Change the language. For more details, refer to the section Configuring the
Session's Language.
• System Information, displayed by default on the main dashboard of the superuser session
allows to set the session's time & date format, list format, language and password; as detailed
in the procedure below.
To configure the connected user preferences from System Information
1. From the gadget System Information, in the section Connected as, click on the user name.
The wizard Configure user settings opens.
2. In the field List line count, you can define how many entries (lines) you want to display on
the listing pages.
3. In the drop-down list List format, you can define every how many entries you want to change
the color of the lines.You can set to change for each line (1-1) or alternate the coloring every
three lines (3-3).
4. In the drop-down list Time zone, you can make the appliance respect the Local time or the
UTC-GMT time.
5. In the drop-down list Date format, you can choose to display the day before the month or
vice versa (mm/dd/yyyy or dd/mm/yyyy).
6. In the drop-down list Language, you can set the interface language: English, French,
Spanish, German, Dutch, Chinese or Japanese. By default, English is selected.
7. Click on OK to commit your configuration. The report opens and closes. The Home page is
visible again.
Configuring the Session's Time and Date Format

From the menu Preferences, you can set the time and date format displayed on the appliance.
All your services must be at the same time to prevent any management problems. Note
that the local time is based on the time zone of your browser whereas the UTC (Universal Time,
Coordinated) is the international standard for civil time and the Internet.
To set your appliance time zone and/or date format
1. From any page of SOLIDserver, in the menu select Preferences > My Account > Set
Time/Date Format. The wizard Configure the Time Display and Date Format opens.
2. In the drop-down list Display time in, select Local time or UTC-GMT.
36
3. In the drop-down list Date format, select mm/dd/yyyy or dd/mm/yyyy.

4. Click on OK to commit your configuration. The report opens and closes. You can see the
display change on the Administration syslog page for instance.
Configuring the Session's List Format

From the menu Preferences, you can choose how many lines to display on the listing pages or
decide to alternate gray and white lines in the listing one by one or three by three.
Keep in mind that the more you increase the number of lines displayed, the more SOLIDserver
uses resources to display them.
To set the listing pages display
1. From any page of SOLIDserver, in the menu select Preferences > My Account > Set Format
List. The wizard Set List Format opens.
2. In the field List line count, type in the number of lines you want to display on each listing
page.
3. In the field List format, select every how many lines the colors change: 1-1 or 3-3.
4. Click on OK to commit your changes. The report opens and closes. If you edited the display
from a listing template, your changes are visible.
Configuring the Session's Language

By default SOLIDserver is in English, you can change the language from the menu Preferences.
The available languages are: English, French, Spanish, German, Dutch, Chinese and Japanese.
To change the language of the GUI
1. From the menu, select Preferences > My Account > Set Language. The wizard Change
language opens.
2. In the list Language, select English, French, Spanish, German, Dutch, Chinese or Japanese.
3. Click on OK to commit your choice. The report opens and closes. SOLIDserver refreshes,
the selected language is displayed.
Configuring the Session's Password

If you were granted sufficient rights, you can edit your local user password, the password used
to connect to SOLIDserver.
1
Keep in mind that remote users cannot edit their password.
To change the password
1. From the menu, select Preferences > My Account > Change password. The wizard Modify
user password opens.
2. In the field Previous password, type in the old password.
3. In the fields New password and Confirmation, type in the new password.
1
Remote users come from a third party server or directory - AD, LDAP or RADIUS - and are authenticated via a dedicated rule. For
more details, refer to the chapter Managing Authentication Rules.
37
4. Click on OK to commit your change. The report opens and closes.
Listing Page
The listing pages are the most common pages within SOLIDserver.
• They allow to sort objects. Click on the name of a column to sort the data displayed on the
page. Underlined columns' name indicate that sorting is available.
• They allow to filter objects. Use the search engine located under the column's name to only
display the data matching your search.
• They allow to manage objects. The options available in the menu indicate what operations
users can perform or not on the page. Depending on their rights some options are not visible.
For more details, refer to the part Rights Management.
• They allow to access the properties page of the objects listed when relevant. For more details,
refer to the section Properties Page.
• They allow to provide a contextual menu with some options for the objects listed. For more
details, refer to the section Using the Contextual Menu.
The listing pages all have the same structure.
Figure 5.8. The buttons on all the listing pages
If a lot of data is displayed on one listing page, the GUI provides some key fields, buttons and
areas.
The Result value indicates the total number of objects listed on all pages. It matches the
filtered searches, so it indicates the database content if no filter is applied, it indicates the
total number of objects matching your search otherwise.
These buttons allow you to display, respectively, the first and previous pages of data, when
possible.
These buttons indicate the number of pages on which data is listed. The number highlighted
in blue displays which page you are currently on.
These buttons allow you to display, respectively, the next and last page of data, when pos-
sible.
This button allows you to refresh the listing page.
All these elements only appear when there are too many elements on the same page. To define
the number of elements per page, refer to the procedure To set the listing pages display.
38
In the modules DHCP and DNS, the listing page All servers provides a button dedicated to
managing the smart architecture content display. By default, the physical servers are listed under
the name of each smart architecture.
Figure 5.9. The button used to show/hide the physical servers managed by a smart architecture
This button allows to display/hide the physical servers managed via smart architectures.
When it is white, they are displayed. In the guide, it is represented as follows: .
In addition, keep in mind that:
• The listing area contains sub-pages that allow to navigate within the object database when
relevant.
• There is no limit to the number of objects on a page but the more data you display, the more
resources SOLIDserver uses to display them.
• Each object can be ticked and managed separately. You can select a set of successive
items using the key SHIFT on your keyboard.
• All the objects can be selected at once. Above the list, you can tick the box left of the first
column to select all the items listed, whether the list is filtered or not, it selects all the items
counted in the result.
• Within the data listed, all the data underlined and in bold provides a link. Depending on the
page, it can be a filter to list the content of the container you clicked on or open its properties
page. On the lowest level of a module hierarchy, it can perform specific operations (assign the
object for instance) or open the object's edition wizard or properties page.
Sorting the List

On all the listing pages, you can sort by ascending or descending order any column that has its
name underlined.
39
Figure 5.10. The columns' name can be used as a sorting tool
The underlined column names indicate that you can sort the column data in direct/reverse
alphabetical order.
This arrow indicates that the list is sorted through the Date column in ascending order.
Column names not underlined indicate that you cannot sort the column data.
To sort the list
1. Go to the module and listing page of your choice.

2. Click on any underlined column name. The list is sorted in descending using the column's
values. If the column that sorts the list by default, it changes the order to ascending or des-
cending.
3. If you click on the column's name again, you change the sorting order.
Keep in mind that sorting a list:
• Follows the natural alphabetical order: first the digits are listed, then the letters, with no difference
between lower and uppercase.
• Can only be done one column at a time but can be used on a filtered list.
• If a column contains too much data it can no longer be sorted. In this case, you should find a
icon next to the column name.
Filtering the List

Almost all the data listed on the GUI pages can be filtered, using one or several columns.
40
Figure 5.11. The column filtering tools
This button allows you to apply the filter using the data entered in the column search engine.
You can also hit Enter to perform a filtered search.
This button allows to unset the filters applied altogether, no matter how many filters were
set.
These fields allow to type in the data you are looking for the in the column: it is the column
search engine. If this field is not visible, you cannot filter through said column, you might
only be able to sort.
Columns with no search field cannot be filtered.
You can filter the list using:
• The available operators directly in the search engine. They are all described in the table Fil-
tering operators. Keep in mind that the space between the operator and the string is accepted.
• The column's Filter constructor available when you double-click in the search engine. It indicates
the options accepted in each column and can also contain a list of the object's possible statuses
or Top occurrences of the most represented values. In columns displaying times and dates, it
contains specific operators that allow to filter dates or whole periods of time, based on UTC
time. For more details, refer to the table Date related filtering operators.
Using Filters
All the columns that can be filtered provide a search engine where you can type in or select, using
the filter constructor, the values that you want to match or avoid.
There are filter constructors dedicated to the database recurring values, such as statuses, protocol
versions, server types, etc.
41
Figure 5.12. The possible statuses of a DHCP server
To filter columns containing data

2. In the search engine of any column, you can:
a. Either type in values or operators. For more details refer to the section Accepted Oper-
ators for All Columns.
b. Or double-click in the search engine to display the filter constructor.
3. In the search engine columns containing a specific data - like the Status, a server Type, the
server Sync status, etc. - you can double-click in the search engine to display the list of ex-
isting values.
4. Click on APPLY to perform the search.
5. Filter one or more columns as well if need be.
For the recurring values in your database, filter constructors provide a box Top occurrences.
Figure 5.13. The top occurrences of DHCP physical servers on the page All servers
To filter a column using the top occurrence
42
2. Double-click in the search engine of the column of your choice. The filter constructor opens.
3. Tick the box Top occurrences to expand the window:
4. To use a top occurrence as a filter:
a. Select a filter constructor in the drop-down list.

b. Tick the value (top occurrence). Its name is displayed in the field next to the filter you
just selected.
5. To use several occurrences, click on . A new line appears, follow the step 4 to define the
new criterion.
Repeat these actions for as many filters as needed.

6. To remove a line, click on on the right-end side of the line.
7. When the filter suits your needs, click on APPLY . Only the data matching your search is dis-
played in the column.
In the columns for time and date, there is a dedicated filter constructor.
Figure 5.14. The dedicated time and date filters
To filter columns containing time and date

2. In the search engine of any column, you can:
a. Either type in values or operators. For more details refer to the section Accepted Oper-
ators for Time & Date Columns.
b. Or double-click in the search engine to display the filter constructor.
3. Click on APPLY to perform the search.

43
Depending on the resources listed on the page, the search engine of some columns provides a
list of Top occurrences. This list provides an overview of the recurring values in the column
(names, vendors...): the most used values.
Accepted Operators for All Columns
All the columns containing a search engine under their name accept filters for their data (names,
etc.). Note that these operators are not available in all search engine fields If you double-click in
a search engine, the filter constructor appears if available:
Figure 5.15. Filter constructor operators
For columns containing time and dates, refer to the section Accepted Operators for Time & Date
Columns.
You can also type in keywords in the search engine, the following operators are accepted:
Table 5.1. Filtering operators

Expression Description
string contains string.
~string contains string.
=string strictly equals string.
>string greater than string.
<string less than string.
>=string greater or equal to string.
<=string less than or equal to string.
!=string strictly different from string.
!~string does not contain string.
=# returns empty lines.
!=# OR !~# returns lines containing data.
*string ends with string.
!~*string does not end with string.
string* begins with string.
!~string* does not begin with string.
expression1 expression2 expression1 and expression2 on the same line.
expression1 & expression2 expression1 and expression2 on the same line.
44
expression1 | expression2 expression1 or expression2 in the same column: the line matching either data
in the column is returned.
Accepted Operators for Time & Date Columns
On several pages, some columns are dedicated to time and/or date. If the column contains a
search engine under the column name, it provides specific filtering operators:
The columns containing time and/or date also provide dedicated keywords that you can use to
filter a list:
Table 5.2. Date related filtering operators

date Type in the date of your choice following the selected time and date format:
dd/mm/yyyy or mm/dd/yyyy. You can also type in the month in full letters: dd
<month> yyyy or <month> dd yyyy.
today The results only include data matching the date of the search.
now The results only include data matching the time and date of the search.
yesterday The results only include data matching the day before the date of the search.
last The results only include all the data matching the day, week, month or year
prior to date of the search.
n period ago The results only include data matching the number of day, week, month, year
prior to date of the search.
day Used with the keyword ago following the format <n period ago>, day or days
allows to filter data based on a specific number of days prior to the date of the
search.
week Used with the keyword ago following the format <n period ago>, week or weeks
allows to filter data based on a specific number of weeks prior to the date of
the search.
month Used with the keyword ago following the format <n period ago>, month or
months allows to filter data based on a specific number of months prior to the
date of the search.
year Used with the keyword ago following the format <n period ago>, year or years
allows to filter data based on a specific number of years prior to the date of the
search.
day of the week Any day of the week can provide a filter like last <day-of-the-week> or n <day-
of-the-week> ago. The column search engine is not case sensitive.
Removing Filters
Once you filtered columns, you can remove your filters following the procedures below.
To remove a filter on a column

2. Once you filtered a column, the column search engine contains the value you set and .
3. Click on to remove the column filter.
To remove all filters
45
2. Once you filtered a column, a cross appears next to the refresh icon .
3. Click on to remove the filters you set on the page.
If the page has its columns filtered by default, they are still filtered.
Customizing the List Layout

Throughout SOLIDserver you can set customized column layouts, called listing templates, to
display, hide and/or order the columns of your page on listing pages. Keep in mind that:
Listing templates are not available on all pages

• The pages that provide layout customization contain the menu Settings > Listing templates.
All the pages provide it, except All VRFs and All VRF Route Targets (IPAM), Analytics
(DHCP, DNS) and All configurations (NetChange). In the module Administration, only the
pages Users and Groups provide it.
• The pages that do not provide it display all the existing columns.
Listing templates have to be displayed
Creating a listing template does not display it on the page. Once created, it is available in
the menu Display where you can select it.
Note that by default, any page providing layout customization displays the listing template
default. You can edit it, if you do the changes are immediately displayed, but we strongly
recommend creating new templates instead because editing the default template overwrites
the initial page settings and prevents you from getting back to the original page layout.
The management of listing template depend on the user permissions
• Any user can display an existing listing template on the pages that provide it.
• Only a user of the group admin can add, edit and remove listing templates. Note that
editing a listing template affects the layout for all the users that display it.
• Only a user of the group admin can move the columns on a page. This operation updates
the listing template displayed.
All modules provide a centralized management of listing templates
The menu Settings on each module's homepage allows to manage the listing templates of
all the pages that provide layout customization:
• From any dashboard you can access the page Listing Templates Management where you
can add, edit and delete the listing templates.
• From any dashboard, the sub-menu Listing templates configuration > <page> allows to
create or edit listing templates.
Classes can help customizing the layout
• You can include columns displaying class parameters in listing templates. In the listing
template configuration wizard, all class parameter columns are called Class param: <object
label>. For more details regarding classes, refer to the section Configuring Classes.
• You can automatically display listing templates based on the class applied to the container
2
of the object listed , they are called automatic templates. For more details on how to apply
a class, refer to the section Configuring Classes.
2
Note that the Automatic template cannot be used on the pages displaying the highest level of a module hierarchy as the option relies
on the class applied to a container.
46
To display a listing template
1. Go to a listing page for which at least one listing template was added.
2. In the menu, select Display > Listing Templates > <your-template>. Only the columns of
the template are displayed, in the menu the template name is now preceded by a *.
Adding and Displaying Listing Templates
You can add listing templates and automatic templates from listing pages, the dashboard of any
module or the page Listing templates management.
Note that you must display a listing template after adding it.
To add and display a listing template
Only users of the group admin can perform this operation.
1. Access the page where you want to add the listing template:
a. Go to the listing page of your choice and, in the menu, select Settings > Listing tem-
plates. The wizard opens.
b. From any dashboard, in the menu, select Settings > Listing templates configuration
> <Page>. The wizard opens.
c. From the dashboard, in the menu, select Settings > Listing templates management.
The page opens, in the panel of your choice, click on ADD . The wizard opens.
2. Configure the template according to your needs.
a. In the drop-down list Action, select New template. A new field appears.
b. In the field Name, type in the new template name.
c. Click on NEXT . The page <Objects> lists configuration opens.
d. Via the lists Hidden columns and Displayed columns, configure your listing template.
Each list contains the same columns than the template default.
• To add a column to the template, select it in Hidden columns and click on . The
column is moved to the Displayed columns.
• To remove a column from the template, select it in the Displayed columns and click
on . The column is moved to the Hidden columns.
• To set the columns' order, select them one by one in the Displayed columns and
click on or .
If you are adding a template for the listing page of objects that do not have a container,
go to the step 7.
e. Click on NEXT . The last page of the wizard opens.
f. In the drop-down list Filter class type, None is selected.
g. Click on OK to commit the listing template creation. The report opens and closes.
3. Display the template:
a. Go to the listing page for which you added the listing template.
47
b. In the menu, select Display > Listing Templates > <your-template>. Only the columns
of the template are displayed, in the menu the template name is now preceded by a *.
To add and display an automatic template
b. From any dashboard, in the menu, select Settings > Listing templates configuration
> <Page>. The wizard opens.
c. From the dashboard, in the menu, select Settings > Listing templates management.
The page opens, in the panel of your choice, click on ADD . The wizard opens.
2. Configure the automatic template according to your needs.
a. In the drop-down list Action, select New template. A new field appears.
b. In the field Name, type in the new template name.
c. Click on NEXT . The page <Objects> lists configuration opens.
d. Via the lists Hidden columns and Displayed columns, configure your listing template.
Each list contains the same columns than the template default.
• To add a column to the template, select it in Hidden columns and click on . The
column is moved to the Displayed columns.
• To remove a column from the template, select it in the Displayed columns and click
on . The column is moved to the Hidden columns.
• To set the columns' order, select them one by one in the Displayed columns and
click on or .
If you are adding a template for a page listing objects that do not have a container, go
to the step 7.
e. Click on NEXT . The last page of the wizard opens.
f. In the drop-down list Filter class type, select the level for which the class should be
applied. Two lists appear.
g. Select the classes that automatically display the template:
• To add a class, select it in the list Selected filter classes and click on . It is moved
to the list Available classes.
• To remove a class, select it in the list Available classes and click on . It is moved
to the list Selected filter classes.
h. Repeat steps b for as many classes as needed. You cannot set different parent levels
for the same template.
i. Click on OK to commit the listing template creation. The report opens and closes.
3. Display the automatic template:
48
a. Go to the listing page for which you added the automatic listing template.
b. In the menu Display, make sure the template * default [auto] is selected. If not, select
Display > Listing Templates > Automatic template. The page refreshes.
c. Click on the name of a container configured with one the classes selected in the auto-
matic template to display the objects it contains.The page refreshes and only the columns
configured in the template are displayed.
Note that if you have configured several templates with the same class, the Automatic
template option displays the most recent one.
Editing Listing Templates
You can edit any type of listing template from listing pages, the dashboard of any module or the
page Listing templates management.
Note that moving the columns of a page automatically edits the listing template displayed, but
you cannot remove a column from the template that way.
To move a column

2. Put your mouse next to the name of the column you want to move.
3. Left-click to drag the column left or right.
4. Drop it where you want. The column's new location updates the current listing template.
To edit any type of listing template
b. From the dashboard of your choice and, in the menu, select Settings > Listing templates
configuration > <Page>. The wizard opens.
2. In the drop-down list Action, select Edit: <your-template>.

3. Click on NEXT . The page <Objects> lists configuration opens.
4. In the lists Hidden columns and Displayed columns, edit the columns according to your
needs.
If you are editing the template of a page listing objects that do not have a container, go to
the step 7.
5. Click on NEXT . The last page of the wizard opens.
6. In the drop-down list Filter class type, select a different value if need be. For more details,
refer to the procedure To add and display an automatic template.
7. Click on OK to commit your changes. The report opens and closes.
49
To edit any type of listing template from the page Listing templates management
1. From the dashboard of your choice, in the menu select Settings > Listing templates man-
agement. The page opens
2. Open the panel that suits your needs and select the template of your choice.
3. Click on EDIT . The wizard opens.
4. In the lists Hidden columns and Displayed columns, edit the columns according to your
needs.
If you are editing the template of a page listing objects that do not have a container, go to
the step 6.
6. In the drop-down list Filter class type, select a different value if need be. For more details,
7. Click on OK to commit your changes. The report opens and closes. The page is visible again.
Renaming Listing Templates
You can only rename any type of listing template from the page Listing templates management.
Note that if you rename a listing template while it is displayed on the page, it has to be selected
again in the menu Display.
To rename any type of listing template
3. Click on RENAME . The wizard opens.
4. In the field New Name, type it the new template name.
5. Click on OK to commit your new name. The report opens and closes. The page is visible
again, the new name is displayed.
Deleting Listing Templates
You can only delete any type of listing template from the page Listing templates management.
Note that you can delete a listing template even if it being displayed.
To delete any type of listing template
3. Click on DELETE . The wizard opens.
50
4. Click on OK to commit the template deletion. The report opens and closes. The page is visible
again, the template is no longer listed.
Using the Contextual Menu

On every listing page, SOLIDserver provides a right-click contextual menu for each object listed.
It provides a few shortcuts and some minimal options also available on the properties page of
the object. The content of the menu differs on every page and column.
Figure 5.16. The full contextual menu
At most the menu offers 5 buttons:
• Properties is a shortcut to the properties page of the object.

• Edit is a shortcut to open the object's edition wizard. It opens the same wizard as the button
EDIT of the panel Main properties on the properties page.
• Chart displays statistics as a chart and is also available on the properties page of the object.
• Information displays a table containing the basic information of the object. This information
is also displayed in the panel Main properties on its properties page.
• Filter allows to filter the list via the column, using the value you right-clicked on.
For more details regarding the options available on the properties page, refer to the section
Properties Page.
Understanding the Column Multi-status

The column Multi-status returns messages if the current configuration of an object is worth
mentioning or very specific. When the column returns information, a colored square containing
a number appears on the line of the object.
The messages returned by this column do no always reflect configuration errors for the object.
For instance, in the DNS a Multi-status message 61006: Server type incompatible with Hybrid
indicates that the server in question cannot be switched to Hybrid DNS, it is probably managing
authoritative and recursive zones; it does not mean that the server is not running properly or
misconfigured.
The column is displayed by default on some pages of the modules DNS and DHCP. You can
display it on the other pages, for more details refer to the section Customizing the List Layout.
51
Figure 5.17. Example of Multi-status messages on the DHCP page All servers
The column Multi-status returns information in colored squares that indicate the severity
of the message, in each square a number indicates how many messages match the severity.
In this example, the colored squares indicates that there is 1 error (yellow) message and 1
warning (blue) message returned for the smart architecture and its content.
Putting the mouse over a square opens the window containing all the message(s) of the
object. In this example, one physical server returns the message 60002 and the other one
the message 60003.
The column provides messages divided into 6 levels of severity. Each one provides useful status
and state information regarding the object or the configuration within the module.
Table 5.3. Multi-Status severity levels

Severity Color Description
Emergency Red The object configuration prevents the system from running properly. Action is required.
Critical Orange The object configuration is in critical conditions. Immediate action is recommended.
Error Yellow The object configuration failed at some level. Action is recommended.
Warning Blue The object configuration triggers error messages if no action is taken. Action to be
taken at your discretion.
Notice Light blue The object configuration is normal but undergoing events that might trigger errors.
No immediate action required.
Informational Gray The object configuration is normal, operational messages (might inform you about
potential incompatibilities with other modules, etc). No action required.
Each message and level of severity is specific to each object. The message numbers correspond
to a specific module: all DHCP messages start with 60000, all DNS messages with 61000... For
more details, refer to the appendix Multi-Status Messages.
Using IPv6 Labels in the IPAM and the DHCP

On a set of pages of the modules IPAM and DHCP you can highlight the IPv6 address of the
objects you manage.
52
Figure 5.18. Example of IPv6 labels used to highlight a geographical distribution in the IPAM
The labels allow to see at a glance common containers for IPv6 objects instead of using their IP
address.
You can create as many labels as you want on the IPv6 pages All networks, All pools and All
addresses in the IPAM; and the IPv6 pages All statics, All scopes, All ranges and All leases in
the DHCP. For more details, refer to the chapter Managing IPAM and DHCP IPv6 Labels.
Properties Page
The properties page gathers all the information regarding an object:
• It is accessible from the listing pages. If the listing page already gathers all the information re-
garding the object managed, the object has no properties page.
• It allows to configure or edit object configurations. Some options are only available on the
properties page and cannot be displayed on the listing page managing the object.
• It distributes all the information among panels. The panel Main properties contains the most
general information. All the other panels contain more specific data. The panels that can be
edited contain the button EDIT.
• It contains the panel Audit in the modules IPAM, DNS and DHCP that indicates every change
made on the object, by whom and when.
• It contains common panels within a module and levels in the hierarchy.
53
Figure 5.19. An example of properties page
This is what an open panel looks like. In this example, the screenshot displays the default
display of a zone properties page.
The Edit button in the menu presents the editable panels on the same list.
The button EDIT is present at the bottom of each and every open panel that you can modify.
It opens an edition wizard of the object parameter. In this example, the Access control
panel edit button opens a wizard to modify the configuration of the allow-query, allow-
transfer and allow-update limitations and access authorizations to query the master zone,
transfer the zone data or update the zone.
This is what a closed panel looks like: only the panel name is visible. You can open one
panel using the button .
This button allows to open or close all the panels of the page.
Some panels are specific to the object you are displaying, others are recurrent across the different
modules:
• Main properties: provides an overview of the main information regarding the object.
This panel is available on every properties page, regardless of the module, except for NetChange
configurations and Administration key rings.
• Advanced properties: displays the advanced properties configuration of the object and the
level the property was inherited from.
54
This panel is available on every properties page of the modules IPAM, DHCP and DNS; except
for DHCP groups and statics. For more details, refer to the chapter Managing Advanced
Properties.
• Audit: logs all the changes carried out by the user logged in on the object over time.
If the user belongs to a group with access to the changes from all users, it displays all the op-
erations ever performed on the object. For more details, refer to the section Allowing Users to
Display All the Operations Performed.
for DHCP servers, groups, scopes, leases, DNS views and RRs.
• Groups access: displays all the groups that have the object as a resource. Under each group
name are listed the rights they have on the resource and what it contains.
for IPAM addresses, DHCP groups, ranges, leases and statics. It is also available in the Ad-
ministration module, on the properties page of users except for ipmadmin. For more details,
refer to the part Rights Management.
Charts
SOLIDserver includes two types of charts:
1. Time-based charts: line or stacked-line charts that are available on properties pages, the
page Statistics or when you generate some reports.
These charts offer a set of options that allow you to highlight, zoom in or display a specific
period. All these functionalities are detailed below.
2. Instant charts: pie and bar charts that you can configure when you add gadgets or generate
reports.
These charts do not offer the same options: on pie charts you cannot select a period; on bar
charts you cannot highlight data.
There are charts on some objects' properties pages, on the page Statistics or in gadgets. For
more details, refer to the section Properties Page, Monitoring the Appliance Statistics and
Building Your Dashboards.
In the image below the options are detailed on a time-based chart but can also be available on
instant charts.
55
Figure 5.20. Overview of a time-based chart
The start and end dates of the data displayed, it matches the period selected in the timeline.
By default, each chart displays the last 3 hours.
The data retrieved is represented in a line or stacked chart. The y-axis indicates the unit,
the axis scale and unit prefix depend on the period selected and maximum value displayed.
Following the standard ISO 80000-1, all the y-axis units can have no prefix or any SI prefix
such as: m (milli), k (kilo) or M (mega).
The timeline of any time-based chart: the overall period of data available. The period dis-
played is highlighted in grey. By default, it displays a maximum of 365 days, to edit it refer
to the section Editing the Number of Days Available on the Timeline.
The legend of the chart. Each set of data has a name and a dedicated color.
The display options, they allow to open the chart in a pop-up window using the button ,
refresh the data or click on to select a period in the drop-down list (Current hour, Last
3 hours, Day, Week, Month or Year) or a specific date with the calendar icon .
Setting the Period to Display

The period selected in the timeline can be extended, reduced or moved.
If you put your mouse over the edge of the grey area, the mouse pointer turns into two-sided arrow
that you can move left or right according to your needs.
Figure 5.21. Extending or reducing the period selected on the timeline
This period, represented by a grey area can also be dragged to select a different period.
56
If you put your mouse with the grey area, the mouser pointer turns into a four-sided arrow.
Figure 5.22. Sliding along the timeline
In addition, you can use you mouse on the timeline to select a period directly.
Figure 5.23. Zooming in on the timeline of a chart
Within the timeline, with a right-click of the mouse over a white area, you can select the
period that suits your needs. The pointer changes from an arrow to a cross.
Once you release the mouse, the data displayed in the chart, x-axis points of reference and
y-axis scale adjust accordingly.
Displaying Some Data and Zooming in

Finally you can zoom in and out directly on the chart. The period selected when you zoom auto-
matically updates the axis of the chart and the period selected in the timeline.
57
Figure 5.24. Zooming in on specific data
When you put your mouse on the chart, the arrow pointer turns to a four-sided arrow and
the background turns blue to indicate that you can interact with the data. You can display
the data time and date above the chart and the value at that time.
A black vertical line indicates where you are on the chart, each measurements focus is
symbolized by a circle in the color of the element displayed. Using the scroll wheel on the
mouse, you can zoom in and out.
You can click on the elements of the chart legend to display or hide them from the chart.
When you are browsing the chart, the value of each measurement on the line is indicated
above each element of the legend.
The value displayed above the legend is an average result of all the data collected over the
period selected. It returns an exact value only when you have zoomed in all the way.
Editing the Number of Days Available on the Timeline

The timeline of every time-based chart indicates for how long they display data. At first you only
have hours and then days, weeks, months and finally a year. The default period of data displayed
in the timeline in one year, 365 days.
A registry database entry allows to change that default maximum value. Once you edit it, all time-
based charts refresh and display only the data retrieved over the period, number of days, that
you set.
To edit the registry key that sets the number of days displayed on the timeline
1. Go to the Administration homepage.

2. In the menu, select System > Expert > Registry database. The page Registry database
opens.
3. In the search engine of the column Name, type in module.graph.default.period. Only this key
is listed.
58
4. In the column Value, click on the value listed. The wizard Registry database Edit a value
opens.
5. In the field Value, type in the value of your choice, in days. The default value is 365.
6. Click on OK to commit your changes. The report opens and closes. The page refreshes and
the new value is displayed.
Wizards
Within SOLIDserver every operation - an object addition, edition, configuration, deletion - is per-
formed via a wizard. All the modules share a common wizard structure, the fields and/or buttons
that it contains depend on each operation. The wizard's title specified the ongoing operation.
In addition to the wizards, SOLIDserver uses pop-up windows: when there are configuration errors
or when you select too many or not enough objects from a list before performing operations via
the menu. However, some pages use pop-up windows, like the Administration pages Groups
and Class Studio or the IPAM page All addresses. Therefore, to use SOLIDserver to the best
of its potential, make sure your Internet browser is not configured to block pop-up windows.
All the wizards share a common structure detailed in the sections below.
Common Structure of the Wizards
Figure 5.25. The common structure of the wizards
59
The drag bar contains the title, a pushpin to save the wizard and the cross to close the
wizard without saving any changes. For more details, regarding how to save a wizard, refer
to the section Quick Wizards.
The gray areas are informational sections. The first one is a location reminder, it indicates
the container you are in and its basic information. The other sections are read-only sections,
like the field Comment that sums up the current configuration, or informational messages
to guide you during the configuration.
The type-in fields are the most commonly used. They change color to guide the configuration:
the field you are working on is surrounded by an orange line, if the background turns orange
there is a syntax error and you cannot save the configuration, if it is gray it is read-only and
you cannot edit it.
The Set/Propagate button allows you to modify the value of a field through inheritance or
propagation properties. If the value is inherited, the field background is gray and cannot be
edited. For more details, regarding the refer to the section Setting Advanced Properties.
The exclamation mark icon indicates that there is a syntax error and you cannot save the
configuration
The star icon indicates that a field/parameter/option is mandatory. If you leave the field blank,
you cannot save your configuration. If the field or drop-down list has a default value, it is
selected and applied when you commit the configuration.
The drop-down list field contains a down arrow to indicate you have a list of values to choose
from.
The box is present on a number of wizards to set specific parameters. Ticking it usually re-
loads the wizard and displays extra fields to configure.
The navigation buttons of the wizard. The button OK indicates that you are on the last page
of the wizard. Clicking on it saves and applies your configuration. The button CLOSE closes
the wizard without saving the configuration or changes applied.
For more specific configurations the wizards embed extra information icons. These icons open
a window containing more detailed information to help with a through configuration of the object.
60
Figure 5.26. An example of help information buttons in the wizards
The question mark indicates extra details regarding the field.

Hover over the question mark to open the field configuration help.
Messages in the Wizards

A number of wizards include warning and information messages with important elements that
you should take into account before committing your changes or configuration.
For instance, all the object deletion wizards contain a warning message, to make you confirm
the deletion or providing extra information regarding the consequences of the deletion. Also,
specific required values that cannot be directly verified by the wizard present warning messages.
61
Figure 5.27. An example of messages in the wizards
Warning messages appear in red. Some specific required values that cannot be directly
verified by the wizard are introduced by warning messages. Also, all the object deletion
wizards contain a warning message, to make you confirm the deletion or to provide extra
information regarding the consequences of the deletion.
Information messages appear in blue.
62
Configuration Lists in the Wizards

A number of wizards provide configurations lists to manage data. They contain two lists that
gather all available data and allow you to choose values from a list or set up your own list. They
usually go in pairs: Available/Selected or Hidden/Displayed.
Figure 5.28. An example of configuration lists in the wizards
This list displays all the available columns that are not yet configured in the listing page
template. In this example, the columns that could be displayed on the page All scopes.
Once you selected a value in the list Hidden column, click on this button to move it to the
Displayed columns and include them to the listing template.
These buttons allow to order the list entries. Select them one by one and move them up
or down until the order suits your needs.
This list displays all the columns that are part of the listing template, in this example on the
page All scopes.
You can remove any column from the listing template, select it and click on this button to
move it to the list Hidden columns.
63
The module Administration provides a set of wizards where you can set up and edit multiple
entries in a single list.
Figure 5.29. An example of data edition in a wizard providing entries management in one list
Once you selected an entry in the list at the bottom of the wizard page, its configuration
detail appear in these fields. You can edit any white field.
Click on this button to save your changes and overwrite the former configuration and follow
the wizard to commit your changes.
Click on this button to delete the selected configuration entry and follow the wizard to commit
your changes.
Click on this button to discard any changes made in the fields, select another entry in the
configuration list or to add a whole new set of data.
The list of existing configurations. The blue color indicates the selected line. During the
modification, it turns gray.
64
Autocompletion Fields in the Wizards

Some fields in the wizards provide an autocompletion option, either manual or automatic.
Figure 5.30. An example of manual autocompletion in the wizards
This field, above the button SEARCH provides manual completion: in this example, you can
type in a hostname to automatically retrieve its IP address if the DNS resolution is configured.
65
Figure 5.31. An example of automatic autocompletion in the wizards
There is no indicator of the autocompletion fields. Typing in a value automatically returns

matching data in a list. If only one value matches your search, it is displayed in the field, if
several entries match your search, a list appears under the field.
Quick Wizards
The quick wizard is a feature that allows to save any wizard at any point of its configuration, for
that it is a shortcut in essence. The wizard's page and all the data filled or selected is saved
within the quick wizard and accessible at any time.
The quick wizards are saved and managed on a dedicated page but you can set shortcuts toward
each of them through a gadget or the menu Preferences.
Browsing Quick Wizards

All quick wizards are saved and listed on the page My Quick Wizards, in the module Administration.
To access the page My Quick Wizards
1. From anywhere in the appliance, in the menu select Preferences > My Quick Wizards.
2. The page My Quick Wizards opens.
66
The page contains five columns that you can sort and/or filter:
• Name displays the quick wizard name. It allows to edit the quick wizards. For more details,
refer to the section Editing Quick Wizards.
• All users indicates if you share the quick wizard's visibility with other users or not (yes or no).
• Description displays the description you might have added to the quick wizard upon creation
or edition.
• Dashboard indicates where you can find the quick wizard: on which dashboard - if you saved
it in the gadget - or in the menu Preferences > Quick Access. For more details, refer to the
section Creating a Quick Wizards Gadget.
• Access contains the link Access toward the wizard saved through the quick wizard.
Quick wizards do not have a properties page, all the information is divided among the columns.
Figure 5.32. The page My Quick Wizards
Adding Quick Wizards

There is only one way to create a quick wizard: via the pushpin located on the drag bar of all the
pages of a wizard, no matter the module. However, you can access your quick wizards in different
ways. For more details, refer to the section Accessing Quick Wizards. Note that:
• When adding a quick wizard, you can indicate only one location for the shortcut: either a
module's dashboard or the quick access menu. However, you can edit it afterward to specify
other modules and/or a quick access.
• Once created, a quick wizard is only available to the user who created it. To make it visible to
everyone, you can edit its visibility.
For more details, refer to the section Editing Quick Wizards.
To create a quick wizard
1. From any wizard page, click on . The wizard Add a Quick Wizard appears.
2. In the field Name, name the quick wizard.
3. In the drop-down list Save in, select either:
• A module to include a shortcut toward the quick wizard. This action automatically displays
the Quick Wizards gadget on the selected module's dashboard.
• Quick access menu to create a shortcut toward the quick wizard in the menu Preferences
> Quick Access.
67
4. In the field Description, you can type in a description.

5. Click on OK to commit the creation. The report opens, the wizard closes and the page you
were on reopens. The quick wizard is listed on the page My Quick Wizards and is also ac-
cessible where you saved it.
Accessing Quick Wizards

There are three ways to access the wizard saved as quick wizard:
• Via the page My Quick Wizards.

• Via the related shortcut embedded in the Quick Wizards gadget. For more details, refer to the
chapter Building Your Dashboards.
• Via a quick access in the menu Preferences > Quick Access.
To access a quick wizard from the page My Quick Wizards
1. From any list, through the menu, select Preferences > My Quick Wizards. The page My
Quick Wizards opens.
2. Filter the list if need be.
3. In the column Access, click on the link Access.
4. The page where you saved the quick wizard opens and displays the page you saved and
all the data you filled before saving the wizard.
To access a quick wizard via the gadget Quick Wizards
1. Go to a dashboard where you displayed the Quick Wizards gadget.

2. In the gadget, click on the name of the quick wizard of your choice.
To access a quick wizard via the menu Preferences
1. From any list, through the menu, select Preferences > Quick Access > <your-quick-wizard>.
Editing Quick Wizards

You can edit your quick wizards from the page My Quick Wizards: you can rename them, change
their description, their access method and visibility.
To edit a quick wizard
2. Click on the name of a quick wizard you want to edit. The wizard Edit a Quick Wizard opens.
3. If need be, edit the fields Name and Description.
68
4. In the list Available, select one by one the modules which dashboard should display a gadget
with a link to the quick wizard. You can also select Quick access menu to add a shortcut in
the menu Preferences > Quick Access.
5. Click on . Your selection is moved to the list Configured. If you want to remove an item
from the list, select it and click on , the item is moved back in the list Available.
6. Tick or untick the box Share with other users according to your needs. Sharing a quick
wizard makes it available for all users.
7. In the list Available, select the module you want the quick wizard to be displayed on.
Sharing Quick Wizards

You can share several quick wizards at once from the page My Quick Wizards.
To share several quick wizards at once
2. Tick the quick wizards you want to share.
3. In the menu, select Edit > Visible to all users > Yes. The wizard Quick wizard visibility
opens.
To make several quick wizards visible only to you
2. Tick the quick wizards you no longer want to share.
3. In the menu, select Edit > Visible to all users > No. The wizard Quick wizard visibility opens.
Deleting Quick Wizards

You can only delete your quick wizards from the page My Quick Wizards.
To delete a quick wizard
2. Tick the quick wizard(s) you want to delete.
3. In the menu, select Edit > Delete. The wizard Delete opens.
4. Click on OK to commit your deletion. The report opens and closes. The selected quick wizards
are no longer listed.
69
Bookmarks
SOLIDserver allows to bookmark any page, even if it is displaying filtered data, and manage the
bookmarks in three different ways: a dedicated management page, the Tree view and a dedicated
gadget.
Browsing Bookmarks
All the bookmarks are listed in the Tree view and can be managed from the page My Bookmarks.
Bookmarks do not have a properties page, all the information is divided among four columns that
you allow to sort and/or filter the list.
Figure 5.33. The page My Bookmarks
The related section in the Tree view is available on all the pages of SOLIDserver.
Name displays the bookmark name. It allows to edit the bookmarks. For more details, refer
to the section Editing Bookmarks.
All users indicates if you share the bookmark visibility with other users (Yes) or not (No).
Bookmark Folder indicates if the bookmark belongs to a folder. / means the bookmark is
not in any folder.
Path contains the link, Access, toward the bookmarked page.
To display the bookmarks in the Tree view
1. From any page within SOLIDserver, open the Tree view.

2. Click on the section My Bookmarks. The list of bookmarks opens.
To display the list of bookmarks
1. From any page within SOLIDserver, in the menu select Preferences > My Bookmarks.
2. The page My Bookmarks opens.
70
Adding Bookmarks
You can bookmark any page, you can even bookmark listing pages displaying filtered data.
To bookmark a page
1. From any page within SOLIDserver, click on at the end of the breadcrumb. The wizard
Bookmark this page opens.
2. In the field Name, rename the bookmark if need be. By default a bookmark is named Module:
Page.
3. In the field Bookmark Folder, you can type in a folder name to organize the bookmarks in
the tree view and on the page My Bookmarks.
The field allows to create or find folders: type in a folder name and click on SEARCH to display
the list of existing folders and select the one you need.
4. If you want to add the bookmark to the bookmark gadget, tick the box Add to the gadget
3
Bookmarks.
5. If you want this bookmark to be visible to any user in the Tree view, tick the box Share with
the other users. If you leave it unticked, you are the only user that sees the bookmark.
6. Click on OK to create your bookmark. The report opens and closes. The page is visible again
and marked . You can now access the bookmark from the Tree view and My Bookmarks.
Accessing Bookmarked Pages

Once you bookmarked a page, you can access it from the Tree view or the page My Bookmarks.
To access a bookmarked page from the Tree view

2. Open the section My Bookmarks.
3. If need be, open the folder that contains the bookmark you are looking for. The folder opens
and displays the bookmarks it contains.
4. Click on the name of the bookmark of your choice. The corresponding page opens.
To access a bookmarked page from My Bookmarks
1. From any page within SOLIDserver, in the menu select Preferences > My Bookmarks. The
page My Bookmarks opens.
2. At the end of the line of the bookmark of your choice, click on Access. The corresponding
page opens.
Editing Bookmarks
From the page My Bookmarks you can edit the bookmarks one at a time: rename them, place
them in a (different) folder, attach them to the bookmark gadget and/or change the visibility settings.
3
For more details, refer to the sections The Gadget Bookmarks and Creating a Bookmarks Gadget.
71
To edit a bookmark details
2. Click on the name of the bookmark you want to edit. The wizard Edit a Bookmark opens.
3. Edit the bookmark according to your needs: you can change its Name, Bookmark Folder
and tick/untick the boxes Add to the gadget Bookmarks, if this box is ticked the gadget
Bookmarks includes a shortcut toward the page and Share with the other users if the box
is ticked all the users can see your bookmark in the Tree view.
4. Click on OK to commit your changes. The report opens and closes. The columns' content
matches your changes.
Sharing Bookmarks
From the page My Bookmarks you can share one or several bookmarks at once.
To share bookmarks
2. Tick the bookmark(s) for which you want to change the visibility.
3. In the menu, select Edit > Visible to all users > Yes. The wizard Bookmark Visibility opens.
4. Click on OK to commit the configuration. The report opens and closes. The page is visible
again: the bookmark is marked Yes in the column All users.
To make bookmarks visible only to you
2. Tick the bookmark(s) for which you want to change the visibility.
3. In the menu, select Edit > Visible to all users > No. The wizard Bookmark Visibility opens.
again: the bookmark is marked No in the column All users.
Deleting Bookmarks
There are two ways of deleting a bookmark, you can either remove it from the bookmarked page
or remove the bookmark from My Bookmarks. From My Bookmarks, you can delete several
bookmarks at once.
To delete a bookmark from the page itself
1. Go to the bookmarked page, click on . The wizard Delete opens.

2. Click on OK to delete your bookmark. The page refreshes. At the end of the breadcrumb the
page is marked .
To delete a bookmark from My Bookmarks
72
2. Tick the bookmark(s) you want to delete.

4. Click on OK to commit the bookmark deletion. The report opens and closes. The page is
visible again.
Global Search
SOLIDserver includes a search engine called Global search that allows you to perform searches
in the database of several modules at once.
This Global search field is located to the top-right corner of the interface and is available from
any page. You can look for data using full names, values or look for fragments of information (a
section of a MAC address, some letters of a name...) to find all the partial matches.
Figure 5.34. An example of search results performed using Global search
Type in the field the data you are looking for.

Click on the magnifying glass to perform the search.
All the objects matching the search are returned separately and preceded by their dedicated
icon in the module they are managed from.
This button allows you to change the global search window size.
To display more information in the Global search window, click on any result line. The table
Information of the contextual menu opens under the object line.
Click on this button to access the properties page of the object data, like in the listings pages.
This button allows you to close the window. Once you performed a search, the window re-
mains open above the page you are currently on, until you close it.
Global search returns matching results in a dedicated window under the field. Note that:
• Global search looks for matching results in the modules IPAM, DHCP, DNS, NetChange,
Device Manager and one page of Administration. It covers the following objects:
• From the IPAM: IPv4 and IPv6 spaces, networks, pools and IP addresses, even in their
compressed form.
73
• From the DHCP: IPv4 and IPv6 smart servers, physical servers not managed via a smart,
scopes, ranges, statics, leases and ACLs.
• From the DNS: smart servers, physical servers not managed via a smart, views, zones and
resource records.
• From NetChange: network devices and ports.
• From Device Manager: devices, ports and interfaces.
• From Administration: groups of users and users.
4
• From all modules: MAC addresses , hostnames.
No matter the module, you can look for an object using its name or value. For instance, you
can find an IP address using its address, MAC address or name.
• All the matching results following the modules' order: IPAM, DHCP, DNS, NetChange,
Device Manager and finally Administration.
• All the matching results respect the internal hierarchy of the module. So if you look for
an IP address, Global search returns first the network(s) from level 0 to n, then the pool(s) and
finally the IP address(es) matching your search.
• Global search does not return VLAN information, whether it is managed from NetChange
or VLAN Manager.
To perform a global search
1. On the top-right corner of the GUI, in the field Global search type in the data you are looking
for.
2. Click on or hit Enter on your keyboard to perform the search.
3. The window Global search opens under the field and displays the results found in each
module.
a. To display more information in the Global search window, click on any result line. The
table Information of the contextual menu opens under the object line.
b. To access the object properties page in the module where it is managed, click on .
Notifications
SOLIDserver keeps track of all the operations performed in a week time period through the
dedicated Notification window. Whether the operation was successful or not, this window lists
the services ran and allows to see and export the final report of the operation.
4
Global search does not return NetChange discovered items from MAC addresses.
74
Figure 5.35. An example of results displayed in the window Notifications
Click on the button Notifications in the top-right corner of the GUI, left of the field Global
search, to open the window.
The notifications are listed by time and date from the most to the last recent.
This button allows you to change the global search window size.
The status is either if the operation was successful or if at least one error occurred.
Any other icon indicates that the operation is ongoing.
The operation is displayed using the service it uses as follows: <action>:<resource it was
performed on>. Click on a report to export it.
Click on this button delete a notification. Beware, there is no warning before deletion.
This button allows you to close the window. Once you opened it, the window remains open
above the page you are currently on, until you close it.
Notifications can be easily displayed and exported by clicking on the line of your choice.
Figure 5.36. An example of a detailed result in the window Notifications
The type and full details of the report appear in the same window.
Click on any of the proposed formats to export the report.
This button allows you to go back to the Notifications list.
To open the notifications window
1. In the top-right corner of the GUI, left of the field Global search, click on the button Notifica-
tions.
2. The window Notifications opens under the button and displays the last operations as follows:
<date><hour:minute> <status> <operation>.
75
The status is either if the operation was successful or if at least one error occurred. Any
other icon indicates that the operation is ongoing. The operation is displayed using the service
it uses as follows: <action>:<resource it was performed on>.
3. Click on the operation that suits your needs to display its report.
4. To go back to the list of Notifications, click on BACK.
To export the operation report
1. Open the window Notifications.

2. Click on the operation of your choice. The report opens.
3. Under the content of the report, click on TEXT , HTML or EXCEL to export the report in the cor-
responding format.
76
Chapter 6. Building your Dashboards
SOLIDserver allows to customize each module homepage, or dashboard, with gadgets.
Figure 6.1. The IPAM dashboard
From each dashboard you can add and organize gadgets. You can also create new gadgets
1
from most listing pages and decide to share them with other users or delete them. Any gadget
can be displayed on any dashboard no matter the data it contains.
Note that you cannot add gadgets from the listing pages of the Administration module.
All the gadgets are composed of two parts:
Figure 6.2. The common structure of the gadgets
1
In this chapter's procedures, any listing page refers to any page of the module IPAM, DHCP, DNS, NetChange, Workflow, Device
Manager or VLAN Manager.
77
Building your Dashboards
The upper gray part is the gadget drag bar. It contains from left to right: the gadget name,
the button that allows to configure some gadgets' content and the button that indicates
that the gadget is expanded, and the button that allows to hide the gadget.
The lower white part contains the information and has a different display for every type of
gadget.
SOLIDserver comes with a set of gadgets in the Gadgets Library, all detailed in appendix Default
Gadgets.
Gadgets Displayed by Default

The superuser session, the user ipmadmin, has a set of gadgets displayed by default:
• On the appliance main dashboard: System Information, General Information, SOLIDserver

Configuration Checklist, My Account Preferences & Configuration and Shortcuts; all detailed
in the sections below.
• On NetChange dashboard: NetChange Network Devices Vendor, NetChange Active Ports
Speed (bps), NetChange Port Status and Number of NetChange Ports per Device; all detailed
in the sections below.
• On Device Manager dashboard: Number of Ports Used per Device, Number of Interfaces Used
per Device and Alert on Ports/Interfaces Reconciliation Drift; all detailed in the sections below.
Keep in mind that on the session of any other user:
• Only the gadget My Account Preferences & Configuration is displayed by default on the main
dashboard of other users.
• Any default gadget can be displayed on their session's dashboards following the procedure in
the section Assigning Gadgets from the Gadgets Library. These gadgets are all listed in the
appendix Default Gadgets.
• The gadget SOLIDserver Configuration Checklist is not available even if they belong to the
group admin, unless the superuser edits the gadget visibility.
System Information
This descriptive gadget is available by default on the main dashboard of the superuser session
(ipmadmin).
Figure 6.3. The gadget System information
It cannot be edited and sums up system and user related information:
78
Connected as
The name of the user connected. Click on the user name (ipmadmin in our example) to open
the wizard Configure user settings that allows to set the user account preferences. For more
details, refer to the section Account Configuration.
Version
The current software and architecture versions.
Date
The appliance current date and time. If it is not accurate, the License type and finally the
support used (Manufacturer, Product and Serial).
License type
The appliance license type: Temporary (with the End date between brackets) or Official i.e.
with no end date.
Manufacturer
The appliance manufacturer name, it indicates if the appliance is installed on a virtual machine
or physical hardware appliance.
Product
The product name: either hardware (with its size) or software. It depends on the manufacturer.
Serial number
The appliance serial number. For hardware appliances, the serial number is as follows: 6
hexadecimal digits that identify your appliance. The virtual appliances have a serial number
(VMware - UID) that is only visible on the page All SOLIDserver.
General Information
This descriptive gadget is available by default on the main dashboard of the superuser session
(ipmadmin).
Figure 6.4. The gadget General information
This gadget cannot be edited and sums up the current network and services configuration:
Services
The main services status: running , disabled or not configured yet . Click on the services
name to manage them. A running service can be disabled from the dashboard, disabled
services and services to configure provide a link to the page Services Configuration. For
more details, refer to the chapter Services Configuration.
Hostname
The appliance hostname. Click on its name (solid.intranet in our example) to open the page
Network Configuration and change it. For more details, refer to the chapter Network Config-
uration.
79
IP Addresses
The appliance interface(s) IP address. The default interface indicates the IP address you
configured to connect to SOLIDserver. Click on the interface name (DEFAULT_INTERFACE
in our example) to open the page Network Configuration and change them. For more details,
refer to the chapter Network Configuration.
Default gateways
The appliance default gateway. Click on its IP address to open the page Network Configuration
and change them. For more details, refer to the chapter Network Configuration.
Member type
The appliance role: Standalone, Master or Hot Standby. The two last roles imply that your
SOLIDserver is part of an appliance High Availability (HA) configuration. Click on the role to
open the page All SOLIDserver. For more details, refer to the chapter High Availability Man-
agement.
Status
The appliance HA Management status. A Standalone appliance is always OK, the appli-
ances configured in HA can be marked , which indicates that the configuration is not
working properly. Click on the status to open the page All SOLIDserver. For more details,
refer to the chapter High Availability Management.
SOLIDserver Configuration Checklist

This configuration gadget is by default displayed on the main dashboard of the superuser session
(ipmadmin).
Figure 6.5. The gadget SOLIDserver configuration checklist
It provides a set of shortcuts that help setting SOLIDserver main configurations and allows the
administrator to make sure that your appliance is used at the best of its potential from the first
connexion onward. The gadget provides a checklist where the lines marked are not configured
yet, and the set configurations are followed by .
This gadget cannot be edited and contains the following shortcuts toward specific configuration
wizards:
Local SOLIDserver
Allows to configure your local SOLIDserver appliance from the gadget. Click on Configuration
to open the wizard Configure local SOLIDserver. For more details, refer to the section Con-
figuring your Master Appliance Locally.
80
Remote SOLIDserver
Allows to add remote appliances to the page All SOLIDserver from the gadget. Click on Add
to open the wizard Add/modify remote SOLIDserver. For more details, refer to the section
Adding the Future Hot Standby.
NTP servers configuration
Allows to add NTP servers from the gadget. Click on Configuration to open the wizard NTP
servers configuration. For more details, refer to the section Configuring the NTP Server.
DNS smart architecture
Allows to create a DNS smart architecture from the gadget. Click on Add to open the wizard
Add a DNS server. For more details regarding smart architectures, refer to the section Adding
a DNS Smart Architecture.
DHCP smart architecture
Allows to create a DHCPv4 smart architecture from the gadget. Click on Add to open the
wizard Manage a DHCP server. For more details regarding smart architectures, refer to the
section Adding a DHCPv4 Smart Architecture.
Backup
Allows to archive the appliance backup on FTP from the gadget. Click on Configuration to
open the wizard Archive server parameters. For more details regarding remote FTP config-
uration, refer to the section Archiving the Backup Files on an FTP or SFTP server.
Change ipmadmin password
Allows the user ipmadmin (also called the superuser) to edit his/her SOLIDserver connexion
password from the gadget. Click on Configuration to open the wizard Modify user password.
For more details, refer to the section Configuring the Session's Password.
Change SSH password
Allows the user ipmadmin to edit the SSH password from the gadget. SSH is used to manage
EfficientIP DNS and DHCP servers and remote appliances, it authenticates the users allowed
to add/edit servers and add remote appliances. So if you edit the password after adding
servers or remote appliances, you must also edit it in the relevant wizards. Click on Config-
uration to open the wizard Change SSH password. For more details, refer to the sections
Managing EfficientIP DNS Servers, Managing EfficientIP DHCP Servers and/or to the config-
uration sections of the chapters High Availability Management and Remote Management of
Other Appliances.
Authentication (AD, LDAP, RADIUS)
Allows you to add one by one the three rules that configure the remote user authentication
via AD, RADIUS or LDAP. Click on Configuration to open the wizard Add a rule. For more
details regarding the methods of remote authentication, refer to the chapter Managing Au-
thentication Rules.
Group
Allows you to add groups of users from the gadget. Click on Add to open the wizard Add a
group. For more details, refer to the section Adding Groups of Users.
Internal module setup
Allows to set the modules advanced properties interaction of the appliance. Click on Config-
uration to open the wizard Internal module setup. For more details, refer to the section De-
fining the Internal Module Setup.
81
My Account Preferences & Configuration

This shortcut gadget is available by default on the main dashboard of all the users.
Figure 6.6. The gadget My account preferences & configuration
This gadget cannot be edited and provides links to help the connected user set their preferences:
Gadgets Library
This button is a link toward the page Gadgets Library in the module Administration.
Set language
This button opens the wizard Change Language above the dashboard it is displayed on.
Shortcuts
This shortcut gadget is available by default on the main dashboard of the superuser session (ip-
madmin).
Figure 6.7. The gadget Shortcuts
This gadget cannot be edited and provides links to the management pages of key objects of the
modules IPAM, DNS and DHCP:
All networks
This button provides a shortcut toward the page All networks in the IPAM, all spaces taken
together. For more details, refer to the section Managing Networks.
All scopes
This button provides a shortcut toward the page All scopes in the DHCP, all servers taken
together. For more details, refer to the chapter Managing DHCP Scopes.
All zones
This button provides a shortcut toward the page All zones in the DNS, all servers taken to-
gether. For more details, refer to the chapter Managing DNS Zones.
NetChange Network Devices Vendor

This chart is available by default on NetChange dashboard of the superuser session (ipmadmin).
82
Figure 6.8. The gadget NetChange network devices vendor
This pie chart represents all the ports listed on the page All ports distributed by vendor with the
number of ports for each vendor. For more details, refer to the chapter Managing Ports.
NetChange Active Ports Speed (bps)

Figure 6.9. The gadget NetChange active ports speed (bps)
This pie chart represents the active ports listed on the page All ports distributed by port speed,
in bits per second, with the number of ports matching this speed. For more details, refer to the
chapter Managing Ports.
NetChange Port Status

83
Figure 6.10. The gadget NetChange port status
This pie chart represents all the ports listed on the page All ports distributed by status, with the
number of ports marked with each status. For more details, refer to the chapter Managing Ports.
Number of NetChange Ports per Device

Figure 6.11. The gadget Number of NetChange ports per device
This pie chart represents all the ports repartition among all the network devices, with the number
of ports for each network device. The ports represented are all listed on the page All ports. For
more details, refer to the chapter Managing Ports.
Number of Ports Used per Device

This chart is available by default on Device Manager dashboard of the superuser session (ipmad-
min).
84
Figure 6.12. The gadget Number of ports used per device
This pie chart represents all the used ports listed on the page All ports & interfaces distributed
by device. For more details, refer to the chapter Managing Ports.
Number of Interfaces Used per Device

This chart is available by default on Device Manager dashboard of the superuser session (ipmad-
min).
Figure 6.13. The gadget Number of Interfaces used per device
This pie chart represents all the used interfaces listed on the page All ports & interfaces distributed
by device. For more details, refer to the chapter Managing Ports.
Alert on Ports/Interfaces Reconciliation Drift

This Top List is available by default on Device Manager dashboard of the superuser session
(ipmadmin).
Figure 6.14. The gadget Alert on ports/interfaces reconciliation drift
85
This gadget was configured from Device Manager, it provides a Top 5 list of the ports and inter-
faces that are marked Drift in the column Reconciliation.
You can edit this Top List to display up to 25 entries in the table or edit the columns it contains.
For more details regarding Top List edition, refer to the section Editing a Top List Gadget.
Understanding the Gadget Types

There are four different kinds of gadgets that you can create:
• Chart: used to get a graphical overview of data repartition or resources use.

• Top List: used to list resources based on specific filters.
• Quick Search: used to create columns search engine shortcuts.
• Shortcut: used to create shortcut links toward specific pages. They include:
• The Gadget Quick Wizards: used to create shortcuts toward the quick wizards of your choice.
• The Gadget Bookmarks: used to create shortcuts toward the bookmarked pages of your
choice.
There are two extra types among the gadgets displayed by default: the Descriptive and Config-
uration gadgets.
Chart
This gadget allows you to create graphical representations of resources activity via a pie chart
or bar chart.The charts allow to compare values and labels, for instance the DNS resource records
type distribution among the zones of a server like in the images below.
Using the chart legend, you can hide or display some data of pie charts. For more details refer
to the section Charts.
Figure 6.15. An example of bar chart representation of the record types distribution
86
Figure 6.16. An example of pie chart representation of the record types distribution
Note that:
• The icon in the gadget drag is only available on the Administration page Statistics and on
the properties page of specific resources. It can be used to quickly create a copy of the gadget
on a dashboard. For more details, refer to the section Creating a Chart Gadget.
• The icon allows to zoom in on the chart in a pop-up window above the page.
• The icon allows to refresh the data displayed.
Top List
This gadget allows you to create a specific list displaying from 5 to 25 items from a listing page.
Once created, the Top List looks like a table composed of a maximum of 4 columns that displays
the entries you want, they can match a filtered display of the source page. For instance, a list of
the five most heavily used terminal networks.
Figure 6.17. An example of a Top List
The Top List can be edited using the button . For more details, refer to the sections Creating
a Top List Gadget and Editing Gadgets.
Quick Search
This gadget allows you to create a filtering tool based on the columns of a page. It is composed
of fields matching the columns search engines in the target listing page. Any search performed
from a Quick Search automatically opens the related page and filters it according to your search.
87
Figure 6.18. An example of a Quick Search
In the gadget, the selected columns are displayed as fields that allow you to enter data. Once
you click on SEARCH, the corresponding listing page opens and displays only the results
matching the data looked for. One of the advantages of this gadget is that you can filter data in
the corresponding list several columns at a time from any dashboard. For instance, you can
search for specific zones through their name, type and DNSSEC configuration within a server
any module dashboard.
The Quick Search can be edited using the button . For more details, refer to the sections Cre-
ating a Quick Search Gadget and Editing Gadgets.
Shortcut
The shortcut gadgets contain link buttons toward specific pages.They are used for specific objects,
the quick wizards and bookmarks. For more details, refer to the section Shortcuts.
The Gadget Quick Wizards
Links toward the quick wizards you have saved can be accessed either from a gadget or in a
dedicated section in the menu.
The Quick Wizards gadget can only be displayed once on each dashboard. You can customize
the gadget content on each dashboard using the button .
Figure 6.19. An example of a Quick Wizards gadget
The menu Quick Access is visible from every page of the appliance in the menu Preferences.
Figure 6.20. An example of a Quick Access
88
For more details, refer to the sections Creating a Quick Wizards Gadget and Editing Gadgets.
The Gadget Bookmarks
This gadget allows you to access selected bookmarks from any dashboard. It displays a set of
chosen bookmarks as buttons named <tab>: <page> if you keep their default name.
This gadget is unique and can be duplicated on as many dashboards as you want but that you
cannot name.
Figure 6.21. An example of a Bookmarks gadget
For more details, refer to the sections Creating a Bookmarks Gadget and Editing Gadgets.
Browsing Gadgets
Gadgets are available on three pages: Gadgets Library, My Gadgets and Statistics.
• Browsing the Gadgets Library lists all the existing gadgets.

• Browsing My Gadgets lists all the gadgets already assigned to at least one dashboard.
• Browsing the Statistics contains the appliance statistics. Every chart on the page can be used
as a gadget and assigned to a dashboard.
Browsing the Gadgets Library

From the page Gadgets Library you can enable, disable and delete the existing gadgets.
To display the page Gadgets Library
1. From any page, in the menu select Preferences > My Dashboards > Gadgets Library.
2. The page Gadgets Library opens.
By default, the page Gadgets Library contains a list of default gadgets that are all Enabled in the
column Status; these gadgets are all detailed in the appendix Default Gadgets.
Some gadgets are displayed by default on the superuser session: on the main dashboard and
on the dashboard of the modules NetChange and Device Manager. For more details, refer to the
section Gadgets Displayed by Default.
The page contains 5 columns:
Table 6.1. The columns of the page Gadgets Library

Column Description
Name The gadget name.
All users The gadget visibility: Yes means it is visible to all users, No means it is only visible for the
user who created it.
89
Column Description
Type The gadget type: Chart, Configuration, Descriptive, Quick Search, Shortcut or Top List.
For more details, refer to the section Understanding the Gadget Types.
Dashboard The module dashboard where the gadget is displayed.
Status The gadget status: Enabled or Disabled.
The listing template of this page cannot be edited.
If you click on a gadget name, the page My Gadgets opens. If the gadget has been assigned to
a dashboard, the gadget is listed with the column Dashboard indicating on which module(s). If
the gadget is not displayed yet, the list My Gadgets is empty.
To display a gadget properties page
1. From any page, in the menu select Preferences > My Dashboards > Gadgets Library. The
page Gadgets Library opens.
2. At the end of the line of the gadget of your choice, click on . The properties page opens.
It contains the panel Main properties that sums up the gadget name, type, accessibility
settings and status.
If the button Edit is available, you can click on it to configure the gadget. For more details,
refer to the section Editing Gadgets.
Browsing My Gadgets
From the page My Gadgets, you can manage the gadgets visibility: hide them from a dashboard
or make them visible to all users.
To display the page My Gadgets
1. From any page, in the menu select Preferences > My Dashboards > My Gadgets.
This page contains the same columns as the page Gadgets Library, the listing template cannot
be edited either.
To display the gadgets of a specific dashboard
1. From any page, in the menu select Preferences > My Dashboards > My Gadgets. The page
Gadgets Library opens.
2. In the search engine of the column Dashboard, type in the name of the dashboard of your
choice.
You cannot access the gadget properties page from My Gadgets itself unless you accessed it
from the page Gadgets Library.
To display a gadget properties page from the page My Gadgets
1. From any page, in the menu select Preferences > My Dashboards > Gadgets Library. The
page Gadgets Library opens.
2. Click on the name of the gadget of your choice. The page My Gadgets opens. The gadget
is only listed if it has been assigned to a dashboard.
90
3. In the breadcrumb, click on the gadget name. The properties page opens. It contains the
panel Main properties that sums up the gadget name, type, accessibility settings and status.
Browsing the Statistics

Within the module Administration the page Statistics provides panels containing charts that can
be assigned as gadgets on any dashboard.
These charts are not listed on the page Gadgets Library, but once assigned they are listed on
My Gadgets.
To display the local SOLIDserver Statistics
1. Go to the Administration tab. If the homepage is not displayed, click on . The dashboard
opens.
2. In the section Monitoring, click on Statistics. The page Statistics opens.
2
3. Under the menu, in the drop-down list SOLIDserver, make sure your local appliance is se-
lected.
The available charts all relate to the appliance system information:
• DNS traffic.
• DHCP traffic.
• HTTP traffic.
• SNMP traffic.
• Database replication traffic.
• Load average
• CPU per process.
• Memory usage per process,.
• I/Os per process.
• SQL queries.
• Threads.
• Memory.
• User sessions.
• Disk Usage.
Any one of them can be used as a gadget and displayed on the modules' dashboard. For more
details, refer to the section Assigning a Gadget from the Page Statistics.
Keep in mind that these charts are empty during the first appliance use: if there is no traffic, there
is no data to display.
The page also contains the panel Processes state that displays a drop-down field. It cannot be
used as a gadget. For more details, refer to the section Monitoring the Appliance Statistics.
2
You can display the statistics of a remote appliance on the page but these charts cannot be used as gadgets.
91
Creating Gadgets
For every type of gadgets there is one or more ways to create a new one or edit its content. Each
type of gadget has a certain logic when it comes to the creation or edition of its content.
That's why the creation of Charts, Top List, Quick Search, Quick Wizards and Bookmarks gadgets
is detailed here below. As for the descriptive and configuration gadgets you cannot create new
ones or delete them, you can enable them, disable them and make them visible or not to other
users.
Once a gadget has been created, you can display it on any dashboard, at any time. For more
details, refer to the section Assigning Gadgets to a Dashboard.
Creating a Chart Gadget

You can create charts from any listing page and display as many of them as you want on every
module dashboard.
Keep in mind that in the Administration tab, only the following pages allow you to create
charts: Key ring; All SOLIDserver; Groups; Users; Logs visualization; Statistics; Session tracking;
User tracking; Alerts; Custom database; Rules; Registry database; Netstat; Localization.
The charts that are available on the properties page of some resources, such as servers or
NetChange ports, can be assigned directly from said properties page to any dashboard. For more
details, refer to the section Assigning a Gadget from a Resource Properties Page.
You can also assign the charts available on the page Statistics of the Administration module to
the dashboards that suit your needs. For more details, refer to the section Assigning a Gadget
from the Page Statistics.
To create a chart from a listing page
1. Go to the listing page of your choice.

2. Filter the list it if need be.
3. In the menu, select Preferences > Add a Chart. The wizard Add a chart opens.
4. Configure the chart:
a. In the field Chart name, name the gadget.

b. In the drop-down list Chart type, select either a pie or a bar chart.
c. In the drop-down list Value, select the value to be displayed in the chart. In some lists,
there is only one value available and Entries count is selected by default.
d. In the drop-down list Label, select a column name to be used as label.
e. In the drop-down list Secondary label, select a secondary label to compare with the first
one. This option is only available if you selected to create a bar chart.
f. In the drop-down list Order by, you can choose to display the value, label or secondary
label, if available, in an ascending order (ASC) or descending order (DESC).
5. Click on PREVIEW if you want to have an overview of the final gadget.

92
7. In the drop-down list Dashboard, select the dashboard you want the gadget to be displayed
on.
8. Click on OK to commit the creation. The report opens and closes. The chart is visible on the
dashboard you chose to display it on.
Note that:
• Charts remain empty as long as there is no data to retrieve in the lists they are created from.
• The icon allows to zoom in on the chart in a pop-up window above the page.
• The icon allows to refresh the data displayed.
• Once a chart is created, you cannot edit it. If the data you used no longer corresponds to your
needs, you have to delete the gadget and create a new one. For more details, refer to the
section Deleting Gadgets.
Creating a Top List Gadget

You can create Top Lists from any listing page and display as many of them as you want on
every module dashboard.
Keep in mind that in the Administration tab, only the following pages allow you to create a
gadget Top List: Session tracking; User tracking and Alerts. These pages are accessible through
the section Monitoring of the Administration tab dashboard.
To create a Top List from a listing page

2. Filter the list it if need be.
3. In the menu, select Preferences > Add a Top List. The wizard Add a Top List opens.
4. Configure the Top List:
a. In the field Name, name the gadget.

b. In the drop-down list Dashboard, select the dashboard you want the gadget to be dis-
played on.
c. In the list Columns, select one by one the columns to be displayed in the gadget.
d. Click on . The name is moved to the field Selected columns. If you want to remove a
column from that field, select it and click on . The column is moved back in the list
Columns.
e. In the field Selected columns, use and to order the columns to your convenience.
You cannot display more than four columns in the gadget so if you specify more than
one, only the first four are saved.
f. In the field Limit, specify the number of items to display in the final gadget: 5, 10, 15,
20 or 25.
5. Click on OK to commit your creation. The report opens and closes. The gadget is visible on
the dashboard you chose to display it on.
The gadget is named Top X list: <your-gadget-name>, where X is the limit configured. You can
edit the gadget at any time through the button in the gadget drag bar. For more details, refer
to the section Editing a Top List Gadget.
93
If you displayed a Top List on several dashboards, any modification made (renaming it, changing
the columns displayed, etc.) on one dashboard also applies to the gadgets on all the other
dashboards.
Once you created a Top List, you can assign it to any dashboard from the pages Gadgets Library,
My Gadgets or any dashboard.
Creating a Quick Search Gadget

You can create Quick Search gadgets from any listing page and display as many of them as you
want on every module dashboard.
The fields available to configure the Quick Search depend on the list the gadget is set from.
To create a Quick Search from a listing page

2. In the menu, select Preferences > Add a Quick Search. The wizard Add a Quick Search
opens.
3. Configure the Quick Search:
a. In the field Name, name the gadget. You should use a name that specifies the page it
is created from.
b. In the drop-down list Dashboard, select the dashboard you want the gadget to be dis-
played on.
c. In the list Columns, select one by one the columns that compose the gadget.
d. Click on . The name is moved to the field Selected columns. If you want to remove a
column from that field, select it and click on , the column is moved back in the Columns
list.
e. In the field Selected columns, use and to order the search fields to your conveni-
ence.
4. Click on OK to commit your creation. The report opens and closes. The Quick Search is
visible on the dashboard you chose to display it on.
You can edit the Quick Search at any time via the button in the drag bar. For more details,
refer to the section Editing a Quick Search Gadget.
If you displayed a Quick Search on several dashboards, any changes made (renaming it, changing
the fields available, etc.) on one dashboard also apply to the gadgets on all the other dashboards.
For more details, refer to the section Assigning Gadgets from the Gadgets Library.
Creating a Quick Wizards Gadget

Quick wizards allow you to save and access wizards at any point of their configuration. For more
details, refer to the section Quick Wizards.
When adding or editing a quick wizard, you can specify a shortcut to access it:
• Either from a Quick Wizards gadget on the dashboards that suit your needs,
• Or from the menu Preferences > Quick Access.
94
Note that, when adding a quick wizard, you can indicate only one location for the shortcut: either
a module's dashboard for the gadget or the menu Quick Access. However, you can edit it afterward
to specify other modules and/or a quick access from the page My Quick Wizards.
To create a Quick Wizards gadget when creating a Quick Wizard
1. On the wizard you want to save, click on in the wizard drag bar. The wizard Add a Quick
Wizard opens.
2. In the field Name, name the quick wizard.
3. In the drop-down list Save in, select the dashboard of your choice.
4. In the field Description, you can add a description if you want.
5. Click on OK to commit your creation. The report opens and closes. The Quick Wizards
gadget is now displayed on the selected module dashboard, it contains a button named after
your quick wizard.
To create a Quick Wizards gadget when editing a Quick Wizard
1. From any listing page, through the menu, select Preferences > My Quick Wizards. The page
My Quick Wizards opens.
2. Click on the name of a quick wizard you want to edit. The wizard Edit a Quick Wizard opens.
3. If need be, edit the fields Name and Description.
4. In the list Available, select one by one the modules which dashboard should display a gadget
with a link to the quick wizard. You can also select Quick access menu to add a shortcut in
the menu Preferences > Quick Access.
5. Click on . Your selection is moved to the list Configured. If you want to remove an item
from the list, select it and click on , the item is moved back in the list Available.
6. Tick or untick the box Share with other users according to your needs. Sharing a quick
wizard makes it available for all users.
7. Click on OK to commit your changes. The report opens and closes. The Quick Wizards
gadget is now displayed on the selected modules' dashboard, it contains a button named
after your quick wizard.
To create a Quick Wizards gadget from a dashboard
1. From any dashboard, click on the button . The wizard Add a gadget opens.
2. In the list Type, select Other.
3. Click on NEXT . The list Gadget appears.
4. Select Quick Wizard.
5. Click on OK to commit your choice. The report opens and closes. The gadget is now visible
but empty, the message The gadget is empty is displayed in the gadget.
Once you created a Quick Wizards gadget you can edit the shortcuts it contains through on the
button in the gadget drag bar. You can also edit an empty Quick Wizards gadget if you click
on the message The gadget is empty. For more details, refer to the section Editing a Quick
Wizards Gadget.
95
Creating a Bookmarks Gadget

The Bookmarks gadget gathers shortcuts toward the existing bookmarks of your choice. The
shortcuts it contains are the same on all the dashboards it is displayed on, it is named Bookmarks
by default and cannot be edited from the gadget itself.
You cannot create the Bookmarks gadget on its own, you must create it when you are bookmarking
a page.
To create a Bookmarks gadget when bookmarking a page
1. On any page, click on in the upper-right corner of the page. The wizard Bookmark this
page opens.
2. In the field Name, the bookmark is named <module>: <page>, you can edit it.
3. In the field Bookmark Folder, you can type in a folder name to organize your bookmarks in
the Tree view. By default, no folder is configured, the field contains /.
To create a folder, type in the name of your choice. You can also create sub-folders using
the character / and the structure /folder/sub-folder.
To find existing folders, type in the beginning of the folder name and click on REFRESH to re-
trieve the matching folder full name.
4. Tick the box Add to the gadget Bookmarks to create the Bookmarks gadget and add it to
the page Gadgets Library.
5. Click on OK to commit your creation. The report opens and closes. The page is now book-
marked and marked . The gadget is not displayed on any dashboard yet, to assign it, refer
to the section Assigning Gadgets to a Dashboard.
Keep in mind that you cannot assign the Bookmarks gadget from a dashboard if you have not
ticked the box Add to the gadget Bookmarks for at least one bookmark.
Every time you tick the box Add to the gadget Bookmarks, you edit the gadget content as you
add extra shortcuts to the gadget. To remove shortcuts, refer to the section Editing the Bookmarks
Gadget.
Assigning Gadgets to a Dashboard

You can assign all the existing gadgets, meaning display them on any dashboard. This operation
can be done from: a dashboard, the page Statistics, the properties page of a resource that contains
charts and the gadgets management pages Gadgets Library and My Gadgets.
To assign several gadgets on several dashboards at once, refer to the section Assigning Gadgets
from the Gadgets Library.
Assigning a Gadget from the Dashboard Itself

You can assign existing gadgets from any dashboard using the button at the end of the menu.
96
Figure 6.22. The button Add a Gadget available on any dashboard
This button opens the wizard Add a gadget where you can select an existing gadget to
display on the dashboard.
To assign a gadget from a dashboard
1. Go to the dashboard of your choice.

2. Click on . The wizard Add a gadget opens.
3. In the list Type, select the type of your choice. Other contains the descriptive gadgets, the
3
Bookmarks gadget and the Quick Wizards gadget.
4. Click on NEXT . The list Gadget displays the available gadgets of the selected type.
5. Select the gadget you want. If there is no gadget of this type yet, the list is empty.
6. Click on OK to commit your addition. The gadget is now visible on the dashboard.
Assigning a Gadget from the Page Statistics

In the Administration module, the statistics page allows you to assign any chart as gadgets on
any dashboard. For more details, refer to the section Browsing the Statistics.
To assign a gadget from the page Statistics
1. Go the Administration tab dashboard.

2. Click on the button Statistics in the section Monitoring. The page Statistics opens.
3. Click on in the upper right corner of the page to close all the panels.
4. In the panel of the chart you want to display, click on . The wizard Gadgets Add: Chart
opens.
on.
6. Click on OK to commit your addition. The gadget is now displayed on the selected dashboard.
Assigning a Gadget from a Resource Properties Page

All the charts that are displayed on you resources' properties page can be added to any dashboard.
For instance, from a server properties page, a NetChange port properties pages, etc. you can
assign one or all charts to the dashboard of your choice.
3
Bookmarks is only listed if you already ticked the box Add to the gadget Bookmarks when bookmarking a page.
97
To assign a gadget from a resource properties page
1. Go the properties page of the object of your choice.

2. Click on in the upper right corner of the page to open all the panels.
3. In the panel of the chart you want to display, click on . The wizard Gadgets Add: Chart
opens.
on.
5. Click on OK to commit your addition. The page refreshes. The gadget is now displayed on
the selected dashboard.
Assigning Gadgets from the Gadgets Library

From the page Gadgets Library you can assign one or several gadgets to one or more dashboards
at once. The wizard allows to specify on which dashboard you want the gadget(s) to be displayed.
Any gadget is listed on the page Gadgets Library even if it is not displayed on any dashboard
yet.
Note that, unlike the Quick Wizards gadget, any changes performed to a Top List, Quick Search
or Bookmarks gadget from a dashboard also apply to other dashboards it is displayed on.
To assign gadgets to one or several dashboards from the page Gadgets Library
1. From anywhere in the appliance, in the menu select Preferences > My Dashboards > Gadgets
Library. The page Gadgets Library opens.
2. Tick the gadget(s) you want to assign to a dashboard.
3. In the menu Edit, select Assign Gadget(s). The wizard Gadget configuration opens.
4. In the list Available, double-click on the name of the dashboard you want the gadget to be
displayed on. The name is moved to the list Configured. You can select on several dash-
boards if you want.
5. Click on OK to commit your choice. The report opens and closes. The gadget is now displayed
on the selected dashboard(s).
Assigning a Gadget from My Gadgets

From the page My Gadgets you can assign one or several gadgets to one or more dashboards
at once. The wizard allows to specify on which dashboard you want the gadget to be displayed.
My Gadgets only contains the gadgets that are already displayed on one dashboard. Any gadget
listed can be displayed on another dashboard.
To assign a gadget to a dashboard from the page My Gadgets
1. From anywhere in the appliance, in the menu select Preferences > My Dashboards > My
Gadgets. The page My Gadgets opens.
2. In the menu Edit, select Assign a gadget. The wizard Gadget Configuration opens.
3. Select the Type. Other contains the descriptive gadgets, the Bookmarks gadget and the
Quick Wizards gadget.
4. Click on NEXT . The list Gadget displays the available gadgets of the selected type.
98
5. Select the gadget you want. If there is no gadget of this type yet, the list is empty.
7. In the list Available, double-click on the name of the dashboard you want the gadget to be
displayed on. The name is moved to the list Configured. You can select several dashboards
if you want.
8. Click on OK to commit your choice. The report opens and closes. The gadget is now displayed
on the selected dashboard(s).
Organizing Gadgets on a Dashboard

On any dashboard, you can organize the gadgets.
You can drag and drop the gadgets. The pointer changes shape and you can see the former
position of the gadget and how much space it takes up in the new spot.
Figure 6.23. Moving a gadget
You can also use the buttons in the drag bar to collapse and expand the gadgets.
Figure 6.24. Collapsing a gadget
Once collapsed, the gadget is displayed as a simple line containing only the gadget name and
the buttons. You can move a collapsed gadget.
Figure 6.25. An example of a collapsed gadget
You can hide the gadgets. Click on in the upper right corner of each gadget.
99
Hiding a gadget means that it is no longer visible on a given dashboard but it does not mean that
it has been deleted. To display it again, refer to the section Assigning Gadgets to a Dashboard.
Displaying or Hiding a Gadget from My Gadgets

From the page My Gadgets, you can choose to display or hide a gadget on a particular dashboard.
If you want to hide a gadget from several dashboards at once, refer to the section Enabling or
Disabling Gadgets.
To hide a gadget from the page My Gadgets
3. Once you found the gadget you want to hide, in the column Status, click on Visible. The
wizard Disable Gadget opens.
4. Click on OK to commit your choice. The report opens and closes. The gadget is marked as
Hidden and no longer visible on the dashboard.
To display a gadget from the page My Gadgets
3. Once you found the gadget you want to display, in the column Status, click on Hidden. The
wizard Enable Gadget opens.
4. Click on OK to commit your choice. The report opens and closes. The gadget is marked as
Visible and displayed on the dashboard it was assigned to.
Editing Gadgets
You can edit some gadgets:
• The gadgets Top list, Quick Search and Quick Wizards can be edited from the dashboard
they are displayed on. The gadgets Top List and Quick Search can also be edited from their
properties page.
• The gadget Bookmarks can be edited from the page My Bookmarks.
Any other type of gadget cannot be edited, you have to create a new gadget again and delete
the one you no longer need.
Editing a Top List Gadget

You can edit a Top List either from one of the dashboards it is displayed on or from its properties
page.
Any changes performed on a Top List apply to all the dashboards it is displayed on.
100
To edit a Top List from a dashboard
1. Go to the dashboard where the Top List is displayed.

2. If the gadget is collapsed, expand it using .
3. Click on , the wizard Edit a Top List opens.
4. Edit the fields Name, Dashboard, Columns, Selected columns and Limit according to your
needs.
5. Click on OK to commit your changes. The report opens and closes. The gadget content is
now updated.
To edit a Top List from its properties page
3. Filter the column Type to only display Top Lists.
4. At the end of the line of the gadget that suits your needs, click on . The properties page
opens.
5. In the panel Main properties, click on EDIT . The wizard Edit a Top List opens.
6. Edit the fields Name, Dashboard, Columns, Selected columns and Limit according to your
needs.
now updated.
Editing a Quick Search Gadget

You can edit a Quick Search gadget either from one of the dashboards it is displayed on or from
its properties page.
Any changes performed on a Quick Search apply to all the dashboards it is displayed on.
To edit a Quick Search from a dashboard
1. Go to the dashboard where the Quick Search is displayed.

3. Click on , the wizard Edit a Quick Search opens.
4. Edit the fields Name, Dashboard, Columns and Selected columns according to your needs.
now updated.
To edit a Quick Search from its properties page
3. Filter the column Type to only display Quick Search gadgets.
4. At the end of the line of the gadget that suits your needs, click on . The properties page
opens.
101
5. In the panel Main properties, click on EDIT . The wizard Edit a Quick Search opens.
6. Edit the fields Name, Dashboard, Columns and Selected columns according to your needs.
now updated.
Editing a Quick Wizards Gadget

You can edit a Quick Wizards gadget from one of the dashboards it is displayed on. Once you
created a gadget Quick Wizards you can edit the shortcuts it contains through on the button
in the gadget drag bar. Keep in mind that you can also edit empty quick wizard gadgets if you
click on the message The gadget is empty to edit the gadget content.
Any changes performed on a Quick Wizards gadget apply only to the dashboard you edited.
To edit a Quick Wizards gadget from a dashboard
1. Go to the dashboard where the Quick Wizards gadget you want to edit is displayed.
3. Click on , the wizard Edit a Quick Wizards gadget opens.
4. Edit the gadget content:
a. The list Available contains all the existing quick wizards that are not yet displayed in
the gadget.
b. Select the quick wizards one by one and click on to move them to the list Configured.
All the quick wizards listed in this field are displayed in the gadget.
c. Repeat these actions for as many quick wizards as needed. To remove quick wizards
from the gadget, select them in the list Configured and click on .
5. Click on OK to commit your configuration. The report opens and closes. The quick wizard is
visible in the Quick Wizards gadget.
Editing the Bookmarks Gadget

From the page My Bookmarks, you can edit the Bookmarks gadget, that is to say add or remove
bookmarks from this shortcut gadget.
Any changes performed on the Bookmarks gadget apply to all the dashboards it is displayed on.
To add a bookmark to the Bookmarks gadget from My bookmarks
1. From anywhere in the appliance, in the menu select Preferences > My Bookmarks The page
My Bookmarks opens.
2. Click on the name of the bookmark you want to add to the gadget. The wizard Edit a Book-
mark opens.
3. Tick the box Add to the gadget Bookmarks. The bookmark is added to the the Bookmarks
gadget.
4. Click on OK to commit your changes. The report opens and closes. The bookmarks added
to the gadget named Bookmarks are marked with a yellow star.
102
To remove a bookmark from the Bookmarks gadget from My bookmarks
1. From anywhere in the appliance, in the menu select Preferences > My Bookmarks. The
2. Click on the name of the bookmark you want to remove. The wizard Edit a Bookmark opens.
3. Untick the box Add to the gadget Bookmarks.The bookmark is removed from the Bookmarks
gadget.
4. Click on OK to commit your modification. The report opens and closes. The bookmark is no
longer visible in the Bookmarks gadget on any dashboard.
Granting Other Users Access to the Gadgets

Only users of the group admin can grant access to the gadgets to other users or manage the
visibility of the gadgets they created.
Standard users can create, edit or delete their gadgets, if their group is granted the proper per-
missions, but they cannot set the visibility of their gadgets.
Configuring Read-Write Access to a Group

Users can only manage the gadgets if the group of users they belong to is granted the relevant
rights.
Only users of the group admin can grant or deny access to gadget related rights.
To grant access to the gadget related options to a group
1. Go the Administration tab. If the homepage is not displayed, click on . The dashboard
opens.
2. In the section System, click on Users, Groups & Rights. The page Users opens.
3. In the breadcrumb, click on Groups. The page Groups opens.
4. At the end of the line of the group of your choice, click on . The properties page opens.
5. If need be, open the panel Administration using .
6. When the panel is open, click on EDIT . The wizard Edit group access opens.
7. In the list Unauthorized services, select a gadget related option (they are preceded by
Bookmarks or Gadgets).
8. Click on . The option is listed in the list Authorized services.
9. Repeat these steps for all the gadget related options.
10. Click on OK to commit the modification. The report opens and closes. The list Permissions
is now updated in the panel.
Do not forget to include users to the group. For more details regarding user permissions refer to
the part Rights Management.
103
Setting Gadgets Visibility

On the page Gadgets Library, the column All users indicates if a gadget is visible to every user
or not. All the users of the group admin can make gadgets to all the users or only to them.
The gadget visibility has some specificities:
• The superuser ipmadmin can see all the gadgets no matter who created them or their visibility
configuration.
• The gadgets displayed by default on the dashboard of the modules Device Manager and
NetChange are visible to anyone with read-write access. For more details, refer to the section
Gadgets Displayed by Default.
• The gadgets displayed by default on the main dashboard are only visible for ipmadmin who
can change their visibility and make them visible to all users. For more details refer to the
section Gadgets Displayed by Default.
• You cannot change the visibility setting of the descriptive gadgets, General information and
System information, they are by default visible to every user granted access to gadgets.
To share a gadget
Library.
2. Tick the gadget you want to make visible to all the other users. You can tick several items.
3. In the menu Edit, select Visible to all users > Set. The wizard Gadget visibility opens.
4. Click on OK . The report opens and closes. In the column All Users, the gadget is marked
Yes.
To make a gadget visible only to you
Library.
2. Tick the gadget you want to make visible only to you. You can tick several items.
3. In the menu Edit, select Visible to all users > Unset. The wizard Gadget visibility opens.
4. Click on OK . The report opens and closes. In the column All Users, the gadget is marked
No.
Enabling or Disabling Gadgets

Enabling or disabling a gadget allows to hide of display a gadget no matter on how many dash-
boards it is displayed on:
• If you disable a gadget, you remove it from all the dashboards it has been displayed on at
once. It does not delete it, the gadget is still listed on the pages Gadgets Library and My Gadgets
but marked Disabled in the column Status.
• If you enable a gadget you previously disabled, you make it visible again on all the dashboards
it is assigned to.
104
You can only enable or disable a gadget from the page Gadgets Library via the listing itself or
the menu.
To enable/disable a gadget from the list
Library. The Gadgets Library opens.
3. To enable a gadget, in the column Status, click on Disabled. The Enable Gadget opens.
4. To disable a gadget, in the column Status, click on Enabled. The Disable Gadget opens.
5. Click on OK to commit your choice. The report opens and closes. The gadget is marked
Enabled or Disabled. If you disabled a gadget, it is no longer visible on the dashboards it
was assigned to. If you enabled a gadget, it is visible on the dashboards it was assigned to.
To enable/disable gadgets through the menu
3. Tick the gadget(s) your choice.
4. In the menu, select the Edit menu > State > Enable or Disable. The wizard opens.
5. Click on OK to commit your choice. The report opens and closes. The gadget is marked
Enabled or Disabled. If you disabled a gadget, it is no longer visible on the dashboards it
was assigned to. If you enabled a gadget, it is visible on the dashboards it was assigned to.
Deleting Gadgets
You can only delete gadgets from on the page Gadgets Library. Deleting a gadget removes it
from the appliance altogether and no matter on how many dashboards it is displayed.
To delete gadgets
2. Tick the gadget you want to delete. You can tick several gadgets if need be.
4. Click on OK to commit the deletion.The report opens and closes.The gadget is now removed
from the dashboard(s) it was displayed on and from the pages Gadgets Library and My
Gadgets.
105
Part II. System Configuration
Before managing your network, your administrator needs to configure your appliance from the module Ad-
ministration.
This part details all the available system configurations needed to set up SOLIDserver, they are divided as
follows:
• Network Configuration: describes all the options that allow integrating the appliance to your network. It
allows to define or edit your appliance IP address, hostname, DNS resolver, firewall or even set up routes,
VIPs, VIFs, etc.
• Services Configuration: describes all the services and servers that you can configure and/or manage from
SOLIDserver: SSH, NTP, HTTP, DNS, DHCP, etc.
• License Management: describes how to request and activate the license you purchased.
Note that the module Administration provides extra pages and features all described in the parts Adminis-
tration and Customization.
Chapter 7. Network Configuration
This chapter details the page Network configuration where you can configure the settings neces-
sary to run SOLIDserver on your network, including:
1
• Setting the Hostname: the Fully Qualified Domain Name (FQDN) of SOLIDserver appliance.
It is used to name the local SOLIDserver in the management GUI.
• Setting the DNS Resolver: the address of the DNS that SOLIDserver uses to resolve names
and addresses that it manages.
• Setting the Firewall: SOLIDserver embedded firewall to reinforce its security by blocking potential
dangerous communications.
• Setting up the Default Gateway: the gateway address that SOLIDserver uses to reach networks
out of its domain's broadcast.
• Setting up Specific Routes: allow to set a specific path for the returned packets.
• Setting up Static Routes: enable data to be forwarded through the network with fixed paths.
• Configuring Basic IP Addressing on an Interface: allow to set an IP address on an interface.
2
• Setting up a VLAN Interface Setting up a VLAN Interface: allow to configure a physical interface
as an 801.1Q interface.
• Setting up an Ethernet Port Failover: allows aggregation of multiple network interfaces as one
virtual interface in order to provide fault-tolerance and high-speed links.
3
• Configuring a VIP Configuring a VIP: Ability to set up IP address that is not connected to a
specific computer or network interface card on a computer. Incoming packets are sent to the
VIP address, but all packets travel through real network interfaces.
4
• Setting up a VIF Setting up a VIF: It is a powerful EfficientIP concept allowing to add, into a
VIF, a configuration of physical interface embedding many services (for instance: VLAN, Eth-
ernet port failover, VIP).
• Configuring a Media Interface: Set the option supported by the physical interface.
During the network configuration, keep in mind that:
• All the services must be set at the same time to prevent any management problems. For
more details, refer to the procedure To set your appliance time zone and/or date format and
to the section Configuring the NTP Server.
• The drop-down list SOLIDserver allows to manage the network configuration of the appliances
configured in high availability or remotely managed. For more details, refer to the chapters
High Availability Management and Remote Management of Other Appliances.
1
The FQDN is the name of the host concatenated with the domain name.
2
Virtual Local Area Network (VLAN) is a group of hosts with a common set of requirements that communicate as if they were attached
to the same broadcast domain, regardless of their physical location.
3
Virtual IP (VIP).
4
Virtual Interface (VIF).
107
Network Configuration
Configuring Basic IP Addressing on an Interface

Multiple IP addresses can be configured on a single VIF. Configuring multiple IP addresses on
a VIF can be helpful in different scenarios, such as DNS server migration. Configuring multiple
IP addresses of existing DNS servers to a single VIF enables administrators to provide continuous
service during server migration or High Availability of the service through different appliances.
By default, an existing VIF (called DEFAULT_INTERFACE) is already applied in the system, you
can use this one or create a new one. In order to apply a new one, refer to the section Setting
up a VIF.
Keep in mind that the overlap of IP addresses linked with different physical interfaces is
not allowed in order to avoid asymmetrical routing. Indeed, if a packet is received from a phys-
ical interface it must not be forwarded to another one.
To set up a Basic Interface Configuration
1. Go to the Administration tab. If the homepage is not displayed, click on . In the breadcrumb,
click on Network configuration.
2. Click on the link DEFAULT_INTERFACE. The wizard Virtual network interface configuration
opens.
3. In the field Virtual interface name, you can rename the default interface if you want.
4. In the list Available physical interfaces, select the available interface, it is named after the
physical port and port MAC address as follows: eth# (##:##:##:##:##:##) and click on . It
is now listed in the field Physical interfaces.
5. Click on NEXT . The next page opens.
If you selected at least two Physical interfaces, in the drop-down list LAGG procotol you can
select failover or LACP. By default, failover is selected. Click on NEXT .
Note that a successful LAGG configuration requires interfaces with the same speed and
duplex and you can only configure LACP on appliances in version 6.0.2 or higher.
6. Fill in the interface IPv4 address configuration parameters following the table below:
Table 7.1. IPv4 virtual network interface configuration parameters

Parameter Description
IP address Type in the interface IP address. This field is mandatory.
Netmask Type in the interface netmask. This field is mandatory.
Specific route This field allows Setting up Specific Routes (setting up source routing) if necessary.
The specified route is dedicated to the IP address.
Once all the parameters needed are configured, click on ADD . The new IP address is now
listed in the field IP addresses list. You can add multiple IP addresses. SOLIDserver can
be accessed through all the IP addresses configured on this VIF.
• To update an entry, select a configured IP address, change the needed data and click on
UPDATE .
• To delete an entry, select a configured IP address and click on DELETE .
• To discard the latest modifications, click on CANCEL .
108
7. Click on NEXT . The last page of the wizard opens. Fill in the interface IPv6 address configur-
ation parameters following the table below:

IPv6 address Type in the interface IP address. This field is mandatory.
Prefix Type in the interface prefix. This field is mandatory.
Once all the parameters needed are configured, click on ADD . The new IP address is moved
to the IPv6 addresses list. You can add multiple IP addresses. SOLIDserver is accessible
through all the IP addresses configured on this VIF.
8. Click on OK to commit your configuration. If you configured LAGG, the protocol you chose
is displayed in the column Configuration.
9. Right now your configuration is pending. In the menu, select Tools > Apply configuration
to save your changes or Tools > Rollback configuration to discard them.
Make sure that at least one interface is available, otherwise, you would lose your
current connection to SOLIDserver.
Setting the Routing

With SOLIDserver you can configure routing on your network by:
• Setting up the Default Gateway, to forward SOLIDserver outgoing traffic.

• Setting up Specific Routes, to set a path for returned packets.
• Setting up Static Routes, to forward data to another subnet.
Setting up the Default Gateway

A gateway is a node on a TCP/IP network that is used as an access point to another network.
The default router is the gateway used by SOLIDserver that forwards traffic to remote subnets
on behalf of a sending host or router. Only one default router can be configured for the entire
appliance in each version of the IP protocol. For security reasons, SOLIDserver does not route
packets between network interfaces.
Keep in mind that the default gateway is only used if a packet is sent from a network address
unknown to SOLIDserver. For some networks, you might want to use route sourcing and set up
a specific route to send the response packet to the sender through the channel it came from
rather than using the default gateway to try and locate the sender. For more details, refer to the
section Setting up Specific Routes.
To configure the default gateway
2. Click on the link Default gateways in the network configuration listing. The wizard Edit the
default gateways opens.
3. In the field IPv4 default gateway, fill in the IPv4 gateway of your choice.
4. In the field IPv6 default gateway, fill in the IPv6 gateway of your choice.
109
5. Click on OK to commit your changes.

to save your changes or Tools > Rollback configuration to discard them. The corresponding
wizard opens, click on OK to confirm your choice.
Setting up Specific Routes

Setting up specific routes allows to configure source routing on your network for IPv4. Without
specific routes, once a packet is sent from a subnet that has not been configured among
SOLIDserver network interfaces, the response packet is returned through the default gateway
and might, depending on your network architecture, never get back to the sender (asymmetric
routing issue). In other words, setting up a specific route allows to specify the route for the return
packet. Once a specific route is configured, its address is preferred to the default gateway for
the return packets.
Keep in mind that the DHCP does not take into account the specific route. Therefore, the man-
agement IP address a DHCP server should always be on the same network as the default gateway.
Within SOLIDserver, you can set up several specific routes. To configure a specific route, refer
to the procedure To set up a Basic Interface Configuration.
Setting up Static Routes

If it is necessary, SOLIDserver allows you to add static routes. These routes allow you to commu-
nicate with another network(s) and to forward data through a fixed path.
To configure static routes (Add/Edit/Delete)
2. Click on the link Static routes. The page Static Routes (IPv4) opens.
Table 7.3. IPv4 static route configuration parameters

Route name Name the static route. This field is mandatory.
IP address Type in the static route IP address. This field is mandatory.
Netmask Depending on the IP address you typed in above, you might have a list of netmasks
to choose from. The netmask you choose automatically selects the corresponding
prefix. This field is mandatory.
Prefix Depending on the IP address and selected netmask, a prefix is automatically selected.
If you choose a different prefix, the netmask is modified accordingly. This field is op-
tional.
Gateway Type in the gateway you want to use with the static route. This field is mandatory.
Once all the parameters needed are configured, click on ADD . The static route is now listed
in the list Static routes. You can add multiple static routes.
• To update an entry, select an existing static route, change data and click on UPDATE .
• To delete an entry, select an existing static route and click on DELETE .
110
3. Click on NEXT . The page Static routes (IPv6) opens. Follow the step 4 to configure an IPv6
static route.
4. Click on OK to commit your configuration.
Setting the Hostname

The hostname is applied to SOLIDserver itself.That name is generally used to identify appliances
between them.
To configure an appliance hostname
2. Click on the link Hostname in the network configuration listing. The wizard Edit the hostname
opens.
3. In the field Hostname, name your hostname with a valid FQDN. By default, every appliance
is named solid.intranet.
Setting the DNS Resolver

The DNS resolver is the default DNS server that SOLIDserver uses to resolve local names.
Several modules like IPAM, NetChange and DNS Manager use the DNS resolver to find IP ad-
dresses' FQDN or to resolve an FQDN IP address.
To configure DNS resolvers (Add/Edit/Delete)
2. Click on the link DNS Resolvers. The wizard Edit DNS resolvers opens.
3. In the field DNS server IP address, type in the IP address of the server of your choice and
click on ADD .
4. Click on ADD . The IP address is now moved to the list DNS Resolvers.
5. Repeat these operations for as many resolvers as needed. If you have several resolvers
use the and buttons to order the list according to your needs.
• To update an entry, select a DNS resolver, change the needed data and click on UPDATE .
• To delete an entry, select a DNS resolver and click on DELETE .
111

Setting the Firewall

5
SOLIDserver embeds a restrictive stateful firewall for securing flows. SOLIDserver firewall uses
the legacy stateless rules and a legacy rule coding technique to achieve what is referred to as
Simple Stateful logic.
SOLIDserver stateful filtering treats traffic as a bi-directional exchange of packets comprising a

session conversation. It has the matching capabilities to determine if the session conversation
between the originating sender and the destination are following the valid procedure of bi-direc-
tional packet exchange. Any packets that do not properly fit the session conversation template
are automatically rejected. SOLIDserver allows firewall messages filing making it possible to review
after the fact information such as: which packets have been dropped, from which addresses they
came from and where they were going, giving you significant capacity to track down attackers.
SOLIDserver supports Stateful Packet Inspection (SPI) mode that helps preventing network attacks
by tracking more state per session.
Enabling or Disabling the Firewall

By default, SOLIDserver firewall is Restricted, i.e. enabled, and all the firewall rules set are re-
spected and enforced in order.
At any time, you can Open the firewall, to disable it, and ignore all these rules.
To open or restrict the firewall
2. In the column Configuration, in the line Firewall can be Restricted or Open.
3. Click on the current state to change it. The wizard Firewall state configuration opens.
4. Click on OK to commit your modification. The firewall is marked Open or Restricted.
Adding a Firewall Rule

Before adding or editing firewall rules, you need to understand a few concepts:
Precedence
It is a key concept in the firewall rule configuration. It corresponds to a number specified in
the Firewall rule wizard. All the parameters that you configure (action, protocol, from, to, port,
5
State full Packet Inspection, also known as dynamic packet filtering.
112
via, log and keep state) in the wizard set up a distinct set of conditions that, if matched, is
dealt with respecting the order set in the field Position. Therefore it is paramount to understand
that if for instance you set two firewall rules regarding the ipv4/ipv6 protocol from a DNS
server A to a DNS server B through the port 53 via em0, and one denies access whereas
the other accepts it, the rule that prevails is the one set with the smallest position number of
the two in the field Position.
Firewall rules
The firewall being restrictive, as opposed to permissive, the last position (65535) denies access
to any kind of packets no matter what protocol or where it goes or comes from. Which is why
EfficientIP has configured a number of firewall rules, they are all listed on the page Firewall
rules. On this page you can edit a number of preexisting rules and the ones you create: the
underlined rules in the column Position can be edited, all the others cannot. For technical
reasons, the positions 1 - 99 are reserved by EfficientIP and users cannot use any of them
when creating rules or editing rules. The position 65535 cannot be used either.
To add a firewall rule
1. Make sure you understand the Precedence and Firewall rules.

3. In the breadcrumb, click on Firewall rules. The page opens.
4. In the menu, select Add > Rule. The Firewall rule configuration wizard opens, fill in all the
required parameters following the table below:
Table 7.4. Firewall rules parameters

Position Set the rule precedence using a number between 100 and 65534. For more details,
refer to the paragraphs Precedence and Firewall rules above.
Action Define what action should be executed when a packet matches the selection criterion
of the rule. For each rule you can:
allow: packets matching the defined criterion. The rule exits the firewall rule processing.
The search terminates at this rule.
deny: packets matching the defined criterion. The packets are discarded. The search
terminates.
Protocol In this drop-down list, choose the protocol used for that rule. These protocols will
handle IPv4 and/or IPv6 protocols.
From Define the source parameters. The fields From and To work together, so you must
specify either two IPv4 addresses or two IPv6 addresses, you cannot mix the protocol
versions. Accepted values are:
me: a special keyword that matches any IP address configured on an interface in
SOLIDserver.
any: a special keyword that matches any IP address.
<IP-address> specified with mask-length following the format: x.x.x.x/x or xxxx::/x .
<IP-address> specified without mask-length following the format: x.x.x.x or xxxx:: .
Source port Define the source port on which the firewall rule should be applied. Use a comma to
separate several port numbers.
To Define the destination parameters. The fields From and To work together, so you must
specify either two IPv4 addresses or two IPv6 addresses, you cannot mix the protocol
versions. Accepted values are:
113
me: a special keyword that matches any IP address configured on an interface in
SOLIDserver.
any: a special keyword that matches any IP address.
<IP-address> specified with mask-length following the format: x.x.x.x/x or xxxx::/x .
<IP-address> specified without mask-length following the format: x.x.x.x or xxxx:: .
Destination port Define the destination port on which the firewall rule should be applied. Use a comma
to separate several port numbers.
Via Set the interface the packets should go through.The via parameter causes the interface
to always be checked as part of the match process. By default, nothing is selected.
Log Choose to save, or not, the log parameter indicating if a packet matches a rule in
SOLIDserver syslog page (it is saved with a facility SECURITY name). By default, No
is selected.
Keep state Decide if you want SOLIDserver firewall to create a dynamic rule, upon match, whose
default behavior is to match bidirectional traffic between source and destination IP/port
using the same protocol. By default, No is selected.

Editing a Firewall Rule

You can edit the firewall rules you added. Before editing a rule, make sure you understand the
Precedence and Firewall rules detailed in the section Adding a Firewall Rule.
To edit a firewall rule
1. Make sure you understand the Precedence and Firewall rules.

4. In the column Position, click on the underlined number corresponding to the rule you want
to edit. The wizard Firewall rule configuration opens.
5. Edit the parameters according to your needs, following the information described in Firewall
rules parameters procedure above.
Deleting a Firewall Rule

Any firewall rule can be deleted, except the rule 65535.
Keep in mind that firewall rules must not be deleted lightly. For instance, the rule #34 is a
delicate rule to delete as it refers to fragmented IP packets. As there is a maximum packet size
114
for transport level that depends on the transport medium (1500 bytes for Ethernet), if the IP
packet is larger than this, it needs to be broken up into fragments that get reassembled at the
destination. Without the rule #34, fragmented IP packets will be blocked by the firewall.
To delete a firewall rule
3. Tick the firewall rule you want to delete.
Setting up a VLAN Interface

On the page Network configuration, you can set up a VLAN interface using the VIF configuration
wizard. By default, a VIF (called DEFAULT_INTERFACE) is already created in the network
configuration, you can use this one or create a new one. To do so, refer to the section Setting
up a VIF.
Note that to avoid asymmetrical routing, you cannot link overlapped IP addresses to different
physical interfaces. This way, if a packet is received from a physical interface it cannot be for-
warded to another interface.
To set up a VLAN interface configuration
2. Click on the name of the interface you want to configure (all interfaces are preceded by an
orange dot). The wizard Virtual network interface configuration opens.
6. Fill in the interface IPv4 addresses configuration parameters following the table below:
115

IP address Type in the interface IP address. It should correspond to one of the VLAN configured
on your network. This field is mandatory.
802.1q tag number Type in the VLAN number of your choice (between 1 and 4094). This tag can be
common to different appliances and differentiate them from other IP addresses on the
VLAN: packets sent to the VLAN with the same tag are only received by these appli-
ances.
listed in the field IP addresses list. You can add multiple IP addresses. The IP determines
to which configured VLAN they belong and the tag provides a more accurate filter.
UPDATE .

IPv6 address Type in the interface IP address. It should correspond to one of the VLAN configured
on your network. This field is mandatory.
Specific route You can apply a Specific route (set up source routing) if necessary. This route is
dedicated to the IP address.
802.1q tag number Type in the VLAN number of your choice (between 1 and 4094). This tag can be
common to different appliances and differentiates them from other IP addresses on
the VLAN: packets sent to the VLAN with the same tag are only received by these
appliances.
to the IPv6 addresses list. You can add multiple IP addresses, the IP determines to which
configured VLAN they belong and the tag provides a more accurate filter.
UPDATE .
116
Setting up an Ethernet Port Failover

The Ethernet Port Failover is an ability of the network system to have 2 or more physical interfaces
configured with one (or more) IP address access. To sum up, Ethernet Port Failover interface
ensures a high SOLIDserver accessibility (if one of the physical interfaces is disconnected, the
system is still available). By default, an existing VIF (called DEFAULT_INTERFACE) is already
applied in the system, you can use this one and create others to set up a failover. For more details
regarding interface addition, refer to the section Setting up a VIF.
To configure an Ethernet Port Failover Interface Configuration
4. In the list Available physical interfaces, select two or more interfaces one by one and click
on . They are now listed in the field Physical interfaces.

listed in the field IP addresses list.
UPDATE .
117

Specific route You can apply a specific route (set up source routing) if necessary. This route is
dedicated to the IP address.
to the IPv6 addresses list.
UPDATE .
Configuring a VIP
By default, an existing VIF, called DEFAULT_INTERFACE, is already applied in the system, you
can use this one or create a new one. In order to apply a new one, refer to the section Setting
up a VIF.
SOLIDserver allows you to set up virtual IP addresses (VIP) on supported services. This mech-
anism, known as Common Address Redundancy Protocol (CARP) is a protocol which allows
multiple EfficientIP devices on the same local network to share a single IP addresse or the same
set of addresses. Its primary purpose is to provide failover redundancy. For example, if there is
a single SOLIDserver running a DNS service and it goes down, then, the networks on each side
of the DNS service can no longer communicate with each other, or, they communicate without
any DNS service. However, if there are two EfficientIP devices running CARP, if one fails, the
other can take over with SOLIDserver on either side of the DNS service not being aware of the
failure. Operations continue as normal. Note that through a VIP you can manage DNS smart ar-
chitectures Master/Slave and Multi-Master.
The general idea is to have a single IP address, and several physical servers behind. In the case
of a failure, the next available server takes the lead and provides the relevant services. This
mechanism is available for DNS, NTP, TFTP services and SOLIDserver management.
Please note that, when using virtual appliances, the VMware ESXi host vSwitch must be configured
with the Promiscuous mode option enabled and the option Net.ReversePathFwdCheckPromisc
set to 1.
To configure a VIP
118

Specific route This field allows Setting up Specific Routes (setting up source routing) if necessary. The
specified route is dedicated to the IP address.
VIP service You can select DNS server, NTP server, TFTP server or SOLIDserver management. By
default, None is selected.
DNS server
The IP address is dedicated to the service you select.
NTP server
Selecting one of these services displays the fields VHID, Password and Priority.
TFTP server
SOLIDser ver Selecting this service allows you to access the appliances configured in High Availability
management through the IP address configured above. This virtual IP address only gives you access to
the Master appliance. For more details, refer to the chapter High Availability Management.
a
Selecting this service server displays the fields VHID and Password .
VHID Type in the Virtual Host IDentification if you are setting up the High Availability of the selected
service. This VHID must be a number between 1 and 255 and it has to be the same on the
appliances through which you set the service High Availability.
Password Type in the password of your choice if you are setting up the High Availability of the selected
service. This password has to be the same on the appliances set in high availability.
Priority You can set the appliance priority to Low, Medium or High. In other words, you can decide
which appliance has the priority over a service.
a
Unlike the other services, the Priority of SOLIDserver management cannot be modified: the Master always has
priority over the Hot Standby.
These fields allow to set up the availability of the DNS, NTP, TFTP or SOLIDserver
management services as long as both appliances belong to the same LAN (layer 2) and
both appliances are set with the exact same parameters in all the fields EXCEPT for the
Priority. To avoid any conflict, you must set one priority level for the first appliance and a
different one on the other.
listed in the field IP addresses list. You can add multiple IP addresses. SOLIDserver is ac-
cessible through all the IP addresses configured on this VIF.
119
UPDATE .

Specific route You can apply a specific route (set up source routing) if necessary. This route is dedicated
to the IP address.
VIP service You can select one of four services: the DNS server, NTP server or TFTP server. By default,
None is selected.
DNS server
The IP address is dedicated to the service you select.
NTP server
Selecting one of these services displays the fields VHID, Password and Priority.
TFTP server
VHID Type in the Virtual Host IDentification if you are setting up the High Availability of the selected
service. This VHID must be a number between 1 and 255 and it has to be the same on the
appliances through which you set the service High Availability.
Password Type in the password of your choice if you are setting up the High Availability of the selected
service. This password has to be the same on the appliances set in High Availability.
Priority You can set the appliance priority to Low, Medium or High. In other words, you can decide
which appliance has the priority over a service.
These fields allow to set up the availability of the DNS, NTP, TFTP services as long as
both appliances belong to the same LAN (layer 2) and both appliances are set with the exact
same parameters in all the fields EXCEPT for the Priority. To avoid any conflict, you must
set one priority level for the first appliance and a different one on the other.
to the IPv6 addresses list. You can add multiple IP addresses. SOLIDserver is accessible
through all the IP addresses configured on this VIF.
UPDATE .
120
Setting up a VIF
A VIF (Virtual Interface) allows to set a number of configurations in a virtual container. Via this
container you can apply or edit a network configuration including embedded services. Keep in
mind that while the procedures below detail how to create, edit or delete a VIF from the page
Network configuration, during each procedure you need to make sure that you have at least one
operating interface connected to SOLIDserver or you might lose your point of access, and
therefore be unable to manage the appliance.
To add a VIF
2. In the menu, select Add > Virtual interface.
3. Configure the Virtual interface according to your needs. For more details, refer to the sections
Configuring Basic IP Addressing on an Interface, Setting up a VLAN Interface, Setting up
an Ethernet Port Failover and Configuring a VIP.
To edit a VIF
2. Click on the name of the interface you want to edit (all interfaces are preceded by an orange
dot). The wizard Configure network virtual interface opens.
3. Edit the Virtual interface according to your needs. For more details, refer to the sections
Configuring Basic IP Addressing on an Interface, Setting up a VLAN Interface, Setting up
an Ethernet Port Failover and Configuring a VIP.
To delete a VIF
2. Click on the name of the interface you want to delete (all interfaces are preceded by an orange
dot). The wizard Configure network virtual interface opens.
121
3. In the field Physical interfaces, select the interfaces to be deleted one by one and click on
. The physical interfaces, are now listed in the field Available physical interfaces.
4. Click on NEXT . The IPv4 address configuration is displayed.
5. In the IP addresses list, select the configured IP address(es) one by one. The configuration
fields appear.
6. Click on DELETE . The IP address is no longer listed in the field.
7. Click on NEXT . The IPv6 address configuration is displayed. Repeat the steps 5 and 6.
Configuring a Media Interface

By default, SOLIDserver automatically negotiates the optimal connection speed and transmission
type (full or half duplex) on the physical links between the 10/100Base-T and 10/100/1000Base-
T ports and the Ethernet ports on a connecting switch. It is usually unnecessary to change the
default auto-negotiation setting; however, you can manually configure connection settings for a
port if necessary.
Set the media interface
2. Click on the name of Physical interface of your choice (it is attached to a VIF or located
under the Unused interfaces). The wizard Network interface configuration opens.
3. In the drop-down list Media, select the speed and duplex to be applied to the physical interface
you clicked on. By default, the autoselect option is selected, it is automatically selected by
SOLIDserver according to your network configuration.
122
Chapter 8. Services Configuration
This chapter details the page Services configuration where you can configure the services em-
bedded in SOLIDserver:
1
• Configuring the SSH Remote Account : allows to connect from an SSH client to SOLIDserver.
2
• Changing the SFTP/SCP/RSYNC User Account Password : SOLIDserver embeds SFTP, SCP
and RSYNC protocol to allow the xfer account to use them respectively.
3
• Managing the TFTP Upload Authorizations : allows to deliver TFTP services in order to send
boot and configuration files to DHCP/BOOTP clients (such as IP phones, thin clients, bootless
stations).
4
• Configuring the SMTP Relay : is the host relay that SOLIDserver uses to send mails.
5
• Configuring the NTP Server : is the address of the Network Time Protocol (NTP) server that
it is used to update SOLIDserver timer.
• Managing the HTTPS Certificate: allows to handle SOLIDserver Apache certificates.
• Handling Services: allows to enable/disable and start/stop all the services embedded in
SOLIDserver.
• Downloading the DNS/DHCP/DHCPv6 Configuration File: allows to retrieve all DHCP and DNS
configuration files.
• Managing the SNMP Service: allows to monitor SOLIDserver performances and load through
the SNMP protocol.
In addition, you can configure the listening interfaces and enable the service DNS Guardian if
your license includes it. For more details, refer to the section Configuring DNS Guardian.
During the services configuration, keep in mind that:
• All the services must be set at the same time to prevent any management problems. For
more details, refer to the procedure To set your appliance time zone and/or date format and
to the section Configuring the NTP Server.
• The drop-down list SOLIDserver allows to manage the network configuration of the appliances
configured in high availability or remotely managed. For more details, refer to the chapters
High Availability Management and Remote Management of Other Appliances.
1
SSH stands for Secure Shell.
2
SFTP stands for Secure File Transfer Protocol also known as SSH File Transfer Protocol. SCP stands for Secure Copy. RSYNC
stands for Remote Synchronization.
3
TFTP stands for Trivial File Transfer Protocol.
4
SMTP stands for Simple Mail Transfer Protocol.
5
NTP stands for Network Time Protocol.
123
Services Configuration
Handling Services
SOLIDserver allows you to completely disable a network service. While a network service is
disabled, it cannot run. Once a network service is enabled, its state is automatically updated after
having applied the configuration. To sum up, a user can easily handle the embedded services:
enabling/disabling and starting/stopping every service provided by SOLIDserver.
Enabling or Disabling a Service

Before enabling or disabling a service, keep in mind that this operation impacts the service:
• Disabling a service automatically stops it.

• Enabling a service automatically starts it
To enable/disable a service
click on Services configuration.
2. In the column Name, look for the service of your choice.
3. In the column Enabled:
a. Click on the link Disabled to enable the service. The wizard opens.
b. Click on the link Enabled to disable the service. The wizard opens.

Starting or Stopping a Service

Before starting or stopping a service, keep in mind that:
• Once a service is disabled, it cannot be started.

• A disabled service is automatically stopped, so you can only stop an Enabled service.
To start/stop a service
2. In the column Name, look for the service of your choice.
3. In the column Running:
a. Click on the link Stopped to start the service. The wizard opens.
b. Click on the link Started to stop the service. The wizard opens.
124
Configuring the SSH Remote Account

SOLIDserver can be accessed remotely through an SSH connection using the account admin if
you enabled the SSH remote console access for SOLIDserver administration. For more details
regarding how to enable/disable it, refer to the section Handling Services.
By default, the account admin is set with the password is set to admin. This account cannot be
edited but its password and the password level of security can be edited, as detailed in the sections
below.
On the appliance, an SSH shell session is available on SOLIDserver file system. If you update
configuration files directly, you can disturb or prevent SOLIDserver from running. Only adminis-
trators should use this configuration mode, by default admin is the only account that can access
SOLIDserver via SSH.
Keep in mind that you can configure SOLIDserver to allow LDAP/RADIUS authentication for SSH
connections. For more details, refer to the appendix Using Remote Authentication for SSH Con-
nections to SOLIDserver.
Changing the SSH Remote Access Password

By default the admin account password is set to admin.
To change the SSH password
2. In the column Name, click on the link Account: admin. The wizard opens.
3. Fill in the password of your choice, in accordance with the level of security you chose, in the
fields New password and Confirm password.
Changing the SSH Password Level

SOLIDserver allows to set up the password security level of your choice on the services that use
a shell connection through a registry key. There are 3 levels of security:
1. Low: the password can contain any character and as few as you want. There is no password
restriction, you could set a password with one character.
2. Medium: the password requires at least 8 characters, it can be any character.
3. High: the password requires at least 8 characters, among which at least 2 must be digits and
at least 2 must be special characters (for example: !, #, @...).
To change the SSH password security level
125
1. Go to the Administration tab. If the homepage is not displayed, click on . The homepage
opens.
2. In the menu, click on System > Expert > Registry database.
3. In the search engine of the column Name, type in module.system.ssh_password. Only this
key is listed.
4. In the column Value, click on the digit link. The wizard Registry database Edit a value opens.
By default, the password level is set to 1.
5. Set the value of your choice, either 1 (low), 2 (medium) or 3 (high). For more details regarding
the levels, refer to the details above this procedure.
Changing the SFTP/SCP/RSYNC User Account Password

The xfer account manages the SFTP, SCP and RSYNC services. By default there is no password
applied to xfer account, so you need to set a password and activate the account to be able to
access these services through a shell connection.
To set the xfer account password
2. In the column Name, click on the link Account: xfer. The wizard opens.
3. In the field New password, type in the password of your choice, in accordance with the level
of security you chose.
4. In the field Confirm password, type in the password again.
The xfer account is not enabled and disabled like the services. Only one wizard allows to enable
and disable the account that manages the SFTP, SCP and RSYNC protocols.
To enable/disable the xfer account
2. In the column Enabled of the Account: xfer line, click on Disabled or Enabled. The wizard
opens.
3. Click on OK to commit your choice. The account is now marked as Enabled or Disabled.
Managing the TFTP Upload Authorizations

SOLIDserver allows to download and upload files through the Trivial File Transfer Protocol (TFTP).
From the GUI, you can enable or disable the service. For more details, refer to the section
Handling Services above.
126
From the page Services configuration, you can enable uploads from remote appliances to
SOLIDserver GUI. The uploaded files and files available for download are listed on a dedicated
page of the page Local files listing. For more details, refer to the section Managing Files from the
Local Files Listing.
To enable TFTP uploads to SOLIDserver
2. In the column Name, under TFTP server, click on the link Upload Authorization: Disabled.
The wizard TFTP File Upload Authorization opens.
3. Click on OK to commit your changes. The report opens and closes. The TFTP Upload Au-
thorizations status is now Enabled.
Once the uploads are enabled, following the procedure above disables them.
Configuring the SMTP Relay

SOLIDserver provides SMTP (Simple Mail Transfer Protocol) to allow you to add/edit the host
relay on emails directly sent through the appliance.
To configure an outgoing mail server
2. In the column Name, click on SMTP relay. The wizard SMTP Relay Configuration opens.
3. In the Outgoing mail server, fill in the valid FQDN or the IPv4 address of the server.
You can also change the source email address of the outgoing mails and alerts notifications.
To change the default source mail
2. In the column Name, under the Mail - SMTP line, click on Default source mail: noreply@ef-
ficientip.com. The wizard Source mail configuration opens.
3. In the field Default mail, type in the email address of your choice.
4. Click on OK to commit your changes. The new address has now replaced the default address
in the list.
127
To change the alert source mail
2. In the column Name, under the Mail - SMTP line, click on Alert source mail: noreply@effi-
cientip.com. The wizard Source mail configuration opens.
3. In the field Alert mail, type in the email address of your choice.
4. Click on OK to commit your changes. The new address has now replaced the default address
in the list.
Configuring the NTP Server

SOLIDserver requires the configuration of an NTP server for the DHCP failover, the SNMPv3
protocol, the DNSSEC mechanism, the Microsoft Active Directory management and the TSIG
zone transfer. You can use the address of a public or private NTP server, depending on your
needs. SOLIDserver supports multiple NTP servers with specific stratum. Stratum is a level that
defines the distance from the reference clock.
When configuring the NTP server, keep in mind that:
• You should configure at least 3 reference NTP servers for all the NTP clients on your network.
• The reference NTP servers must be reachable when you start the service.
• All the services must be set at the same time to prevent any management problems.
To configure NTP servers
2. Under the menu, in the drop-down list SOLIDserver, make sure the appliance of your choice
is selected.
3. In the column Name, click on the link NTP server. The wizard NTP Servers Configuration
opens.
4. Fill in the fields NTP address and Stratum. The address can be an IPv4 or IPv6 address.
5. Click on ADD to move the data in the list NTP servers.
• To update an entry, select the NTP server of your choice, change data and click on UPDATE .
• To delete an entry, select the NTP server of your choice and click on DELETE .

128
The NTP servers configuration wizard is also available from the Home page in the gadget
SOLIDserver Configuration Checklist.
At any time, you might need to force the time and date update of the NTP server (for instance
when managing two appliances in HA).
Keep in mind that updating the NTP server time and date restarts all the services that are
impacted by the server. Make sure that at least one NTP server is configured and reachable in
the meantime, otherwise, you might not be able to access your appliance at all.
To force an NTP update
2. Under the NTP server line, click on FORCE UPDATE. The wizard Force NTP update opens.
3. Click on OK to commit your choice.
Managing the HTTPS Certificate

During the first boot, SOLIDserver generates a self-signed certificate. It is used to make your
connection safe from eavesdroppers, but it is not trusted by your web browser as it is not signed
by a Certificate Authority (CA). For this reason, warning messages appear to inform you that the
certificate is not from a trusted certifying authority, that the hostname of the certificate is invalid,
etc. This connection can be prone to a man-in-the-middle (MITM) attack.
When you receive such warnings, you can accept the certificate just for the current session, save
it in the certificate store of your browser or authenticate SOLIDserver and eliminate the certificate
warnings altogether. To do so, you must:
• Importing an SSL Certificate or Creating an SSL Certificate through the GUI.

• Changing the HTTPS Certificate.
SOLIDserver manages X.509 (official and auto-signed SSL certificates), Private Key certificates
as well as the certificate signing requests (CSR).
The SSL certificate is unique to each SOLIDserver appliance. So if you want to use a certi-
ficate and you are managing remote appliances or appliances in High Availability: use the drop-
down list SOLIDserver to make sure you are setting each appliance with its own SSL certificate.
Importing an SSL Certificate

You can obtain a CA signed SSL certificate from any Certificate Authority trusted by your Internet
browser.
This certificate must respect the CRT format and must not contain any passphrase. If it
does, the HTTP protocol cannot start and you might lose the GUI access to your appliance.
You can upload to SOLIDserver if you respect the following:
1. Create a CSR through the GUI to require a certificate respecting the CRT format. For more
details, refer to the section Creating a CSR from the GUI below.
129
2. Once the CA sent you a certificate, you can upload it via a *.ZIP or a *.TAR archive file that
contains:
• The certificate that must respect the CRT format and be named "certificate" without extension.
• Your private key named "private_key" without extension.
3. Once your archive file respects the above requirements, you can upload it to SOLIDserver.
For more details, refer to the section Importing a Certificate to SOLIDserver below.
4. Once the archive is uploaded, you can use it as a new HTTPS certificate. For more details,
refer to the section Changing the HTTPS Certificate.
Creating a CSR from the GUI
You can create the CSR yourself or take advantage of SOLIDserver and the CSR creation ded-
icated wizard.
To create a CSR from the GUI
opens.
2. Click on Key ring. The list Key ring opens.
3. In the menu, select Display > Certificate. The page Authentication key ring opens. The
Apache SSL Cert Base is listed.
4. In the menu, select Add > SSL Certificate. The wizard Create an SSL object opens.
5. In the field Object Name, name your certificate.
6. In the drop-down list SSL File Type, select CSR File.
7. If you want to use an existing private key, follow the steps below. Otherwise, go to step 9.
a. Tick the box Use a previously generated private key. The field Use key appears.
b. In the drop-down list Use key, select one of your private keys or certificates or even the
default entry Apache SSL Key Base or request_auto_key.
8. If you do not want to use an existing private key:
a. In the drop-down list Encryption type, RSA is displayed in read-only.

b. In the field Encryption, type in the value of your choice. By default, 2048 is displayed.
9. Click on NEXT . The next page of the wizard opens.

10. Finish the file configuration.
a. In the field Country Code, type in the two letter code of your country.
b. In the field State or Province, type in the state, province or region name in full letters.
c. In the field Locality, type in the city name.
d. In the field Organization Name, type in your company name.
e. In the field Organization Unit Name, type in the name of the department final user among
the company.
130
f. In the field Common Name, type in the appliance hostname.

g. In the field Email address, type in your email address.
11. Click on OK to commit your creation. The report opens and closes. The CSR is listed on the
page All certificates.
Once the CSR is created, you need to send the certificate to the Certificate Authority.
To retrieve the needed CSR data before sending it to a CA
opens.
4. At the end of the line of the CSR, click on . The properties page opens.
5. In the panel Certificate, click on DOWNLOAD and save the file.
6. Send the file to the CA.
Once the CA sent you back a certificate that respects SOLIDserver requirements, you can upload
it.
Importing a Certificate to SOLIDserver
The certificate upload has to be done from the page Authentication key ring if it respects the fol-
lowing:
1. The CA signed certificate respects the CRT format.

2. The certificate is named "certificate" without extension.
3. The certificate does not include a passphrase. If it does, the HTTP protocol cannot start and
you might lose the GUI access to your appliance.
4. The certificate is included in a *.ZIP or a *.TAR archive file that also contains your private key,
named "private_key" without extension.
To import a CA signed SSL certificate
opens.
4. In the menu, select Tools > Import. The wizard Import an SSL certificate opens.
5. In the drop-down list Object type, select Certificate.
6. Click on BROWSE and look for the certificate. Once selected, it is visible in the field File name.
131
7. Click on OK to commit your import. The report opens and closes. The certificate is listed on
the page All certificates.
Once the certificate is listed on the page Authentication key ring, you can use it as HTTPS certi-
ficate. For more details, refer to the section Changing the HTTPS Certificate.
Creating an SSL Certificate

From the Authentication key ring of the Administration module, you can add an SSL certificate
yourself. The wizard allows to create a self-signed certificate, a CSR or a private key. This guide
details the creation of an X509 certificate, a self-signed certificate.
To create an SSL certificate
opens.
4. In the menu, select Add > Certificate. The wizard Create an SSL object opens.
5. In the field Object Name, name your certificate.
6. In the drop-down list SSL File Type, select X509 certificate.
7. If you want to use an existing private key, follow the steps below. Otherwise, go to step 9.
a. Tick the box Use a previously generated private key. The page Use key appears.
b. In the drop-down list Use key, select one of your private keys or certificates or even the
default entry Apache SSL Key Base or request_auto_key.
c. In the field Certificate Validity (days), edit the default number of days, 1825, if need be.
d. In the drop-down list Digest method, select None, SHA224, SHA256, SHA384, SHA512
or DSS1.
8. If you do not want to use an existing private key:
a. In the drop-down list Encryption type, RSA is displayed in read-only.

b. In the field Encryption, type in the value of your choice. By default, 2048 is displayed.
c. In the field Certificate Validity (days), edit the default number of days, 1825, if need be.
d. In the drop-down list Digest method, select None, SHA224, SHA256, SHA384, SHA512
or DSS1.

10. Finish the file configuration.
a. In the field Country Code, type in the two letter code of your country.
b. In the field State or Province, type in the state, province or region name in full letters.
c. In the field Locality, type in the city name.
132
d. In the field Organization Name, type in your company name.

e. In the field Organization Unit Name, type in the name of the department final user among
the company.
f. In the field Common Name, type in the appliance hostname.
g. In the field Email address, type in your email address.
11. Click on OK to commit your creation. The report opens and closes. The certificate is listed
on the page All certificates.
Once the certificate is created, you can use it to change the HTTPS certificate. For more details,
refer to the section Changing the HTTPS Certificate below.
Changing the HTTPS Certificate

Once you have an SSL certificate in your database, whether you added or imported it, you must
follow the procedure below to use it.
To choose an HTTPS certificate
2. Under the HTTP webserver line, click on the link SSL Certificate. The wizard Change the
current SSL certificate opens.
3. In the drop-down list SSL Certificate, select the certificate of your choice. By default, the
Apache SSL Cert Base is available and selected.
Configuring DNS Guardian

If your license includes DNS Guardian, you can configure its listening network interface(s) from
the page Service configuration and enable the dedicated service to make your EfficientIP DNS
server Guardian enabled.
Keep in mind that you cannot enable and configure DNS Guardian on an appliance that has less
than 8 GB of RAM. For more details regarding DNS Guardian, refer to the chapter DNS Guardian.
To configure DNS Guardian with network interfaces
2. In the column Name, click on DNS Guardian. The wizard Edit DNS Guardian Configuration
opens.
133
3. In the list Available interfaces, select the interface of your choice and click on . The interface
is moved to the list Selected interfaces.
Each interface name is followed by its MAC address, whether they are active or not. Only
Intel network interfaces are listed as no other interface card can be configured for DNS
Guardian.
4. Repeat this action for as many interfaces as you need.
7. The page refreshes, your local DNS server is now configured.You can start the service DNS
Guardian as detailed in the section Handling Services.
Managing the SNMP Service

You can manage the SNMP service directly from the user interface. From the module Adminis-
tration you can:
• Configure the TCP/UDP ports the server listens on.

• Configure the server v1, v2c and v3 profiles allowed to access SOLIDserver SNMP agent. By
default, a v1/v2c profile exists with the community string public. You can delete it and create
custom profiles to secure your system.
• Configure SNMP Traps on the server for a network management platform.
The columns Running and Enabled on the page Services configuration indicate the server state
on the appliance.
Note that SNMPv3 requires a properly configured NTP server. For more details, refer to the
chapter Configuring the NTP Server.
To configure the SNMP server
2. Click on the link SNMP server. The wizard SNMP Server Configuration opens.
3. In the fields UDP port and TCP port, type in the port number to communicate with the protocol
of your choice. At least one field has to be filled in. By default, the UDP port number used
is 161, you can also use that port with TCP.
a. Configure an SNMP profile following the table below.
Table 8.1. SNMP profiles parameters

Parameters Description
SNMP version You can choose either v1/v2c or v3. By default, v1/v2c is selected.
Access No matter the SNMP version, this field cannot be edited and is by default in Read-
only.
134
v1/v2c SNMPv1 and SNMPv2c are simple request/response protocols. SNMPv2c support
includes a bulk-retrieval mechanism and more detailed error message reporting
to management stations. If you select v1/v2c, the following fields are displayed:
Access, Community and SNMP restriction.
v3 SNMPv3 uses the security features providing secure access to devices. If you
select v3, the following fields are displayed: Access; Users, Key, Protocol (authen-
tication fields) and Key and Protocol (privacy fields).
Community Type in the community string that would act as a password to access the SNMP
agent.
SNMP restriction Type in the source of the SNMP. It can be one IP address, several IP addresses
separated by a space or a default value.
User Type in the login used for authentication.
Level You can choose either a noauth, auth or priv security level.
Key Type in the authentication passphrase (i.e. password), it must contain at least 8
characters.
a b
Algorithm You can select either the MD5 or the SHA algorithm. By default, MD5 is selec-
ted.
Key Type in a privacy passphrase. If the privacy passphrase is not specified, it is as-
sumed to be the same as the authentication passphrase. This field is optional
c d
Protocol You can select either the DES or AES algorithm. By default, DES is selected.
a
MD5 Message-Digest algorithm.
b
Secure Hash Algorithm.
c
Data Encryption Standard.
d
Advanced Encryption Standard.
b. When the access configuration is complete, click on ADD . The profile is moved to the
SNMP access list.
• To update an entry, select the SNMP profile of your choice, change the data according
to your needs and click on UPDATE .
• To delete an entry, select the SNMP profile of your choice and click on DELETE .
• To discard the latest changes, click on CANCEL .
c. Repeat these operations for as many SNMP profiles as you need.
a. You can set an SNMP trap configuration, following the table below.
Table 8.2. SNMP trap configuration

a
Send Trap v1 You can choose to enable an agent to send a trap notifying the management
station of significant events through the SNMP v1 protocol. By default, Yes is se-
lected.
Send Trap V2 You can choose to enable an agent to send a trap notifying the management
station of significant events through the SNMP v2 protocol. By default, Yes is se-
lected.
Send Trap Inform You can choose to enable routers to send inform requests to SNMP managers.
By default, Yes is selected.
Host Type in the IP address of the computer that listens to the network and catches
the trap.
135
Port You can define through which port the host that should catch the trap. This field
is optional.
Community Type in the community string that would act as a password to access the SNMP
agent.
a
Details regarding agent can be found in the Management Information Base (MIB)
b. When your configuration is complete, click on ADD . The profile is moved to the Trap list.
• To update an entry, select the SNMP trap of your choice, change the data according
to your needs and click on UPDATE .
• To delete an entry, select the SNMP trap of your choice and click on DELETE .
c. Repeat these operations for as many traps as you need.

Downloading the DNS/DHCP/DHCPv6 Configuration File

The Services configuration page allows you to download the current DNS (named.conf), DHCP
(dhcpd.conf), DHCPv6 (dhcpd6.conf), NSD (nsd.conf) or Unbound (unbound.conf) configuration
file of the appliance of your choice: whether the local one or the configuration of one of the appli-
ances you are managing remotely.
To download the DNS/DHCP/DHCPv6/NSD/Unbound configuration file
2. In the drop-down list SOLIDserver, under the menu, select the appliance for which you want
to download the configuration file.
3. In the menu, select Tools > Download configuration file.The wizard Download configuration
file opens.
4. In the drop-down list Configuration file, select DNS, DHCP, DHCP V6, NSD or Unbound
according to your needs.
5. Click on OK to commit your choice. The report opens, the configuration file is now stored on
the Local files listing page (Administration tab homepage > Maintenance > Local files listing).
If you do not want to download the file on your computer, go to step 8.
6. Click on DOWNLOAD and save the file.
7. Click on CLOSE . The wizard closes and the page Services configuration is visible again. Note
that the report is generated and stored on the page Local Files Listing. For more details re-
garding reports, refer to the chapter Managing Reports.
136
Chapter 9. License Management
At any point you might need to renew your license because it expired or change it to manage
more services. Before installing an activation key, check that this activation key is compatible for
the appliance you are upgrading.
If you do not have an activation key for your SOLIDserver, you must make an activation key request
to EfficientIP. In order to generate your new activation key, you have to send EfficientIP the ref-
erence token of the SOLIDserver you installed.
Requesting a New Activation Key

To update the license of an appliance, you need to connect to it and request a new activation
key.
To request a new activation key
1. Go to the Administration tab. If the homepage is not displayed, click on

2. In the menu, select System > Licenses, the page Licenses opens.
3. In the menu, select Add > Request license. The wizard Request license opens.
4. Copy the content of the field Key, you need it to fill out the request license form.
5. Click on OK to close the wizard.
6. Go to the page http://www.efficientip.com/license-request/ to fill out the license request form:
a. In the fields FIRST NAME, LAST NAME, EMAIL, COMPANY, PHONE NUMBER and
COUNTRY NAME, specify your contact details. All these fields are required.
b. In the field LICENSE PERIOD REQUEST, specify the desired license length: 1 month,
2 months, 3 months, 6 months or Permanent. This field is required.
c. If you selected Permanent, you must fill in the field CONTRACT NUMBER (IF PERMAN-
ENT LICENSE).
d. In the field REQUEST KEY, paste your key. This field is required.
e. In the field NUMBER OF EXTERNAL MANAGED SERVERS (MVSM, IF ANY), specify
the total number of servers - DNS/DHCP/... - you intend to manage from SOLIDserver.
f. In the section OPTIONAL MODULE, tick all the optional modules you might need:
1
NETCHANGE , DEVICE MANAGER, SPX or DNS GUARDIAN.
g. If relevant, fill in the field IF REQUESTER IS OTHER THAN THE END CUSTOMER,
PLEASE PROVIDE YOUR CONTACT INFORMATION (NAME, COMPANY, EMAIL,
PHONE).
h. Click on SUBMIT to send us your information.
Once EfficientIP license team has answered your request and sent you a license key, you can
activate the key as detailed in the next section.
1
If you do not tick this box, you are using NetChange basic options, or NetChange-IPL.
137
License Management
Activating a New License

Once EfficientIP sent your an activation key, you can activate it and change your license following
the procedure below.
To activate a new activation key

2. In the menu, select System > Licenses, a new page is displayed.
3. In the menu, select Add > License. The wizard Add a license opens.
4. In the the field License, paste the activation key.
138
Part III. Imports and Exports
SOLIDserver supports many imports and exports methods in almost all the modules..
• Importing Data from a CSV File details how to import or reimport data from a CSV file in the modules
IPAM, DHCP, DNS, NetChange, Devic Manager, VLAN Manager and Administration.
• Importing IPAM Data details how to import VitalQIP and Nortel NetID data to the module IPAM.
• Importing DHCP Data details how to import ISC, Alcatel-Lucent VitalQIP, Microsoft, Infoblox, MetaIP and
Nortel NetID configuration files to the module DHCP.
• Importing DNS Data details how to import BIND and VitalQIP zones from an archive file to the module
DNS.
• Exporting Data details how to export data from any module to CSV, HTML, XML, Excel or PDF files.
Chapter 10. Importing Data from a CSV
File
SOLIDserver allows to massively import data from CSV formatted files in the modules IPAM,
DHCP, DNS, NetChange, Device Manager, VLAN Manager and Administration. To import spe-
cific IPAM, DNS or DHCP configurations in a different format, refer to the import chapter in each
module.
Before importing CSV files, keep in mind that:
• The user importing the data must have the appropriate administrative rights
For instance, importing addresses into a terminal network implies that the user has administrative
rights over said network.
• The resources you import must have a unique name
You can import as many resources as you need as long as they all have a unique name.
• An import is generated one page at a time
If you are importing zones from the page All zones in the DNS, you only import the zones
themselves but not the RRs they contain.
• The object parameters that you can import correspond to the columns of the page
When you import objects, you can import all or some of their properties. That way, for instance,
you can import a zone and specify its view, this allows you to set up your DNS hierarchy more
easily.
• An import can overwrite the existing page data
The last step in the import wizard allows to overwrite, or not, all the existing parameters of the
resource except for its name.
• If the page does not have the Import option in the menu Add you cannot import data
Within SOLIDserver, almost any page allows the import. As for the import of CSV files, the
menu Add contains Import > CSV <data>. To see the whole list of pages where you can import
data, refer to the recap table in each module-dedicated import section below.
• Your classes may edit the fields available in the wizard
The import procedure only describes the fields that are displayed by default for each resource.
During each import, the number of fields that might appear or be required depends on the
classes you or your administrator might have configured for each resource.
• Any object parameter value is imported with the Inheritance property forced to Set or
Inherit
This allows to respect the configuration of the Inheritance property of an object parameter:
• It is forced to Set if the parameter is not configured on the parent object or if it has a different
value.
• It forced to Inherit if it is configured on the parent object and has the same value.
140
Importing Data from a CSV File
The Import Wizard

During an import, the wizard displays a set of pages that you should configure properly. Once
you selected the CSV file you want to import, the page CSV fields association, opens.
Figure 10.1. The first page of the import wizard
This section allows to specify the CSV import file details. They can be configured and saved
as templates to speed up the checking process. Its fields are detailed in the table CSV file
basic parameters.
This section contains some parameters (columns) that you can include in your import.
The the first section of the import wizard is common to all objects and can be configured as follows.
Table 10.1. CSV file basic parameters

Delimiter Select the data delimiter of your choice (a comma, a semi-colon or a tab) in the drop-down
list. The comma is selected by default.
Enclosure Select the data enclosure of the text (a single quotation or a double quotation mark) in the
drop-down list. The double quotation mark is selected by default.
a
Input format Select the input format of your data (UTF-16, ASCII or UTF-8 ) in the drop-down list. The
ASCII format is selected by default.
Skip first line Select Yes or No in the drop-down list depending on your needs. Skipping the first line
avoids importing the columns title. Yes is selected by default.
141
Template Select None if you do not want to save your parameters in a template. Select New template
to save your parameters as a CSV file export template. This drop-down list also contains
the existing templates that you can reuse.
Template name If you selected New template, name it in this field.
Save template This box is visible if you did not create a template or if you selected an existing template.
Tick it if you want to save the changes made to an existing template.
a
The UTF-8 input format is necessary to successfully import CSV files containing accents.
On the next page, Class parameters, there are many drop-down lists as there are existing class
parameters for the resource you are importing. None of the lists are required, they allow to make
a specific and detailed import if your parameters match a class in the database or if they can be
interpreted. Any class parameter that does not correspond to a class in the database is not dis-
played in the GUI once imported.
Finally, on the last page, CSV import parameters, a few options are available.
Figure 10.2. The consistency check page of the import wizard
This drop-down list Existing records allows to replace the existing entries with the data of
the CSV file you are importing.
The box Trigger the execution of all advanced properties allows to force the DNS, DHCP
and VLAN advanced property mechanisms during the import of networks, pools and ad-
dresses. For more details, refer to the section Importing Data to the IPAM
The button CHECK performs a data validity check of the content of the CSV file. The last
pages of the wizard provide a Report: a data validity report and an import report.
142
Importing Data to the IPAM

Within the IPAM module, you can import data on every page, except the pages All deleted IP
addresses (neither in IPv4 nor in IPv6) and All policies. The table below details where you can
import them within the module.
Table 10.2. IPAM pages where you can import CSV files
IPAM page Objects that can be imported Option name in the menu Add > Import
All spaces Spaces CSV spaces
Block-type networks CSV networks (block)
Subnet-type networks CSV networks (subnet)
Pools CSV pools
Addresses CSV addresses
IPv6 block-type networks CSV networks (block v6)
IPv6 subnet-type networks CSV networks (subnet v6)
IPv6 pools CSV pools (v6)
IPv6 addresses CSV addresses (v6)
RIPE allocated networks RIPE allocated networks
RIPE assigned networks RIPE assigned networks
IPv6 RIPE allocated networks RIPE allocated networks (v6)
IPv6 RIPE assigned networks RIPE assigned networks (v6)
All networks Block-type networks CSV networks (blocks)
Subnet-type networks CSV networks (subnets)
Pools CSV pools
IP Addresses CSV addresses
RIPE allocated networks RIPE allocated networks
RIPE assigned networks RIPE assigned networks
All networks (v6) IPv6 block-type networks CSV networks (block v6)
IPv6 subnet-type networks CSV networks (subnet v6)
IPv6 pools CSV pools (v6)
RIPE IPv6 allocated networks RIPE allocated networks (v6)
RIPE assigned networks (v6) RIPE assigned networks (v6)
All pools Pools CSV pools
Addresses CSV addresses
All pools (v6) IPv6 pools CSV pools (v6)
All addresses Addresses CSV addresses
All addresses (v6) IPv6 addresses CSV addresses (v6)
All AS Numbers Autnums CSV Autnums
RIPE Autnums RIPE Autnums
All VRFs VRFs CSV VRFs
VRF Route Targets CSV VRF Route Targets
All VRF Route Tar- VRF Route Targets CSV VRF Route Targets
gets
143
Before importing, keep in mind that:
• The advanced properties can automate the creation of entries in your database after the import.
If all the advanced properties are activated, importing IPAM data may automatically update
the DHCP and DNS databases. If you do not want your import to impact other modules, edit
the internal module setup before importing IPAM data. For more details, refer to the chapter
Managing Advanced Properties.
• Other advanced options, like the IPv4 to IPv6 transition, the IPAM / Device Manager interaction
properties and the IPAM/VLAN interaction properties, may also update your database automat-
ically. For more details, refer to the chapters Setting Up a Transition From IPv4 to IPv6, Man-
aging the Interaction with the IPAM and Managing the IPAM/VLAN Interaction.
To import VitalQIP or Nortel NetID data, refer to the chapter Importing IPAM Data.
Importing Spaces
When importing space(s), only the field Name is required. The other parameters are optional and
can be left empty.
To import spaces through a CSV file
1. Go to the IPAM tab. If the homepage is not displayed, click on . The homepage opens.
2. Click on Spaces. The page All spaces opens.
3. In the menu, select Add > Import > CSV spaces. The wizard Import a CSV file opens.
4. Click on BROWSE to select the CSV file to import. The selected file is visible in the field File
name.
5. Click on NEXT . The page CSV fields association opens.
6. Specify the format of the import file using the fields Delimiter, Enclosure, Input format, Skip
the first line and set in as a Template if you want. For more details, refer to the table CSV
file basic parameters.
7. Scroll down the page to select the columns of your CSV file you want to import.
Only the field Name is required. All fields are detailed in the table below.
Table 10.3. Space import parameters

Name The space name. This field is required.
Description The space description. This field is optional.
Parent space The space parent space (VLSM), if relevant. This field is optional.
Class parameters The space-related combination of parameters, in URL format. It can contain all the
class parameters of the resource, in which case you do not need to specify them one
by one on the page Class parameters. This field is optional.
Class name The space class name. This field is optional.
8. Click on NEXT . The page Class parameters opens. If you want to import class parameters
and did not import all your class parameters on the previous page, you can set the ones you
need one by one in the drop-down lists. All the fields are optional, they are named after the
parameters.
9. Click on NEXT . The page CSV import parameters opens.
144
10. In the drop-down list Existing records, select either Replace to overwrite the existing records
that have the same name or Don't replace to add the items to the listing. Don't replace is
selected by default.
11. Click on CHECK . The page Check the validity of the CSV file opens and displays a report
indicating the total amount of correct lines within the file. If you want to download the validity
report, refer to the next step. If you do not want to download it, go to step 13.
12. In the section Export format of the wizard, click on TEXT , HTML , or EXCEL to download the
validity report in the specified file format.
13. Click on OK to accept the validity check report results. The page Import data from a CSV
file opens and displays a report indicating the total number of spaces actually imported. If
you want to download that final report, refer to the next step. If you do not want to download
it, go to step 15.
import report in the specified file format.
15. Click on CLOSE to go back to the page All spaces. The spaces are now listed.
Importing Networks
You can import block-type networks or subnet-type networks in IPv4 or IPv6.
Block-type Networks
Block-type networks must be imported into a space.
Importing IPv4 Block-type Networks
When importing a file containing any type of network, the field First address and one of the fields
specifying the network size are required: Last address, Netmask, Prefix or Size must be specified.
Note that the procedure below is based on an import made on the page All networks. You can
also import networks in a specific space, in which case the field Space name is not displayed in
the wizard.
To import IPv4 block-type networks through a CSV file
2. Click on Network. The page All networks opens.
3. On the right-end side of the menu, click on V4 .
4. In the menu, select Add > Import > CSV networks (blocks). The wizard Import a CSV file
opens.
name.
145
The field First address and any field that indicates the network size (Last address, Netmask,
Prefix or Size) are required. All fields are detailed in the table below.
Table 10.4. Block-type network import parameters

First address The network first address. This field is required.
Last address
Netmask The drop-down lists that specify the size of the network(s), the number of IP addresses
Prefix being imported. You must fill at least one of them.
Size
Name The network name. This field is optional.
Class parameters The network-related combination of parameters, in URL format. It can contain all the
Description The network description. This field is optional.
Class name The network class name. This field is optional.
Space name The name of the space where you want import the network(s). It can be a space listed
in the file or an existing space in your database. This field is required.
parameters.
it, go to step 15.
16. Click on CLOSE to go back to the page All networks. The networks are now listed.
Importing IPv6 Block-type Networks
Note that the procedure below is based on an import made on the page All networks. This allows
you to import a network from any space into the space that suits your needs.You can also import
networks in a specific space, in which case the field Space name is not displayed in the wizard.
146
To import IPv6 block-type networks through a CSV file
4. In the menu, select Add > Import > CSV networks (block v6). The wizard Import a CSV file
opens.
name.
The fields First address, Prefix and Space name are required. All fields are detailed in the
table below.
Table 10.5. IPv6 block-type network import parameters

First address The first address of the IPv6 network(s). This field is required.
Prefix The network Prefix. This field is required.
Name The network name. This field is optional.
Description The network description. This field is optional.
parameters.
147
it, go to step 15.
16. Click on CLOSE to go back to the list All networks. The networks are now listed.
Subnet-type Networks
Subnet-type networks can be imported into a block-type network or directly into a space.
If you import IPv4 subnet-type networks on the page All networks (rather than within a specific
space or block-type network), the option Use best space is available in the drop-down list Space
name. It allows to put the content of the CSV file into the space containing the smallest network
able to receive the pool(s).
Note that importing subnet-type networks into a space containing no matching block-type network
places them in a container called Orphan networks. Later on, you can create a block-type network
large enough to contain them. For more details, refer to the chapter Adding Networks.
SOLIDserver also provides specific options that allow you to import VLSM organizations.
VLSM Import Options and Specificities
Two options are dedicated to VLSM in the wizard:
1. The field VLSM space name
During the subnet-type networks import, you can manage a VLSM organization content. If you
are importing a list of subnet-type networks in a parent space, you can select one of its direct
sub-spaces in the field VLSM space name. This way, the imported network(s) in the parent space
is automatically replicated as block-type network(s) in the selected sub-space. Note that:
• To import subnet-type networks in a VLSM configuration you need to be on the page All networks
of the parent space.
• SOLIDserver cannot complete the import if you choose the option Use best space in the field
Space name and specify a child space in the field VLSM space name.
• The wizard displays on the same page the box Imbricated networks and the option VLSM
space name. However, configuring both these options during an import triggers error
messages: in this case, VLSM space name prevails and Imbricated networks is ignored. You
need to configure these options separately if you need them both in your network configuration.
2. The box Imbricated networks
If you want to import subnet-type networks containing terminal or non-terminal subnet-type net-
works, the box Imbricated networks allows you to recreate the whole hierarchy of subnet-type
networks of the CSV file. Note that if you import a subnet-type networks hierarchy without ticking
the box, they are imported in a container Orphan Networks following the order saved in the .csv
file: the first items are imported, the rest is considered overlap, triggers an error message and is
not imported at all.
Keep in mind that ticking the box triggers the following behaviors, depending on the receiving
container:
148
• If you import a subnet-type networks organization into a space that does not contain any block-
type network to receive it, the first non-terminal subnet-type network becomes a block-type
network.
• If you import a subnet-type network hierarchy into a space that already contains a block-type
network:
• If the block-type network is bigger than the first non-terminal subnet-type network, the whole
hierarchy is created within the block-type network, but only if there is enough space available.
Otherwise, the report displays an error message and only the subnet-type networks that fit
in the block-type network are imported.
• If the block-type network and the first non-terminal subnet-type network are the same size,
the first non-terminal subnet-type network is ignored, the block-type network already matches
its ranges of addresses. The subnet-type networks contained in the non-terminal subnet-
type network are imported in the block-type network if there is enough space for them in the
block-type network. Otherwise, the report displays an error message and only the subnet-
type networks that fit in the block-type network available addresses are imported.
Importing IPv4 Subnet-type Networks
If you import IPv4 subnet-type networks on the page All networks (rather than within a specific
space or block-type network), the option Use best space is available in the drop-down list Space
name. It allows to put the content of the CSV file into the space containing the smallest block-
type network able to receive the subnet-type network(s).
To import IPv4 subnet-type networks through a CSV file
4. In the menu, select Add > Import > CSV networks (subnet). The wizard Import a CSV file
opens.
name.
The fields Address, Name, Space name and one field specifying the network size (Netmask,
Prefix or Size) are required. All fields are detailed in the table below.
Table 10.6. IPv4 subnet-type network import parameters

a
Address The network start address. This field is required.
Netmask The drop-down lists that specify the size of the network(s), the number of IP addresses
149
Size
Name The network name. This field is required.
Network is terminal The VLSM status of the network(s), terminal or non-terminal. By default, if you import
a networks hierarchy the last imbricated network is considered terminal even if it is
not. Selecting the line corresponding to the value of the column adds an extra check
when parsing the data and ensure that the import respects the status you set for
each network. The values listed between brackets should be 0 or 1, otherwise, it is
b
not taken into account during the import . This field is optional.
class parameters of the resource, in which case you do not need to specify them
one by one on the page Class parameters. This field is optional.
in the file, an existing space in your database or you can use the option Use best
space. This field is required.
Use best space Select this option, in the drop-down list Space name, if you do not have a column
containing the space name in your CSV file. Note that if you select this option, the
VLSM space name option does not work properly.
VLSM space name If you set up a space-base VLSM organization, select the sub space that uses the
subnet-type network you are importing as a block-type network. Note that this option
cannot be used in association with the option Imbricated networks option. This field
is optional.
Imbricated networks Tick this box if you want to import a hierarchy of non-terminal and terminal (subnet-
type) networks. Note that you cannot use this option if you are setting up a VLSM
import using the option VLSM space name.
a
When reimporting data from SOLIDserver, you can select the Address + prefix field and select the network Name
and Space name fields to continue with the import.
b
When exporting the content of the column Terminal, make sure to tick the box The export might be reimported. If
the import wizard displays Yes and No between brackets, it is ignored during the import.
parameters.
10. Click on NEXT . The page CSV import parameters opens:
a. In the drop-down list Existing records, select either Replace to overwrite the existing
records that have the same name or Don't replace to add the items to the listing. Don't
replace is selected by default.
b. Tick this box Trigger the execution of all advanced properties if you want to force the
advanced property mechanisms during the import. These mechanisms depend on the
configuration set on the page Class parameters and/or on the properties inherited from
higher level(s), they can include properties impacting the IPAM, DNS, DHCP and VLAN
Manager. For more details, refer to the section Network Advanced Properties or to the
chapter Managing the IPAM/VLAN Interaction.
After the import, you can still trigger the execution of the configured mechanisms. Tick
the subnet-type networks of your choice and in the menu select Tools > Expert > Initialize
rules. This operation also triggers the replication on the objects they contain.
150
it, go to step 15.
Importing IPv6 Subnet-type Networks
Note that in IPv6, the option Use best space is not available in the drop-down list Space name.
To import IPv6 subnet-type networks through a CSV file
4. In the menu, select Add > Import > CSV networks (subnet v6). The wizard Import a CSV
file opens.
name.
The fields Address, Prefix, Name and Space name are required. All fields are detailed in
the table below.
Table 10.7. IPv6 subnet-type network import parameters

Address The network start address. This field is required.
Prefix The size of the network(s), the number of IP addresses being imported. This field is
required.
Name The network name. This field is required.
151
VLSM space If you set up a space-base VLSM organization, select the sub space that uses the
subnet-type network you are importing as a block-type network. Note that this option
cannot be used in association with the option Imbricated networks option. This field
is optional.
Imbricated networks Tick this box if you want to import a hierarchy of non-terminal and terminal networks.
You cannot use this option if you are setting up a VLSM import using the VLSM space
name option.
parameters.
higher level(s), they can include properties impacting the IPAM, DNS, DHCP and VLAN
Manager. For more details, refer to the section Network Advanced Properties or to the
the subnet-type networks of your choice and in the menu select Tools > Expert > Initialize
rules. This operation also triggers the replication on the objects they contain.
it, go to step 15.
Importing Pools
Keep in mind that you cannot import pools in an empty space: to successfully import pools,
you need a terminal network that can receive them.
152
Importing IPv4 Pools
On the page CSV fields association, the fields First address, Last address, Name and Space
name are required.
If you import IPv4 pools on the page All networks (rather than within a specific space or block-
type network), the option Use best space is available in the drop-down list Space name. It allows
to put the content of the CSV file into the space containing the smallest network able to receive
the pool(s).
To import IPv4 pools through a CSV file
2. Click on Pools. The page All pools opens.
3. On the right-end side of the menu, click on V4 to display the IPv4 pools.
4. In the menu, select Add > Import > CSV pools. The wizard Import a CSV file opens.
name.
The fields First address, Name, Space name and one of fields specifying the pool size (Last
address or Size) are required. All fields are detailed in the table below.
Table 10.8. IPv4 pool import parameters

First address The pool first address. This field is required.
Last address The drop-down lists that specify the size of the pool(s), the number of IP addresses
Size being imported. You must fill at least one of them.
Name The pool name. This field is required.
Read-only The pool reservation status. This field is optional.
Class name The pool class name. This field is optional.
Space name The name of the space where you want import the pool(s). It can be a space listed in
the file, an existing space in your database or you can use the option Use best space.
This field is required.
containing the space name in your CSV file.
parameters.
153
higher level(s), they can include the IPAM to DHCP replication. For more details, refer
to the section Pool Advanced Properties.
the pools of your choice and in the menu select Tools > Expert > Initialize rules. This
operation also triggers the replication on the IP addresses they contain.
it, go to step 15.
15. Click on CLOSE to go back to the page All pools. The pools are now listed.
Importing IPv6 Pools
When importing IPv6 pools, you must specify a space with a terminal network able to receive the
pools. On the page CSV fields association, the fields First address, Last address, Name and
Space name are required.
Note that in IPv6, the option Use best space is not available in the drop-down list Space name.
To import IPv6 pools through a CSV file
3. On the right-end side of the menu, click on V6 to display the IPv6 pools.
4. In the menu, select Add > Import > CSV pools (v6). The wizard Import a CSV file opens.
name.
154
The fields First address, Last address, Name and Space name are required. All fields are
detailed in the table below.
Table 10.9. IPv6 pool import parameters

First address The pool first address. This field is required.
Last address The drop-down lists that specify the size of the pool(s), the number of IP addresses
Name The pool name. This field is required.
Read-only The pool reservation status. This field is optional.
Class name The pool class name. This field is optional.
Space name The name of the space where you want import the pool(s). It can be a space listed in
the file or an existing space in your database. This field is required.
parameters.
higher level(s), they can include the IPAM to DHCP replication. For more details, refer
to the section Pool Advanced Properties.
the pools of your choice and in the menu select Tools > Expert > Initialize rules. This
operation also triggers the replication on the IP addresses they contain.
it, go to step 15.
15. Click on CLOSE to go back to the page All pools. The pools are now listed.
155
Importing IP Addresses
Keep in mind that you can import addresses in an empty space, they are saved in an container
Orphan Addresses.
Importing IPv4 Addresses
When importing a file containing IPv4 address(s), on the page CSV fields association, the fields
IP address, Name and Space name are required.
To import IPv4 addresses through a CSV file
2. Click on Addresses. The page All addresses opens.
3. On the right-end side of the menu, click on V4 to display the IPv4 addresses.
4. In the menu, select Add > Import > CSV addresses. The wizard Import a CSV file opens.
name.
The fields IP address, Name and Space name are required. All fields are detailed in the table
below.
Table 10.10. IPv4 address import parameters

IP address The IP address. This field is required.
Name The IP address name. This field is required.
MAC address The IP address MAC address. This field is optional.
Alias The alias associated with the IP address(es). This field is optional.
Class parameters The IP address-related combination of parameters, in URL format. It can contain all
the class parameters of the resource, in which case you do not need to specify them
Space name The name of the space where you want import the address(es). It can be a space
listed in the file, an existing space in your database or the option Use best space. This
field is required.
containing the space name in your CSV file. The best space is a space containing a
a
block-type network and subnet-type network that can receive the IP address(es) .
Class name The class name of the IP address(es) you are importing.
a
To import IP addresses in a container Orphan Addresses, import them on the page All networks or All pools of a
specific space.
parameters.
156
higher level(s), they can include properties impacting the IPAM, DNS, DHCP and Device
Manager. For more details, refer to the section IP Address Advanced Properties or to
the chapter Managing the Interaction with the IPAM.
the IP addresses of your choice and in the menu select Tools > Expert > Initialize rules.
it, go to step 15.
15. Click on CLOSE to go back to the page All addresses. The IP addresses are nos listed.
Importing IPv6 Addresses
When importing a file containing IPv6 address(s), on the page CSV fields association, the fields
IP address, Name and Space name are required.
To import IPv6 addresses through a CSV file
3. On the right-end side of the menu, click on V6 to display the IPv6 addresses.
4. In the menu, select Add > Import > CSV addresses (v6).The wizard Import a CSV file opens.
name.
The fields IP address, Name and Space name are required. All fields are detailed in the table
below.
157
Table 10.11. IPv6 address import parameters

IP address The IP address. This field is required.
Name The IP address name. This field is required.
MAC address The IP address MAC address. This field is optional.
Class name The IP address class name. This field is optional.
Class parameters The IP address-related combination of parameters, in URL format. It can contain all
the class parameters of the resource, in which case you do not need to specify them
Space name The IP address space name. At the bottom of the list of columns of the CSV file, the
existing spaces are also listed, select the space where you want import the address(es).
parameters.
higher level(s), they can include properties impacting the IPAM, DNS, DHCP and Device
Manager. For more details, refer to the section IP Address Advanced Properties or to
the chapter Managing the Interaction with the IPAM.
the IP addresses of your choice and in the menu select Tools > Expert > Initialize rules.
it, go to step 15.
15. Click on CLOSE to go back to the page All addresses. The IP addresses are now listed.
Importing VRFs
When importing VRF(s), the fields VRF name and VRF RD ID are required.
158
To import VRFs through a CSV file
2. Click on VRF. The page All VRFs opens.
3. In the menu, select Add > Import > CSV VRFs. The wizard Import a CSV file opens.
name.
The fields VRF name and VRF RD ID are required. All fields are detailed in the table below.
Table 10.12. VRF import parameters

VRF name The VRF name. This field is required.
VRF RD ID The VRF RD ID. This field is required.
VRF comment The VRF comment. This field is optional.
VRF class name The VRF class name. This field is optional.
VRF class parameters The VRF-related combination of parameters, in URL format. It can contain all
the class parameters of the resource, in which case you do not need to specify
them one by one on the page Class parameters. This field is optional.
parameters.
it, go to step 15.
15. Click on CLOSE to go back to the page All VRFs. The VRFs are now listed.
159
Importing VRF Route Targets

You can import VRF Route Targets to set up communication between existing VRFs.
When importing VRF route target(s), the fields Source RD ID of the VRF Route Targets and
Target RD ID of the VRF Route Targets are required. As the VRFs are already in the database,
the name is retrieved and displayed on the page once the Route Targets are imported.
To import VRF Route Targets through a CSV file
3. In the breadcrumb, click on All VRF Route Targets. The page All VRF Route Targets opens.
4. In the menu, select Add > Import > CSV VRF Route Targets. The wizard Import a CSV file
opens.
name.
The fields Source RD ID of the VRF Route Targets and Target RD ID of the VRF Route
Targets are required. All fields are detailed in the table below.
Table 10.13. VRF route target import parameters

Source RD ID of the VRF Route Targets The source VRF of the Route Target. This field is required.
Target RD ID of the VRF Route Targets The target VRF of the Route Target. This field is required.
Imported VRF Route Target The import VRF Route Target parameter. This field is op-
tional.
Exported VRF Route Target The export VRF Route Target parameter. This field is op-
tional.
parameters.
160
it, go to step 15.
16. Click on CLOSE to go back to the page All VRF Route Targets. The VRF Route Targets are
now listed.
Importing Data to the DHCP

Within the DHCP module, you can import data on the scopes, ranges and statics pages in IPv4
and IPv6. The table below details where you can import them within the module.
Table 10.14. DHCP pages where you can import CSV files
DHCP page Objects that can be imported Option name in the menu Add > Import
All scopes Scopes CSV scopes
Ranges CSV ranges
Statics CSV statics
All scopes (v6) IPv6 scopes CSV scopes
IPv6 ranges CSV ranges
IPv6 statics CSV statics
All ranges Ranges CSV ranges
All ranges (v6) IPv6 ranges CSV ranges
All statics Statics CSV statics
All statics (v6) IPv6 statics CSV statics
Before importing, keep in mind that the advanced properties can automate the creation of entries
in your database after the import. If all the advanced properties are activated, importing DHCP
data may automatically update the IPAM and DNS databases. If you do not want your import to
impact other modules, edit the internal module setup before importing DHCP data. For more
details, refer to the chapter Managing Advanced Properties.
To import an ISC, Alcatel-Lucent VitalQIP, Microsoft, Infoblox, MetaIP or Nortel NetID configuration,
refer to the chapter Importing DHCP Data.
Importing Scopes
You can import several scopes coming from different DHCP configurations into the same server.
If you plan on importing scopes into different servers, make sure that your CSV file contains a
column dedicated to the server name.
Importing IPv4 Scopes
When importing a file containing IPv4 scope(s), on the page CSV fields association, the fields
Start address, DHCP server and one of the fields specifying the scope size are required: End
address or Size must be specified.
To import IPv4 scopes through a CSV file
1. Go to the DHCP tab. If the homepage is not displayed, click on . The homepage opens.
161
2. Click on DHCP servers. The page All servers opens.

3. Click on the Name of the DHCP server of your choice. The page All scopes of the server
opens.
4. On the right-end side of the menu, make sure V4 is white.
5. In the menu, select Add > Import > CSV scopes. The wizard Import a CSV file opens.
name.
The fields Address, DHCP server and one field specifying the scope size (Prefix, Netmask
or Size) are required. All fields are detailed in the table below.
Table 10.15. DHCP scope import parameters

Name The scope name. This field is optional.
Address The scope first address. This field is required.
Prefix
The drop-down lists that specify the size of the scope(s), the number of IP addresses
Netmask
being imported. You must fill at least one of them.
Size
Scope space The scope space in the IPAM. This field is optional.
Shared network The scope shared network. This field is optional.
Failover The scope failover. This field is optional.
Class name The scope class name. This field is optional.
Class parameters The scope-related combination of parameters, in URL format. It can contain all the
DHCP server The scope server name. At the bottom of the list of columns of the CSV file, the existing
servers are also listed, select the server where you want to import the scope(s). This
field is required.
parameters.
11. Click on NEXT . The page DHCP options opens. All the fields are optional, choose the data
you want to import. For more details, refer to the chapter Configuring DHCP Options.
162
it, go to step 16.
18. Click on CLOSE to go back to the page All scopes. The scopes are now listed.
Importing IPv6 Scopes
When importing a file containing IPv6 scope(s), on the page CSV fields association, the fields
To import IPv6 scopes through a CSV file
3. Click on the Name of the DHCP server of your choice. The page All scopes of the server
opens.
5. In the menu, select Add > Import > CSV scopes. The wizard Import a CSV file opens.
name.
The fields Start address, DHCP server, any field specifying the scope size (End address or
Prefix) are required. All fields are detailed in the table below.
Table 10.16. DHCPv6 scope import parameters

Name The scope name. This field is optional.
Start address The scope start address. This field is required.
End address The drop-down lists that specify the size of the scope(s), the number of IP addresses
Scope space The scope space in the IPAM. This field is optional.
Class name The scope class name. This field is optional.
Class parameters The scope-related combination of parameters, in URL format. It can contain all the
163
DHCP6 server The scope server name. At the bottom of the list of columns of the CSV file, the existing
servers are also listed, select the server where you want to import the scope(s). This
field is required.
parameters.
it, go to step 16.
18. Click on CLOSE to go back to the page All scopes. The scopes are now listed.
Importing Ranges
From the page All ranges, you can import IPv4 and IPv6 ranges. These ranges must be imported
within an existing scope.
Importing IPv4 Ranges
When importing a file containing IPv4 range(s), on the page CSV fields association, the fields
To import IPv4 ranges through a CSV file
2. Click on Ranges. The page All ranges opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 ranges.
4. In the menu, select Add > Import > CSV ranges. The wizard Import a CSV file opens.
name.
164
The fields Start address, DHCP server and any field specifying the range size (End address
or Size) are required. All fields are detailed in the table below.
Table 10.17. DHCP range import parameters

Start address The range(s) start address. This field is required.
End address The drop-down lists that specify the size of the range(s), the number of IP addresses
Failover channel The range failover channel. This field is optional.
ACL The range ACL. This field is optional.
Class name The range class name. This field is optional.
Class parameters The range-related combination of parameters, in URL format. It can contain all the
DHCP server The range server name. At the bottom of the list of columns of the CSV file, the existing
servers are also listed, select the server where you want to import the range(s). This
field is required.
parameters.
it, go to step 16.
17. Click on CLOSE to go back to the page All ranges. The ranges are now listed.
Importing IPv6 Ranges
Note that there are no DHCP options for DHCPv6 ranges, so you cannot import them.
165
When importing a file containing IPv6 range(s), on the page CSV fields association, the fields
Start address, End address and DHCP6 server are required.
To import IPv6 ranges through a CSV file
4. In the menu, select Add > Import > CSV ranges. The wizard Import a CSV file opens.
name.
The field Start address, End address and DHCP6 server are required. All fields are detailed
in the table below.
Table 10.18. DHCPv6 range import parameters

Start address The range start address. This field is required.
End address The range last address. This field is required.
DHCP6 server The range server name. At the bottom of the list of columns of the CSV file, the existing
servers are also listed, select the server where you want to import the range(s). This
field is required.
parameters.
166
it, go to step 15.
16. Click on CLOSE to go back to the page All ranges. The ranges are now listed.
Importing Statics
From the page All statics, you can import IPv4 and IPv6 static reservations. These statics can
be imported in a DHCP server or group.
If you are importing statics with IP address in a DHCP server version 6.0.0, keep in mind that
they are managed like leases by the server. For more details, refer to the section Adding DHCPv4
Statics.
Importing IPv4 Statics
When importing a file containing IPv4 static reservation(s), on the page CSV fields association,
the fields DHCP server, MAC address and Client DUID are required.
To import IPv4 statics through a CSV file
2. Click on Statics. The page All statics opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 statics.
4. In the menu, select Add > Import > CSV statics. The wizard Import a CSV file opens.
name.
The fields MAC address and DHCP server are required. All fields are detailed in the table
below.
Table 10.19. DHCP static import parameters

Field Description
DHCP static name The static name. This field is optional. For EfficientIP DHCP servers version
6.0.0, if you specify the static name and leave the field Option host-name empty,
the value of the DHCP option is used as the static name as well. You should
specify either the DHCP static name or the Option host-name.
MAC address The static MAC address. This field is required.
DHCP static IP address The static IP address. This field is optional.
DHCP group The static group. This field is optional.
DHCP static class name The static class name. This field is optional.
Class parameters The static-related combination of parameters, in URL format. It can contain all
167
Field Description
DHCP server The static server name. At the bottom of the list of columns of the CSV file, the
existing servers are also listed, select the server where you want to import the
static(s). This field is required.
parameters.
For EfficientIP DHCP servers version 6.0.0, you can specify the Option host-name and leave
the field DHCP static name empty to use the value of the option as the name of the static.
You should specify either the DHCP static name or the Option host-name.
it, go to step 16.
17. Click on CLOSE to go back to the page All statics. The static reservations are now listed.
Importing IPv6 Statics
When importing a file containing IPv6 static reservation(s), on the page CSV fields association,
the fields DHCP server, MAC address and Client DUID are required.
To import IPv6 statics through a CSV file
4. In the menu, select Add > Import > CSV statics. The wizard Import a CSV file opens.
name.
168
The fields DHCP static name and DHCP server are required. All fields are detailed in the
table below.
Table 10.20. DHCPv6 static import parameters

Field Description
DHCP static name The static name. This field is required.
Static IP address The static IP address. This field is optional.
MAC address The drop-down lists that identify the static(s) client. It is required to fill at least
Client DUID one of them.
DHCP group The static group. This field is optional.
DHCP static class name The static class name. This field is optional.
Class parameters The static-related combination of parameters, in URL format. It can contain all
DHCP6 server The static server name. At the bottom of the list of columns of the CSV file, the
existing servers are also listed, select the server where you want to import the
static(s). This field is required.
parameters.
it, go to step 16.
17. Click on CLOSE to go back to the page All statics. The static reservations are now listed.
169
Importing Data to the DNS

Within the DNS module, you can import zones and resource records. The table below details
where you can import them within the module.
Table 10.21. DNS pages where you can import CSV files
DNS page Objects that can be imported Option name in the menu Add > Import
All zones Zones CSV zones
All RRs Resource records CSV RRs
in your database after the import. If all the advanced properties are activated, importing DNS
data may automatically update the IPAM and DHCP databases. If you do not want your import
to impact other modules, edit the internal module setup before importing DNS data. For more
To import zones from a BIND or VitalQIP archive file, refer to the chapter Importing DNS Data.
Importing Zones
When importing a file containing zone(s), on the page CSV fields association, the fields DNS
zone name, DNS zone type and DNS server name are required.
To import zones through a CSV file
1. Go to the DNS tab. If the homepage is not displayed, click on . The homepage opens.
2. Click on DNS servers. The page All servers opens.
3. Click on the Name of the server of your choice. The page All zones of the server opens.
4. In the menu, select Add > Import > CSV zones. The wizard Import a CSV file opens.
name.
6. Click on NEXT . The page CSV fields association page appears.
The fields DNS zone name, DNS zone type and DNS server name are required. All fields
are detailed in the table below.
Table 10.22. Zone import parameters

DNS Zone name The zone(s) name. This field is required.
DNS Zone type The static type. This field is required.
Master IP address The static master server IP address.This field is required when importing slave zone(s).
Forwarder IP ad- The static forwarding server IP address. This field is optional.
dress
DNS view The static view name. This field is optional.
170
DNS server name The static server name. At the bottom of the list of columns of the CSV file, the existing
servers are also listed, select the server where you want to import the zone(s). This
field is required.
parameters.
it, go to step 14.
16. Click on CLOSE to go back to the page All zones. The zones are now listed.
Importing Resource Records

When importing a file containing resource record(s), on the page CSV fields association, the
fields RR name, Value 1, Zone name and RR type are required.
To import resource records through a CSV file
2. Click on DNS RRs. The page All RRs opens.
3. In the menu, select Add > Import > CSV RRs. The wizard Import a CSV file opens.
name.
The fields RR name, Value 1 and RR type are required. All fields are detailed in the table
below.
171
Table 10.23. Resource record import parameters

RR name The RR(s) name. This name can be FQDN if you also import the column containing
the Zone name. This field is required.
TTL The RR TTL. This field is optional.
Value 1 The first piece of information in the column Value. This field is required.
Value 2
Value 3
Value 4 The extra information that can contain the column Value depending on the RR type.
Value 5 These fields are optional.
Value 6
Value 7
Zone name The RR zone name. This field is required.
DNS view The RR view name. This field is optional.
DNS server The RR server name. This field is optional.
RR type The RR type. At the bottom of the list of columns of the CSV file, the existing RR types
are also listed, you can choose one of them. This field is required.

it go to step 13.
14. Click on CLOSE to go back to the page All RRs. The records are now listed.
Importing Data to NetChange

Within NetChange module, you can import data on the network devices page. The table below
details where you can import them within the module.
Table 10.24. NetChange pages where you can import CSV files
NetChange page Objects that can be imported Option name in the menu Add > Import
All network devices Network devices CSV file
Importing Network Devices

When importing network device(s), only the field Target space is required.
172
To import network devices through a CSV file
1. Go to the NetChange tab. If the homepage is not displayed, click on . The homepage
opens.
2. Click on Network devices. The page All network devices opens.
3. In the menu, select Add > Import > CSV file. The wizard Import a CSV file opens.
name.
7. Scroll down the page to select the columns of your CSV file you want to import as described
in the table below:
Table 10.25. Network device import parameters

Address The network device(s) IP address. This field is mandatory.
Community The SNMPv1/v2c community string that would act as a password to access SNMP
agent on the device(s). For SNMPv3, one or several SNMP profiles can be specified
on the last page of the wizard. This field is optional.
SNMP version The version of the SNMP protocol used on the network device(s). It must be either 1
for SNMPv1 or 2 for SNMPv2c. For SNMPv3, one or several SNMP profiles can be
specified on the last page of the wizard. This field is optional.
Class The network device(s) class. This field is optional.
Target space The network device(s) space in the IPAM, i.e. the space that should list the IP address
of the discovered items on the network device(s). This field is required. If you have
classes enabled, it will appear on the next page of the wizard.
8. Tick the box Expert mode to specify more details regarding the device(s) information retrieval.
If you have classes enabled, it will appear on the next page of the wizard. Edit the parameters
according to your needs following the table below:
Table 10.26. SNMP parameters

Field Description
SNMP port The port that the SNMP service must use. By default, the port 161 is selected.
SNMP retries Select the number of connection attempts when the server is in timeout. You
can set it between 0 and 5. By default, it is set to 2 attempts.
SNMP transfer timeout Set the number of minutes above which the SNMP transfer is aborted when you
(minutes) add or refresh a device. You can set it between 0 and 999. By default, it is set
to 0.
Use bulk If you use SNMPv2c or v3, you can choose to use a bulk transfer of data. This
compact SNMP request method accelerates transfers by sending several requests
at once. By default, it is set to Yes.
Use TCP transport Choose to use the TCP protocol instead of the UDP when the network link is not
reliable. By default UDP is used, the drop-down list is set to No.
9. Click on NEXT . If you have classes enabled, the page Class parameters opens. You can set
the class parameters you need one by one in the drop-down lists. All the fields are optional,
173
they are named after the parameters.The fields Target space and Expert mode are described
in the previous step.
10. Click on NEXT . The last page of the wizard appears. You can select the SNMP profile(s) to
use in order to access the SNMP agent on the devices if they are not associated to a version
or community string in the CSV file. It is the only way to specify authentication parameters
in SNMPv3.
Table 10.27. SNMP profile information parameters

SNMP profiles configuration The SNMP profiles available. By default there are 3 profiles, standard v1,
standard v2c and standard v3, but you can create as many profiles as
needed to display them in this list. For more details, refer to the section
Managing SNMP Profiles. Select a profile and click on to move it to the
list Selected profiles.
Selected profiles This field lists the SNMP profiles to use in order to retrieve the device(s)
information. SOLIDserver tries all the profiles on the device(s), following
the list order. To remove a profile from the list, select it and click on .
If you do not select any, NetChange uses the profile standard v2c.
11. Click on OK to commit the import. The Report opens and work for a while: the import pro-
gression is visible. Once the import is over, the report lists the IP addresses imported as well
as the existing ones. If you want to download that final report, refer to the next step. If you
do not want to download it, go to step 11.
13. Click on CLOSE to go back to the page All network devices. The devices are now listed.
Importing Data to Device Manager

Within Device Manager module, you can import data from the page All Devices and All ports &
interfaces. The table below details where you can import them within the module.
Table 10.28. Device Manager pages where you can import CSV files
Device Manager page Objects that can be imported Option name in the menu Add > Import
All devices Devices CSV devices
Ports and/or interfaces CSV interfaces
All ports & interfaces Ports and/or interfaces CSV interfaces
Importing Devices
When importing a file containing device(s), on the page CSV fields association, only the field
Name is required.
To import devices through a CSV file
1. Go to the Device Manager tab. If the homepage is not displayed, click on . The homepage
opens.
2. Click on Devices. The page All devices opens.
3. In the menu, select Add > Import > CSV devices. The wizard Import a CSV file opens.
174
name.
Table 10.29. Device import parameters

Name The device name. This field is required.
Class name The device class name. This field is optional.
Class parameters The device-related combination of parameters, in URL format. It can contain all the
parameters.
it, go to step 14.
15. Click on CLOSE to go back to the page All devices. The devices are now listed.
Importing Ports & Interfaces

When importing a file containing ports and interface(s), on the page CSV fields association, only
the fields Name, Type and Device are required.
To import ports and/or interfaces through a CSV file
opens.
175
2. Click on Ports & interfaces. The page All ports & interfaces opens.
3. In the menu, select Add > Import > CSV interfaces. The wizard Import a CSV file opens.
name.
Table 10.30. Port and/or interface import parameters

Name The port and/or interface name. This field is required.
Type The port and/or interface type. This field is required.
MAC address The port and/or interface MAC address. This field is optional.
Class name The port and/or interface class name. This field is optional.
Class parameters The port and/or interface-related combination of parameters, in URL format. It can
contain all the class parameters of the resource, in which case you do not need to
specify them one by one on the page Class parameters. This field is optional.
Device The port and/or interface device name. At the bottom of the list of columns of the CSV
file, the existing devices are also listed, select the device where you want to import
the port(s) and/or interface(s). This field is required.
parameters.
it, go to step 14.
15. Click on CLOSE to go back to the page All ports & interfaces. The ports and interfaces are
now listed.
176
Importing Data to VLAN Manager

Within VLAN Manager module, you can import domains, ranges and VLANs. The table below
details where you can import them within the module.
Table 10.31. VLAN Manager pages where you can import CSV files
VLAN Manager page Objects that can be imported Option name in the menu Add > Import
All domains Domains CSV domains
Ranges CSV ranges
VLANs CSV VLANs
All ranges Ranges CSV ranges
VLANs CSV VLANs
All VLANs VLANs CSV VLANs
Importing VLAN Domains

When importing a file containing VLAN domain(s), on the page CSV fields association, only the
fields Name, Start ID and End ID are required.
To import VLAN domains through a CSV file
1. Go to the VLAN Manager tab. If the homepage is not displayed, click on . The homepage
opens.
2. Click on Domains. The page All domains opens.
3. In the menu, select Add > Import > CSV domains. The wizard Import a CSV file opens.
name.
The fields Name, Start ID and End ID are required. All fields are detailed in the table below.
Table 10.32. VLAN domain import parameters

Name The domain name. This field is required.
Start ID The domain first VLAN ID. This field is required.
End ID The domain last VLAN ID. This field is required.
Description The domain description. This field is optional.
Class name The domain class name. This field is optional.
Class parameters The domain-related combination of parameters, in URL format. It can contain all the
177
parameters.
it, go to step 14.
15. Click on CLOSE to go back to the page All domains. The VLAN domains are now listed.
Importing VLAN Ranges

When importing a file containing VLAN ranges(s), on the page CSV fields association, only the
fields Name, Start ID, End ID and Domain are required.
To import VLAN ranges through a CSV file
opens.
name.
5. Click on NEXT . The CSV fields association opens.
The fields Name, Start ID, End ID and Domain are required. All fields are detailed in the table
below.
Table 10.33. VLAN range import parameters

Name The range name. This field is required.
No ID overlapping The VLAN ID overlapping policy for the range. By default it is set to yes, the overlapping
is disabled: the ranges can only contain unique VLAN IDs. This field is optional.
Start ID The range first VLAN ID. This field is required.
178
End ID The range last VLAN ID. This field is required.
Description The range description. This field is optional.
Domain The range domain name. This field is required.
parameters.
it, go to step 14.
15. Click on CLOSE to go back to the page All ranges. The VLAN ranges are now listed.
Importing VLANs
When importing a file containing VLAN ranges(s), on the page CSV fields association, only the
fields VLAN ID, Range and Domain are required.
To import VLANs through a CSV file
opens.
2. Click on VLANs. The page All VLANs opens.
name.
179
The fields VLAN ID, Range and Domain are required. All fields are detailed in the table below.
Table 10.34. VLAN import parameters

Name The VLAN name. This field is optional.
VLAN ID The VLAN ID. This field is required.
Range The VLAN range name. This field is required.
Domain The VLAN domain name. This field is required.
parameters.
it, go to step 14.
15. Click on CLOSE to go back to the page All VLANs. The VLANs are now listed.
Importing Data to the Administration Module

Within the Administration module, you can import data on the Groups, Users and Custom data
pages. The table below details where you can import them within the module.
Table 10.35. Administration module pages where you can import CSV files
Administration page Objects that can be imported Option name in the menu Add > Import
Groups Groups of users CSV groups
Users Users CSV file
a
RIPE users RIPE persons
Custom data Custom data CSV custom data
a
To import RIPE users, or persons, refer to the section Importing RIPE Persons.
180
Importing Groups of Users

When importing a file containing group(s) of users, on the page CSV fields association, only the
field Name is required.
To import groups through a CSV file
opens.
2. In the section System, click on Groups. The page Groups opens.
3. In the menu, select Add > Import > CSV groups. The wizard Import a CSV file opens.
name.
Table 10.36. Group of users import parameters

Name The group of users name. This field is required.
Description The group of users description. This field is optional.
Category The group of users category. This field is optional.
Class name The group of users class name. This field is optional.
Group parent name The name of the group of users' parent group. This allows to copy the rights of the
selected group and apply them to the group(s) your are importing. This field is optional.
parameters.
it, go to step 14.
181
15. Click on CLOSE to go back to the page Group. The groups are now listed.
Importing Users
To import RIPE users, or persons, refer to the section Importing RIPE Persons.
When importing a file containing user(s), on the page CSV fields association, only the field Login
is required.
To import users through a CSV file
opens.
2. In the section System, click on Users. The page Users opens.
3. In the menu, select Add > Import > CSV file. The wizard Import a CSV file opens.
name.
Table 10.37. User import parameters

Login The user login. This field is required.
First name The user first name. This field is optional.
Last name The user last name. This field is optional.
Email The user email address. This field is optional.
Password The password the user should use to access SOLIDserver. This field is optional.
Description The user description. This field is optional.
Authentication method The user authentication method. This field is optional.
Default page The user default page. This field is optional.
Class name The user class name. This field is optional.
Maintainer group The user maintainer group. This field is optional.
8. Click on NEXT . The page Class parameters. If you want to import class parameters for the
class you selected on the previous page, you can set the ones you need one by one in the
drop-down lists. All the fields are optional.
182
it, go to step 14.
15. Click on CLOSE to go back to the page Users. The users are now listed.
Importing Custom Data

Within a custom DB you can import one or several custom data entries. When importing a file
containing custom data, on the page CSV fields association, only the field Value 1 is required.
All the fields are named Value <number> to match the default column name of a custom DB.
To import custom data through a CSV file
opens.
2. In the section Customization, click on Custom DB. The page Custom database opens.
3. In the column Name, click on the name of the custom database of your choice. The page
Custom data of that database opens.
4. In the menu, select Add > Import > CSV custom data. The wizard Import a CSV file opens.
name.
Only the field Value 1 is required. There are in total 10 fields named Value 1 through to Value
10.
183
it, go to step 14.
15. Click on CLOSE to go back to the page Custom data. The entries are now listed.
Managing Import Templates

Every import template you created is listed on the page Import/Export Templates Management
of each module. On this page, you can either rename or delete the templates.
This page is composed of as many panels as there are pages where you can import data in the
module. Each panel lists all the templates configured on the page, the import templates are listed
as follows: Import: <template_name>.
To rename an import template
1. Go to the tab of your choice. If the homepage is not displayed, click on . The homepage
opens.
2. In the menu, select Settings > Import/Export templates management.The page Import/Export
Templates Management opens.
3. In the panel of your choice, select the Import: <template_name> you want to rename.
4. Click on RENAME . The wizard Rename template opens.
5. In the field New Name, rename your template.
6. Click on OK to commit your changes. The report opens and closes. The name changes in
the list.
To delete an import template
opens.
3. In the panel of your choice, select the Import: <template_name> you want to delete.
4. Click on DELETE . The wizard Delete template opens.
6. Click on OK to commit your changes. The report opens and closes. The template is no longer
listed.
184
Chapter 11. Importing IPAM Data
SOLIDserver offers several ways of importing data existing IP addresses organizations without
having to recreate them manually in the GUI.
You can import:
• VitalQIP data.
• Nortel NetID data.
Before importing, keep in mind that:
• The advanced properties can automate the creation of entries in your database after the import.
If all the advanced properties are activated, importing IPAM data may automatically update
the DHCP and DNS databases. If you do not want your import to impact other modules, edit
the internal module setup before importing IPAM data. For more details, refer to the chapter
• Other advanced options, like the IPv4 to IPv6 transition, the IPAM / Device Manager interaction
properties and the IPAM/VLAN interaction properties, may also update your database automat-
ically. For more details, refer to the chapters Setting Up a Transition From IPv4 to IPv6, Man-
aging the Interaction with the IPAM and Managing the IPAM/VLAN Interaction.
To import spaces, networks, pools or IP addresses from a CSV file, refer to the chapter Importing
Data from a CSV File.
Importing a VitalQIP Export

From the page All spaces you can import VitalQIP data in a .qef file. This file includes networks
and addresses so you need to import only one file to manage all your organization from the GUI.
To import VitalQIP data into SOLIDserver:
• The QIP export file (*.qef) must belong to an archive file which extension is .tar, .gz, .tgz, .tar.gz
or .zip .
• The .qef file must be located at the root of the archive file.
• The archive file does not need to include the files *_aud.qef as they are not relevant to the
import and might make your import take longer.
To import Vital QIP data
3. In the menu, select Add > Import > QIP data. The wizard Import entries from file opens.
4. Click on BROWSE to search for the CSV file to import. A window opens to help you browse
through folders, select the needed file.
5. Click on Open. The window closes and the file is visible in the field File name.
6. Click on NEXT . The page Select a space opens.
7. In the drop-down list Space, select one of the following options:
185
Importing IPAM Data
Table 11.1. Space field available options

Field Description
Create space per organization Select this option to create a space for each of the organizations that
you are importing. This option is selected by default.
Existing spaces Select a space to import your data to be imported in one of your exist-
ing spaces.
Note that all the data the space contains is imported as well (block-type networks, subnet-
type networks and addresses).
1
8. In the drop-down list Network (block) class, select an existing class to be applied to the
block-type networks you are importing. If no class exists or is enabled, only None is listed.
9. In the drop-down list Network (subnet) class, select an existing class to be applied to the
subnet-type networks you are importing. If no class exists or is enabled, only None is listed.
10. Click on OK to import the data. The report opens and closes. The data is listed according to
your import configuration.
Importing Nortel NetID IP Address Data

SOLIDserver allows to import NetID networks, subnet-type networks and host addresses. The
Nortel NetID database must be exported as a text file with a comma or semi-colon data delimiter.
Here below, are listed the Nortel NetID's fields that SOLIDserver can import via a CSV files.
To avoid missing any parameters or losing any data, we recommend that you follow the module
hierarchy during these imports in an existing space: block-type networks, subnet-type networks
and finally IP addresses .
For more details regarding CSV imports, refer to the section Importing Data to the IPAM.
Importing Nortel NetID Networks

In SOLIDserver, the Nortel NetID Networks are imported as networks (blocks). Here below are
listed the fields equivalence between the two appliances to help you go through with the networks
import.
Table 11.2. Nortel NetID network fields name when importing networks
Nortel NetID field SOLIDserver field
Network number First address
Network name Name
Subnet type -
CIDR mask -
Subnet mask Netmask
Importing Nortel NetID Subnets

In SOLIDserver, the Nortel NetID Subnets are also called networks (subnets). However, the
fields to describe them differ. For more details, refer to the table below.
1
The classes listed were created and enabled on the page Class Studio and apply to the IPAM networks. For more details, refer to the
chapter Configuring Classes.
186
Importing IPAM Data
Table 11.3. Nortel NetID subnet fields name when importing networks
Network number Address
Network name Name
Subnet type -
CIDR mask -
Subnet mask Netmask
Importing Nortel NetID Host Addresses

In SOLIDserver, the Nortel NetID Host addresses are also called addresses. Here below are
listed the fields equivalence between the two appliances to help you go through with the networks
import.
Table 11.4. Nortel NetID host addresses fields name when importing networks
Host address IP address
Domain name Domain
Client ID -
MAC address MAC address
ClMAC type -
Custom fields -
187
Chapter 12. Importing DHCP Data
SOLIDserver offers several ways of importing data from legacy DHCP to all other DHCP servers
managed through the GUI, these wizards are all the more useful during a migration. You can
import:
• ISC configuration files.

• Alcatel-Lucent VitalQIP configuration files.
• Microsoft configuration files.
• Infoblox configuration files.
• MetaIP configuration files.
• Nortel NetID configuration files.
in your database after the import. If all the advanced properties are activated, importing DHCP
data may automatically update the IPAM and DNS databases. If you do not want your import to
impact other modules, edit the internal module setup before importing DHCP data. For more
To import DHCP or DHCPv6 scopes, ranges and statics, refer to the section Importing Data to
the DHCP.
Importing an ISC DHCP Configuration

SOLIDserver allows importing DHCP configuration coming from the ISC DHCP software in IPv4.
Through this import, the whole DHCP server configuration create the following elements within
an EfficientIP DHCP server: scopes, ranges, leases, statics, groups and DHCP options. However,
there are some restrictions:
• Scopes restriction: if the server you are importing contains overlapping scopes, only the first
scope are imported, the rest is ignored.
• Statics restriction: statics associated to an IP address not included in one the scopes you
are importing are ignored.
• Shared network restriction: shared network options are ignored.
• DHCP options restriction: only standard options are supported during the import. If the
server was configured using non standard DHCP options, they can only be imported if they
were previously defined either in the configuration file or within the SOLIDserver appliance.
However, you can configure conditional options afterward using the DHCP ACLs.
The ISC DHCP loads its configuration from the file named dhcpd.conf. This file contains the whole
configuration of the DHCP server. SOLIDserver allows to import this file directly from its graphical
user interface at scope level of the DHCP organization.
EfficientIP recommends reducing all lease times to one hour before switching to the new
DHCP server in order to minimize the risk of duplicating IP address assignments during the
transition from the legacy DHCP server to SOLIDserver. This measure ensures that when you
turn off your legacy DHCP servers, the DHCP clients quickly move to SOLIDserver when their
lease renewal efforts fail: they broadcast their first DISCOVER message and get an answer
within the hour.
188
Importing DHCP Data
To import an ISC DHCP configuration
2. Click on Scopes. The page All scopes opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 scopes.
4. In the menu, select Add > Import > ISC DHCP. The Import an ISC dhcpd.conf file wizard
opens.
5. Click on BROWSE to find the ISC dhcpd.conf file. Once you clicked on Open, the file is visible
in the wizard File name field.
6. In the drop-down list DHCP server, select the target server.
7. Click on OK to commit the import the file. The report opens and closes. The file is listed.
This procedure also works from the page All scopes of the server for which you want to import
the ISC configuration: at server level click on the name of the server concerned, once on the
page All scopes, follow the procedure from step 4. The server is automatically selected in the
drop-down list DHCP server.
Several ISC configuration files can be imported one after the other on the same target DHCP
server. It allows to merge different DHCP configurations on one unique DHCP server. Through
all the imports, no data is deleted: if the configurations conflict with each other all the different
elements are added. In the same way, if two configuration files have a scope in common but
named differently, the first scope name imported is overwritten by the new scope name.
Importing an Alcatel-Lucent VitalQIP Configuration

SOLIDserver allows importing DHCP configuration coming from Alcatel-Lucent VitalQIP solution
in IPv4. The DHCP range concept does not exist in VitalQIP, each address identified as an object
in VitalQIP can become a dynamic assignment. SOLIDserver imports VitalQIP dynamic objects
as a DHCP range. If several VitalQIP contiguous dynamic objects are imported, SOLIDserver
adds only one dynamic DHCP range providing that VitalQIP dynamic objects share the same
DHCP option set. If not, several DHCP ranges are created.
SOLIDserver supports the following VitalQIP configuration of DHCP:
• DHCP server options.

• Scopes.
• Scope options.
• Ranges.
• Range options.
• Address pools.
• Static reservations.
• Static reservations options.
• DHCP option definitions.
The VitalQIP DHCP loads its configuration from the file named dhcpd.conf. This file contains the
whole configuration of the VitalQIP DHCP server. SOLIDserver allows to import this file directly
from its graphical user interface at scope level of the DHCP organization.
189
Importing DHCP Data
EfficientIP recommends reducing all lease times to one hour before switching to the new
DHCP server in order to minimize the risk of duplicating IP address assignments during the
transition from the legacy DHCP server to SOLIDserver. This measure ensures that when you
turn off your legacy DHCP servers, the DHCP clients quickly move to SOLIDserver when their
lease renewal efforts fail: they broadcast their first DISCOVER message and get an answer
within the hour.
To import a VitalQIP DHCP configuration
4. In the menu, select Add > Import > QIP DHCP. The Import a QIP DHCP configuration file
wizard opens.
5. Click on BROWSE to find the VitalQIP dhcpd.conf file. Once you clicked on Open, the file is
displayed in the field File name.
7. Click on OK to commit the import the file. The report opens and closes.
Several VitalQIP configuration files can be imported one after the other on the same target DHCP
Importing a Microsoft DHCP Configuration

SOLIDserver allows importing Microsoft DHCP server configuration in IPv4 from one file generated
by the Microsoft netsh command on your DHCP servers. The configuration files can be imported
from Microsoft Window Servers 2008, 2008 R2, 2012 R2 or 2016.
Microsoft netsh commands for DHCP offer a command-line tool that helps administrating the
DHCP servers and provides an equivalent alternative to console-based management. You can
run these commands from the command prompt of a Windows Server or from the command
prompt for the netsh DHCP context.
To run netsh commands from the command prompt of a Windows Server, you must include
"netsh dhcp" before every command and parameter as detailed below:
C:\netsh dhcp server \\myservername dump > C:\dump_dhcp.txt
This command, generated from your Microsoft DHCP server, allows to import its whole configur-
ation including:
• Definition of DHCP server options.

• Scopes.
• Scope options.
• Ranges.
• Address pools.
• Reservations.
190
Importing DHCP Data
• Reservation options.
• Exclusions.
Because several Microsoft DHCP configuration files can be imported into the same EfficientIP
DHCP server, DHCP options are not imported at the server level. They must be manually con-
figured.
Microsoft allows creating only one range per network (i.e. scope) and then exclude the ranges
of IP addresses you do not need. Unlike Microsoft, SOLIDserver allows to configure several
ranges in one scope. On the page All ranges, the list of Microsoft imported ranges does not display
exclusion ranges, it only lists the ranges created. For more details regarding EfficientIP and Mi-
crosoft DHCP management differences, refer to the explanation SOLIDserver DHCP configuration
vs. Microsoft DHCP configuration.
In the same way, when a Microsoft DHCP range contains a reservation, EfficientIP imports a
reservation wrapped around two DHCP ranges.
Keep in mind that with Win2008R2 it is impossible to create a static outside a range.
To import a Microsoft DHCP configuration
4. In the menu, select Add > Import > Microsoft DHCP. The Import a Microsoft DHCP server
dump wizard opens.
5. Click on BROWSE to find the Microsoft dump file. Once you clicked on Open, the file is displayed
in the field File name.
7. In the section Import global options, tick the box if you want to apply options configured in
the Microsoft DHCP dump to the destination server.
Several Microsoft configuration files can be imported one after the other on the same target
DHCP server. It allows to merge different DHCP configurations on one unique DHCP server.
Through all the imports, no data is deleted. If two configuration files have a scope in common
but named differently, the first scope name imported is overwritten by the new scope name.
Note that, for large configurations, SOLIDserver runs the import process in the background. As
it can take a while, the result is not displayed immediately.
Importing an Infoblox DHCP Configuration

SOLIDserver allows importing DHCP configuration coming from Infoblox solutions in IPv4.Through
this import the whole DHCP server configuration creates the following elements within an EfficientIP
DHCP server: scopes, ranges, leases, statics, groups and DHCP options. However, there are
some restrictions:
scope is imported, the rest is ignored.
191
Importing DHCP Data
• DHCP options restriction: only standard options are imported. If the server was configured
using non standard DHCP options, they are imported only if they were previously defined either
in the configuration file or within the SOLIDserver appliance.
• Failover restriction: Failover channels are not imported.
• Infoblox options restriction: all Infoblox options are ignored (these options usually include
"infoblox" in their name).
The Infoblox DHCP loads its configuration from the file named dhcpd.conf. This file contains the
whole configuration of the DHCP server. Within SOLIDserver:
• You must import your configuration at scope level within a specific DHCP server.
• You can import your configuration in a smart architecture as long as it is a One-to-One, a One-
to-Many or a Single-Server smart architecture. It is impossible to import this configuration in a
Split-Scope or a Stateless architecture.
To import an Infoblox DHCP configuration
4. In the menu, select Add > Import > Infoblox DHCP. The Import an Infoblox dhcpd.conf file
wizard opens.
5. Click on BROWSE to find the Infoblox dhcpd.conf file. Once you clicked on Open, the file is
the Infoblox configuration: at server level click on the name of the server concerned, once on the
Several Infoblox configuration files can be imported one after the other on the same target DHCP
Importing a MetaIP DHCP Configuration

SOLIDserver allows importing DHCP configuration coming from the Meta Info DHCP software
solution in IPv4. Through this import, the whole DHCP server configuration create the following
elements within an EfficientIP DHCP server: scopes, ranges, leases, statics, groups and DHCP
options. However, there are some restrictions:
192
Importing DHCP Data
scope is imported, the rest is ignored.
• DHCP options restriction: only standard options are imported. If the server was configured
using non standardDHCP options, they are imported only if they were previously defined either
in the configuration file or within the SOLIDserver appliance.
The Meta IP DHCP loads its configuration from the file named dhcpd.conf. This file contains the
whole configuration of the DHCP server. SOLIDserver allows to import this file directly from its
graphical user interface at scope level of the DHCP organization.
To import a MetaIP DHCP configuration
4. In the menu, select Add > Import > Meta IP DHCP. The Import a Meta IP dhcpd.conf file
wizard opens.
5. Click on BROWSE to find the Meta IP dhcpd.conf file. Once you clicked on Open, the file is
the Meta IP configuration: at server level click on the name of the server concerned, once on the
Several Meta IP configuration files can be imported one after the other on the same target DHCP
Importing a Nortel NetID Configuration

SOLIDserver allows to import DHCP configuration coming from Nortel NetID solution in IPv4.
SOLIDserver supports the following NetID configuration of DHCP:
• Scopes.
• Scope options.
• Ranges.
• Range options.
• Reservations.
• Reservations options.
193
Importing DHCP Data
The NetID DHCP loads its configuration from the file named dhcpcfg.cur. This file contains the
whole configuration of the NetID DHCP server. SOLIDserver allows importing this file directly
from its graphical user interface at scope level of the DHCP organization.
To import a NetID DHCP configuration
4. In the menu, select Add > Import > NetID DHCP. The Import a NetID DHCP dump file wizard
opens.
5. Click on BROWSE to find the NetID dump file. Once you clicked on Open, the file is displayed
in the field File name.
6. Click on NEXT . The page Select DHCP server preferences opens.
8. Using the following drop-down lists, select the elements you want to retrieve from the config-
uration file:
Table 12.1. NetID DHCP import options

Option Description
Scopes Specify if you want to import the scopes from the configuration file.
Scopes options Specify if you want to import the options tied to the scopes from the configuration file.
Ranges Specify if you want to import the ranges from the configuration file.
Ranges options Specify if you want to import the options tied to the ranges from the configuration file.
Statics Specify if you want to import the reservations (statics) from the configuration file.
Statics options Specify if you want to import the options tied to the reservations (statics) from the
configuration file.
9. Click on OK to commit the file(s) import. The report opens and closes.
Several NetID configuration files can be imported one after the other on the same target DHCP
194
Chapter 13. Importing DNS Data
SOLIDserver offers several ways of importing zones and RRs from legacy DNS servers to Effi-
cientIP DNS servers. The DNS data can be downloaded or transferred from the GUI without
having to install any tools on the remote system. You can import:
• BIND archive files.

• VitalQIP archive files.
in your database after the import. If all the advanced properties are activated, importing DNS
data may automatically update the IPAM and DHCP databases. If you do not want your import
to impact other modules, edit the internal module setup before importing DNS data. For more
To import zones and records from a CSV File, refer to the section Importing Data to the DNS.
Importing DNS Zones from a BIND Archive File

Within the DNS module you can import a BIND archive file containing all your zones.
Prerequisites
• The archive file must be imported in a DNS server, preferably an EfficientIP DNS server, an
EfficientIP DNS Package server or a smart architecture.
• The archive file must contain all the directories of your BIND configuration including: the
file named.conf, the zone files and any other necessary files whether they belong to the same
directory or other sub directories.
• The archive file must have one of the following extensions: .tar, .tgz, .gz or .zip . It is not ne-
cessary to change the directory paths of your zone files in the file named.conf , if you are not
able to provide the whole directory organizations in the archive file, the system can retrieve
the files in the archive (several zone files may use the same name in different directories).
Limitations
• You cannot use the characters "_", "@" and ":" when importing a BIND archive file. Make
sure you did not use any of these characters in zone names, record names, etc. as it would
trigger either parsing errors (and not import the file) or import everything but the line containing
these characters. For more details, refer to the RFC 1034Domain Names - Concepts and Fa-
cilities.
• The archive must only contain supported BIND options. Any non-supported BIND option
declared in the archive file is ignored. Once the archive file is imported, you can configure
these extra options following the appendix Configuring Non-Supported Options.
• The file named.conf can contain include directives linking to other files if any include directive
is declared outside existing clauses. Any include directive declared within existing clauses
like option {}, zone {}, etc. is ignored. The file(s) declared in the directive include must be part
of the archive file.
• The archive cannot contain the directive $GENERATE, this directive is not supported.
195
Importing DNS Data
Importing a BIND Archive File

Once you comply with the prerequisites and limitations, you can import your BIND archive file.
To import zones from a BIND archive file
3. Click on the name of the server in which you want to import the BIND archive file. The page
All zones opens.
4. In the menu, select Add > Import > BIND archive file. The wizard Importing a BIND archive
file opens.
5. Click on BROWSE to select the BIND archive file to import.
6. In the field File name, the file is displayed.
7. In the drop-down list DNS Server, select the server that should receive the configuration.
The server you click on is automatically selected.
8. In the drop-down list Action, you can either Import data or Check file.
9. You can tick the box Import all options if you want to import the global configuration settings
that apply to all the zones.
10. Click on OK to commit your import configuration. The report opens and works for a while
before displaying the import result and potential errors.
11. In the section Export format, you can download the import result report in TEXT , HTML or
EXCEL .
12. Click on CLOSE to go back to the page All servers .
Importing the Content of a BIND Zone

If you already created your BIND zone in the GUI, you can import its content from the page All
RRs of the zone.
This import relies directly on the BIND zone file itself, <zone-name>, without extension located
in the DNS database.
To import the content of a BIND zone
3. Click on the name of the server in which you want to import the BIND archive file. The page
All zones opens.
4. Click on the name of the zone. The page All RRs opens.
5. In the menu, select Add > Import > BIND zone file. The wizard Importing a BIND zone file
opens.
6. Click on BROWSE to select the BIND zone file to import.
8. Click on OK to commit the import. The report opens and closes. The resource records are
listed.
196
Importing DNS Data
Importing DNS Zones from a VitalQIP Archive File

From the DNS page All servers you can import VitalQIP data in a .qef file. Keep in mind that this
file includes and imports VitalQIP DNS as well as IPAM data at the same time.
To import VitalQIP data into SOLIDserver:
• The QIP export file (*.qef) must belong to an archive file which extension is .tar, .gz, .tgz, .tar.gz
or .zip .
• The .qef file must be located at the root of the archive file.
• The archive file does not need to include the files *_aud.qef as they are not relevant to the
import and might make your import take longer.
To import zones from a VitalQIP archive file
3. In the menu, select Add > Import > QIP data. The wizard Importing a QIP file opens.
4. Click on BROWSE to select the QIP archive file to import.
5. In the field File name, the file is displayed once selected.
7. In the drop-down list DNS Server, select the server that should receive the configuration.
8. Click on OK to commit your choice. The report opens and works for a while before displaying
the import result and potential errors.
9. In the section Export format, you can download the import result report in TEXT , HTML or
EXCEL .
10. Click on CLOSE to go back to the page All servers .
197
Chapter 14. Exporting Data
Within SOLIDserver, exporting data follows a set of rules:
• The object parameters that you can export correspond to the columns of the page
That way, on the one hand you can export the name of the object container: if you export a list
of zones you can also export the name of the server and view they belong to. And on the other
hand, you can export the customized parameters that you created through Class Studio and
displayed as columns.These columns are preceded by the mention Class param: in the wizard.
• An export is generated one level at a time
If you are exporting zones from the page All zones in the DNS, you only export the zones
themselves but not the RRs they contain.
• An export can be generated in five different formats
1
You can export lists of objects in .csv, .html, .xml, .xls and .pdf . Only the .csv file format provides
the possibility to reimport the list again in the GUI.
• An export can take into account from 1 to n objects
On any page, exporting data takes into account every object listed. However, if you tick one
or more elements, only the parameters of the ones you ticked are exported.
• An export can be done at a specific time or scheduled to be generated regularly
From the export wizard, you can choose to export the data right away or later on, even on a
regular basis and at the frequency of your choosing.
• An export name provides time and format information
An export is always named after its format and moment of generation, never after what it con-
tains. Each export is named as follows: export_<extension>_<date>_<time>.<extension>.
Where extension refers to the export format; date is displayed as such: YYYYMMDD and time
as such: HHMMSS. For instance, "export_excel_20130301_073042.xls" is an export generated
in EXCEL on March 1st, 2013 at 07:30:42.
• If the page does not have the menu Report, you cannot export the data listed
Within SOLIDserver, almost any page allows to export data. To see the whole list of pages
where you can export data, refer to the section Pages where you can export data below.
All exports are displayed on a single page, however the configuration files of the scheduled exports
are displayed on their own page.
You can export data from almost any page. The menu Report indicates which pages are con-
cerned:
Table 14.1. Pages where you can export data

Module Pages
IPAM All the pages of the module allow data exports
DHCP All the pages of the module allow data exports
1
Keep in mind when exporting data to a PDF file that the number of columns is limited to 40 and affects the final display and might
generate a file very hard to read.
198
Exporting Data
Module Pages
DNS All the pages of the module allow data exports, except All RPZ rules
NetChange All network devices
All VLANs
All ports
All discovered items
Device Manager All the pages of the module allow data exports
VLAN Manager All the pages of the module allow data exports
Administration Key Ring
All SOLIDserver
Groups
Users
Syslog
Session tracking
User tracking
Alerts
Custom database
Custom data
The Export Wizard

No matter what format you chose for the export, the Export <format> file wizard opens and looks
like the image below.
199
Exporting Data
Figure 14.1. The CSV export wizard
Template is a drop-down list that allows you to save all your configuration as a template for
later exports of the list.
When exporting CSV files, you can find two extra fields. First, the drop-down list Delimiter
allows you to select which delimiter you want to use during the data export. Second, the
2
box The export might be reimported can be ticked if you want to reimport the data in a
SOLIDserver appliance: this basically exports the list as raw data that is easier (and therefore
faster) to reimport.
Action is a drop-down list that allows you to export right away your list or schedule the export
it at the frequency of your choice.
Columns is a list that allows you to select the columns, i.e. parameters, of your choice. This
list contains all the columns that you can display on the page as well as the class parameters
related to the objects of the list.
Selected is a list that sums up all the columns that you selected and which data you are
about to export. It also allows you to order the data according to your needs.
Browsing the Exports Database

All the exports must be downloaded at the end of the export wizard.
Only the scheduled exports are available on the page Local files listing.The schedule configuration
is available on the page Scheduled exports.
2
Exporting data without ticking this box might trigger some errors. Some columns might not be imported at all, for instance the value
of the column Network is terminal cannot be imported if the box is not ticked.
200
Exporting Data
To display the scheduled exports
opens.
2. In the menu, select Maintenance > Local files listing. The page Local files listing opens.
By default, it displays the list Local where you can find all your exports.
To display the scheduled exports configuration
opens.
2. In the menu, select Monitoring > Scheduled exports. The page Scheduled exports opens.
Configuring Exports
The export can be of numerous forms as you can choose an export format, to schedule it or not
and finally save your columns configuration in a template and later on use the template as is or
use it as a basis during another export.
To export data immediately
1. Go to the page of your choice.

2. Tick the objects of your choice or none if you want to export the whole list.
3. In the menu, select Report > Export > format of your choice. The wizard Export <format>
file opens.
4. In the drop-down list Template:
a. Select None if you do want to create a template and go to step 5.

b. Select New template if you want to create a template. The field Template name appears,
name your template. The template saves the columns you select as well as the delimiter
if you export the list in a .csv file.
Once the export is generated, you can rename or delete the templates if need be. For
more details, refer to the section Managing Export Templates below.
5. If you chose to export a CSV file:
a. In the drop-down list Delimiter, select comma, semi-colon or tab.

3
b. Tick the box The export might be reimported to export the list or selected objects as
raw data.
6. In the drop-down list Action, select Generate new data.

7. In the list Columns, select one by one the columns that you want to export and click on .
They are moved to the list Selected.
8. In the list Selected, you can order the columns according to your needs using and . To
remove a column from the export, select it and click on . It is moved back to the list Columns.
9. Click on OK to commit the export. The report opens and works for a while.
3
This option must be ticked if you plan on reimporting some data, for instance the value of the Terminal column.
201
Exporting Data
10. You can click on DOWNLOAD to save the export. The page refreshes when the export is over.
11. Click on CLOSE to to close the wizard. The page is visible again.
From the menu Report > Export you can also schedule exports. Keep in mind that these exports
are managed differently: the generated file is available in the Local files Listing, plus scheduling
an export creates a configuration that you can manage on the page Scheduled exports. For more
details, refer to the section Managing Scheduled Exports Configuration Files below.
To schedule an export

2. Tick the objects of your choice or none if you want to export the whole list.
3. In the menu, select Report > Export > format of your choice. The wizard Export <format>
file opens.
4. In the drop-down list Template, you can:
a. Choose not to create a template by selecting None and export your data.
b. Choose to create a template by selecting New template. The field Template name ap-
pears, name your template. The template saves the columns you select as well as the
delimiter if you export the list in a .csv file.
5. If you chose to export a CSV file:
a. In the drop-down list Delimiter, select comma, semi-colon or tab.

b. In the section The export might be reimported, check the box to export the list or selected
objects as raw data.
6. In the drop-down list Action, select Schedule the report. The page refreshes.
7. In the list Columns, select one by one the columns that you want to export and click on .
They are moved to the list Selected.
8. In the list Selected, you can order the columns according to your needs using and . To
remove a column from the export, select it and click on . It is moved back to the list Columns.
10. Configure the export frequency or date and time (UTC) of the export using the table below.
Table 14.2. Scheduled export fields

Field Description
Day(s) of the week In this drop-down list, select a frequency (over the whole week or for a specific set of
days) or a specific day of the week. By default, Every day is selected.
Date of the month In this drop-down list, select a specific day of the month or a frequency (every day)
for the refresh. By default, Every day is selected.
Month In this drop-down list, select a specific month or a frequency (every month) for the
refresh. By default, Every month is selected.
Hour In this drop-down list, select a frequency (over the whole day or for a limited period
of time each day), a set of hours or a specific hour per day for the refresh. The hour
respects the UTC standard. By default, Every hour is selected.
Minute In this drop-down list, select the moment (o'clock, quarter past, half past or quarter
to) or the frequency (in minutes) of the refresh. The minute respects the UTC standard.
By default, Every minute is selected.
202
Exporting Data
Field Description
Name In this field, name the scheduled export in this field.
Mail to In this drop-down list, select the group which users should receive the export notification
email. This email cannot be sent if the users email address is not valid or if your SMTP
relay is not configured. For more details, refer to the section Configuring the SMTP
Relay. By default, the first of your groups, in the ASCII alphabetic order, is selected.
Rights as In this drop-down list, select a user. His/her rights and limitations are applied in the
report: only the items this user has access to are listed in the export.
11. Click on OK to commit the export. The report works and displays the export report.
12. Click on CLOSE to go back to the page.
The export configuration is available on the page Scheduled exports. For more details, refer
to the procedure To display the scheduled exports configuration.
When the export is generated, it is available on the page Local files listing. For more details,
refer to the procedure To display the scheduled exports.
Exporting Data To Reimport It Later

Any list you might have exported can be reimported on most pages as long as you exported it in
a CSV file. For more details, refer to the table IPAM pages where you can import CSV files. We
strongly recommend that during the export you tick the box The export might be reimported,
to make it faster to process.
Keep in mind that in each of these modules and pages, you can reimport all the parameters of
your choice but some columns are required, and without them, you cannot go through with the
import. So when exporting, you must select these columns. In the sections below, we will only
detail the pages where you can actually import data.
Required Columns To Reimport Data in the IPAM Module

The export wizard is accessible in the menu Report of any page of the module IPAM. On each
page, some data is required during an import so you might need the columns listed in the table
below if you intend to reimport a CSV file.
Keep in mind that the field Space name of the import wizard allows you to:
• Select the corresponding column of your CSV file

• Select one space among the ones in your database or the option Use best space, with IPv4,
the option uses the IP address and size to place the object in the best space, block-type network
and/or subnet-type network possible.
Table 14.3. Required columns to reimport data in the IPAM

Object Listing page required Column name in the ex- Column name in the im-
column(s) port wizard port wizard
On the page All spaces
Space Name Space Name Name
On the page All networks
Block-type network Start Network start address First address
Space Space name Space name
203
Exporting Data
Object Listing page required Column name in the ex- Column name in the im-
Block-type network (v6) Start Network start address First address
Prefix Network prefix Prefix
a
Subnet-type network Address Address + prefix Address
Name Network name Name
Subnet-type network (v6) Address Network address Address
Prefix Network prefix Prefix
Name Network name Name
On the page All pools
Pool Start address Pool start address First address
Name Pool name Name
Pools (v6) Start address Pool start address First address
End address Pool end address Last address
Name Pool name Name
On the page All addresses
IP address Address IP address IP address
Name IP name Name
IP address (v6) Address IP address IP address
Name IP name Name
On the page All VRFs
VRFs Name VRF name VRF name
RD ID VRF RD ID VRF RD ID
On the page All VRF Route Targets
VRF Route Targets Source RD ID Source RD ID Source RD ID of the VRF
Route Targets
Target RD ID Target RD ID Target RD ID of the VRF
Route Targets
a
This field can be used to export and reimport the network start address and size.
Required Columns To Reimport Data in the DHCP Module

The export wizard is accessible in the menu Report of any page of the module DHCP, except
the pages All servers, All leases and All leases (v6). On each page, some data is required during
an import so you need the columns listed in the table below if you intend to reimport a CSV file.
Keep in mind that the DHCP server and DHCP6 server fields of the import wizard allow you to:
• Select the corresponding column of your CSV file

• Select one server among the ones in your database.
204
Exporting Data
Table 14.4. Required columns to reimport data in the DHCP

DHCP page Listing page required Column name in the ex- Column name in the im-
All scopes Address DHCP scope address Address
Server DHCP server name DHCP server
All ranges Start address DHCP range start addr Start address
All statics Name DHCP static name DHCP static name
MAC address MAC address MAC address
All scopes (v6) Address Address Start address
Server Server DHCP6 server
All ranges (v6) Start address Start address Start address
End address End address End address
All statics (v6) Name DHCP static name DHCP static name
Required Columns To Reimport Data in the DNS Module

The export wizard is accessible in the menu Report of any page of the module DNS. On each
page some data, is required during an import so you need the columns listed in the table below
if you intend to reimport a CSV file.
Table 14.5. Required columns to reimport data in the DNS

DNS page Listing page required Column name in the ex- Column name in the im-
All zones Name Zone name DNS zone name
Type Zone type DNS zone type
Server DNS server name DNS server name
All RRs RR name RR name RR name
a
Value RR value Value 1
Zone DNS zone name Zone name
Type Space name RR type
a
This field includes all the information exported from the column Value.
Required Columns To Reimport Data in NetChange Module

The export wizard is accessible in the menu Report of any page of the module NetChange. On
each page, some data is required during an import so you need the columns listed in the table
below if you intend to reimport a CSV file.
Table 14.6. Required columns to reimport data in NetChange

NetChange page Listing page required Column name in the ex- Column name in the im-
All network devices Space Space Name Target space
205
Exporting Data
Required Columns To Reimport Data in Device Manager Module

The export wizard is accessible in the menu Report of any page of the module Device Manager.
On each page, some data is required during an import so you need the columns listed in the
table below if you intend to reimport a CSV file.
Table 14.7. Required columns to reimport data in Device Manager

IPAM page Listing page required Column name in the ex- Column name in the im-
All devices Name Device name Name
All ports & interfaces Name Interface name Name
Type Type Type
Space Device name Device
Required Columns To Reimport Data in VLAN Manager Module

The Export wizard can be accessed through the Report menu on any page of the VLAN Manager
module. Some data is required on each page during an import, therefore, you might need to
specify the columns listed in the table below if you intend to reimport a CSV file.
Table 14.8. Required columns to reimport data in VLAN Manager

IPAM page Listing page required Column name in the ex- Column name in the im-
All domains Name Name Name
Start ID Domain Start ID Start ID
End ID Domain End ID End ID
All ranges Name Name Name
Start ID Range Start ID Start ID
End ID Range End ID End ID
Domain Range Domain Domain
All VLANs VLAN ID VLAN ID VLAN ID
Range Range Range
Domain Domain Domain
Required Columns To Reimport Data in the Administration Module

The Export wizard can be accessed through the Report menu on a limited number of pages of
the Administration module: Key Ring, All SOLIDserver, Groups, Users, Session tracking, User
tracking, Alerts, Custom database and Custom data.
Table 14.9. Required columns to reimport data on the module Administration

Administration page Listing page required Column name in the ex- Column name in the im-
Groups Name Name Name
Users Login Login Login
Custom data First column / Value 1
206
Exporting Data
Managing Scheduled Exports

Once generated, all the scheduled exports are saved in the directory /data1/exports. In the
GUI, they are available in the page Local files listing, under the filter page Local, where you can
export or delete them.
Each column on the page corresponds to the parameters configured during the export configur-
ation. You can sort the list through each column, you can filter it through the columns Name,
Type and Owner. You cannot edit the listing layout of this page or access a properties page as
all the information is displayed.
To download a scheduled export from the Local files listing
opens.
By default, it displays the list Local where you can find all your scheduled exports.
3. Click on the name of the export of your choice to download it.
To delete a scheduled export from the Local files listing
opens.
By default, it displays the list Local where you can find all your scheduled exports.
3. Tick the export(s) you want to delete.
4. In the menu, select Edit > Delete file(s). The wizard Delete file opens.
5. Click on OK to commit the export file deletion. The report opens and closes. The page re-
freshes, the selected scheduled export is no longer listed.
Managing Scheduled Exports Configuration Files

If you created scheduled exports, the configuration file is on the page Scheduled exports. Once
created a scheduled export, you cannot edit its configuration. However, you can disable and
enable it or even delete it.
All the configuration files are listed and each column corresponds to the parameters configured
during the scheduled export creation.You can sort and filter the list through each column but you
cannot edit the listing layout of this page. The scheduled exports do not have a properties page
as all the information is displayed.
To enable/disable a scheduled export configuration file
opens.
3. Tick the configuration file(s) of your choice.
4. In the menu, select Edit > Enable or Disable. The wizard opens.
207
Exporting Data
5. Click on OK to commit your modification. The report opens and closes. The file is marked
OK or Disabled.
To delete a scheduled export configuration file
opens.
3. Tick the configuration file(s) you want to delete.
5. Click on OK to commit the file deletion. The report opens and closes. The page refreshes,
the file is no longer listed.
Managing Export Templates

Every export template you created is listed on the page Import/Export Templates Management
of each module. On this page, you can either rename or delete the templates.
This page is composed of as many panels as there are pages where you can import data in the
module. Each panel lists all the templates configured on the page, the export templates are listed
as follows: Export: <template_name>.
To rename an export template
opens.
3. In the panel of your choice, select the Export: <template_name> you want to rename.
4. Click on RENAME . The wizard Rename template opens.
6. Click on OK to commit your changes. The report opens and closes. The name changes in
the list.
To delete an export template
opens.
3. In the panel of your choice, select the Export: <template_name> you want to delete.
4. Click on DELETE . The wizard Delete template opens.
6. Click on OK to commit your changes. The report opens and closes. The template is no longer
listed.
208
EAST ASIA
RIO DE
JANEIRO
Part IV. IPAM Management

The Internet Protocol Address Management (IPAM) was designed to plan, track, organize and manage IP
addresses into networks. This organization can rely on IPv4 that manages 32-bit addresses or on IPv6 that
manages 128-bit addresses.
CLIENTS
AMERICA EUROPE ASIA
USA CHINA
NEW YORK BEIJING
BRAZIL INDIA
AFRICA
BRASILIA NEW DELHI
OCEANIA
Figure 88. Representation of the IPAM hierarchy
Within SOLIDserver, the IPAM has a dedicated module. From its dashboard, or homepage, you can access
the key levels of the hierarchy.
Figure 89. The IPAM dashboard
The IP address management requires to create a space, within which you create a block-type network, that
contains at least one subnet-type network that manages your IP addresses. You can also add a pool to
configure some or all of your IP addresses with extra parameters. If you want to import an existing IPAM
organization, refer to the part Imports and Exports.
The IPAM hierarchy can include up to 5 levels of organization:

• Space: the highest level of the hierarchy, the essential entry point of the IP address management. It is
required to create at least one. It defines the addressing space in which all the IP addresses are unique
and can contain both IPv4 and IPv6 address organizations.You can create as many spaces as you need,
they contain block-type networks. For more details, refer to the chapter Managing Spaces.
• Block-type network: the second level of the hierarchy, where you set the range of IPv4 or IPv6 addresses
that you manage within your space.You must create at least one to manage IP addresses.You can create
as many block-type networks as you need within a space, as long as they do not overlap each other.
They contain subnet-type networks. For more details, refer to the chapter Managing Networks.
• Subnet-type network: the third level of the hierarchy, where you can assign IPv4 or IPv6 addresses. It
is required to create at least one to manage IP addresses. You can create as many subnet-type networks
as you need within a block-type network, as long as they do not overlap each other. They contain pools
and/or IP addresses. For more details, refer to the chapter Managing Networks.
• Pool: the pool is an optional fourth level of the hierarchy. It can contain IPv4 or IPv6 addresses and allows
to set them with specific parameters. For more details, refer to the chapter Managing Pools.
• IP address: the lowest level of the hierarchy. They can belong to IPv4 or IPv6 pools and/or subnet-type
networks. For more details, refer to the chapter Managing IP Addresses.
Note that you can customize your organization display in the Tree view. For more details, refer to the section
Tree View of the chapter Understanding the GUI.
The IPAM module also provides:
• Transition from IPv4 to IPv6.You can configure the IPAM to automate the creation of IPv6 objects when
you create them in IPv4. For more details, refer to the chapter Setting Up a Transition From IPv4 to IPv6.
• Templates for IPv4 organizations. You can create templates to ease up the creation of IPv4 objects
with specific configurations or content. For more details, refer to the chapter Managing IPAM Templates.
• Variable Length Subnet Mask (VLSM). You can delegate and organize on different levels your spaces
and/or networks in IPv4 or IPv6. For more details, refer to the chapter Using VLSM to Manage Your IPAM
Network.
• VRF management.You can create and manage VRFs and VRF Route Targets from two dedicated pages.
For more details, refer to the chapter Managing VRF.
• Network to VLAN association. You can create a subnet-type network and associate it with a VLAN of
the module VLAN Manager. For more details, refer to the chapter Managing the IPAM/VLAN Interaction.
• Automation of DHCP and DNS resources creation.The advanced properties allow to automate creations
in the DHCP or DNS when you create IPAM resources. For more details, refer to the chapter Managing
• RIPE database management. Thanks to a dedicated license you can configure the connection to the
RIPE and manage your networks, inetnums, net6nums, persons and aut-num from the IPAM. For more
details, refer to the appendix SPX.
Chapter 15. Managing Spaces
The space is the highest level in the IPAM module's organization, the entry point of any IPv4 or
IPv6 addressing plan. It allows to manage unique ranges of IP addresses.
Browsing Spaces
Spaces are managed on the page All spaces. They contain the networks, pools and IP addresses.
SPACE NETWORK NETWORK POOL ADDRESS

BLOCK SUBNET
ALIAS
Figure 15.1. The space in the IPAM hierarchy
Spaces provide uniformity and consistency check that ensure uniqueness of IP resources: there
cannot be two identical configurations of IP addresses, pools or networks within one space. To
manage identical N address plans, you can create N spaces in the IPAM module.
You can create as many spaces as you want to organize your addressing plan(s) or set up multiple
private networks following RFC 1918. Each space can contain as many block-type networks as
you need, their size defines the number subnet-type network, pools and IP addresses that you
actually manage.
By default, the space Local is present on the page All spaces. It is configured to receive all the
DHCP and DNS resources configured with replication that are not attached to any space.
Browsing the Spaces Database

To display the list of spaces
3. You can look for a specific space using the search engine of the column Name.
To display a space properties page
2. In the breadcrumb, click on All spaces. The page All spaces opens.
4. At the end of the line of the space of your choice, click on . The properties page opens.
Customizing the Display on the Page All Spaces

Users of the group admin can create customized column layouts that any user can display from
the menu Display. For more details, refer to the section Customizing the List Layout.
211
Managing Spaces
Adding a Space
Spaces allow to set up addressing plans containing either IPv4 or IPv6 addresses.You can create
as many spaces as you need or use the space Local, created by default.
Note that you can also import spaces, for more details refer to the section Importing Spaces.
To add spaces, you can use the menu or click on the button in the upper-right corner of the
page All spaces.
If you plan on adding different spaces with similar properties, creating a template might be useful.
For more details, refer to the chapter Managing IPAM Templates.
To add a space
3. In the menu, select Add > Space. The wizard Add a space opens.
4. In the list VLSM parent space, select None or one of the existing empty spaces. If you select
an existing space as VLSM parent space, the new space is affiliated to the space you selec-
ted. For more details, refer to the chapter Using VLSM to Manage Your IPAM Network.
6. If you or your administrator created classes at space level, in the list Space class, select a
class or None. Click on NEXT . The last page of the wizard opens.
Note that if no class is set and enabled, the class dedicated page of the wizard is automatically
skipped. Applying a class on an object can impact the configuration fields available and/or
required, for more information contact your administrator.
7. In the field Space name, name the space.
8. In the field Description, you can type in a description of the space.
9. Depending on the administrator's configuration, you may be able to fill in the advanced
properties fields following the table below.
Table 15.1. Advanced properties configuration

Field Description
Advanced properties Select either Default or All.
Default This value indicates that all the fields/options displayed in the wizard are part of
the wizard default display. This display configuration is available to your admin-
istrator via the wizard Advanced properties customization. For more details, refer
to the chapter Managing Advanced Properties; the IPAM properties are detailed
in the section Configuring IPAM Advanced Properties.
All This value allows to display all the advanced property fields/options that can be
displayed in this wizard. For more details, refer to the chapter Managing Advanced
Properties.
10. Click on OK to commit the configuration. The report opens and closes. The new space is
listed.
212
Managing Spaces
Editing a Space
At any time you can edit an existing space. You can either edit it from its properties page or via
the contextual menu on the page All spaces.
To edit a space
3. At the end of the line of the space of your choice, click on . The space properties pages
opens.
4. In the panel Main properties, click on EDIT .
5. The wizard Edit a space opens.

6. In the list VLSM parent space, select a parent space if need be.
9. Edit the Space name, Description and Advanced properties fields according to your needs.
10. Click on OK to commit your modifications. The report opens and closes. The changes are
listed in the panel.
Deleting a Space
At any time you can delete a space. Keep in mind that:
• Deleting a space also deletes all the addresses, pools and networks it contains.
• You cannot delete a space containing other spaces. For more details regarding Variable Length
Subnet Masking, refer to the chapter Using VLSM to Manage Your IPAM Network.
• None of the resources created in the DNS and DHCP from the IPAM, through the advanced
properties, are deleted. This is a safety measure in case a space is deleted by mistake.
To delete a space
3. Tick the space(s) you want to delete.
5. Click on OK to commit the deletion. The report opens and closes. Selected spaces are no
longer listed.
213
Managing Spaces
Defining a Space as a Group Resource

In SOLIDserver, only users of the group admin can manage and modify the items of every module.
Adding a space as one of the resources of a specific group allows the users of that group to
manage the space(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a space as a resource also grants access to every item it contains. For more
details, refer to the section Assigning Resources to a Group in the chapter Managing Groups.
214
Chapter 16. Managing Networks
Within the IPAM hierarchy the networks are a key level where you define ranges of IP addresses
to work with. Their management follows the recommendations introduced with the RFC 950, that
was aimed at providing a solution to the problems that the Internet community was facing with
dual hierarchical address levels.
The networks help you set the organization that suits your needs: it can allow to set a range of
addresses dedicated to your customers, and within that range a network for the customers of
specific country/city; or it can help delegate terminal network management tasks to administrators.
You can manage IPv4 and IPv6 networks, within one space. To successfully set up your address-
ing organization, you must create within a space:
1. A block-type network, where you set the range of addresses you want to manage. This net-
work is by essence non-terminal. That network contains:
2. One or several subnet-type networks. These networks can be terminal so you can assign
the IP addresses they contain, or non-terminal and contain other subnet-type networks. For
more details, refer to the chapter Using VLSM to Manage Your IPAM Network.
At network level, the IP address management follows some basic rules:
• All block-type networks belong to a space.

• Block-type networks cannot overlap each other in a space.
• All subnet-type networks belong to a block-type network.
• Subnet-type networks cannot overlap each other in a block-type network.
• A subnet-type network is defined by an IP address, size and name.
If you want to manage RIPE networks and objects, refer to the appendix SPX.
Browsing Networks
The page All networks manages both block-type and subnet-type networks, these subnet-type
networks can be terminal or not.
Block-type networks, or level 0 networks, belong to spaces and are the second level of the IPAM
hierarchy. They set the range of IPv4 or IPv6 addresses that you can divide into subnet-type
networks. On the page they are preceded by .

BLOCK SUBNET
ALIAS
Figure 16.1. The block-type network in the IPAM hierarchy
215
Managing Networks
1
Subnet-type networks, or level 1 (to n) networks, belong to block-type networks and are the third
level of the IPAM hierarchy. Terminal networks contain IPv4 or IPv6 addresses that you can assign.
On the page they are preceded by .

BLOCK SUBNET
ALIAS
Figure 16.2. The subnet-type network in the IPAM hierarchy
You can divide the IP addresses of a subnet-type network into pools. For more details, refer to
the chapter Managing Pools.
The icon color provides information on the network. When is blue it indicates small sized network
managing 2 or 1 IP address. It precedes /31 and /32 networks in IPv4, and /127 and /128 networks
in IPv6.
Browsing the Networks Database

To display the list of networks
2. In the breadcrumb, click on All networks. The page All networks opens.
3. On the right-end side of the menu, click on V4 or V6 depending on your needs.
Both block-type and subnet-type networks are listed.

4. You can look for a specific block-type network using the search engine of the columns Name
and Address + prefix.
To display the list of networks of a specific space
3. On the right-end side of the menu, click on click on V4 or V6 depending on your needs.
4. In the column Space, click on the name of your choice. Only the networks of that space are
listed.
To display the networks of a specific block-type network
4. In the column Container, click on the name of your choice. Only the networks of that network
are listed.
1
Subnet-type networks can also belong to non-terminal subnet-type networks. For more details, refer to the chapter Using VLSM to
Manage Your IPAM Network.
216
Managing Networks
In this column, N/A is displayed on the line of block-type networks.
To display a network properties page
5. At the end of the line of the network of your choice, click on . The properties pages opens.
If you or your administrator configured IPAM to DHCP advanced properties, some subnet-type
networks have a panel DHCP options on their properties page, to configure DHCP options for
the scope associated with the network. For more details, refer to the chapters Managing Advanced
Properties and Setting DHCP Options.
Customizing the Display on the Page All Networks

Keep in mind that:
• In IPv4 you can display the column Free IP. It indicates the total number of free addresses in
each subnet-type network.
• In IPv6 you can display colored labels above parts of the IP addresses listed. It allows to differ-
entiate at a glance your containers. For more details, refer to the chapter Managing IPAM and
DHCP IPv6 Labels.
Understanding the Network Statuses

The column Status provides information regarding the terminal networks you manage.
Table 16.1. Terminal subnet-type network statuses

Status Description
Unmanaged The network is not managed.
OK The network is configured and managed.
Creating The delayed status while you wait for the RIPE to confirm the network creation.
Deleting The delayed status while you wait for the RIPE to confirm the network deletion.
NOT VALID The subnet-type network size does not fit in the block-type network although it was validated
by the RIPE.
Adding Networks
To manage IP addresses, you must define a range of IP addresses to work with, with a block-
type network, and then set the range of addresses you can assign, with a terminal subnet-type
network.
To add a block-type network, refer to the section Adding Networks Manually.
217
Managing Networks
To add a subnet-type network, refer to the section Adding Networks Manually or Adding Networks
Using the Option By Search. The option By search allows to find the first available section of free
IP addresses within a space based on a network size.
Adding Networks Manually

You can manually add IPv4 or IPv6 networks from the page All networks:
1. First, you must add a level 0 network, a block-type network, to define the range of addresses
2. Second, you can add a terminal subnet-type network. If you add non-terminal networks, you
need at least one terminal network where you can assign IP addresses.
By default, the first and last IP address of a terminal network you create are reserved for the
network and broadcast. The networks managing two or fewer addresses do not reserve any IP
address.
Before creating a network keep in mind that:
• Several networks can be named the same.

• Several block-type networks cannot overlap each other in one space.
• Several subnet-type networks cannot overlap each other in one non-terminal network.
• By default in IPv6, you can only manually create /64, /127 or /128 terminal networks. If you
want to configure them with a different prefix, refer to the section Enabling the Creation of IPv6
Terminal Networks with Non-Standard Prefixes.
• You can also use templates to add several networks with similar properties. For more details,
refer to the chapter Managing IPAM Templates.
Note that you can also import networks, for more details refer to the section Importing Networks.
To add a block-type network manually
4. In the menu, select Add > Network or Network (v6) > Manual. The wizard opens.
2
5. In the drop-down list Network type, select Block . Click on NEXT . The next page of the wizard
opens.
6. In the list Choose a space, select the space in which you want to add the network. Click on
NEXT . The next page of the wizard opens.
7. If you or your administrator created classes at network level, in the list Network class select
a class or None. Click on NEXT . The page Add an IPv4 network or Add an IPv6 network
opens.
8. In the field Network Name, name the network.
2
If your group's permissions do not include the addition of both block-type and subnet-type networks, the page is automatically skipped.
218
Managing Networks

10. In the field Address, type in the start address.
11. If you are adding an IPv4 network:
a. In the drop-down list Netmask select a netmask. The netmask value automatically edits
the Prefix.
b. In the drop-down list Prefix, select a value if you did not choose a netmask. The prefix
value automatically edits the Netmask.
The network size configuration is visible in the field Comment.

12. If you are adding an IPv6 network, in the drop-down list Prefix, select a value between /16
and /64. The values depend on the Address you specified.
If your administrator disabled the RFC 4291 compliance registry database entry, you can
select a prefix between /16 and /128. For more details, refer to the section Enabling the
Creation of IPv6 Terminal Networks with Non-Standard Prefixes.

Field Description
Properties.
14. Click on OK to commit the addition. The report opens and closes. The network is listed.
Once you created a block-type network, you can create the subnet-type networks it contains.
To add a subnet-type network manually
3
5. In the drop-down list Network type, select Subnet . Click on NEXT . The next page of the
wizard opens.
6. In the list Choose a parent space, select a non-terminal network among the ones listed under
each space. The + sign left of the spaces' name opens the list of their networks. Click on
3
219
Managing Networks
opens.
9. In the field Description, you can type in a description. The field may be in read-only because
it is Inherited from a higher level. If you want to specify a different description and/or restrict
its propagation to lower levels, you must Set its Inheritance property and/or Restrict its
Propagation property before being able to specify any value in the field. For more details,
refer to the chapter Inheritance and Propagation.
10. In the field Address, type in the start address. By default, the start address of the block-type
network you selected is displayed in the field.
a. In the drop-down list Netmask, select a netmask. The netmask value automatically edits
the Prefix.

12. If you are adding an IPv6 network, in the drop-down list Prefix, select /64, /127 or /128.
13. The box Terminal network is ticked by default to create a terminal network that automatically
has a gateway. Depending on your administrator's display configuration:
a. The field Gateway can be displayed and you can edit it.
b. The field Gateway can be hidden but it is created anyway, based on the gateway offset
calculation set in the wizard Advanced properties customization at network level.
You can untick the box if you want to create a non-terminal network that can contain other
networks, in this case the network does not have a Gateway. For more details, refer to the
section Setting Up a Network-Based VLSM Organization.

Field Description
220
Managing Networks
Field Description
Properties.
15. Click on OK to commit your creation. The report opens and closes. The network is listed.
Adding Networks Using the Option By Search

You can use the option By search to create subnet-type IPv4 or IPv6 networks based on a network
size. This option is designed to find matching ranges of available IP addresses within a space
that you can choose from.
Before creating a network using the option By search keep in mind that:
• Several networks can be named the same.

• The option only allows to create subnet-type networks, they can be terminal or non-terminal.
• The wizard offers a list of the available start addresses matching your network size criteria.
These results are displayed in ascending order from the non-terminal network with the most
important fragmentation to the one with the least fragmentation. The hierarchy is symbolized
by stars, three stars being the most.
• Several subnet-type networks cannot overlap each other in one non-terminal network.
• By default in IPv6, you can only create /64, /127 or /128 terminal networks. If you want to
configure them with a different prefix, refer to the section Enabling the Creation of IPv6 Terminal
Networks with Non-Standard Prefixes.
You can use the option via in the menu Add or the button + on the right-end side of the menu
area on the page All networks.
To create an IPv4 network using the option By search
4. In the menu, select Add > Network > By search (subnets). The wizard opens.
5. In the list Choose a space, select the space of your choice. Click on NEXT .
6. If you or your administrator applied classes on some block-type network(s), in the list Parent
network class you can select a class. Selecting a class or No class narrows the search for
available sections of IP addresses within the networks using the class selected or no class.
Click on NEXT . The next page opens.
a class or None. Click on NEXT . The page Network size opens.
221
Managing Networks
8. Select a Size, Prefix or Netmask for your network. Selecting one value automatically changes
the other two. Click on NEXT . The page Search result opens.
9. In the list Network address, select a start address. Click on NEXT . The page Add an IPv4
subnet opens.
12. The fields Address and Prefix display the values set on the pages Network size and Search
result.

Field Description
Properties.
To create an IPv6 network using the option By search
2. Click on Network (v6). The page All networks opens. On the right-end side of the menu,
make sure V6 is white.
3. In the menu, select Add > Network (v6) > By search (subnets). The wizard opens.
4. In the list Choose a space, select the space of your choice. Click on NEXT .
5. If you or your administrator created classes at network level, in the list Parent network class
select a class or None. Click on NEXT . The page Network size opens.
222
Managing Networks
7. The box Terminal network is ticked by default. You can untick it if you want to create a non-
terminal network that can contain other networks. For more details, refer to the section Setting
Up a Network-Based VLSM Organization.
8. In the drop-down list Network prefix, select the network prefix.
a. If the box Terminal network is ticked, select 64 bits, 127 bits or 128 bits.
b. If the box Terminal network is not ticked, select a prefix between 8 bits and 64 bits.
select a prefix between 8 bits and 128 bits whether the network is terminal or not. For more
details, refer to the section Enabling the Creation of IPv6 Terminal Networks with Non-
Standard Prefixes.
Click on NEXT . The page Search result opens.

9. In the list Network address (v6), select a start address. Click on NEXT . The page Add an
IPv6 network opens.
result.
13. If the box Terminal network was ticked and depending on your administrator's display con-
figuration:

Field Description
223
Managing Networks
Field Description
Properties.
Enabling the Creation of IPv6 Terminal Networks with Non-Standard Prefixes

By default, the IPv6 terminal networks addition wizard offers only three prefixes: /64, /127 and
/128 to comply with RFC 4291.
If want to configure terminal networks with other, non-standard, prefixes, your administrator can
break the compliance with RFC 4291 by enabling the registry database entry module.ip.viol-
ate.rfc4291. Once the registry entry is enabled, any prefix matching the terminal network start
address is returned by the drop-down list Network prefix.
Note that enabling the registry database also modifies the content of drop-down list Network
prefix for non-terminal networks.
To edit the registry key that enforces the compliance with RFC 4291

opens.
3. In the column Name, type in 4291. Only the entry module.ip.violate.rfc4291 is listed.
opens.
5. In the field Value, type in 1 to enable it. By default, its value is 0.
Editing Networks
You can edit networks from the page All networks via the contextual menu or from their properties
page. Other network editions like splitting, merging or moving are detailed in the following sections.
Before editing a network properties keep in mind that you cannot edit networks created using a
template. For more details, refer to the chapter Managing IPAM Templates.
To edit a network
2. Click on Network. The page All network opens.
4. At the end of the line of the network of your choice, click on . The properties pages opens.
224
Managing Networks
5. In the panel Main properties, click on EDIT . The wizard opens.

a class or None. Click on NEXT . The page Edit an IPv4 network or Edit an IPv6 network
opens.
7. Edit the Network name, Description according to your needs.
8. If you are editing a subnet-type network, the box Terminal network is displayed.
a. You can tick the box, in this case the network is terminal and has a gateway. Depending
on your administrator's display configuration, the field Gateway can be displayed and
you can edit it.
b. You can untick the box, in this case the network is non-terminal and can contain other
networks. For more details, refer to the section Setting Up a Network-Based VLSM Or-
ganization.
Keep in mind that you cannot make a terminal network non-terminal or vice versa if they
contain other networks or pools.

Field Description
Properties.
10. Click on OK to commit your changes. The report opens and closes. The changes are listed
in the panel.
Splitting Networks
You can split IPv4 or IPv6 networks to manage the IP addresses they contain in separate networks.
Before splitting network, keep in mind that:
• You can split a network into 2, 4 or 8 smaller networks of same size.

• The new networks are all named after the network you split.
• When splitting a terminal network, the new smaller networks all use the first available IP address
as their gateway.
• You can split a network containing other networks only if the operation does not impact the
networks it contains.
225
Managing Networks
• If the networks are configured with advanced properties, splitting them might compromise your
original configuration.
• You cannot split unmanaged networks.
To split a network
2. Click on Networks. The page All networks opens.
4. Tick the network(s) you want to split.
5. In the menu, select Edit > Split. The wizard Splitting networks opens.
6. In the drop-down list Number of networks to create, select 2, 4 or 8. By default, 2 is selected.
7. Click on OK to commit the split. The report opens and closes. The networks are listed.
Merging Networks
You can merge IPv4 or IPv6 terminal networks, to manage more addresses. Before merging
subnet-type networks, keep in mind that:
• You can only merge subnet-type networks.

• You can only merge networks belonging to the same non-terminal network, either a non-ter-
minal subnet-type network or a block-type network.
• You can only merge contiguous networks.
• You can only merge networks of equal size.
• The new network is named after the very first network in the list that manages all the IP ad-
dresses of the selected networks.
• The number of networks before the merge must be a power of two (2, 4, 8, 16, 32, 64, ...).
• The new larger network uses one of the existing gateway addresses as gateway for the new
network.
• The result of the merge must produce a network with a netmask address boundary.
• You cannot merge unmanaged networks, IPv6 networks or block-type networks.
To merge subnet-type networks
4. Tick the networks you want to merge.
5. In the menu, select Edit > Merge. The wizard Merging networks opens.
6. Click on OK to commit the merge. The report opens and closes. The new network is listed,
it is named after the first network in the list and has the start address of the first selected
network and the end address of the last selected network.
Keep in mind that if the merge you are trying to execute is impossible, an error message appears
on the report page and only a partial report of some networks is executed.
226
Managing Networks
Moving Networks
You can move IPv4 or IPv6 networks from one space to the other. Before moving a network keep
in mind that:
• The migration of a block-type network also moves the networks, pools and IP addresses it
contains.
• The migration of a subnet-type network is only possible if the target space contains a block-
type network that can receive it.
• You can overwrite an existing network in the target space if both networks have the same size.
• You cannot move a network if it overlaps partially an existing network in the target space.
• You cannot move an unmanaged network.
To move a network from one space to the other
4. Tick the network(s) you want to move.
5. In the menu, select, Tools > Expert > Migrate to another space. The wizard Migrating IPv4
networks or Migrating IPv6 networks opens.
6. In the drop-down list Target space, select the space where you want the network to be
moved.
7. In the drop-down list Overwrite, select Yes or No according to your needs.
8. Click on OK to commit the move the network to another space. The report opens and closes.
The selected network's space has changed.
Discovering the Assigned IP Addresses in a Network

Within terminal IPv4 networks, you can find out which IP addresses are being used. The option
Discover networks allows to ping the IP addresses of the terminal network and assign them on
the page All addresses. That way, the IP addresses already in use on your physical network -
computers, servers, etc. - cannot be used. If advanced properties are configured, this addition
may also update the database of other modules. For more details, refer to the section IP Ad-
dress Advanced Properties.
The option Discover networks names the assigned IP addresses if the DNS resolver of the appli-
ance is properly configured and if these IP addresses are declared in a valid PTR record. For
more details, refer to the sections Setting the DNS Resolver and Adding a PTR Record.
Considering that pinging all the IP addresses of a network can take some time, you can choose
to perform this scan at different speeds: it can be fast, normal or slow. The slower the discovery,
the more likely you are to properly scan the network. The discovery mechanism sends 32 ICMP
echoes at once on the network. For more details, refer to the table below.
Table 16.7. The available speeds for the option Discover networks
Speed Timeout Retry
Slow 3 seconds 2 attempts
227
Managing Networks
Speed Timeout Retry

Normal 2 seconds 1 attempt
Fast 1 second no retry
To discover the assigned IPv4 addresses within a terminal network
2. Click on Network. The page All network opens.
3. On the right-end side of the menu, click on V4 to display the IPv4 networks.
4. Tick the terminal network(s) of your choice.
5. In the menu, select Edit > Discover networks > Fast, Normal or Slow. The wizard Discover
networks opens.
6. Click on OK to perform the terminal networks discovery.The report opens during the discovery.
Click on CLOSE to go back to the list.
When the operation is over, the assigned IP addresses are the ones that responded to the ping.
They are marked In use in the column Status and they have a Name if they are properly declared
in a PTR record.
Using Network Map to Display Assigned IP Addresses

From the page All networks of a specific non-terminal network you can access the page Network
map to have an overview of which segments are already managed and in which segments you
can create new subnet-type networks, terminal or not.
Network map allows to see the occupancy rate of IPv4 block-type or subnet-type non-terminal
networks and to make sure you did not forget any IP addresses in your addressing strategy.
To display the page Network map
3. On the right-end side of the menu, make sure that the button V4 is white.
4. Click on the name of the non-terminal network of your choice.The page refreshes and displays
the networks it contains.
5. In the menu, select Display > Network map. The page Network map opens.
6. To access the properties page of a subnet-type network, click on any blue area.
On the page Network map, non-terminal networks are divided into lines of /24 terminal networks,
where free ranges are gray and used ranges are blue.
228
Managing Networks
Figure 16.3. Example of a Network map
This column indicates the first IP address of the networks. Every simple line represents a
segment of 256 consecutive IP addresses, free or belonging to a network.
The blue areas indicate used IP addresses within the non-terminal network. On this image,
three existing networks are highlighted:
• 42.16.0.0-42.16.255.255: This network is dark and light blue because it uses more than
256 addresses. The light area indicates that no IP address is free in the portion of the
non-terminal network.
• 42.50.3.0-42.50.3.255: This network is dark blue because it uses exactly 256 addresses.
• 42.60.0.0-42.60.0.127: This network uses only a portion of a /24 network, so it is directly
followed by a gray area that extends to the next existing network to highlight all the free
IP addresses between the two networks.
The gray areas indicates the free IP addresses within the non-terminal network. On this
image, the segment 42.60.3.0-42.255.255.255 is free.
Put your mouse over any blue area to display the network details: name, start and end IP
addresses and size. If you click on the blue area the properties page of the network opens.
This column indicates the last IP address of the network.
Managing or Unmanaging Networks

You can choose to manage or unmanage IPv4 or IPv6 networks, unmanaging a network prevents
overlapping. By default, all networks are managed, in the column Status they are OK.
229
Managing Networks
The option can be useful, for instance, if you are allocated a particular range of addresses by the
RIPE through SPX, especially if you are still waiting on this range to be officially allocated to you.
As any network set as unmanaged is virtually non existent in the database, it gives you time to
create new networks managing the same start IP address and prefix as an existing unmanaged
network and assign in advance the addresses it contains if need be.
Before using the option, keep in mid that:
• You can only use the option on terminal networks, i.e. subnet-type networks.
• Unmanaging a subnet-type network puts the used IP addresses it manages in a container
Orphan addresses.
• It is impossible to manage again an unmanaged network if it uses IP addresses that are already
used by a managed network.
• It is impossible to split or merge unmanaged networks.
To manage/unmanage a subnet-type network
4. Tick the subnet-type network(s) of your choice.
5. In the menu, select Tools > Expert > Manage or Unmanage. The wizard opens.
6. Click on OK to commit your choice. The report opens and closes. In the column Status, the
selected networks are marked OK or Unmanaged.
Automating the DNS Records Update

From the page All networks, you can configure and apply a link between a subnet-type network
and a zone via the advanced properties. This allows you to automate record creations when
adding or editing IP addresses within the subnet-type networks of your choice.
• The advanced properties allow to set a default domain (zone) to associate with subnet-type
networks or to set up a list of zones to choose from when adding or editing subnet-type networks.
For more details, refer to the chapter Managing Advanced Properties.
• Once these links are applied, the IP address creation or edition automatically creates records
in the selected zone if you apply the property "Update DNS" at IP address level. For more details,
refer to the chapter Managing Advanced Properties.
Automating the DHCP Statics Reservation

From the page All networks, you can use the advanced properties to link IPAM subnet-type net-
works to DHCP clusters. This allows to automate static creation when adding or editing IP ad-
dresses within the subnet-type networks of your choice.
When you add IP addresses, you can automatically reserve a static in the DHCP thanks to the
advanced properties.
• You can link a subnet-type network to the cluster of your choice. This allows to automate
static reservations on the selected servers. For more details, refer to the chapter Managing
230
Managing Networks
• Once this link is set, the edition of the IP addresses within the configured subnet-type networks
reserves statics using the IP address details if you apply the property "Create DHCP static" at
IP address level. For more details, refer to the chapter Managing Advanced Properties.
Associating Networks With a VLAN

SOLIDserver provides the possibility of creating Virtual Local Area Networks in the module VLAN
Manager and associate them networks. This configuration allows two subnet-type networks to
communicate with each other no matter what space or network they belong to.
You can set up this configuration between existing VLANs and subnet-type networks directly
from the IPAM using the advanced properties. For more details, refer to the section Managing
the IPAM/VLAN Interaction in the part VLAN Manager.
Deleting Networks
At any time you can delete networks. But keep in mind that:
• As a safety measure:
• Deleting a block-type network does not erase it from the database. If it contains objects -
networks, pools, used IP addresses - it is renamed Orphan Network and the objects it con-
tained are managed by the next block-type network created that matches the deleted network
configuration, i.e. the same start IP address, size and advanced properties.
• Deleting a subnet-type network puts its used IP addresses in an Orphan Network. The free
IP addresses are deleted.
If you really want to delete a network, you must delete its content first, starting with its used IP
addresses and up the IPAM hierarchy until the network you want to delete is empty. For more
details, refer to the chapters Managing IP Addresses and Managing Pools.
• Deleting a network configured with the advanced property DNS server for reverse zones or
DNS view for reverse zones also deletes the corresponding reverse zone from the DNS, if it
only contains the default SOA and NS records.
To delete networks from a VLSM organization, refer to the chapter Using VLSM to Manage Your
IPAM Network.
To delete a network
4. Tick the networks(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. Selected networks are no
longer listed, they might be replaced by Orphan networks or Orphan Addresses.
Defining a Network as a Group Resource

Adding a network as one of the resources of a specific group allows the users of that group to
231
Managing Networks
manage the network(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a network as a resource also grants access to every item it contains. For
more details, refer to the section Assigning Resources to a Group in the chapter Managing
Groups.
232
Chapter 17. Managing Pools
Within the IPAM hierarchy, pools are the fourth level of the IPAM module hierarchy, they are the
last container level. They can be created within terminal networks to manage IP addresses, their
use is optional.
Pools allow reserving IP addresses for restricted usage such as: address provisioning, planning
or migrations. Pools can also be used to delegate one or several ranges of IP addresses to groups
of administrators or to restrict access to users.
Browsing Pools
The pools belong to terminal networks and contain IPv4 or IPv6 addresses. They are managed
in the page All pools.

BLOCK SUBNET
ALIAS
Figure 17.1. The pool in the IPAM hierarchy
Pools are identified by name and start/end IP address.
Browsing the Pools Database

To display the list of pools
4. You can look for a specific pool using the search engine of the columns Name, Start address,
End address and/or Reserved.
To display the list of pools of a specific network
4. Filter the list using the column Network, either:
a. Type in the network name of your choice in the search engine.

b. Right click over the name of your choice and click on in the contextual menu.
To display a pool properties page
233
Managing Pools

5. At the end of the line of the pool of your choice, click on . The properties pages opens.
Customizing the Display on the Page All Pools

Keep in mind that in IPv6 you can display colored labels above parts of the IP addresses listed.
It allows to differentiate at a glance your containers. For more details, refer to the chapter Managing
IPAM and DHCP IPv6 Labels.
Adding a Pool
Within any terminal network, a subnet-type network, you can create pools to organize further
your IP addresses and, for instance, configure them with a common set of options. Pools can be
created from the pages All pools, All addresses and from a terminal network's properties page,
in the panel IP address pool of .
Note that you can also import pools, for more details refer to the section Importing Pools.
To add a pool
4. Click on the name of the subnet-type network of your choice. The page All addresses of this
network opens.
5. In the breadcrumb, click on All pools. The page All pools of the network opens.
6. In the menu, select Add > Pool or pool (v6). The wizard opens.
7. If you or your administrator created classes at pool level, n the list IP pool class, select a
class or None. Click on NEXT . The page Add an IPv4 pool or Add an IPv6 pool opens.
8. In the field Pool name, name the pool.
9. The box Pool read-only allows to reserve the pool, mark it as read-only. By default, the box
is not ticked. For more details, refer to the section Reserving a Pool.
10. In the field Start address, type in the first address of the pool.
11. In the field End address, type in the last address of the pool. Specifying an end address
automatically edits the value of the field Size.
12. In the field Size, you can type in the number of IP addresses you want to manage with the
pool. If you specify a size, the end address is automatically modified. The value of the field
Size is automatically calculated using the fields Start address and End address.
234
Managing Pools

Field Description
Properties.
14. Click on OK to commit the creation. The report opens and closes. The pool is listed. On the
page All addresses, the column Pool indicates the pool name next to all the addresses it
manages.
Reserving a Pool
You can reserve a pool when creating or editing a pool thanks to the box Pool read-only. This
reservation may be useful to dedicate the use of IP addresses to the DHCP, identify a bunch of
printers, etc.
To reserve an existing pool
1. Go to the properties page of the pool of your choice.

3. If you or your administrator created classes at pool level, in the list IP pool class, select a
class or None. Click on NEXT . The page Edit an IPv4 pool or Edit an IPv6 pool opens.
4. Tick the box Pool read-only to reserve the pool.
5. Click on OK to commit your changes. The report opens and closes. The pool is now marked
Yes in the section Read-only of the panel Main properties.
When adding a pool, you can tick the box as well to reserve it.
Resizing a Pool
You can resize IPv4 pools to manage more or less addresses than they did when you created
them. Resizing a pool shifts the start and/or end IP address of the pool, you can specify a number
of addresses to include/exclude.
So, if your pool managed the addresses 192.168.100.10-192.168.100.125 you can decide to
resize it to manage the addresses 192.168.100.100-192.168.100.105 indicating a start address
shift of "90" and an end address shift of "-20".
235
Managing Pools
You cannot resize a pool if the addresses you include or exclude are already used or belong to
another pool.
To resize an IPv4 pool
1. Go to the IPAM tab homepage.If the homepage is not displayed, click on . The homepage
opens.
5. Tick the pool(s) you want to resize.
6. In the menu, select Edit > Resize Pools. The wizard Resize IPAM pools opens.
7. In the field Start address shift, type in the positive or negative start address shift for the pool.
If you type in 0 (zero), the address stays the same.
8. In the field End address shift, type in the positive or negative end address shift for the pool.
If you type in 0 (zero), the address stays the same.
9. Click on OK to commit your changes.The report opens and closes.The new start/end address
for the pool(s) is listed.
Deleting a Pool
At any time, you can delete pools. Note that if you delete a pool you do not delete the ad-
dresses it contains or create an orphan container. You only delete the pool itself and the para-
meters it was set with.
If addresses inherited class parameters from the deleted pool, their value and the source of their
value remain the same: the Inheritance property of each class parameter is forced to Inherited
or Set to match the configuration of the deleted pool.
To delete a pool
4. Tick the pool(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The pool is no longer listed.
On the page All addresses, the free IP addresses managed by a deleted pool are no longer listed.
The addresses In use are still listed but next to them the column Pool is empty.
Defining a Pool as a Group Resource

Adding a pool as one of the resources of a specific group allows the users of that group to manage
the selected pool(s) as long as they have the corresponding rights and delegations granted.
236
Managing Pools
Granting access to a pool as a resource also grants access to every item it contains. For more
237
Chapter 18. Managing IP Addresses
The IP address is the last level of the IPAM hierarchy, where you assign your IP addresses to
specific users, devices, etc.
The page All addresses provides management options for IPv4 and IPv6 and allows to display
on one page the entire IP address database.
Browsing IP Addresses
The IP addresses can belong to terminal subnet-type networks and pools. They can be configured
with one or several aliases.

BLOCK SUBNET
ALIAS
Figure 18.1. The IP address in the IPAM hierarchy
Browsing the IP Addresses Database

To display the list of addresses
2. In the breadcrumb, click on All addresses. The page All addresses opens.
To display IPv6 addresses in full
2. Click on Addresses (v6). The page All addresses opens, on the right-end side of the menu,
the button V6 is white.
3. In the menu, select Display > Uncompress IPv6 addresses. The page refreshes and all the
addresses are displayed entirely.
To display the list of addresses of a specific network
4. In the column Network, click on the name of the terminal network of your choice. The page
refreshes, the list only displays the IP addresses of that network; the breadcrumb indicates
the parent network(s) of the terminal network.
To display an IP address properties page
238
Managing IP Addresses

4. At the end of the line of the address of your choice, click on . The properties pages opens.
Customizing the Display on the Page All Addresses

Keep in mind that:
• In IPv4 you can display the column Aliases. It provides a complete overview of the aliases
configured on IPv4 addresses.
• In IPv6 you can display colored labels above parts of the IP addresses listed. It allows to differ-
entiate at a glance your containers. For more details, refer to the chapter Managing IPAM and
DHCP IPv6 Labels.
Understanding the IP Address Type and Status

The columns Type and Status provide information regarding the IP addresses you manage.
These columns provide information regarding the IPAM to DHCP interaction that can be set via
the advanced properties or directly when configuring statics. For more details, refer to the chapter
Managing Advanced Properties or the section Adding DHCPv4 Statics.
Table 18.1. IP address types

Type Description
Network The Network address is the first IP address of an IPv4 or IPv6 terminal network. It should
not be assigned, except in IPv4 networks with a /31 or /32 prefix or in IPv6 networks
with a /127 or /128 prefix. To make it assignable refer to the section Assigning the
Broadcast and Network Addresses.
Broadcast The Broadcast address is the last IP address of an IPv4 terminal network. It should not
be assigned, except in IPv4 networks with a /31 or /32 prefix. To make it assignable
refer to the section Assigning the Broadcast and Network Addresses.
? Orphan The IP address belonged to a network that was deleted. It was not deleted because it
is assigned.
Regular The IP address is only managed in the IPAM.
DHCP static Only for IPv4, the IP address was added in the IPAM and configured with the advanced
property Create a DHCP static. For more details, refer to the chapter Managing Advanced
Properties.
DHCP lease Only for IPv4, the IP address belongs to a pool configured with the advanced property
Add a DHCP range. For more details, refer to the chapter Managing Advanced Properties.
Table 18.2. IP address statuses

Status Description
Non assignable The IP address cannot be assigned, it is the Network or Broadcast address of a
terminal network. For more details, refer to the table IP address types.
Reserved Only for IPv4, the IP address is reserved for DHCP use, if it is a DHCP lease it can
be allocated to a DHCP client the next time they connect to the network.
Only for IPv4, the IP address is reserved for DHCP use, if it is a DHCP static it is
assigned to a DHCP client.
239
Status Description
In use For a Regular IP address, the address is already assigned.
For a DHCP lease, the IP address was allocated to a DHCP client that connected to
the network.
For a DHCP static, the IP address was assigned to a DHCP client and allocated as
a lease to the client when they connected to the network. This status is only displayed
if your DHCP configuration relies on EfficientIP DHCP servers in version 6.0.0 or more.
Free The IP address can be assigned.
Read-only / Free The IP address is currently free but cannot be assigned because it belongs to a pool in
read-only. That pool is not configured with DHCP advanced properties.
Read-only / In use The IP address is currently used but cannot be edited because it belongs to a pool in
read-only. That pool is not configured with DHCP advanced properties.
Invalid Only for IPv4, the IP address does not match any IP address in the DHCP database but
it belongs to a network or pool configured with DHCP advanced properties. The IPAM
to DHCP advanced properties are probably misconfigured.
Keep in mind that the Gateway address of a terminal network is different from the other IP ad-
dresses:
• It can be automatically created when you create a terminal network and named Gateway. For
more details, refer to the chapter Configuring IPAM Advanced Properties.
• Its address can be automatically calculated to use the penultimate address of the network,
unless you edit the value of the field Gateway offset in the wizard Advanced properties custom-
ization. For more details, refer to the chapter Configuring IPAM Advanced Properties.
Adding an IP Address
At address level, there are two ways of adding, or assigning, IP addresses:
• Manually: if you already know the IP address you want to assign and are sure that this IP ad-
dress is free. You can add it from the menu Add or from the list All addresses itself.
• By search: if you do not know if there is a free IP address within your terminal networks, you
can use this option to find available IP addresses.
Note that you can also import IP addresses, for more details refer to the section Importing IP
Addresses.
When you create large terminal networks, the Broadcast and Network addresses are
automatically assigned. Both addresses are by default Non assignable in large networks, but
you can make them assignable. For more details refer to the section Assigning the Broadcast
and Network Addresses.
Adding an IP Address Manually

From the page All addresses you can add IP addresses, that is to say assign them a name and
associate them with a specific MAC address. You can do it from the menu or from the list of IP
addresses.
To add an IP address from the menu
240

4. In the menu, select Add > Address or Address (v6) > Manual. The wizard opens.
5. In the list Space, select a space and click on NEXT . The next page opens.
6. If you or your administrator created classes at higher levels, the <object> class page appears.
Select the class of your choice, All or None/No class and click on NEXT . The next page opens.
For more details, refer to the section Applying Classes.
7. In the list Network name, select the terminal network of your choice and click on NEXT . The
next page opens.
8. If the network contains pools, in the list Pool name, select a pool or No pool. Click on NEXT .
9. If you or your administrator created classes at the IP address level, in the list IP address
class, select a class or None. Click on NEXT . The next page of the wizard appears.
10. On the page Add an IPv4 address or Add an IPv6 address, configure your IP address:
Table 18.3. IP address configuration fields

Field Description
IP address name This field is in read-only and displays the name specified in the field Shortname
followed by the domain if you select one.
IP address The IP address you assign, has to be part of the selected terminal network. By
default, the first free and Regular IP address in this network or the first IP address
of the selected pool is displayed in the field.
MAC address You can type in a MAC address for the IP address. Remember that in IPv6, the
MAC address corresponds to the last twelve hexadecimal characters of the client
DUID. This field is optional.
Shortname Name the IP address.
Domain You can select one of your DNS zones or None. If you select a domain, the IP
address updates the selected zone; its name is edited and follows the syntax:
<shortname.domain>.
Properties.
11. Click on NEXT . The page Aliases configuration opens.

12. In the field Add an alias, name your alias(es). Click on ADD to add it to the Aliases list. For
more details regarding aliases, refer to the section Configuring and Managing IP Address
Aliases.
13. Click on OK to commit your creation. The report opens and closes. The address is listed, its
Type and Status depend on your configuration. For more details, refer to the section Under-
standing the IP Address Type and Status.
241
From the page All addresses, whether it displays all the addresses or only the addresses of a
specific network, you can click on any free IP address to name and configure it.
To add an IP address from the list
4. Click on the available IP address of your choice. A pop-up window This address is free, do
you want to assign it? opens.
5. Click on OK . The wizard opens.
8. On the page Add an IPv4 address or Add an IPv6 address, configure your IP address:

Field Description
IP address This field is in read-only and displays the IP address you clicked on in the list.
<shortname.domain>.
Properties.

Aliases.
242
Adding an IP Address Using the Option By search

From the page All addresses you can add addresses using the option By search.This option allows
to automatically find available IP addresses within a terminal network and configure the one that
suits your needs.
To add an IP address using the option By search
4. In the menu, select Add > Address or Address (v6) > By search. The wizard opens.
5. In the list Space, select a space and click on NEXT . The next page opens.
7. In the list Network name, select the terminal network of your choice and click on NEXT . The
next page opens.
8. If the network contains pools, in the list Pool name, select a pool or No pool. Click on NEXT .
The page Search result opens.
10. In the list IP address, select the IP address of your choice. The first ten available addresses
of the network are listed. Click on NEXT .
11. On the page Add an IPv4 address or Add an IPv6 address, fill in the following fields:

Field Description
IP address This field is in read-only and displays the IP address you selected in the field IP
address on the previous page.
<shortname.domain>.
243
Field Description
Properties.

more details regarding aliases refer to the section Configuring and Managing IP Address
Aliases.
Assigning the Broadcast and Network Addresses

By default, the IPv4 terminal networks with a prefix smaller than /30 (more than 4 addresses) are
created with a Network address and Broadcast address that are both Non assignable. In Pv6,
terminal networks with a prefix smaller than /127 (more than 3 addresses) are created with a Non
assignable Network address.
Depending on the way you organized your addressing plan, you might need to assign all the
addresses of your networks, including the Network and Broadcast addresses. A registry database
entry allows to make them both assignable.
To make the Broadcast and Network addresses of a network assignable
1. Go the Administration tab. If the homepage is not displayed, click on . The homepage
opens.
opens.
3. In the search engine of the column Name, type in www.display.lock_broadcast_network_ad-
dresses and hit Enter. The key is the only one listed.
4. In the column Value, click on the key value. The wizard Registry database Edit a value
opens.
5. In the field Value, type in 0 to remove the restriction on the broadcast and network addresses.
By default, the value of the key is 1.
6. Click on OK to commit your changes. The report opens and closes. The Registry database
is visible again.
Once the Broadcast and Network addresses are assignable, you can configure them like any
other IP address. Note that on the page All addresses, their Status remains Non assignable but
the IP address itself is underlined to indicate that you can assign them.
244
Editing an IP Address
You can edit used IP addresses to change their class, name, MAC address or even their advanced
properties or class parameter configuration. This edition can be done from the list All addresses
or from the IP address properties page.
Note that you cannot edit IP addresses belonging to a pool read-only.
To edit an IP address
4. Right-click over the Name of the IP address you want to edit. In the contextual menu, click
on Edit. The wizard opens.
6. Click on NEXT . The page Add an IPv4 address or Add an IPv6 address opens.
7. Edit the IP address configuration according to your needs:
a. You cannot edit the fields IP address and IP address name. IP address name displays
the changes performed in the fields Shortname and/or Domain.
b. Edit the MAC address, Shortname, Domain and/or Advanced properties configuration.

Aliases.
10. Click on OK to commit your changes. The report opens and closes. The address is listed,
its Type and Status depend on your configuration. For more details, refer to the section
Understanding the IP Address Type and Status.
Configuring and Managing IP Address Aliases

One IP address can have one unique FQDN that can be registered in the DNS. If additional
names are necessary, SOLIDserver allows to register them as IP aliases.

BLOCK SUBNET
ALIAS
Figure 18.2. The alias in the IPAM hierarchy
245
There is no limitation for the number of IP aliases that SOLIDserver can manage. If you configured
the update of the IP addresses in the DNS, the alias is usually a CNAME record created within
the chosen domain that can therefore resolve the IP address name in your DNS servers.
The alias creation can be done from a free IP address or from a used IP address. Your alias can
be named the way you want, its full name concatenates the name of one your existing domains
to associate it with one your zones. Technically, the IP address alias can create either an A,
AAAA or CNAME record in the DNS.
The aliases configuration can be used to point a record toward an IP address within one zone
or toward an IP address saved in different zones. Within the same zone, the IP address alias is
a CNAME record that follows the DNS standard use and points to an A/AAAA record. Among
two different zones, the name is crucial: the IP address shortname.domain1 creates an A record
of the zone domain1 and a CNAME record in the zone domain2 with the value shortname.domain2.
That way, your alias name links to two of your zones.
The most commonly used aliases create CNAME records in the DNS but, depending on the DNS
configuration you want to set, you might need to create A records.
To let users follow the procedures below you need to configure the IPAM to DNS advanced
properties to make sure the alias creation from the IP addresses creates records in the DNS. At
network level, or higher, you need to choose a DNS server, set a Domains list and tick the box
Update DNS. You can also set a default domain. For more details, refer to the chapter Managing
Advanced Properties.That way, the addresses you configure with aliases all inherit the properties
and the records are successfully created in the DNS. Administrators can choose to display All
advanced properties to set these options and successfully create records in the DNS.
To configure an alias on a free IP address
4. Click on the Name of the available IP address of your choice. The pop-up window This ad-
dress is free, do you want to assign it? opens.
8. In the field Shortname, name the IP address.
9. In the drop-down list Domain, select a zone. The list of available zones depends on your
configuration at network level.
10. In the drop-down list Advanced properties, select All and make sure that the property DNS
server is configured with the value All.
12. In the field Name, name your alias. Its name must be different from the IP address name,
especially if they share the same domain.
246
13. In the drop-down list Domain, select an existing domain or None. The alias full name is dis-
played in the field Alias following the format: <name>.<domain> .
14. In the drop-down list Type, select CNAME, A or AAAA. By default, CNAME is selected.
15. Click on ADD to move your alias to the Aliases list. Repeat these actions for as many aliases
as you need. In the list, each alias is listed as follows: (<record-type>) <full-alias-name>.
To see its aliases in the list, display the column Aliases. For more details, refer to the section
Customizing the List Layout.
To configure an alias on an IP address in use
4. At the end of the line of the IP address of your choice, click on . The properties page opens.
5. In the panel Aliases, click on EDIT . The wizard opens.
11. In the drop-down list Type, select CNAME, A or AAAA. By default, CNAME is selected.
12. Click on ADD to move your alias to the Aliases list. Repeat these actions for as many aliases
as you need. In the list, each alias is listed as follows: (<record-type>) <full-alias-name>.
13. Click on OK to commit your creation. The report opens and closes. The properties page is
visible again, the panel Aliases lists all aliases.
To edit an IP address alias
1. Go to the properties page of the IP address of your choice. For more details, refer to the
procedure To display an IP address properties page.
247
6. In the field Aliases list, select the alias you want to edit. The alias details are displayed in
each of the relevant fields.
7. Make the changes you need.
8. Click on UPDATE . The alias is edited and listed in the Aliases list.
9. Click on OK to commit your changes. The report opens and closes. The properties page is
To remove an IP address alias
1. Go to the properties page of the IP address of your choice. For more details, refer to the
procedure To display an IP address properties page.
6. In the field Aliases list, select the alias you want to remove and click on DELETE . The alias
is no longer listed.
7. Click on OK to commit the alias deletion. The report opens and closes. The properties page
is visible again, in the panel Aliases the alias is no longer listed.
Configuring Multiple A Records for an IP Address

You can create several A records for one IP address from the IPAM module. That way, one IP
address can have several aliases in the DNS, this can be especially useful when configuring load
balancing and round robin. For more details, refer to the section Load Balancing with Round
Robin.
We strongly recommend against configuring your DNS with one IP address associated
with a set of A aliases. Indeed, a proper configuration of your DNS implies that a name zone
is configured with a reverse zone which allows DNS clients to query your domain, through its
name on the one hand and its IP address on the other. In this configuration, DNS best practices
advise to create a PTR record in the reverse zone for each A record of the name zone to make
sure the domain or sub-domain is accessible through its name and IP address. If your name zone
contains several A records with the same value, your reverse zone should contain as many PTR
records. These records would all be named after the same IP address (the value of the A records).
In this case, the reverse zone would contain several PTR records with the same name pointing
to different domains. Therefore querying this IP address to get the corresponding domain or sub-
domain is impossible: the server cannot know which hostname to send when answering the DNS
clients query. To make sure that a domain can be accessed through its name and IP address,
248
there should be one PTR record in the reverse zone for each A record of the name zone. If you
need to provide an alias, you should add a CNAME record pointing to the A record in the master
zone. For more details, refer to the sections Adding an A Record, Adding a AAAA Record, Adding
a PTR Record and Adding a CNAME Record.
To let users follow the procedures below you need to configure the IPAM to DNS advanced
properties to make sure the alias creation from the IP addresses creates records in the DNS. At
network level, or higher, you need to choose a DNS server, set a Domains list and tick the box
Update DNS. You can also set a default domain. For more details, refer to the chapter Managing
Advanced Properties.That way, the addresses you configure with aliases all inherit the properties
and the records are successfully created in the DNS. Administrators can choose to display All
advanced properties to set these options and successfully create records in the DNS.
Keep in mind that if your configuration is not properly set in the IPAM, the A and/or AAAA records
are not created in the DNS and no error message is displayed in the DNS.
To create several A/AAAA records when assigning an IP address
4. Click on the Name of the available IP address of your choice. The pop-up window This ad-
dress is free, do you want to assign it? opens.
8. In the field Shortname, name the IP address.
9. In the drop-down list Domain, select a zone. The list of available zones depends on your
configuration at network level.
10. In the drop-down list Advanced properties, select All and make sure that the property DNS
server is configured with the value All.
14. In the drop-down list Type, select A or AAAA.
15. Click on ADD to move your alias to the Aliases list. Repeat these actions for as many records
as you need. In the list, each one is listed as follows: (A) <full-alias-name> or (AAAA) <full-
alias-name>.
16. Click on OK to commit your creation. The report opens and closes. The properties page is
249
To create several A/AAAA records for an assigned IP address
4. At the end of the line of the IP address of your choice, click on . The properties page opens.
5. In the panel Aliases, click on EDIT . The wizard opens.
11. In the drop-down list Type, select A or AAAA.
12. Click on ADD to move your alias to the Aliases list. Repeat these actions for as many records
as you need. In the list, each one is listed as follows: (A) <full-alias-name> or (AAAA) <full-
alias-name>.
To edit or remove A and AAAA record aliases, refer to the procedures To edit an IP address alias
and To remove an IP address alias.
Renaming IPv4 Addresses Massively

SOLIDserver provides a tool to rename IPv4 addresses massively. There are three ways of re-
naming the IP addresses, you can replace part of the name or append/preprend the name with
characters.
To massively rename IPv4 addresses
4. Tick the IP address(es) you want to rename.
5. In the menu, select Edit > Replace > IP address name. The wizard Replace name of IP ad-
dresses opens.
6. In the field Exact search, select one of the following options:
250
Table 18.6. Available methods to rename IP addresses

Option Description
Replace Select this option to rename the IP address entirely or partially. The fields Replace
and Name are displayed.
Replace: type in the name or part of the name to be replaced.
Name: type in the characters that replace the value specified in the field Replace.
Append Select this option to concatenate characters at the end of the name of the selected
IP address(es). The field Name is displayed.
Name: type in the characters you want to append to the name.
Prepend Select this option to concatenate characters at the beginning of the name of the IP
address selected. The field Name is displayed.
Name: type in the characters you want to prepend to the name.
7. Click on OK to rename the IP addresses selected. The report opens and closes. The new
IP addresses names are visible in the list.
Moving IP Addresses
SOLIDserver provides several ways of moving, or migrating, IPV4 addresses within your database.
Migrating IP address can be useful when you have to relocate hosts.
Keep in mind that migrating an IP address edits its class parameters' inheritance and propagation
configuration : the value of the parameters is kept but each property configuration is forced to
Set/Propagate.
Moving IPv4 Addresses to another Network

You can massively move IPv4 addresses from one terminal network to the other, i.e. you can
relocate hosts and move them to another network. This operation allocates the first available IP
address in the specified terminal network and keeps their properties and aliases.
Set/Propagate.
To move an IPv4 address to another network
1. Go to the IPAM tab and opens the page All addresses.

3. Tick the IP address(es) you want to move to another network.
4. In the menu, select Edit > Migrate to another network. The wizard Migrate addresses to
another network opens.
5. In the drop-down list Target space, select a space.
6. In the field New network IP, type in the start address of the terminal network you want to
move the address(es) to.
7. Click on OK to commit the migration. The report opens and closes. The page is visible again,
you can filter it to check the new address assigned to your hosts.
251
Moving IP Addresses to another Space

You can massively move IP addresses from one space to the other and keep their properties
and aliases. To successfully migrate IP addresses to another space, keep in mind that:
• You can migrate IP addresses if the target space contains a terminal network with:
• A start address and prefix that allow it to receive all the selected IP addresses. If the network
is too small, the migration is impossible.
• Enough free addresses to assign the IP addresses you migrate.
• You cannot migrate an IP address if the target network already has the same IP address in
use. The migration would be interrupted.
• You cannot migrate an IP address from or towards a pool in read-only.
Set/Propagate.
To move IPv4 addresses to another space
1. Go to the IPAM tab and open the page All addresses.

2. On the right-end side of the menu, click on V4 to display IPv4 addresses.
3. Tick the IP address(es) you want to move to another space.
4. In the menu, select Edit > Migrate to another space. The wizard Migrate addresses to an-
other space opens.
5. In the drop-down list Target space, select the space of your choice.
display the addresses of the target space to see your addresses listed.
To move IPv6 addresses to another space
1. Go to the IPAM tab and open the page All addresses.

2. On the right-end side of the menu, click on V6 to display IPv6 addresses.
3. Tick the IP address(es) you want to move to another space.
4. In the menu, select Tools > Expert > Migrate to another space.The wizard Migrate addresses
to another space opens.
5. In the drop-down list Target space, select the space of your choice.
display the addresses of the target space to see your addresses listed.
Migrating the Properties of an IPv4 Address

You can migrate the properties and aliases of one IP address individually. This allows to relocate
a host to a different space or network or within the same space.
The wizard provides the possibility to detect an IP address in a source space and change the IP
address itself, while keeping its properties in the target space.
252
Set/Propagate.
To migrate the properties of an IPv4 address
1. Go to the IPAM tab and opens the page All addresses.

3. In the menu, select Tools > Migrate a specific IP. The wizard Migrating a specific IP address
opens.
4. In the drop-down list Source space, select a space or Auto-detection. This option can be
selected only if your IP address exists in only one space.
5. In the field IP address to migrate, type in the IP address you want to migrate.
6. In the drop-down list Target space, select a space or Same as source. This option can be
selected only if you specify a different IP address in the field New IP address.
7. In the field New IP address, type in the IP address of your choice. It can be a different one
or the same as the one specified in the field IP address to migrate.
you can filter it to check the new address assigned to your hosts.
Pinging an IP Address
From the IPAM module, you can ping IP addresses to check if the host they are associated with
is responding.
The report can display the following messages:
• Notice Ping OK (IP address).
The corresponding host was found and responded to the ping.

• Error Ping Timeout (IP address).
The corresponding host did not respond to the ping. It could mean a number of things, the host
is not running, is an a different network, is configured not to respond to the ping utility, etc.
To ping one or several IP addresses
4. Tick the IP address(es) you want to ping.
5. In the menu, select Tools > Ping. The wizard Pinging IP addresses opens.
6. Click on OK to perform the ping. The report opens and displays the results.
7. In the section Export format, you can click on TEXT , HTML or EXCEL to export the result in the
corresponding format. Even if you do not download the report, it is available in the window
Notifications next to the field Global search.
8. Click on CLOSE to go back to the page.
253
Deleting an IP Address
At IP address level, deleting an address actually frees it. Even though it is no longer listed, you
can assign it again by search or manually. Note that, as deleting an address releases it, it is im-
possible to delete free addresses.
To delete an IP address
4. Tick the IP address(es) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. Selected addresses are
no longer listed.
Restoring an IP Address
You can restore deleted IP addresses, i.e. undo an IP address deletion. From the page All deleted
IP addresses, you can restore your IP addresses.
From this page you can also export the entries listed or even create an alert or a chart.
Figure 18.3. The button undo on the page All Addresses
This button allows to access the page All Deleted IP addresses of the version displayed on
the page All addresses.
The page contains three columns:
Table 18.7. Columns on the page All deleted IP addresses

Column Description
Date The date and time of the IP address deletion.
User The name of the user who deleted the IP address. This name is underlined, if you click
on it you open user properties page in the module Administration.
Description The IP address details: the IP address itself, its name, its MAC address (if relevant), the
terminal network it belongs to and finally the space it belongs to.
To undo an IP address deletion
254
4. On the right-end side of the menu, click on . The page All deleted IP addresses opens.
5. Tick the IP address(es) you want to restore.
6. In the menu, select Edit > Undo IP deletion or Undo IP deletion (v6). The wizard Restoring
IP addresses or Restoring IPv6 addresses opens.
7. Click on OK to commit your choice. The report opens and closes. The addresses are no
longer listed on the page All deleted IP addresses.
8. On the right-end side of the menu, click on V4 or V6 to go back to the page All addresses.
The addresses you restored are listed again.
Automating the DNS Records Update From the Page All

addresses
The name of an IP address as well as its aliases can automatically be created in the DNS via
the advanced properties.
• The record is created in the zone you configured when setting the properties at network level.
• Once the network properties are set and applied, to automate the record creation, you must
tick the box Update DNS.
The records created is named after the IP address and zone name. Its value contains at least
the IP address. For more details regarding IP address to DNS advanced properties, refer to
the chapter Managing Advanced Properties.
For more details regarding the aliases configuration, refer to the section Configuring and Managing
IP Address Aliases.
Automating the DHCP Statics Reservation From the Page

All addresses
When you add IP addresses, you can automatically reserve a static in the DHCP thanks to the
advanced properties.
• The static is created in the DHCP cluster you configured when setting the properties at network
level. For more details, refer to the chapter Managing Advanced Properties.
• Once the network properties are set and applied, to automate the static creation, you must tick
the box Create DHCP static.
The new static shares the same IP address, MAC address and name as the new IP address.
For more details regarding IP address to DHCP advanced properties, refer to the chapter
Updating Device Manager From the Page All addresses

At IP address level, there are two ways of updating Device Manager. You can use a dedicated
option that populate its database; or you can configure advanced properties to edit Device Manager
database when adding IP addresses.
255
Populating Device Manager

From the page All addresses, you can select assigned addresses and populate Device Manager.
That is to say, create devices and interfaces based on your IP addresses. This operation creates
a device that contain a set of interfaces based on each IP address and MAC address in your
database.
For more details, refer to the section Automatically Adding Devices from the IPAM in the chapter
Managing devices.
Editing Device Manager from the page All Addresses

From the page All addresses, you can update Device Manager, when adding an IP address,
thanks to some advanced properties that allow users to:
• Create devices,
• Associate an IP address with an existing device,
• Edit the topology links between devices.
For more details, refer to the section Manually Adding Devices from the IPAM in the chapter
Managing devices.
256
Chapter 19. Setting Up a Transition From
IPv4 to IPv6
SOLIDserver allows to set up a semi-automated way to transition from IPv4 to IPv6 when creating
IPv4 objects. You can now link the IPv4 networks or addresses you create with existing IPv6
networks or addresses as long as they belong to the same space. That way the day you stop
using IPv4, your addressing plan is already configured with IPv6.
The transition option is managed like the advanced properties: you must configure and activate
it.
Transition Specificities
The transition options are configured at space or network level and inherited at lower levels where
you can apply them.
• For block-type networks, if the transition options are configured:

• The transition to IPv6 can be set when adding or editing IPv4 networks.
• The transition can only be set with existing IPv6 block-type networks.
• For subnet-type networks, if the transition options are configured:
• The transition to IPv6 requires the address an existing block-type network, you either specify
it or inherit from a configured parent network.
• The transition to IPv6 automatically creates the appropriate IPv6 subnet-type network within
the specified block-type network when you add or edit an IPv4 subnet-type network.
• The IPv6 subnet-type network created is named after its IPv4 counterpart.
• For IP addresses, if the transition options are configured:
• The transition is only possible if it was set at network level.
• You can choose the IPv6 address creation behavior.
• Adding or editing an IPv4 address creates the corresponding IPv6. The IPv6 address is
named after the IPv4 address, has the same MAC address, device and class parameters.
If you edit an IPv4 subnet-type network already configured with a VLAN to set the transition to
IPv6, the IPv6 corresponding network inherits the IPAM/VLAN interaction settings: both networks
then belong to the VLAN.
Limitations
• The transition can only be set within one space: you cannot create IPv4 subnet-type networks
in one space and expect to link them with IPv6 subnet-type networks in another space.
• If you set the transition parameters on an existing organization, they are not inherited and have
to be set applied one object at a time.
• For block-type networks, the transition can only be configured and activated with existing IPv6
block-type networks. The transition options do not create block-type networks in IPv6 but only
link IPv4 blocks with existing IPv6 blocks.
• The advanced properties set in IPv4 are not inherited by the corresponding IPv6 objects.
257
Setting Up a Transition From IPv4
to IPv6
• At pool level, the transition options are not available.

• If you create an object in IPv4 and their IPv6 counterpart overlaps existing objects, only the
IPv4 object is created.
• Deleting an IPv4 object linked to an IPv6 object does not delete the corresponding IPv6 object.
Configuring the IPv4 to IPv6 Transition

The transition has to be configured through the wizard Advanced properties customization and
then activated. The configuration has to be set at space, network and IP address level. For the
IP addresses the configuration set the IPv6 address creation behavior that suits your needs.
Configuring the Transition at Space and Network Level

The transition configuration is the same at space and network level: you need to display the IPv4
to IPv6 transition fields to be able to set the transition on every object.
To configure IPv4 to IPv6 transition at space and network level
3. In the menu, select Settings > Wizard customization. The wizard Advanced properties
customization opens.
4. Tick the box Display the IPv4 to IPv6 transition fields.
again. Your configuration is now available in the addition and edition wizards.
6. In the breadcrumb, click on All networks. The page All network opens.
7. On the right-end side of the menu, make sure the button V4 is white.
8. Repeat the steps 3 to 6 to configure the transition at network level.
Once the transition is configured, you can apply it when adding or editing spaces and IPv4 net-
works.
Configuring the Transition at IP Address Level

At IP address level, the transition option offer three ways of creating the IPv6 addresses:
1. Offset allows to take into account the position of the address you are assigning within the IPv4
terminal network and reuse it when assigning the corresponding IPv6 address. The 100th
address of the IPv4 subnet-type network creates the 100th address of the related IPv6 subnet-
type network.
2. Injection allows to convert in hexadecimal the IPv4 address you are assigning and use the
whole address in its hexadecimal from as the last two bytes of the corresponding IPv6 address.
3. First IP address available allows to assign the first available IP address in the IPv6 terminal
network when you assign an address in the IPv4 terminal network.
To configure IPv4 to IPv6 transition at IP address level
258
to IPv6
5. In the drop-down list IPv4 addresses transition to IPv6 policy, select Offset, Injection or First
IP address available. By default, Offset is selected.
again. Your configuration is now available in the addition and edition wizards.
Activating the IPv4 to IPv6 Transition

Once the option has been configured, you can activate it at every level of the IPAM hierarchy,
except at pool level.
In the procedures below, the procedures use the inheritance from space to block-type network,
block-type network to terminal network and terminal network to address. And create them one
after the other. But each procedure can be used when editing the objects as long as you configured
the option in the menu Settings.
The transition configuration details are available on the objects properties page, in IPv4 and IPv6.
Activating the Transition at Space Level

At space level, you can configure and apply the transition options. This does not create any IPv6
object but sets the existing IPv6 block-type networks of your choice for the transition. The options
you set at this level are inherited by the IPv4 blocks you create in your space.
To activate the IPv4 to IPv6 transition when editing a space
3. Right-click over the Name of a space. The wizard Edit a space opens.
4. In the list VLSM parent space, select None.
7. Tick the box Activate the IPv4 to IPv6 transition. The field IPv6 network (block) appears.
8. In the field IPv6 network (block), specify the beginning of the address of an existing block-
type network in the space. The value set in this field must not exceed the first 2 bytes of the
existing IPv6 block-type network. You cannot use the semi-colon (:) twice. That network you
specify becomes the container of the IPv6 terminal subnet-type networks and addresses
you create.
9. Click on OK to commit the configuration. The report opens and closes. The page All spaces
is visible again. Your configuration is available on the space properties page in the panel
Advanced properties.
Once the option is configured, the IPv4 networks and addresses you create within your block-
type network inherit this option. You can untick the box Activate the IPv4 to IPv6 transition if you
do not want to set a transition for some of your objects.
259
to IPv6
Activating the Transition at Network Level

At network level, the transition settings applied at space level are inherited automatically. You
need to create at least a block-type network and then subnet-type network.
You can untick the box Activate the IPv4 to IPv6 transition if you do not want to set the transition
for a particular network.
When creating a block-type network, the settings are displayed and taken into account automat-
ically. To set the transition for existing IPv4 networks, you need to edit them and tick the box.
To activate the IPv4 to IPv6 transition when creating a block-type network
3. Click on the name of the space you applied the transition options to. The page All networks
of the space opens.
5. In the menu, select Add > Block. The wizard opens.
a class or None. Click on NEXT . The page Add an IPv4 network opens.
9. In the drop-down list Netmask select a netmask. The netmask value automatically edits the
Prefix.
10. In the section IPAM properties, the box Activate the IPv4 to IPv6 transition is ticked. The
parameter is Inherited and set to Propagate. If you want to untick the box, you must Set the
Inheritance property and then untick the box.
11. The field IPv6 network (block) displays the value set at space level.The parameter is Inherited
and set to Propagate. If you want to edit it, you must Set the Inheritance property to be able
to edit the value in the field, the bytes entered must correspond to an existing IPv6 block-
type network.
12. Click on OK to commit the addition. The report opens and closes. The network is listed. The
configuration is displayed on the properties page of the IPv4 and the IPv6 networks, in the
panel Advanced properties.
Once the transition is configured on a block-type network, it is inherited by the subnet-type net-
works in contains.
When creating a subnet-type network, whether terminal and not, the settings are displayed and
taken into account automatically. To set the transition for existing IPv4 subnet-type networks,
you need to edit them and tick the box.
To activate the IPv4 to IPv6 transition when creating a subnet-type network
260
to IPv6
4. Click on the name of the block-type network you applied the transition options to. The page
All network of that network opens.
5. In the menu, select Add > Network > Manual. The wizard opens.
6. In the drop-down list Network type, select Subnet. Click on NEXT . The next page opens.
a class or None. Click on NEXT . The page Add an IPv4 network opens.
9. In the field Address, type in the start address. By default, the start address of the block-type
network you selected is displayed in the field.
10. Set the network size:
a. In the drop-down list Netmask, select a netmask. The netmask value automatically edits
the Prefix.

11. In the section IPAM properties, the box Activate the IPv4 to IPv6 transition is ticked. The
parameter is Inherited and set to Propagate. If you want to untick the box, you must Set the
Inheritance property and then untick the box.
12. The field IPv6 network (block-type network displays the value set at higher level. The
parameter is Inherited and set to Propagate. If you want to edit it, you must Set the Inheritance
property to be able to edit the value in the field, the bytes entered must correspond to an
existing IPv6 block-type network in the space.
13. The field IPv6 network (subnet) displays the start address and prefix of an IPv6 subnet-type
network and prefix that is created along with the IPv4 network you are creating.
14. Click on OK to commit your creation. The report opens and closes. The network is listed. In
IPv6, the subnet-type network is created as well and shares the same name.The configuration
is displayed on the properties page of the IPv4 and the IPv6 networks, in the panel Advanced
properties.
Activating the Transition at IP Address Level

At address level, all the configurations set at higher levels are inherited.
To activate the IPv4 to IPv6 transition when assigning an IP address
4. Click on the Name of a terminal subnet-type network you applied the transition options to.
The page All addresses of the network opens.
5. Click on the available IP address of your choice. The pop-up window This address is free,
do you want to assign it? opens. Click on OK . The wizard opens.
6. If you or the administrator created classes at the IP addresses level, in the list IP address
class, select a class or None. Click on NEXT . The page Add an IPv4 address opens.
261
to IPv6
7. In the field MAC address, you can type in the MAC address of your choice. The IPv6 address
is also associated to this MAC address.
8. In the field Corresponding IPV6 address, the IPv6 address is displayed in gray. This IP ad-
dress depends on the transition you set in the wizard Advanced properties customization.
For more details, refer to the section Configuring the Transition at IP Address Level.
9. In the field Shortname, name the IP address. The IPv6 address is named the same. The IP
address name field displays the shortname you typed in.
11. Click on OK to commit your creation. The report opens and closes. The address is listed. In
IPv6, the address is created as well, it has the same name and MAC address. The configur-
ation is displayed on the properties page of the IPv4 and IPv6 addresses, in the panel Ad-
vanced properties.
262
Chapter 20. Managing IPAM Templates
The IPAM provides a template that allows to create fully preconfigured IPAM structures, templates,
to create the IPAM resources that suit your needs.
Using templates successfully implies:
1. Creating a template class for each relevant level of the IPAM hierarchy.
2. Creating the template resources that suit your needs.
3. Applying your template class when creating your resources. The template class applies the
template configuration to your resource.
For instance, you can create a template for a block-type network containing 3 networks, each
managing 3 pools, and associate it with a template class. Selecting this class when adding a new
block-type network overwrites its name with its template name and automatically creates the related
child objects with their template name, size and organization.
Note that the prefix set in the template class is not applied to the object you create with this class.
However, all the template content is created in your resource, so make sure that the resource
you create has a prefix small enough to contain all the objects set in the template.
Creating Template Classes in Class Studio

To create IPv4 templates, you need to create network classes and pool classes and set them
both as template class.
You can create several template classes if you want to set up different organizations. You can
use class directories to differentiate them. These classes are listed in the IPAM addition/edition
wizards as follows: <directory-name>/<class-name> [template].
To create an IPAM template class
1. Create a network class
a. Go to the Administration tab. If the homepage is not displayed, click on . The

homepage opens.
b. In the section Customization, click on Class Studio. The page Class Studio opens.
c. In the menu, select Add > Class. The wizard Add a new class opens.
d. In the field Filename, name the class.
e. In the field Sub directory, you can type in a directory name. If it does not exist it is cre-
ated.
f. In the drop-down list Module, select IPAM.
g. In the drop-down list Type, select Network.
h. In the section Enable class, tick the box.
i. Click on OK to commit the creation. The report opens and closes. The class is now listed
on the page among the IPAM module classes and marked Enabled in the column Status.
263
Managing IPAM Templates
2. Create a pool class
a. In the menu, select Add > Class. The wizard Add a new class opens.
b. In the field Filename, name the class.
c. In the field Sub directory, you can type in a directory name. If it does not exist it is cre-
ated.
d. In the drop-down list Module, select IPAM.
e. In the drop-down list Type, select Pool.
f. In the section Enable class, tick the box.
g. Click on OK to commit the creation. The report opens and closes. The class is now listed
on the page among the IPAM module classes and marked Enabled in the column Status.
3. Enable the classes as template class
a. In the list Class Studio, tick the classes you just created.
b. In the menu, select Tools > Use as template class. The wizard Add template opens.
c. Click on OK to commit the configuration. The report opens and closes. The classes are
marked yes in the column Template.
You can rename or edit a template class as long as you are not using it already. For more details,
refer to the chapter Configuring Classes.
Creating IPAM Templates

The template mode allows to create templates at every containing level of the IPAM module in
IPv4. Before going further, keep in mind that:
• The template of an element created in Template mode that must be associated with a class
to be used in Normal mode. If you created a whole hierarchy in template mode but only asso-
ciated a terminal network with the appropriate class template, only this template is available
in Normal mode.
• A template class can only be applied to one resource in template mode. You can use it on as
many resources as you need in normal mode.
• A template can be configured with advanced properties and class parameters, they are applied
to the resources you create in normal mode and inherited by the resources they contain.
• The Inheritance property and Propagation property of the templates' parameters and prop-
erties can be Set/Propagate, Set/Restrict or Inherited/Propagate.
• You cannot configure the Inheritance property and Propagation property to Inherited/Restrict
in template mode.
• You cannot overlap addresses in Template mode even though you might only associate a few
resources with a template class and apply them in normal mode.
At space level, you cannot apply template classes. Space templates are only the entry point of
the templates hierarchy.
264
At network level:
• The start address set for a template is overwritten by the one you specify in normal mode: it
is only used to define the network size.
• The prefix set for a template is overwritten by the one you specify in normal mode but the objects
it contains are created with the configuration set in template mode. So make sure that the re-
source you create in normal mode is big enough to receive all the objects configured in template
mode.
• A block-type network template, once associated with an enabled template class, allows to
create a block-type network with the same name, properties and content as the template
(networks, pools and assigned addresses).
• A subnet-type network template, once associated with an enabled template class or if the
template network belongs to a block-type network associated with one, allows to create subnet-
type network with the same name, properties and content as the template (pools and assigned
addresses).
• The IPAM/VLAN interaction is limited: you cannot configure a subnet-type network template
to Create a VLAN, you can only associate it with an existing VLAN.
At pool level:
• A pool template, once associated with an enabled template class or if the template pool belongs
to a network associated with one, allows to create a pool named after the template, with the
same properties and content (assigned addresses).
• The start address set for a template is overwritten by the one you specify in normal mode. If
you configured the template pool with a template class, you must set the same size for the
pool the
• If you configured the template pool with a template class, creating a pool in normal mode
with this class requires that you set it with the exact same size. Any other size returns an
error.
• If the template pool belongs to a network configured with a template class, creating the net-
work automatically creates the pool. The start address of the template pool is then only used
to define an offset for the first IP address of the pool and define its size.
At IP address level, you cannot apply templates. However, if you assign addresses belonging
to a network template or pool template, they are assigned when you create the resources using
the template.
Creating a Space Template

To be able to apply templates at network or pool level, you need to create a space template.
A space template cannot be associated with a template class, therefore you must configure the
space with all the parameters and properties that you want to propagate at lower levels both ion
template and normal mode.
You can create several space templates if you want.
To create a space in template mode
1. Display the template mode.
a. Go to the IPAM tab and open the page All spaces.
265
b. In the menu, select Display > Template mode. The page opens and a red message
under the menu indicates that you are in template mode.
2. In the menu, select Add > Space. The wizard opens.

class or None. That class is not a template class, it does not allow to automate a space
configuration in normal mode. Click on NEXT . The page Add a space opens.
4. In the field Space name, name the space.The name you choose cannot be reused in template
or normal mode afterward.
6. You can fill in the advanced properties fields following the table below.

Field Description
Properties.
Keep in mind that these properties have to be manually set on the space you create in normal
mode, the space template cannot be associated with a template class. Your configuration
is, however, inherited by the resource you create in the space in template mode.
7. Click on OK to commit the creation. The report opens and closes. The space is listed.
Once your space template is created, you can create the objects it contains.
Keep in mind that in Template mode, you need to follow the IPAM hierarchy: the Orphan Networks
and Orphan Addresses containers do not exist.
Creating a Network Template

Once you created a space template, you can create the network templates it contains. Keep in
mind that:
• You can only use templates for networks if you created a class for them, enabled it and set it
as template class. For more details, refer to the section Creating Template Classes in Class
Studio.
• You cannot overlap block-type networks or subnet-type networks, even in template mode.
• You can create a block-type network in template mode that is not configured with a template
class if you intend to only use templates for subnet-type networks and/or pools.
• You can create a subnet-type network in template mode that is not configured with a template
class:
• If you intend to only use templates for pools.
• If you intend to organize the content of a block-type network created in template mode but
not configured with a template class.
266
• Any resource added in the block-type network becomes part of the template and is created
when you add the network in normal mode. So you do not need to associate all lower level
levels with a template class, but you can.
• Any resource added in the subnet-type network becomes part of the template and is created
when you add the network in normal mode. So you do not need to associate all lower level
levels with a template class, but you can.
To create a template for a block-type network
a. Go to the IPAM tab. If the homepage is not displayed, click on . The homepage opens.
b. Click on Spaces. The page All spaces opens.
c. In the menu, select Display > Template mode. The page opens in template mode.
2. Click on the Name of the space template of your choice. The page All networks opens.
3. In the menu, select Add > Network > Manual. The wizard Block class opens.
4. In the drop-down list Network type, select Block. Click on NEXT . The next page of the wizard
opens.
5. In the list Network class, select the template class of your choice. Click on NEXT . The page
Add an IPv4 network opens.
If you want to create a template at lower level, select None. Your configuration is inherited
in template mode, but the content of your network cannot be created when you add a block-
type network in normal mode.
6. In the field Network name, name the network.
9. In the drop-down list Netmask or Prefix, select the value of your choice. The netmask you
choose automatically edits the prefix and vice versa. The final size is displayed in the field
Comment.
10. Depending on the administrator's configuration you may be able to fill in the advanced
properties fields. They might be inherited from the space. For more details, refer to the section
Configuring IPAM Advanced Properties.
Once you created a template for block-type networks, you can create a template for subnet-type
networks. You can create it manually or using the option By search.
To create a template for a subnet-type network
b. Click on Networks. The page All networks opens.
267
2. Click on the Name of the template for block-type network of your choice. The page All net-
works of the network opens.
3. In the menu, select Add > Subnet > By search (subnets). The wizard opens.
4. In the list Network class, select the template class of your choice. Click on NEXT . The page
Network size opens.
If you do want to create a template at this level, select None.

subnet opens.
8. In the field Description can display the value set on the parent network. The parameter is
Inherited and set to Propagate. If you want to edit it, you must Set the Inheritance property
to be able to edit the value in the field.
9. The fields Address and Prefix display the values set on the page Network size.
11. Depending on the administrator's configuration you may be able to fill in the advanced
properties fields. They might be inherited from the parent network. For more details, refer to
the section Configuring IPAM Advanced Properties in the chapter Managing Advanced
Properties.
If you do not need pools, you can go straight to the section Applying a Template.
Do not hesitate to assign addresses within the terminal network templates, they are automatically
assigned in normal mode when the template is used.
Creating a Pool Template

Once you created a template for subnet-type networks, you can create a pool template. Keep in
mind that:
• You can only use pool templates if you created a class for them, enabled it and set it as template
class. For more details, refer to the section Creating Template Classes in Class Studio.
• Pools cannot overlap each other, even in template mode.
• You can create a pool in template mode that is not configured with a template class if you intend
to organize the content of a network created in template mode but not configured with a template
class.
268
• Any IP address assigned in a pool becomes part of the template and is created when you add
the pool or network that contains the pool.
To create a pool template
b. Click on Networks. The page All networks opens.
2. Create a pool template.
a. Click on the Name of the terminal network template of your choice. The page All ad-
dresses opens, in the breadcrumb, click on All pools.
b. In the menu, select Add > Pool. The wizard opens.
c. In the list IP pool class, select the template class of your choice. Click on NEXT . The
page Add an IPv4 pool opens.
If you do not want to set a template at this level, select None.

d. In the field Pool name, name your pool.
e. In the section Pool read-only, tick the box if you want all the addresses the pool contains
to be reserved.
f. In the field Start address, specify the first address of the pool. By default, the first address
of the parent network is displayed.
g. In the field End address, specify the last address of the pool. By default, the last address
of the parent network is displayed. Editing this field automatically edits the field Size
field, and vice versa.
h. In the field Size, type in the number of addresses you want in the pool. Setting a size
edits the End address, if you do not specify anything, the size is automatically calculated
according to the start and end addresses.
i. Depending on the administrator's configuration you may be able to fill in the advanced
properties fields. They might be inherited from the parent network. For more details,
refer to the section Configuring IPAM Advanced Properties.
j. Click on OK to commit your creation. The report opens and closes. The pool is listed.
Once you created all the pool template(s) you need, you can apply them in normal mode.
Applying a Template
To apply the templates in normal mode, you need to select a template class when creating net-
works and pools. Before applying a template, keep in mind:
The template mode limitations

1. Template classes do not exist for spaces.
• If you create a network or pool template with a specific configuration of behaviors, you
need to create a space in normal mode, with the exact same configuration as the space
containing your objects in template mode.
269
• In template mode, all the configuration parameters that you set for a network can only
apply if the space is also configured with them.
2. In normal mode, you cannot name the object to which you apply a template class.
When you create an object using a template class, you must name it in the wizard but its
name is automatically overwritten to match the object to which the class is associated in
template mode.
For instance, if in template mode you created a network named France that you associated
with the template class france, when you apply this class to a network you add in normal
mode, you can name it FR in the addition wizard but when you commit your creation, the
new network listed is named France.
3. In normal mode, you cannot rename an object created using a template.
The network templates specificities
1. The start address of a network/pool set in template mode indicates the size.
When you define a network/pool start address in the addition wizard, this address is actually
used and the size of the template object is applied based on the start address you set.
2. When you are configuring a network using a template, type in the start address and make
sure that the size automatically calculated is greater than the size of the template. In other
words, make sure the automatic size matching the network can contain the template. The
template class does the rest.
For instance, if you are using a subnet-type network template, type in the name and the
start address. SOLIDserver proposes a size going from the start address you specified to
the very last available in the block-type network. If this represents 512 addresses and your
subnet-type network template sets up 128 addresses, do not modify anything as your
subnet-type network template size can be contained in the subnet automatically calculated.
Only the first 128 addresses you need are included in the newly created subnet-type net-
work.
The pool template specificities
1. The pool template allows to provision subnet-type networks. All the assigned addresses
are saved and recreated.
2. In normal mode when you apply a pool class template, the pool you create must be set
with the same Size and Pool read-only than the template pool.
The procedure below illustrates the use of template classes when adding a block-type template.
You can adapt this procedure to any level.
To apply a template when creating a block-type network
1. Go to the IPAM tab.

2. Go to the page All networks of the space of your choice.
4. In the menu, select Add > Network > Manual. The wizard opens and displays the class
dedicated page.
5. In the drop-down list Network type, select Block. Click on NEXT . The next page of the wizard
opens.
270
6. In the list Network class, select the class template of your choice. Click on NEXT . The page
Add an IPv4 Network opens.
The class name format is as follows: your-template-name [template] or your-sub-direct-

ory/your-template-name [template] .
7. In the field Network Name, name the network. This name is overwritten by the name of the
template for block-type network that you selected.
10. Do not edit the fields Netmask and Prefix. By default, no matter its content, the template
automatically overwrites the default values to apply the size that you set in the template
class.
11. Depending on the administrator's configuration you may be able to edit or complete the
network configuration, the template's advanced properties and class parameters configuration
are automatically loaded.
12. Click on OK to commit the addition. The report opens and closes. The network is listed, click
on its Name to display its content: it contains all the objects set in template mode.
271
Chapter 21. Using VLSM to Manage Your
IPAM Network
The Variable Length Subnet Masking (VLSM) is a technique that allows network administrators
to break down the IP address organization on different levels of spaces, networks or pools both
in IPv4 and IPv6.
From the space level you can use the IPAM hierarchy to model the organization of IP resources
and increase its capacity. There are two ways of using VLSM within the GUI, both can be used
to delegate user rights.
SOLIDserver uses specific icons to display VLSM hierarchies:
Table 21.1. VLSM icons on the pages All spaces and All networks
Icon Description
The dot, located left of the space or network icon, indicates that the object belongs to another object.
It specifies the level of the space or network in the VLSM hierarchy: one dot for level 1, two dots for
level 2, three dots for level 3, and so forth depending on how deep your organization is.
This icon indicates that the subnet-type network is non-terminal i.e. using VLSM. In a space-based
VLSM organization it indicates that it is linked to a block-type network of the child space. In a network-
based VLSM organizations, it indicates that the network contains other subnet-type networks.
This icon indicates that the block-type network is part of a space-based VLSM organization and belongs
to a level 2 space, or lower. It shows that the block-type network is linked to a non-terminal subnet-
type network in the parent space, they both share the same name and size.
Choosing the Method That Suits Your Needs

SOLIDserver provides two different implementation techniques for VLSM:
• A Space-Based VLSM Implementation.

• A Network-Based VLSM Implementation.
In both cases, organizing your IPAM network using VLSM provides a way to delegate user rights
as it allows to limit what users belonging to certain groups can display and manage.
You can set up an organization that uses both methods but there are some requirements to meet.
For more details, refer to the section Properly Using Both Methods Simultaneously.
Space-Based VLSM Implementation

Your IPAM network can organize spaces: you can create as many spaces as you need and
connect them with each other to set up your organization. The VLSM hierarchy can be as deep
as you need.
VLSM introduces a parent to child dependency relationship between two spaces. A child space
is then attached and related to a parent space, they are affiliated .
272
Using VLSM to Manage Your IPAM
Network
SPACE
NETWORK
BLOCK
Space filiation
NETWORK
SUBNET
SUBSPACE
SUBSPACE
SUBSPACE
Figure 21.1. The space filiation in a space-based organization
The resources contained in the parent space can then be allotted to one of its child spaces. When
a subnet-type network is created in a parent space, it may then be allotted to a child space: non-
terminal subnet-type networks of parent space become block-type networks in the child space.
This block-type network may then be divided into several subnet-type networks to be allotted as
block-type networks in "grandchildren" spaces, and so on.
SPACE
NETWORK /21
BLOCK
Space filiation
NETWORK /22
SUBNET
SUBSPACE
NETWORK /22
BLOCK
NETWORK /24
SUBNET
Figure 21.2. A delegation of networks among affiliated spaces
As spaces can be combined to map your organization, they can help network administrators to
delegate the IP address management per layer of space. For instance, large block-type networks
can be defined as root entries at the top level of the space hierarchy. These networks can be
divided into several non-terminal subnet-type networks to be allotted to subspaces: each non-
terminal subnet-type network becomes a block-type network in the child space. Within these
subspaces, the block-type networks are divided into subnet-type networks matching the size of
273
Network
your choice to register a network device, manage a specific set of IP addresses within your
company...
This hierarchy makes it possible to obtain a coherent space unit where the resource administration
is governed by the dependent relationships created between these spaces. The consistency
check of resources and their uniformity are made between all affiliated spaces.
Figure 21.3. A space-based VLSM organization on the page All spaces
In the example above, the clients IP database is organized based on geography: each country
has a separate space affiliated to the continent it belongs to. These spaces were created prior
to creating the networks and pools in order to shape the rest of the IP addresses organization.
With this type of organization, the delegation of rights and permissions can be set per continent,
per country or within a country.
For more details regarding the manual VLSM implementation, refer to the section Setting Up a
Space-Based VLSM Organization.
Network-Based VLSM Implementation

Your IPAM network can organize subnet-type networks delegation within one space.
274
Network
SPACE
NETWORK /21
BLOCK
NETWORK /22
SUBNET
NETWORK /23
SUBNET
NETWORK /24
SUBNET
POOL
ADDRESS
Figure 21.4. A network-based organization
Like the space-based implementation, it involves creating non-terminal subnet-type networks but
this time it sets up several levels of hierarchy within one space. Therefore, the semi-automated
VLSM allows you to distribute IP addresses on more than one level within a space without setting
a space affiliation.
Figure 21.5. A network-based VLSM organization on the page All networks
In the example above, the internal block is divided into managing staff and all other staff members.
The distribution of staff IP addresses is once again geographical. As the division is performed at
the lower level, the delegation of rights and permissions to different administrators can be all the
more precise with limited access to the database if necessary.
There is no limit to the number of non-terminal subnet-type network levels you can set. It all de-
pends on their size and the size of the block-type network they belong to.
For more details regarding the network-based implementation, refer to the section Setting Up a
Network-Based VLSM Organization.
275
Network
Properly Using Both Methods Simultaneously

To use both methods you must keep in mind that VLSM implementation follows the IPAM
hierarchy logic: spaces contain block-type networks that contain subnet-type networks that
contain pools that contain IP addresses. Which is why you can only set both methods if you respect
the following:
• You cannot set up a space-based organization using a space that already contains non-terminal
subnet-type networks, meaning, a preexisting network-based organization. You can only set
up first a space-based distribution and then a network-based delegation.
• The network-based implementation can only be set at the lowest of the space-based organiz-
ation.
Keep in mind that, in a mixed organization, you can specify the inheritance and propagation
properties depending on your needs. For more details, refer to the section Editing a VLSM Block-
type Network Class Parameters Inheritance.
Managing a Space-Based VLSM Organization

The space-based or manual VLSM implementation must respect a specific order to be properly
set.
1. Create all the spaces one by one.

2. Affiliate all the spaces. Either when creating them or once created, as long as they are still
empty.
3. Create all the block-type networks in the parent space(s).
4. Create the non-terminal subnet-type networks within these block-type networks. They become
the block-type networks of the child space.
Once set up, you can move networks to edit the network links between a parent space and one
of its children but you cannot set up a deeper organization once the spaces contain affiliated
networks.
Note that you can also import space-based VLSM organizations, for more details refer to the
section Importing Spaces.
Setting Up a Space-Based VLSM Organization

Following the IPAM hierarchy, your space-based organization is done in the following order:
1. Creating and Affiliating the Spaces to set the delegation depth.

2. Creating the Block-type Networks in the Parent Space to define a range of IP addresses to
delegate.
3. Creating the Future Block-type Networks in the Child Space that is to say creating non-terminal
subnet-type networks in the parent space.
Keep in mind that once the organization is implemented:
• The network display is independent for each space level. From the page All networks of the
top space you cannot display the networks of all space levels.
276
Network
• Every non-terminal subnet-type network in a parent space becomes a block-type network in

the child space.
• The content of a non-terminal network is common to both affiliated spaces: the terminal net-
works, pools and assigned IP addresses of a non-terminal subnet-type network are created
both in the parent and child spaces.
• The subnet-type networks, pools and assigned IP addresses of a non-terminal subnet-type
network are created both in the parent and child spaces.
• Any object you create in a parent space is created in the child and vice versa.
• Any object you delete in a parent space is deleted in the child and vice versa.
• Every terminal network in a space stays where it is created, even is it was created in a parent
space.
• You cannot edit the space-based organization to make it deeper. However, some operations
may relocate your networks. For more details, refer to the section Editing a Space-Based VLSM
Organization.
Creating and Affiliating the Spaces
The space affiliation is configured in the space addition or edition wizard.
Before creating your space affiliation, keep in mind that:
• You can have one parent space with several children. These children can also be parent to
other spaces.
• The direct VLSM hierarchy affiliation between spaces updates simultaneously both spaces.
• The parameters and advanced properties configured at space level are inherited by the spaces,
networks, pools and IP addresses they contain.
Therefore, the block-type networks of each space inherit the configuration, the subnet-type
networks managed by the block-type network inherit as well, and so forth down to the IP ad-
dresses. You can edit any level of the hierarchy to set a particular parameter or property and
propagate it to the lower level.
Figure 21.6. A space filiation where the space Clients contains the child space America
To set up the VLSM space-based organization
1. Creating the top level space
b. Click on Spaces. The page All spaces opens.
c. In the menu, select Add > Space. The wizard Add a space opens.
277
Network
d. In the list VLSM parent space, select None. This first space is the top level space in
your organization.
e. Click on NEXT . The next page opens.
f. If you or your administrator created classes at space level, in the list Space class, select
a class or None. Click on NEXT . The last page of the wizard opens.
g. Fill the fields Space name and Description according to your needs.
h. Using the drop-down list Advanced properties, you can configure advanced properties.
i. Click on OK to commit the space creation. The space is listed.
2. Creating the affiliated child space
a. In the menu, select Add > Space. The wizard Add a space opens.
b. In the list VLSM parent space, select the top level space you just created.
c. Click on NEXT . The next page opens.
d. If you or your administrator created classes at space level, in the list Space class, select
e. Fill the fields Space name and Description according to your needs.
f. Using the drop-down list Advanced properties, you can configure advanced properties.
g. Click on OK to commit the space creation. The level 1 space is listed.
You can repeat step 2 for as many spaces as you need. In the list VLSM parent space, you
can select a space no matter its level in the hierarchy. The spaces display indicates each
space level as detailed in the table VLSM icons on the pages All spaces and All networks.
You can edit some aspects of the space-base organization even after you created networks,
pools and addresses. For more details, refer to the section Editing a Space-Based VLSM Organ-
ization.
Creating the Block-type Networks in the Parent Space
Once your space affiliation is set, you can create IPv4 or IPv6 block-type networks:
• The block-type networks must be created in the top level space of the affiliated spaces.
If you create them on a child space, the VLSM organization cannot be set, you would be creating
a block-type network and not setting up a space-based organization.
• If you configured specific parameters or behaviors at space level, the block-type networks in-
herit them.
Figure 21.7. A block created in the space Clients
278
Network
To add a block-type network manually
1
5. In the drop-down list Network type, select Block . Click on NEXT . The next page of the wizard
opens.
6. In the list Choose a space, select the space in which you want to add the network. Click on
opens.
a. In the drop-down list Netmask select a netmask. The netmask value automatically edits
the Prefix.

12. If you are adding an IPv6 network, in the drop-down list Prefix, select a value between /16
and /64. The values depend on the Address you specified.

Field Description
1
279
Network
Field Description
Properties.
To respect the levels of management you set, once you create a subnet-type non-terminal network
in a top level space, if you click on its Name on the page All networks you are redirected to the
content of the block-type network it created in the child space. This allows to navigate from one
level to the other and create your terminal networks, pools and IP addresses.
Once you created a block-type network in the parent space, you can create a non-terminal subnet-
type network(s) it contains.
Creating the Future Block-type Networks in the Child Space
In the parent space, if you create non-terminal subnet-type networks in a block-type network they
become the block-type networks of the child space of your choice. The terminal networks you
create belong to the space, they are not delegated.
Keep in mind that, once you link block-type and subnet-type networks in a space affiliation, they
update each other:
• If you create objects in the non-terminal subnet-type network, they are also created in the
block-type network of the child space.
• If you create objects in the block-type network of the child space, they are also created in the
subnet-type network of the parent space.
Figure 21.8. A non-terminal network created in the block of the space Clients
Figure 21.9. In the child space America, the non-terminal network is a block-type network
In the procedures below, we create a non-terminal subnet-type network by search but you can
also create it manually.
280
Network
To create an IPv4 block-type network in a child space from a parent space
3. Click on the Name of the top level space. The page All networks opens.
5. Click on the Name of the block-type network of your choice to display its networks.
network opens.
result.
13. Untick the box Terminal network. The wizard refreshes and no longer includes the fields
Gateway and pool related fields if they were displayed.
14. Using the drop-down list Advanced properties, you can configure advanced properties. For
more details, refer to the chapter Managing Advanced Properties.
15. Click on NEXT . The page VLSM space opens.
16. In the list VLSM space, select the child space where the non-terminal subnet-type network
becomes a block-type network.
17. Click on OK to commit the creation. The report opens and closes. The network is listed with
the icon . Depending on the organization depth, it is preceded by one or several . For
more details, refer to the table VLSM icons on the pages All spaces and All networks.
On the page All networks of the child space you chose, the non-terminal subnet-type network
is listed as a block-type network.
To create an IPv6 block-type network in a child space from a parent space
3. Click on the Name of the top level space. The page All networks opens.
281
Network
9. In the drop-down list Network prefix, select the value of your choice between 16 bits and 64
bits.
10. Click on NEXT . The page Search result opens.
IPv6 network opens.
result.
15. Click on NEXT . The page VLSM space opens.
16. In the list VLSM space, select the child space where the non-terminal subnet-type network
becomes a block-type network.
17. Click on OK to commit the creation. The report opens and closes. The network is listed with
the icon . Depending on the organization depth, it is preceded by one or several . For
more details, refer to the table VLSM icons on the pages All spaces and All networks.
On the page All networks of the child space you chose, the non-terminal subnet-type network
is listed as a block-type network.
If you add another non-terminal subnet-type network in the parent space, a new block-type network
is created in the child space.
Editing a Space-Based VLSM Organization

Once you set up a space-based organization, you can:
• Edit the VLSM parent of a space.

• Edit subnet-type networks to make them terminal or not in some specific cases.
• Edit VLSM block-type networks to inherit the value of a class parameter from a parent network
or space.
• Delete subnet-type networks in some specific cases.
You cannot set up a deeper organization of spaces once they contain networks linked from one
level to the other.
Editing the VLSM Parent of a Space
You can edit the VLSM parent of a space:
• Only if it does not already contain a block-type network that was created when a non-terminal
subnet-type network was created at higher level.
For more details, refer to the section Editing a Space.
282
Network
Editing a Subnet-type Network within a Space-Based Organization
Within a space-based organization, editing a subnet-type network terminal is limited:
• Editing a terminal network to make it non-terminal

• Is only possible in the lowest level of the space organization, if the network contains pools.
You must delete the pools and then edit the subnet-type network.
• Editing a non-terminal network to make it terminal
• Is impossible if the block-type network created at lower level contains networks.
• Is impossible if the non-terminal subnet-type network contains other networks, pools and/or
IP addresses.
• Is only possible if the block-type network created at lower level is empty.
• Editing the target space of a subnet-type network created at lower level
• In an organization where a space manages several child spaces of same level, you can edit
a non-terminal subnet-type network in the managing space to change its VLSM space. In
the example below, this edition would be possible in the space America.
This edition moves the block-type network created in the former child space, along with all
the networks, pools and addresses it contains, to the child space you specified.
• In an organization where a subnet-type network was created at several space levels - the
spaces Clients, Europe and France in the example below - you can edit the VLSM space of
the network and select the space america. That edition results in the creation of Orphan
containers in the spaces europe and france and the creation of the block-type network in
the space america. From there you can recreate the networks that suit your needs. With
such an organization, this specific edition is only possible because the top space contained
several spaces at the same level.
Figure 21.10. A space-based VLSM organization on the page All spaces
Editing a VLSM Block-type Network Class Parameters Inheritance
Once you set a space-based VLSM organization, you can add and edit class parameters at the
different levels of the hierarchy.
Both the parents of a VLSM block-type network, i.e. the space and the non-terminal subnet-type
network, can have different values for the same class parameter. The VLSM block-type network
inherits the parameter that has been configured before the other.
283
Network
You can edit the class parameters inheritance source of a VLSM block-type network. The class
parameter value can be inherited from:
• Space: the class parameter value is inherited from the lowest space in the organization, the
space where the selected block-type network is located. You cannot choose a space located
at higher level.
• Network: the class parameter value is inherited from the non-terminal subnet-type network it
is linked with, one level up in the space hierarchy. You cannot inherit the value of any subnet-
type network located higher in the hierarchy.
To edit a VLSM network class parameters inheritance
2. Click on Spaces. The page All networks opens.
3. Tick the VLSM block-type network(s) of your choice.
4. In the menu, select Tools > Expert > Edit class parameters inheritance source (VLSM
block). The wizard Edit class parameters inheritance source wizard opens.
5. In the drop-down list Parameter, select the class parameter which value you want the selected
network(s) to inherit.
6. In the drop-down list Inherited from, select the inheritance source:
a. Space if you want to inherit the value from the space containing the block-type network
you selected.
b. Network if you want to inherit the value from the network linked with the block-type
network you selected, one level up.
7. Click on ADD . The wizard refreshes. The class parameter, along with its source and restriction
option are listed in the Properties list.
8. Repeat steps 5 to 7 for as many parameters as needed.
You can edit the content of the Properties list. Select an entry, it is displayed again in the
field, edit it and click on UPDATE or click on DELETE to remove it from the list. If you made
changes that you do not want to save, click on CANCEL .
9. Click on OK to commit the inheritance changes. The report opens and closes.
Deleting Networks in a Space-Based Organization
As the IP address management in space-based VLSM organization relies on subnet-type and

block-type networks distributed on different levels, deleting the networks has to follow certain
rules.
• You cannot delete a block-type network directly from the space it belongs to.
Deleting a VLSM block-type network can only be done from higher level: when you delete the
non-terminal subnet-type network that created it, the block-type network is deleted as well.
• You can only delete a subnet-type network if the block-type network it created at lower
level is empty.
You cannot delete a subnet-type network in a parent space if the block-type network created
in the child space contains networks
284
Network
Deleting subnet-type networks automatically deletes the block-type network it created at lower
level.
Unifying the VLSM Networks

In some cases after a migration, you might have a space-based VLSM organization where the
parent and child spaces content do not match. The following two options allow to unify the content
of your spaces especially the link between block-type and subnet-type network networks of two
different levels.
Attaching a Network to its VLSM Parent
After a migration, the content of the parent and child spaces might differ and some objects might
not be associated: you might have a block-type network in a child space that is not associated
with a non-terminal subnet-type network.
Depending on your configuration, you might be able to create the missing non-terminal subnet-
type network in the parent space using the option Attach network to its VLSM parent. This would
allow to continue using VLSM to delegate rights and resources or create and delete objects in
both spaces at once.
Keep in mind that you can only use this option if:
• The block-type network in the child space is not already associated with a non-terminal subnet-
type network of the parent space.
• The parent space can receive the child space block-type network as a non-terminal subnet-
type network:
1. In the parent space, a block-type network can receive the non-terminal subnet-type network.
2. There is no overlap.
To attach a network to its VLSM parent
3. Click on the name of the child space of your choice. The page All networks open.
4. Tick the block-type network(s) of your choice.
5. In the menu, select Tools > Expert > Attach network to its VLSM parent. The Attach network
to its VLSM parent wizard opens.
6. Click on OK to commit the operation. The report opens and closes. The selected block-type
network is now preceded by .
Aggregating VLSM Networks
After a migration, you can have affiliated spaces which IP addresses are not properly associated:
you might have a missing non-terminal subnet-type network in a parent space even if the block-
type network does exist in the child space.
In this case, you can use the option Aggregate VLSM networks from the page All spaces to create
the missing non-terminal subnet-type networks in the parent space.
285
Network
To aggregate VLSM networks
3. In the menu, select Tools > Expert > Aggregate VLSM networks. The Aggregate VLSM
networks wizard opens.
4. In the drop-down list Parent space, select the parent space where the corresponding non-
terminal subnet-type network is missing.
5. Click on OK to commit the modifications. The report opens and closes. The missing non-
terminal subnet-type network(s) is created on the page All networks list of the space you
selected.
Moving IPv4 Addresses across the VLSM Hierarchy
If you reorganize your space-based hierarchy and plan on adding sub-spaces, you might need
to move IPv4 terminal networks from a top level space to a lower level of the hierarchy. In that
case, the IP addresses must be moved to the sub-space(s). This operation could be performed
by moving IP addresses from one space to the other, as detailed in the section Moving IP Ad-
dresses to another Space; however, you might have a lot of IPv4 terminal networks to spread
on multiple sub-spaces, and it would take a long time to repeat the operation for each sub-space.
The option Move addresses to VLSM network allows to automate the migration of IPv4 addresses
to the lowest terminal networks across the space hierarchy. It spreads the IP addresses in all the
available terminal networks that can contain them. That is to say, a terminal network at the lowest
level of the hierarchy which start address can receive the selected addresses.
To spread IPv4 addresses across the VLSM hierarchy
1. Double-click on the IPAM tab. The homepage opens.

3. Tick the IP address(es) you want to spread within the lower spaces of your VLSM organization.
4. In the menu, select Tools > Expert > Move addresses to VLSM network. The Move VLSM
IP addresses wizard opens.
5. Click on OK to commit the migration. The report opens and closes. The IP addresses are
listed, the space and networks they belong to have changed.
Managing a Network-Based VLSM Organization

The network-based VLSM organization organizes subnet-type networks imbrication within one
space, it can be set within different block-type networks.
Note that you can also import network-based VLSM organizations, for more details refer to the
section Importing Networks.
Setting Up a Network-Based VLSM Organization

Setting up a network-based VLSM organization implies creating non-terminal subnet-type networks
that manage terminal networks, pools and IP addresses on different levels. Note that:
• You can make the network-based VLSM organization go as deep as you need.
286
Network
• You can use the network-based organization to delegate management, limit permissions or
grant access to specific parts of your network. You can also use it to configure areas of your
network differently, like in the image below.
• You cannot set up a network-based VLSM organization in a parent space. The network-based
VLSM organization implies creating non-terminal subnet-type networks:
• Either in an independent space,
• Or in a child space that is at the lowest level of a space-based VLSM organization. In other
words, in a child space that does not have any child space.
Indeed, creating non-terminal subnet-type networks in a parent space creates block-type net-
works in a child space, in which case, your VLSM organization is space-based.
SPACE Continent = America
NETWORK Country = USA

BLOCK
NETWORK State = District of Columbia

SUBNET
NETWORK City = Washington

SUBNET
NETWORK Department = Procurement

SUBNET
POOL
ADDRESS
Figure 21.11. Example of a class parameter configuration based on the networks' organization
Contrary to the space-based organization, the network-based VLSM organization allows you to
display the IPAM hierarchy at a glance, in one block-type network. As all the networks can be
listed all together, there is no need to go through different spaces separately to list of non-terminal
subnet-type networks and their content.
To create an IPv4 non-terminal subnet-type network
3. Click on the Name of the space of your choice. The page All networks of the space opens.
287
Network
network opens.
result.
14. Click on OK to commit the creation. The report opens and closes. The non-terminal subnet-
type network is listed and preceded by .
To create an IPv6 non-terminal subnet-type network
3. Click on the Name of the space of your choice. The page All networks of the space opens.
9. In the drop-down list Network prefix, select the value of your choice between 16 bits and 64
bits.
IPv6 network opens.
result.
15. Click on OK to commit the creation. The report opens and closes. The non-terminal subnet-
type network is listed and preceded by .
Once you created a non-terminal subnet-type network, it can contain as many non-terminal
subnet-type networks as you need: it all depends on their size. And you can create a hierarchy
as deep as you need.
Within the non-terminal subnet-type networks you can create terminal networks to manage pool
and assign addresses. For more details, refer to the section Adding Networks.
288
Network
Editing a Network-Based VLSM Organization

You can edit a network-based organization by editing the networks themselves, or deleting non-
terminal networks.
Editing a Subnet-type Network to Make it Terminal or Non-Terminal
To make a subnet-type network terminal or not, you must tick or untick the box Terminal network
in the addition/edition wizard. For more details, refer to the section Setting Up a Network-Based
VLSM Organization below.
Keep in mind that:
• Making a terminal network non-terminal

• You cannot edit a terminal network to make it non-terminal if it contains pools. You must first
delete the pools.
• You can edit a terminal network to make it non-terminal even if it manages addresses. The
assigned addresses it manages, including the gateway address, are moved to an Orphan
Addresses container. This container is deleted once its content is deleted or the IP addresses
are managed by another terminal network.
Note that if the network you edit belongs to a space that has child spaces, you can select a
VLSM space.This action sets up a space-based delegation. In this case, a block-type network
is created in the specified child space and it contains the same Orphan Addresses container.
• Editing a non-terminal network to make it terminal
• You cannot edit a non-terminal subnet-type network to make it terminal if it contains any
network. It must be empty.
Deleting Subnet-type Networks in a Network-Based Organization
Deleting non-terminal subnet-type networks simply removes one level in the organization:
• In an organization with a non-terminal subnet-type network managing several terminal networks,

these terminal networks and their content are managed directly by the block-type network.
• In a deep network-based organization, one level is removed. All the lower level networks it
managed are moved up one level. If they inherited class parameters from the deleted container,
for each class parameter:
• The Inheritance property is forced to Inherited or Set to match the configuration of the deleted
parent network. The value and the source of the value remain the same.
• The Propagation property remains the same.
Using the VLSM Hierarchy to Delegate Management

You can use the different levels of the VLSM hierarchy to organize, divide or limit the different
users' rights in the IPAM module. Through the menu Edit menu you can make some spaces,
networks or pools a resource for as many groups of users as you need. That way you can give
them the possibility to add/delete/duplicate/move... the objects they contain.
If you make the different pieces of a space organization resources to specific groups, you can
delegate the management one level at a time and whoever has access to the whole hierarchy
can keep track of all the changes.
289
Network
For more details regarding users, groups and delegation within SOLIDserver, refer to the part
Rights Management.
Delegating Management in a Space-Based Organization

In a space-based VLSM organization, the delegation could be done as follows.
Figure 21.12. An example of a space-based VLSM organization
In the example above, a way of using the space-based VLSM hierarchy could be to grant a group
of users:
• Access and management permissions to the content of the space usa. That is to say, make
all the block-type networks of the space usa a resource of the group and grant them the relevant
permissions of these objects. That way, the users of the group:
• Can see the space usa, as it is the container of the block-type networks they have in the
page Resources.
• Can display the content of the block-type networks they have among their resources. But
cannot display the content of the subnet-type networks and pools of the block-type networks
as they are not listed among their resources.
• Can manage the block-type networks listed among their resources, as they were granted
the relevant permissions.
Note that, if you grant the group access to the subnet-type networks and pools of the space
usa, they can actually see the whole content of the space from the block-type networks down
to the IP addresses and not only the subnet-type networks of the block-type networks. With
the relevant permissions, they can manage these objects as well. For more details, refer to
the section Assigning Resources to a Group.
• Grant access to the space america. That is to say, make the space america a resource of the
group. That way, the users of the group:
• Can display the content of the space america : all the spaces it contains, including the space
usa. And therefore, see that all changes performed in the spaces usa and america.
Keep in mind that granting access to a resource does not grant users access to its container.
Therefore, if you grant access to the group usa, users cannot see the content of america. In the
same ways, if you grant access to america, users cannot see the content of clients.
If you grant access to these spaces to two different groups of users: one can perform specific
operations and the other one to supervise these operations.
290
Network
Rights Management.
Delegating Management in a Network-Based Organization

In a network-based VLSM organization, the delegation could be done as follows.
Figure 21.13. An example of a network-based VLSM organization
In the example above, a way of using the VLSM hierarchy would be to grant a group of users:
• Access and management permissions to the all the subnet-type networks of the non-terminal
subnet-type network outside paris. That is to say, grant them relevant permissions and make
the non-terminal subnet-type network outside paris a resource of the group. That way, the
users of the group:
• Can display the content of the subnet-type networks they have among their resources.
• Can edit the objects listed among their resources if they were granted the proper permissions
and rights.
For more details, refer to the section Assigning Resources to a Group.

• Grant access to the non-terminal subnet-type network Field workers. That is to say, make the
non-terminal subnet-type network Field workers a resource of the group. That way, the users
of the group:
• Can display the content of the non-terminal subnet-type network Field workers and see that
it contains another subnet-type network.
• Can see that all changes performed on this range of addresses.
You can also only grant access to these subnet-type networks to two different groups of users.
That way, you would set a group of users to manage specific operations and the other one to
supervise these operations.
291
Network
Note that if you grant access to the non-terminal subnet-type network Field workers, users are
able to list the subnet-type networks it contains but not the content of the terminal network of the
non-terminal subnet-type network.
Rights Management.
292
Chapter 22. Managing VRF
From the module IPAM you can manage Virtual Routing and Forwarding (VRF).
Defined in RFC 4364, VRFs provide additional routes in a VPN for routing and forwarding as
they allow several instances of a routing table to co-exist within the same router of an MPLS
Virtual Private Network.
The routing tables exchange data through a level 3 connection, using an IP address, and each
routing instance is independent from the other(s), so you can use one IP address on each one
of them without worrying about a potential overlapping. Note that on a router:
• Each VRF behaves like an independent router with its own interfaces, IP subnet-type networks
and routing protocol.
• Each VRF has separate routing and forwarding tables used only for the packets that enter said
VRF.
All VRFs can be identified through their unique Route Distinguisher (RD) that allows to differentiate
all the routes configured on the network that potentially use the same IP addresses. The RD
keeps the routes globally unique and allows, for instance, a router to determine whether the traffic
is destined to a terminal network in New York or Singapore even if they both use the same range
of IP addresses.
Once added to your database, the VRF provides an extra tool to link your subnet-type networks.
To set up this interaction, you need to create and configure classes.
Browsing VRFs and Route Targets

Within the GUI, two pages of routing tables are dedicated to VRF management: All VRFs that
lists all your VRFs and All VRF Route Targets that displays the linking routes between the VRFs.
Browsing the VRF Database

The page All VRFs is a routing table in essence where you can add or import all the VRFs that
you need. By default, all the columns are displayed on the page, you cannot change their order.
To display the list of VRFs
To display a VRF properties page
3. At the end of the line of the VRF of your choice, click on . The properties page opens.
Browsing the VRF Route Targets Database

The page All VRF Route Targets allows to link together your VRFs. By default, all the columns
are displayed on the page, you cannot change their order.
293
Managing VRF
To display the list of VRF Route Targets
The VRF Route Targets do not have a properties page as all the information is displayed on the
page.
To display the list of VRF Route Targets of a specific source VRF
3. Click on the name of the VRF of your choice. The page All VRF Route Targets opens.
4. Only the Route Targets with the chosen VRF defined as source are listed. The list displayed
can be empty if the VRF has never been used as a source.
Managing Virtual Routing and Forwarding

You can add, edit and delete VRFs for basic management purposes. Once listed on the page,
you can link them and enable the import and/or export of data between them.
Adding a VRF
You can add as many VRFs as you need. Note that you can also import VRFs, for more details
refer to the section Importing VRFs.
To add a VRF
3. In the menu, select Add > VRF. The wizard opens.
4. If you or your administrator created classes at the VRF level, in the list VRF class select a
class or None. Click on NEXT . The page Add a VRF opens.
5. In the field Name, name your VRF.
6. In the field RD ID, type in the Route Distinguisher IDentifier of your VRF. Following RFC
4364, the three accepted types rule the RD ID format:
Table 22.1. RD ID types and formats

Type RD ID Format
0 <integer between 0 and 65535>:<integer between 0 and 4294967296>
1 <IPv4 address>:<integer between 0 and 65535>
2 <integer between 0 and 4294967296>:<integer between 0 and 65535>
294
Managing VRF
7. In the field Comment, you can add a description. This field is optional.
8. Click on OK to commit the addition. The report opens and closes. The VRF is listed.
Editing a VRF
Once created, you can edit all the information regarding a VRF. Keep in mind that if you edit a
VRF name or RD ID, its VRF Route Targets are updated as well.
You can edit a VRF from the listing page or from its properties page in the Main properties panel.
To edit a VRF
3. Right-click over the Name of the VRF you want to edit. The contextual menu opens.
4. Click on . The wizard opens.
5. If you or your administrator created classes at the VRF level, in the list VRF class select a
class or None. Click on NEXT . The page Add a VRF opens.
6. Edit the Name, RD ID and Comment fields according to your needs.
7. Click on OK to commit your changes. The report opens and closes. The page refreshes, the
VRF is listed with the new information.
Deleting a VRF
At any point you can delete one or several VRFs. Keep in mind that the related VRF Route Targets
are deleted as well.
To delete a VRF
3. Tick the VRF(s) you want to delete.
5. Click on OK to commit the VRF deletion. The report opens and closes. The VRF is no longer
listed, the VRF Route Targets with that VRF are deleted as well.
Managing VRF Route Targets

The route-target is a way of linking routes between the VRFs. Every VRF is associated with one
or more Route Target (RT) attributes. A Route Target attribute can be thought of as a set of sites
identifiers even though it would be more precise to describe it as the identifier of a set of VRFs.
Associating a particular Route Target attribute with a route allows said route to be placed in the
VRFs that are used for routing the traffic received by the corresponding sites.
295
Managing VRF
Adding a VRF Route Target

You can link you VRFs through their name on the page All VRF Route Targets. You need to:
• Specify which VRF is the source VRF and which id the destination VRF.
• Specify if the VRF can send out to or receive data from the other one via the boxes Import and
Export. Keep in mind that if you do not tick either box, the data exchange is impossible.
Note that you can also import Route Targets, for more details refer to the section Importing VRF
Route Targets.
To add a VRF Route Target that allows both VRFs to exchange data
4. In the menu, select Add > VRF Route Target. The wizard Add a VRF Route Target opens.
5. In the field Source VRF name, type in the first letters of your source VRF. The auto-completion
provides the list of matching names, select the one you want.
6. In the field Target VRF name, type in the first letters of your target VRF. The auto-completion
7. Tick the box Import.
8. Tick the box Export.
To add a VRF Route Target that allows the source VRF to receive data from the
target VRF
7. Tick the box Import.
To add a VRF Route Target that allows the source VRF to send data to the target
VRF
296
Managing VRF
7. Tick the box Export.
Editing a VRF Route Target

To edit a Route Target, you need to follow the addition procedure and set different import and
export parameters. The new addition overwrites the existing Route Target.
To edit a VRF Route Target
5. In the field Source VRF name, the source VRF of your choice.
6. In the field Target VRF name, the target VRF of your choice.
7. Overwrite the existing settings of the Route Target according to your needs:
a. Tick or untick the box Import.

b. Tick or untick the box Export.
configuration changes are visible in the columns Imported and Exported.
Deleting a VRF Route Target

At any point you can delete a VRF Route Target between two VRFs.
To delete a VRF Route Target
4. Tick the VRF Route Target(s) you want to delete.
5. In the menu, select Edit > Delete VRF Route Target. The wizard Delete opens.
6. Click on OK to commit the VRF deletion. The report opens and closes. The page refreshes,
the VRF Route Target is no longer listed.
297
Part V. DHCP Management
The Dynamic Host Configuration Protocol (DHCP) is a network protocol which role is automate the assignment
of parameters to the clients connecting to the network, from a valid IP address to specific DHCP options.
It allows to set up specific connection behaviors for current devices and new devices on the network. The
connection can be temporary, through dynamic allocation, or permanent, through fixed reservation. If
you want to import an existing DHCP configurations, refer to the part Imports and Exports.
The DHCP grants users access to the network following four steps:
1. Discovery: the DHCP client (host) broadcasts a DHCPDISCOVER packet on its physical subnet (usually
255.255.255.255) to discover the available DHCP servers;
2. Offer: all the available DHCP servers receiving the request respond to the host with a DHCPOFFER
packet containing their own IP address and valid connection settings, dynamic or fixed;
3. Request: the host sends a DHCPREQUEST packet to inform all the DHCP servers that offered an IP of
the acceptance. That packet includes the IP address of the DHCP server delivering access by the host,
the other servers can return the offered IP address to their pool of available addresses;
4. Acknowledge: the selected server sends all the configuration data to the host in a DHCPACK packet.
Discover
The client broadcasts a request for an IP address
Offer
The DHCP server offers an IP address
Request
The client broadcasts their IP address acceptance
DHCP server
DHCP client Acknowledge
The DHCP server confirms the IP address allocation
Figure 111. Representation of the DHCP IP address assignation process
Within SOLIDserver, the DHCP has a dedicated module. From its dashboard, or homepage, you can access
the key levels of the hierarchy for IPv4 and IPv6 addressing.
Figure 112. The DHCP dashboard

The DHCP hierarchy can include up to 4 levels of organization. These levels depend on the connection
behaviors you set, dynamic allocation or fixed reservation:
• Servers: the highest level of the hierarchy. It allows to set up fixed reservation and/or dynamic allocation.
It can contain scopes, groups, ranges, leases and/or statics. For more details, refer to the chapter Managing
DHCP Servers. One or several servers can be managed via a smart architecture to ensure service
availability and prevent data or configuration loss. For more details, refer to the chapters Deploying DHCP
Smart Architectures and Managing DHCP Smart Architectures.
• Groups: an optional level of fixed reservation that belongs to a server and contains static reservations.
It allows to apply specific DHCP options to the statics of your choice. For more details, refer to the section
Managing DHCP Groups in the chapter Managing Fixed Reservations.
• Scopes: the second level of the hierarchy. It can contain ranges for dynamic allocation or directly statics
for static allocation. For more details, refer to the chapter Managing DHCP Scopes.
• Ranges: the third level of the hierarchy for dynamic allocation. They contain the IP addresses that are
randomly allocated to hosts for a limited period of time, the leases. When the lease time expires, the address
is returned to the range and can be reallocated. Ranges can be configured with Access Control Lists
(ACLs) to restrict or authorize access to specific users. For more details, refer to the section in the Managing
DHCP Ranges in the chapter Managing Dynamic Addressing.
• Leases: the lowest level of the hierarchy for dynamic allocation. Each lease is an IP address belonging
to a range that is currently being allocated or was allocated to a host, you can track the leases history.
For more details, refer to the section Managing DHCP Leases in the chapter Managing Dynamic Addressing.
• Statics: the lowest level of the hierarchy for fixed reservation. Static reservation ensures that a host always
gets the same access details when the connect to the network. A static identifies a host using their MAC
address and always provides them with an IP address and/or a set of DHCP options. For more details,
refer to the section Managing DHCP Statics in the chapter Managing Fixed Reservations.
The DHCP module also provides:
• Failover channels. The synchronization mechanism between two DHCP servers managing IPv4 address-
ing. It prevents allocation conflicts and depending on the configuration, it also allows disaster recovery.
For more details, refer to the chapter Managing Failover Channels.
• DHCP options. They can be set at any level of the hierarchy and are inherited at lower levels. For more
details, refer to the chapter Configuring DHCP Options.
• Monitoring and Reporting. There are many ways for the reporting and monitoring of DHCP servers
traffic and activity. For more details, refer to the chapter Monitoring and Reporting DHCP Data.
• Automation of IPAM and DNS resources creation.The advanced properties allow to automate creations
in the IPAM or DNS when you create DHCP resources. For more details, refer to the chapter Managing
Chapter 23. Deploying DHCP Smart
Architectures
The DHCP can quickly become an essential piece of any network data organization. Once
properly set up, it is usually hardly noticed, silently and faithfully performing its duties, day in and
day out.
The DHCP clients' needs must be considered, including which DHCP options are supported by
the client's operating system and which options and values need to be assigned. In large-scale
DHCP implementations, the topology of the network becomes a very important factor.The network
topology dictates where DHCP servers and/or relay agents must be placed. A final consideration
is planning for fault tolerance.
To ensure that the DHCP service is available at all times and that you do not lose specific config-
urations if a DHCP server crashes, we strongly recommend that you manage physical servers
through smart architectures. To understand the possible configurations of your service availability,
refer to the section Building a Highly Available Service With Smart Architectures.
Smart architecture pre-built DHCP configurations including backup and failover features with
IPv4 addressing. Their deployment reduces the risk of misconfiguration.
There are several architectures and possible configurations to choose from both for DHCPv4
and DHCPv6. In DHCPv6, smart architectures simply provide a configuration backup.
For IPv4, SOLIDserver allows to build 4 types of high available DHCP architectures:
• One-to-One: in this DHCP configuration, two servers share the ranges of dynamic IP addresses.
• One-to-Many: this DHCP configuration is based on a central DHCP server with several peri-
pheral DHCP servers as backup.
• Split-Scope: two DHCP servers are running in active/active mode and distribute the ranges
management.
• Single-Server: this configuration manages one DHCP server. It provides a backup of the con-
figuration that is pushed onto a new DHCP server if ever the original server crashed or stopped
responding.
For IPv6, SOLIDserver allows to build 3 types of high available DHCP architectures:
• Single-Server: this configuration manages one DHCP server. It provides a backup of the con-
figuration that is pushed onto a new DHCP server if ever the original server crashed or stopped
responding.
• Split-Scope: two DHCP servers are running in active/active mode and distribute the ranges
management.
• Stateless: this configuration provides a number of options to the servers managed through the
architecture. The defined options, and not any other, are accessible to the DHCP clients. There
is no limitation in the number of DHCP servers managed as this mode only provides options.
Being based on DHCP options, stateless servers do not provide leases or include ranges or
statics.
SOLIDserver supports a set of vendors detailed in the section DHCP Vendors Compatible with
Smart Architectures.
300
Deploying DHCP Smart Architec-
tures
Implementing DHCP Smart Architectures

We strongly recommend that you manage every DHCP server with the smart architecture that
suits your needs. Indeed, one of the main goals of this virtual management tool is to backup of
your configuration. If the server(s) you are managing through the smart architecture were to
crash, the architecture would save the configuration and allow you to push it on some new server(s)
automatically. In addition, at any time you can change the type of smart architecture and the
physical server(s) it manages.
DHCPv6 architectures have some particularities that differentiate them from the DHCPv4 archi-
tectures:
• The failover protocol is not available in IPV6. Thus, the page All failover channels in v6 is
merely a list linking servers through the defined ports. For more details, refer to the chapter
Managing Failover Channels.
• IPv6 addressing is only possible from the EfficientIP servers.
• DHCPv6 servers operate on an appliance running in IPv4.
• In IPv6 there is no compatibility with the numerous vendors providing IP addressing
DHCPv4 One-to-One Smart Architecture

The DHCP One-to-One smart architecture allows you to quickly build a peer of two DHCP servers
managing IPV4 addresses with a pre-built high availability mechanism. When you deploy a One-
to-One smart architecture, you drastically reduce the DHCP service downtime if one of your
DHCP servers is out of service.
DHCP DHCP
Master Backup
Figure 23.1. DHCPv4 One-to-One smart architecture
The One-to-One smart architecture allows two DHCP servers to share a range of common ad-
dresses. Should a server stop working, the second server would take over, depending on your
failover configuration. For more details regarding failover, refer to the section DHCP Failover
Principles and Operational States of the chapter Managing Failover Channels.
DHCPv4 One-to-Many Smart Architecture

Functionally, the DHCP One-to-Many smart architecture is a replication of several One-to-One
smart architectures, which is why it is only available for DHCP servers managing IPv4 addresses.
The One-to-Many smart architecture is based on a set of DHCP servers that are all linked to only
one Master DHCP server.
301
tures
DHCP
Master
DHCP DHCP
Backup Backup
Figure 23.2. DHCPv4 One-to-Many smart architecture
This architecture is particularly relevant for organizations that have many sites and need to have
a dedicated DHCP service per site. It looks like a star configuration, where N DHCP servers, no
matter their location, share a failover channel with the central DHCP server of the smart architec-
ture: it is a N+1 servers configuration.
DHCPv4 Split-Scope Smart Architecture

The Split-Scope smart architecture allows you to share ranges between two EfficientIP DHCP
servers in an active/active configuration.You can define the proportion of IP addresses managed
by each server. One server is set as a master and the other one as a backup. The main goal of
this architecture is the availability of the services at all times thanks to the shared load.
Split-Scope Split-Scope
80% 20%
Figure 23.3. DHCPv4 Split-Scope smart architecture
There is no failover protocol between the two servers but being a smart architecture, the Split-
Scope provides a backup of the configuration: if anything were to happen to any of the managed
servers, installing them back to SOLIDserver would apply the smart architecture on both servers
again.
DHCPv4 Single-Server Smart Architecture

The Single-Server architecture provides a backup of the management configuration of any of the
available DHCP servers: EfficientIP DHCP, EfficientIP DHCP Package, Microsoft DHCP and
Nominum DCS. Therefore, if it were to crash, you could install it again and let SOLIDserver push
automatically the smart architecture configuration back onto your server.
302
tures
Single
DNS
Figure 23.4. DHCPv4 Single-Server smart architecture

The DHCPv6 Single-Server architecture only provides a backup of the management configuration
of an EfficientIP DHCP server. Therefore, if the physical server were to crash, you could install
it again and let SOLIDserver push automatically the smart architecture configuration back onto
your server.
Single
DHCP
DHCPv6

The Split-Scope smart architecture allows you to share ranges between two EfficientIP DHCPv6
servers in an active/active configuration.You can define the proportion of IP addresses managed
by each server. One server is set as a master and the other one as a backup. The main goal of
this architecture is the availability of the services at all times thanks to the shared load.
80% 20%
DHCPv6
303
tures
There is no failover protocol between the two servers but being a smart architecture, the Split-
Scope provides a backup of the configuration: if anything were to happen to any of the managed
servers, installing them back to SOLIDserver would apply the smart architecture on both servers
again.
DHCPv6 Stateless Smart Architecture

The Stateless smart architecture allows you to set up a number of options to the scopes of the
servers you manage. The DHCP clients have access to a set of options that you define for the
architecture. Which is why you can add as many servers as you need in this configuration.
There is no master or backup servers per se in this configuration. By default, they all are inde-
pendent master servers sharing the same options configuration.
Stateless
DHCPv6
Figure 23.7. DHCPv6 Stateless smart architecture
Keep in mind that the Stateless smart architecture only has an impact on the options available
to the DHCPv6 clients, therefore it is impossible to add ranges and static through this configuration.
In the same way, no leases are provided or managed.
DHCP Vendors Compatible with Smart Architectures

SOLIDserver supports a set of DHCP Servers Managing IPv4 Addressing. In DHCP Servers
Managing IPv6 Addressing, only EfficientIP servers are supported.
DHCP Servers Managing IPv4 Addressing

SOLIDserver appliances support both EfficientIP and other vendor DHCP servers, allowing you
to configure and deploy IP services across your distributed network and synchronize data updates
in real time from the GUI.
Table 23.1. DHCPv4 supported vendors

Smart Architecture
Vendor
One-to-One One-to-Many Split-Scope Single-Server
EfficientIP DHCP X X X X
EfficientIP DHCP Package X X X X
Microsoft (all types) X X
Nominum DCS X X
304
tures
SOLIDserver supports almost all features delivered by each vendor but does not add additional
features at service level.Thus, limitations depend on each vendor. For instance, Microsoft Windows
DHCP services do not provide failover, so you cannot configure it from the appliance.
You can manage any supported vendor on one page through the GUI. SOLIDserver is an abstrac-
tion layer that masks the specific processes of each DHCP vendor to network administrators.
DHCP services are not managed one server at a time but as a global service. It is possible to
simultaneously configure Microsoft Windows running DHCP servers and Linux running ISC DHCP
servers, modify VoIP options on all DHCP servers or create transversal reports to get an imme-
diate comprehensive understanding of network services configurations.
Each and every one of these servers can be managed by SOLIDserver smart architecture to
ease the management configuration and provide a backup of the chosen configuration. For more
details, refer to the chapter Managing DHCP Smart Architectures.
DHCP Servers Managing IPv6 Addressing

With DHCPv6 addressing, the choice is more limited. For now, you can only manage EfficientIP
DHCP servers but there are a number of architectures that allow you to manage either one or
several EfficientIP DHCP servers at once.
For more details, refer to the chapter Adding a DHCPv6 Smart Architecture.
Building a Highly Available Service With Smart

Architectures
A way of maintaining DHCP service in case of a partial power loss or network outage is to set
up two DHCP servers and enable them to both serve the same network. You can set up each
server on different networks. In this case, if you lose connectivity or power on one network but
not the other, the DHCP service continues.
Two active DHCP servers cannot share an IP address pool since they have no way of knowing
with certainty which IP addresses are being distributed. Therefore, two active DHCP servers
cannot perform dynamic DHCP which is why scope splitting is necessary to separate IP address
ranges per server. This configuration, the Split-Scope, is available for both DHCPv4 and DHCPv6.
With a traditional active/passive pair of DHCP servers, if the active server fails, the network ad-
ministrator is required to manually turn on the passive DHCP server so that it can take over until
the initial active server is restored. DHCP High Availability with IP address scope splitting provides
failover but with the risk of meeting downtime as addresses are leased to more than one client
and have potential manual intervention to clean up the lease database. In order for two DHCP
servers to provide DHCP services for the same network segments, the servers must coordinate
their behavior. Each server must either know what the other is doing or be configured so that it
can operate without knowing what the other is doing. In order for each server to know what the
other is doing, the DHCP safe failover protocol can be implemented.
As the failover protocol is not available in DHCPv6, the DHCP Safe failover protocol is only
available for DHCPv4 servers.
305
Chapter 24. Managing DHCP Smart
Architectures
Once you chose the smart architecture(s) that suit your needs in the chapter Deploying DHCP
Smart Architectures, you can manage them following the sections below.
Browsing DHCP Smart Architectures

Smart architectures are managed from the page All servers, listed like physical servers and
preceded by the icon . For more details, refer to the section Browsing DHCP Servers.
Understanding the Smart Architecture Statuses

The column Status provides information regarding the smart architectures' configuration.
Table 24.1. Smart architecture statuses

Column Description
OK The smart architecture is operational.
Invalid settings The smart architecture does not contain any physical server, is missing one or sev-
eral physical servers or is not configured properly (not enough failover channels
configured, etc).
Locked synchronization The server configuration is not viable. For more details, refer to the section The
Status Locked Synchronization .
Moreover, the column Sync (i.e. synchronization) provides additional information regarding the
exchanges between the smart architecture and the physical server(s).
Table 24.2. Smart architecture synchronization statuses

Column Description
Synchronized The smart architecture has successfully synchronized the server(s) it manages.
Busy The smart architecture is synchronizing the server(s).
Locked synchronization The synchronizing failed as the server configuration is not viable: the smart architec-
ture cannot send the configuration file to the physical server(s). For more details,
refer to the section The Status Locked Synchronization .
The Status Locked Synchronization

SOLIDserver provides a consistency check for the smart architectures. Once you configured a
smart architecture with the server(s) you want to manage, the smart configuration is checked
before it is sent to the physical server(s): this ensures the consistency of the configuration and
avoids pushing useless information to the server:
• If the check is conclusive, the information is sent to the server and, on the page All servers,
its status is Synchronized.
• If any error is found, the verification stops and the server status changes to Locked Synchron-
ization once the page is refreshed. To get a valid synchronization status again, you need to
"undo" the latest changes. This action loads a new synchronization and uploads the status
accordingly.
306
Managing DHCP Smart Architec-
tures
Once the server is in Locked synchronization, the corrupted configuration file is automatically
stored locally on the appliance and available for download in the Local files listing. It is named
<server_name>-dhcpd.conf. We advice that you take a look at this file because after the first
found error, the check stops and returns the Locked synchronization status. So if there are sev-
eral errors, the status is returned over and over again until the file is conclusive and can be sent
to the physical server.
The check for failure in the configuration file can be done though CLI (we recommend it) or through
the GUI.
To check for failure in a DHCPv4 configuration file through CLI
1. Open an SSH session.

2. Use the following command to retrieve the list of corrupted files:
# ls -la /data1/exports/*-dhcpd.conf
3. Use the following command to get a precise list of all the errors:
# /usr/local/nessy2/bin/dhcpd –t –4 -cf /data1/exports/<server_name>-dhcpd.conf
4. Adjust identified statements, once the check runs again, the Locked Synchronization status
disappears if you now have a valid configuration.
To check for failure in a DHCPv6 configuration file through CLI

# ls -la /data1/exports/*-dhcpd6.conf
# /usr/local/nessy2/bin/dhcpd -t -6 -q -cf /data1/exports/<server_name>-dhcpd6.conf
To look for DHCP errors on the Syslog page of the local appliance
1. Go to the Administration tab. If the homepage is not displayed click on . The homepage
appears.
2. In the Monitoring section, click on Logs visualization. The Syslog page opens.
3. In the SOLIDserver drop-down list, verify that the local appliance is selected. Only the host-
name appears with no IP address.
4. In the Services filed, select dhcpd. The logs appear.
Adding a DHCPv4 Smart Architecture

A smart architecture can be configured without DHCP servers. It allows you to create the archi-
tecture that suits your needs before applying it to one or more DHCP servers. It also provides a
backup of the management configuration of the server it manages. If your DHCP server crashes,
you delete it and add a new one on which you apply the same architecture, SOLIDserver remem-
bers the former server's configuration and apply it to the new one.
307
tures
With DHCPv4, there are four different kinds of smart architectures: One-to-One, One-to-Many,
Split-Scope and Single-Server. As for DHCPv6 smart architectures, SOLIDserver proposes the
Single-Server, Split-Scope and Stateless architectures. In the procedures below, we are going
to describe the configuration of the DHCP smart architectures with the DHCP servers they
manage, but you can go through the configuration without adding any server and do it later. For
more details, refer to the part Adding a DHCP Server into a Smart Architecture.
Once the configuration is completed, the DHCP smart architecture appears on the page All
servers as a real server.
As you can see, the column Type mentions the kind of smart architecture applied, the DHCP
smart members column is marked N/A and for that reason, the server status is Invalid settings.
DHCPv4 One-to-One Smart Architecture

The One-to-One Smart Architecture allows you to set up a failover channel between two DHCP
servers: one is set as master server and the other one as backup. Note that, if the master server
crashes, you have to manually set up the partner-down mode to reclaim the available IP addresses,
refer to the sectionOperating in Partner-down State in the chapter Managing Failover Channels.
This architecture also provides a shared management of the leases that you can configure ac-
cording to your needs.
To configure a DHCPv4 One-to-One smart architecture
3. In the menu, click on Add > Server > DHCP smart architecture. The Manage a DHCP server
wizard opens.
4. Fill in the fields according to the table below:
Table 24.3. DHCPv4 smart architecture basic parameters

DHCP server name Name your server with a valid FQDN.
Isolated Tick the box if you do not want your server configuration to update any other
module (IPAM or DNS). It's mainly useful when dealing with migrations. Keep in
mind that the smart architecture still receives data if your network configuration
allows it. If you tick the box, any configuration set via the drop-down list Advanced
Properties has to be applied to the smart architecture later on. Before unticking
the box make sure that the configuration you set suits your needs.
Description Type in a description if you want, it appears in the column Description of the
page All servers.
Advanced Properties Select either Default or All.
to the chapter Managing Advanced Properties; the DHCP properties are detailed
in the section Configuring DHCP Advanced Properties.
Properties.
5. Click on NEXT .The next page of the wizard opens.
308
tures
6. In the list DHCP smart architecture, select One-to-One.
DHCP DHCP
Master Backup
Figure 24.1. DHCPv4 One-to-One Smart Architecture

8. In the list Available DHCP servers, you can select one by one the two DHCP servers that
you want to manage through the smart architecture.
9. Click on . The selected server is moved to the list Selected DHCP servers. Repeat these
actions for the second server.
11. In the drop-down list Master DHCP server, select which one of the two servers is going to
be the Master server in the configuration.
13. This page allows you to configure the failover channel between the servers of the architecture.
Fill in the fields according to the table below:
Table 24.4. DHCPv4 One-to-One failover parameters

Peering name The default failover channel name, <failover-your.smart.server.name>, is dis-
played in the field. You can edit it.
Failover port Type in the number of the port on the master server dedicated to the failover.
By default, the port 847 is used.
Failover peer port Type in the number of the port on the backup server dedicated to the failover.
By default, the port 647 is used.
Automatic switch to part- Type in this field the amount of time (in hours) after which a failover channel in
ner-down delay (in hours) Communications-interrupted state should automatically switch to Partner-down.
The accepted values are between 4 and 65535. By default, the option is disabled
and the field is set to 0.
Peer DHCP server The DHCP backup server is automatically entered in this field.
Split leases In this drop-down list, you can choose how to split the leases between the two
servers: Balanced, Prefer backup or Prefer master. By default, Balanced is se-
lected.
Balanced If you select this option, the leases are delivered to the clients by both servers
equally.
Prefer backup If you select this option, the leases are delivered to the clients by the backup
server only.
Prefer master If you select this option, the leases are delivered to the clients by the master
server only.
14. Click on OK to commit your configuration.The report opens and closes.The smart architecture
is listed as a DHCP server and marked Smart (one-to-one) in the column Type. You can
309
tures
display or hide the physical servers managed through your smart architecture using the
button on the right-end side of the menu.
DHCPv4 One-to-Many Smart Architecture

The One-to-Many Smart Architecture, which is basically a star network topology of the DHCP
servers of your choice, allows you to set up several failover channels between one master server
and at least two backup servers to be used as backup. You actually can include as many servers
as you want in this configuration as long as there are no power limitations or overload of the
equipment managing the flow of information between the servers. This architecture also provides
a shared management of the leases that you can configure according to your needs.
To configure a DHCPv4 One-to-Many smart architecture
wizard opens.

page All servers.
Properties.

6. In the list DHCP smart architecture, select One-to-Many.
310
tures
DHCP
Master
DHCP DHCP
Backup Backup
Figure 24.2. DHCPv4 One-to-Many smart architecture

8. In the list Available DHCP servers, you can select one by one the DHCP servers that you
want to manage through the smart architecture. Ideally, you would configure at least three
DHCP servers with this architecture.
actions as many times as needed.
12. In the list DHCP peering assignment, select the default failover channel named Peering:
failover-<smart_server_name> on DHCP (). Then, configure it following the table below:
Table 24.6. DHCPv4 One-to-Many failover parameters

Field Description
Peering name The default failover channel name, <failover-your.smart.server.name>, is dis-
played in the field. You can edit it.
Failover port Type in the number of the port on the master server dedicated to the failover.
By default, the port 847 is used, you can only use it once.
Failover peer port Type in the number of the port on the backup servers dedicated to the failover.
By default the port 647 is used, you can use it on each backup server if you want.
Automatic switch to part- Type in this field the amount of time (in hours) after which a failover channel in
ner-down delay (in hours) Communications-interrupted state should automatically switch to Partner-down.
The accepted values are between 4 and 65535. By default, the option is disabled
and the field is set to 0.
Peer DHCP server Choose the DHCP backup server with which you want to configure the failover.
By default, None is selected.
Split leases In this drop-down list, you can choose how to split the leases between the two
chosen servers: Balanced, Prefer backup or Prefer master. By default, Balanced
is selected.
Balanced If you select this option, the leases are delivered to the clients by both servers
equally.
Prefer backup If you select this option, the leases are delivered to the clients by the backup
server only.
Prefer master If you select this option, the leases are delivered to the clients by the master
server only.
311
tures
Click on UPDATE to commit your configuration. Your first failover channel is configured and
present in the list DHCP peering assignment as such: Peering: <failover_channel_name>
on DHCP (<backup_server_name>).
Repeat this action in order to have a failover channel between the master and each backup
server.
13. Click on OK to commit your smart architecture configuration. The report opens and closes.
The smart architecture is listed as a DHCP server and marked Smart (one-to-many) in the
column Type. You can display or hide the physical servers managed through your smart
architecture using the button on the right-end side of the menu.

The Split-Scope Smart Architecture allows you to distribute the management of ranges (and
therefore leases) between two DHCP servers. They are set in an active/active configuration that
ensures availability of the services at all times: if one server fails, the other can still lease IP ad-
dresses to the clients. You can actually choose the proportion of IP addresses (in percent)
managed by each one of them.
To configure a DHCPv4 Split-Scope smart architecture
wizard opens.

page All servers.
Properties.

6. In the list DHCP smart architecture, select Split-Scope.
312
tures
80% 20%

8. In the list Available DHCP servers, you can select one by one the two DHCP servers if want
to manage through the smart architecture.
12. In the field Distribution ratio (in percent), type in the ratio of IP ranges to be managed by
the Master DHCP server you just selected. By default, 80 is proposed, meaning that the re-
maining 20% are listed and managed by the backup server.
is listed as a DHCP server and marked Smart (split-scope) in the column Type. You can
Note that a virtual failover channel is automatically created with the smart architecture, it is
named failover-<smart_architecture_name> and listed on the page All failover channels.

The Single-Server Smart Architecture allows you to manage one single DHCP server that provides
a backup. If the DHCP server crashes, the smart architecture configuration is saved and automat-
ically applied to the new DHCP server managed through the Single-Server smart architecture.
To configure a DHCPv4 Single-Server smart architecture
wizard opens.

313
tures
page All servers.
Properties.

6. In the list DHCP smart architecture, select Single-Server.
Single
DNS

8. In the list Available DHCP servers, select the DHCP server that you want to manage through
the smart architecture.
9. Click on . The selected server is moved to the list Selected DHCP servers.
is listed as a DHCP server and marked Smart (single-server) in the column Type. You can
314
tures
Adding a DHCPv6 Smart Architecture

A smart architecture can manage IPv6 addresses and just like DHCPv4 can be configured without
DHCP servers. Note that, with a DHCP v6 smart architecture, you still apply your configuration
to a DHCP server managed on a SOLIDserver appliance running on an IPv4 address.
With DHCPv6, there are three different kinds of smart architectures: Single-Server, Split-Scope
and Stateless. In the procedures below, we are going to describe the configuration of DHCPv6
smart architectures with DHCP servers but you can go through the configuration without adding
any server and do it later. For more details, refer to the part Adding a DHCP Server into a Smart
Architecture.

The Single-Server Smart Architecture has the same advantages in DHCPv6 and DHCPv4, it allows
you to manage one single DHCP server that provides a backup. If the DHCP server crashes, the
smart architecture configuration is saved and automatically applied to the new DHCP server
managed through the Single-Server smart architecture.
To configure a DHCPv6 Single-Server smart architecture
3. In the menu, click on Add > Server (v6) > DHCP smart architecture. The Manage a DHCP
server wizard opens.

page All servers.
Properties.

6. In the list DHCP smart architecture, select Single server.
315
tures
Single
DHCP
DHCPv6

8. In the list Available DHCP servers, select the DHCPv6 server that you want to manage
through the smart architecture.
9. Click on . The selected server is moved to the list Selected DHCP servers.
is listed as a DHCP server and marked Smart (single-server) in the column Type. You can

The Split-Scope Smart Architecture allows you to distribute ranges of IP addresses between two
DHCP servers. The active/active configuration ensures availability of the leasing service to clients.
You can actually choose the proportion of IP addresses (in percent) managed by each one of
them.
To configure a DHCPv6 Split-Scope smart architecture

316
tures
page All servers.
Properties.

6. In the list DHCP smart architecture, select Split-Scope.
80% 20%
DHCPv6

8. In the list Available DHCP servers, you can select one by one the two DHCP servers if want
to manage through the smart architecture.
12. In the field Distribution ratio (in percent), type in the ratio of IP ranges to be managed by
the Master DHCP server you just selected. By default, 80 is proposed, meaning that the re-
maining 20% are listed and managed by the backup server.
is listed as a DHCP server and marked Smart (split-scope) in the column Type. You can
317
tures
DHCPv6 Stateless Smart Architecture

The Stateless Smart Architecture allows you to set up a number of options to the scopes of the
servers you choose to manage. The clients then have access to the options defined in the archi-
tecture. Keep in mind that there is no ranges, statics or leases management in a stateless archi-
tecture: you cannot create or provide them.
To configure a DHCPv6 Stateless smart architecture

page All servers.
Properties.

6. In the list DHCP smart architecture, select Stateless.
Stateless
DHCPv6
Figure 24.7. DHCPv6 Stateless smart architecture
318
tures

8. In the list Available DHCP servers, you can select one by one as many DHCP servers as
you want.
actions as many times as needed.
is listed as a DHCP server and marked Smart (stateless) in the column Type.You can display
or hide the physical servers managed through your smart architecture using the button
on the right-end side of the menu.
Editing a DHCP Smart Architecture

Once created, you can edit a DHCP smart architecture: change the servers it manages, edit the
servers' role or even change the smart architecture type.
Adding a DHCP Server into a Smart Architecture

Once a smart architecture is properly configured and applied, you can add DHCP servers
whenever you want. First, to add a DHCP server, refer to the section Managing DHCP Servers.
According to the DHCP smart architecture chosen, if you do not complete the architecture with
all the necessary servers, the smart architecture may not work properly. Make sure that you have
added all the necessary DHCP servers into the smart architecture.
When you add one or more DHCP servers into a smart architecture, the smart data is
automatically replicated from the architecture to the DHCP servers it manages. So if the
smart architecture is empty (first use), the DHCP server added is totally overwritten.
To add a DHCP server into DHCP smart architecture
3. At the end of the line of the smart architecture of your choice, click on . The properties
page opens.
4. In the panel Main properties, click on EDIT . The Edit a DHCP server wizard opens.
5. In the list DHCP server type, make sure DHCP smart architecture is selected. Click on NEXT .
The Manage a DHCP server page opens.
6. If need be, modify the smart architecture basic parameters according to the table below:

319
tures
page All servers.
Properties.

8. In the list DHCP smart architecture, modify the type of your DHCP smart architecture if need
be. Click on NEXT . The next page of the wizard opens.
9. In the list Available DHCP servers, select a server to add in the smart architecture and click
on . The server has been moved to the list Selected DHCP servers. Repeat this action for
as many servers as needed. You can remove any of them from the selected servers list by
clicking on .
10. For a Single-Server smart architecture, go to the last step of this procedure. Otherwise, click
on NEXT . The next page of the wizard opens.
11. In the drop-down list Master DHCP server, edit the master server if need be.
12. For a Split-Scope architecture, in the field Distribution ratio (in percent), type in the ratio of
IP ranges to be managed by the selected Master DHCP server, the rate is managed by the
backup server.
13. If need be, edit the existing failover ports and split leases parameters between the master
and backup servers.
14. Click on OK to commit your modifications. The report opens and closes. You can display or
hide the physical servers managed through your smart architecture using the button on
the right-end side of the menu. The DHCP Smart members column of the smart architecture
displays the name of the new master server between brackets next to the name of the other
backup servers.
Removing a DHCP Server from a Smart Architecture

Whenever you want, you can remove one or more DHCP servers from a DHCP smart architecture.
When you remove one, the configuration applied on this server is conserved on the DHCP
server previously removed.
To remove a DHCP server from a smart architecture
page opens.
5. Click on NEXT . The page Manage a DHCP server opens.
320
tures

8. The servers managed by the smart architecture are listed in the list Selected DHCP servers.
You can remove any of them by clicking on . The server(s) is moved to the list Available
DHCP servers.
10. If the smart architecture is still managing servers: in the list Master DHCP server, change
the master server if need be. Click on NEXT . The next page of the wizard opens.
11. If the smart architecture is still managing servers: modify the failover ports on each server
and/or the split leases parameters if need be.
12. Click on OK to commit your modifications. The report opens and closes. The servers that
have been removed are listed as DHCP servers of whatever kind in the list Type. If your
smart architecture is still managing physical servers, you can display or hide them using the
Changing the DHCP Server Roles within a Smart Architecture

As easily as possible, you can change the role of DHCP servers within a smart architecture. For
instance, you can change a master server into a slave server within a One-to-One smart archi-
tecture at any given time.
To change the role of a DHCP server within a smart architecture
page opens.
5. Click on NEXT . The page Manage a DHCP server opens.
8. The servers managed by the smart architecture are listed in the list Selected DHCP servers.
You can remove any of them and add a new one by clicking on or . The server(s) is
moved accordingly between the lists Selected DHCP servers and Available DHCP servers.
10. In the drop-down list Master DHCP server, select the master server.
backup server.
12. If need be, edit the existing failover ports and split leases parameters between the master
and backup servers.
the right-end side of the menu. The column DHCP Smart members of the smart architecture
321
tures
displays the name of the new master server between brackets next to the name of the other
backup servers.
Changing the Type of a DHCP Smart Architecture

The type of a DHCP smart architecture can be easily changed while keeping all DHCP configur-
ation and data you already set. For instance, you already have a DHCP smart architecture con-
figured in One-to-One that includes two DHCP servers -one in master and the other in slave-
and you plan to change your smart architecture type into Split-Scope. By editing the smart archi-
tecture, you can change its type and configure the role of servers.
To edit a DHCP smart architecture type
page opens.
5. In the list DHCP server type, make sure DHCP smart architecture is selected. Click on NEXT .
The Manage a DHCP server page opens.

page All servers.
Properties.

8. In the list DHCP smart architecture, modify the type of your DHCP smart architecture. Click
9. If your smart architecture manages servers, they are listed in the list Selected DHCP servers.
You can remove any of them and add a new one by clicking on or . The server(s) is
moved accordingly between the lists Selected DHCP servers and Available DHCP servers.
322
tures
11. In the drop-down list Master DHCP server, select the master server.
backup server.
13. If need be, modify the existing failover ports and split leases parameters between the master
and backup servers.
14. Click on OK to commit the modifications. The report opens and closes. The page All servers
is visible again. The column Type displays the modification you performed on the smart ar-
chitecture.
Deleting a DHCP Smart Architecture

At any time, you can decide to stop managing your DHCPv4 or DHCPv6 servers through the
smart architectures.You might not need to delete a smart architecture, editing it might be enough.
For more details, refer to the section Changing the Type of a DHCP Smart Architecture.
Before deleting a smart architecture, keep in mind that:
• Deleting a smart architecture does not delete any data from the physical server: it means that
you stop managing the server via the smart architecture. However, the configuration backup
of the smart architecture is deleted. Therefore, if the server crashes after the smart architec-
ture deletion, you have to configure everything again manually.
• You cannot delete a smart architecture if it is still managing DHCP servers.
To delete a DHCP smart architecture
4. If the smart architecture is managing DHCP servers, remove them according to the Removing
a DHCP Server from a Smart Architecture section.
5. Tick the smart architecture you want to delete.
7. Click on OK to commit the deletion. The report opens and closes. The smart architecture is
no longer listed on the page All servers.
Defining a DHCP Smart Architecture as a Group Resource

Adding a smart architecture as one of the resources of a specific group allows the users of that
group to manage the architecture in question as long as they have the corresponding rights and
delegations granted.
Granting access to a smart architecture as a resource also grants access to every physical
server it contains. For more details, refer to the section Assigning Resources to a Group in the
chapter Managing Groups.
323
Chapter 25. Managing DHCP Servers
Within the DHCP module, the server is the highest level of the hierarchy where you set the basis
of any DHCP configuration. You can either manage servers independently or a within a smart
architecture that provides a backup of your configuration and a dedicated failover between a
master server and its backup(s) servers. For more details regarding the available smart architec-
tures for DHCPv4 or DHCPv6, refer to the chapters Deploying DHCP Smart Architectures and
Managing DHCP Smart Architectures.
In IPv4, you can create EfficientIP DHCP, EfficientIP DHCP Package, Microsoft DHCP and
Nominum DCS DHCP servers on the page All servers. In IPv6, you can only create EfficientIP
DHCP servers.
Whether you manage IPv4 or IPv6 addressing, the IP address of the DHCP servers you manage
must be in IPv4 and belong to one of the networks that your configured part of the networks you
configured, to make sure it can provide clients with IP addresses. If you manage large networks,
DHCP servers can rely on DHCP relays (also called helpers), for more details refer to the section
DHCP Relay Agents.
Browsing DHCP Servers

To put it simply, the server is a container for all the information necessary to provide IP addresses
to the DHCP clients. Keep in mind that any parameter and/or option set at a lower level overwrites
any configuration set at server level.
These servers can be configured to provide IPv4 and IPv6 addresses, obviously the options
available change from one version to the other as in essence, DHCPv4 and DHCPv6 protocols
can be considered to be two different protocols although they serve the common goal of providing
the addresses to DHCP clients. Both versions of the Dynamic Host configuration Protocol allow
to configure the server and provide either dynamic addressing or fixed addressing: in the image
below the two branches of the tree symbolize both types of addressing. On the left are represented
the level of hierarchy necessary to set up dynamic addressing and on the right the fixed addressing.
ACL
SCOPE RANGE LEASE
SERVER OPTION OPTION OPTION
GROUP
STATIC OPTION
Figure 25.1. The server in the DHCP hierarchy
So, in short, the very first step of the DHCP implementation is the creation of a server with a
unique IP address within which you must create at least one scope that listens on a particular
part of the network and discover clients' request and answer them at the best of its capacity. Af-
terward, you decide to set up dynamic and/or fixed addressing for the DHCP clients.
324
Managing DHCP Servers
Browsing the DHCP Servers Database

To display the list of DHCP servers
3. To list the IPv4 DHCP servers:
a. In the column Protocol, right-click over IPv4. The contextual menu.

b. Click on . Only the IPv4 DHCP servers are listed.
4. To list the IPv6 DHCP servers:
a. In the column Protocol, right-click over IPv6. The contextual menu.

b. Click on . Only the IPv6 DHCP servers are listed.
To display a DHCP server properties page
1. Go to the DHCP list All servers.

3. At the end of the line of the server of your choice, click on . The corresponding server
properties pages opens.
Customizing the Display on the Page All Servers

Understanding the DHCP Server Statuses

The column Status provides information regarding the servers you manage.
Table 25.1. DHCP server statuses

Status Description
OK The server is configured
Unknown The server does not have a status as it has not synchronized yet.
Timeout The server does not answer anymore due to a scheduled configuration of the server.
Invalid credentials The SSL credentials are invalid.
Syntax error The server configuration could not be parsed properly.
License The license used in SOLIDserver is not compliant with the added server: the license
is invalid.
Invalid settings There was a setting error during the server declaration. For instance, some settings
were added to a server that does not support them or a smart architecture is not
managing any physical server.
Insufficient privileges The account used to add the Agentless DHCP server does not have sufficient priv-
ileges to manage it.
Locked synchronization The server configuration is not viable. For more details, refer to the section The
Status Locked Synchronization .
325
Note that the column Sync column changes in accordance with the column Status. While the
server synchronization is not OK yet, the column Sync might be Busy; it can also be in
Locked synchronization.
The column Multi-status provides you with emergency, warning, critical, error or informational
messages regarding the server compatibility with Hybrid. For more details, refer to the section
Understanding the Column Multi-Status.
Managing EfficientIP DHCP Servers

The DHCP management module supports several EfficientIP DHCP servers, including the DHCP
server embedded in SOLIDserver device and EfficientIP DHCP package running the ISC DHCP
server on Linux.
Configuring the Listening Network Interfaces

1
The DHCP server selects the listening network interfaces via the DHCP scopes . To make the
server listen on an interface, you have to create a scope that includes one or several local inter-
faces of the DHCP server to allow the server to reply to the DHCP client requests.
For instance, your DHCP server has 2 network interfaces configured: 192.168.10.3 and
192.168.10.5.To listen to both interfaces, you have to configure a scope with the network address
192.168.10.0 and the netmask 255.255.255.0. For more details regarding scope management,
refer to the chapter Managing DHCP Scopes.
EfficientIP DHCP server implements the safe DHCP failover protocol. For more details, refer to
the chapter Managing Failover Channels.
Adding an EfficientIP DHCP Server

The EfficientIP DHCP server is the only server within SOLIDserver that you can create to provide
IPv4 or IPv6 addresses. For this server, keep in mind that:
• EfficientIP DHCP servers can only be managed via SSL since version 6.0.0.
• SNMP is now only used to retrieve the server statistics. For more details, refer to the
section Editing the SNMP Monitoring Parameters of an EfficientIP DHCP Server.
• The use of the SNMP protocol to manage servers is deprecated.
• If you migrated from a version 4.0.x, your server is still managed via SNMP as a legacy.
• Once you migrated to 6.0.0, if your DHCP server is a version 4.0.x legacy, editing the man-
agement protocol from SNMP to SSL is non-reversible.
• EfficientIP servers prior to version 4.0.x are no longer supported.
• You should not set a VIP as management address of your DHCP server.
In addition, EfficientIP DHCP servers version 6.0.0 manage the IPv4 static reservations like
leases. The MAC address specified during the static reservation identifies the clients' IP address
and allocates it a lease as well as soon as they are visible on the network. Once the lease is al-
located, if the IPAM and DNS replication are configured, the data is sent to the IPAM and creates
the corresponding DNS entries. For more details, refer to the section Adding DHCPv4 Statics.
1
If you do not set a listening scope, you must configure a relay to communicate with DHCP clients.
326
To add an EfficientIP DHCP server
3. In the menu, select Add > Server or Server (v6) > EfficientIP DHCP. The wizard Manage a
DHCP server opens.
4. If you or your administrator created classes at the server level, in the list DHCP server class
select a class or None. Click on NEXT . The next page of the wizard appears.
5. Fill in the following fields to set up the basic server configuration:
Table 25.2. DHCP server basic parameters

Field Description
DHCP server name In this field, fill in a FQDN name for your server. This field is required.
Management IP address In this field, fill in the IPv4 address of your server. This field is required.
Isolated Tick this box if you do not want your server configuration to update the
module IPAM or DNS, any advanced property set via the drop-down list
Advanced properties have to be applied to the server later on. This option
is mainly useful when dealing with migrations. Keep in mind that the server
still receives data if your network configuration allows it. Before unticking
Description Type in a description if you want, it appears in the column Description of
the page All servers. This field is optional.
6. If you modified the SSH login and password, tick the box Configure SSL parameters. If not,
go to step 7.
Once you ticked the box, the fields Login and Password appear. By default they both contain
admin, edit them to make sure that the SSL credentials match your SSH credentials.
2
7. If you want to edit the server SNMP parameters , tick the box Configure SNMP monitoring
parameters. If not, go to step 8.
Once you ticked the box, the following fields appear:
Table 25.3. SNMP parameters used to monitor the server statistics

Field Description
SNMP port The port used to retrieve the server statistics. By default, the port 161 is
used. If you changed the UDP port of your SNMP server, you must use the
same port. For more details, refer to the section Managing the SNMP Ser-
vice.
Use TCP Tick the box if you want to use the TCP protocol instead of the UDP when
the network link is not reliable.
SNMP profile The SNMP profile used to retrieve the statistics. By default, standard v2c
is selected. The list contains the default profiles (standard v1, standard v2c
and standard v3) and the ones you may have created. Each profile has its
own level of security and enables the definition of a global security policy.
For more details, refer to the section Managing SNMP Profiles.
2
The SNMP protocol parameters are used to monitor and retrieve the server statistics.
327
Field Description
SNMP retries The number of connection attempts when the server is in timeout. You can
set it between 0 and 5. By default, it is set to 2 attempts.
SNMP timeout The number of seconds between each connection attempt. You can set it
between 1s and 5s or set it to 10s. By default, it is set to 5s.
8. Depending on the administrator configuration, you may be able to configure advanced

properties according to the table below.

Field Description
Default This value indicates that all the fields/options displayed in the wizard are
part of the wizard default display. This display configuration is available to
your administrator via the wizard Advanced properties customization. For
more details, refer to the chapter Managing Advanced Properties; the DHCP
properties are detailed in the section Configuring DHCP Advanced Proper-
ties.
All This value allows to display all the advanced property fields/options that
can be displayed in this wizard. For more details, refer to the chapter
9. Click on OK to commit your creation. The report opens and closes. The server is listed.
To edit the SNMP monitoring parameters on an existing server, refer to the section Editing the
SNMP Monitoring Parameters of an EfficientIP DHCP Server.
Configuring Server Options

It is possible to implement DHCP options to servers. Therefore, the options configured at this
level are propagated to the DHCP objects managed by the server, whether the addressing is
dynamic or fixed. EfficientIP provides the DHCP option inheritance in the following order: server,
scope, range. For more details regarding DHCP options, refer to the chapter Configuring DHCP
Options.
To edit the DHCP server options
1. Display the properties page of the server of your choice. For more details, refer to the pro-
cedure To display a DHCP server properties page.
2. In the panel DHCP Options, click on EDIT . The wizard Configure DHCP options opens.
3. For a DHCPv4 server: in the drop-down list Options category, select a category if need be.
The Most used options are displayed by default.
4. For a DHCPv6 server: scroll down the wizard to find the needed option(s).
5. Make your modifications.
6. Click on OK to commit the changes. The report opens and closes. Every item modified is
displayed in the panel.
Editing the SNMP Monitoring Parameters of an EfficientIP DHCP Server

At any time you can edit the SNMP monitoring parameters of an EfficientIP DHCP server.
328
To edit the DHCP server monitoring parameters
1. Display the properties page of the server of your choice.

2. In the panel SNMP monitoring parameters, click on EDIT . The wizard SNMP parameters
opens.
3. Edit the SNMP parameters according to your needs:

Field Description
SNMP version The version of the SNMP protocol used to retrieve the statistics. It can be either
v1, v2c or v3. By default, v2c is selected.
SNMP port The port used to retrieve the server statistics. By default, the port 161 is used.
If you changed the UDP port of your SNMP server, you must use the same port.
For more details, refer to the section Managing the SNMP Service.
SNMP retries The number of connection attempts when the server is in timeout. You can set
it between 0 and 5. By default, it is set to 2 attempts.
SNMP timeout The number of seconds between each connection attempt.You can set it between
1s and 5s or set it to 10s. By default, it is set to 5s.
Use bulk If you use SNMP version 2 or 3, you can choose to use a bulk transfer of data.
This compact SNMP request method accelerates transfers by sending several
requests at once. By default, it is set to Yes.
Use TCP Choose to use the TCP protocol instead of the UDP when the network link is not
4. Click on NEXT . The page SNMP profile opens.

5. In the drop-down list SNMP profile, choose a profile using the same version of the SNMP
protocol as the one you selected in the field SNMP version.
If you created SNMP profiles, you can choose one of your profiles. They are listed only if
they use the same version of the SNMP protocol as the one you selected on the previous
page.
Note that the SNMP profiles you can choose from must be configured on the appliance you
are currently working with. For more details, refer to the section Managing SNMP Profiles.
in the panel.
Managing Agentless Microsoft DHCP Servers

SOLIDserver allows to manage Microsoft DHCP servers via an Agentless Microsoft DNS servers.
Meaning that you do not need to install any WinDHCP agent to manage your Microsoft DHCP
server. This server can be included into an Active Directory (AD) domain or not.
Since version 6.0.0, SOLIDserver no longer supports Microsoft DHCP servers with agent.
Understanding Microsoft Server Management

SOLIDserver allows to update Microsoft Windows DHCP server configuration from its GUI. The
Microsoft configuration of scopes, ranges and reservations can be defined within SOLIDserver
and then updated to the remote Microsoft Windows server. All active lease information from Mi-
crosoft Windows server is displayed in real time within the SOLIDserver user interface. SOLID-
server can control the policy that governs how Microsoft DHCP server performs the DNS update.
329
Note that the way to manage the ranges within SOLIDserver and Microsoft DHCP server are
different. You can create as many ranges as you need with SOLIDserver but only one with Mi-
crosoft DHCP. So, when SOLIDserver overwrites Microsoft DHCP server configuration:
• The unique Microsoft range start and end addresses match the start and end address of a
SOLIDserver scope.
• A number of exclusion ranges are created on the Microsoft server to match the ranges you
created with SOLIDserver.
This mechanism allows SOLIDserver to offer the same services as Microsoft but what is displayed
in SOLIDserver GUI differs from what you see on the Windows Administrative Tools of your Mi-
crosoft DHCP server: the ranges that you create with SOLIDserver correspond to a unique range
with a number of exclusion ranges.
SOLIDserver DHCP configuration vs. Microsoft DHCP configuration

With SOLIDserver when you create a scope with the start address 192.168.10.0 and the end
address 192.168.10.255, the configuration is pushed onto Microsoft DHCP server exactly
the same. However, the way to deal with the ranges differ.
When you create the two following ranges with SOLIDserver:

First range
192.168.10.5 - 192.168.10.10
Second range
192.168.10.25 - 192.168.10.100
The configuration looks as follows in the Microsoft DHCP configuration:

One unique range
192.168.10.0 - 192.168.10.255. It basically corresponds to the scope start and end ad-
dresses.
Three exclusion ranges
192.168.10.1 - 192.168.10.4
192.168.10.11 - 192.168.10.24
192.168.10.101 - 192.168.10.254
The Agentless Microsoft DHCP server management through SOLIDserver is based on the Mi-
crosoft Remote Procedure Calls (MSRPC). This inter-process communication technique provides
an efficient method to extend the notion of conventional or local procedure calling, in such a way
that there is no need to have the called procedure and the calling procedure in the same space
of addresses anymore. The two processes can either be on the same system or on different
systems as long as they have a network connecting them. That way, programmers of distributed
applications avoid the details of the interface with the network. Plus, the transport independence
of RPC isolates the application from the physical and logical elements of the data communications
mechanism and allows the application to use a variety of transports.
Through MSRPC, the client first calls a procedure to send a data packet to the server. Upon the
reception of the packet, the server calls a dispatch routine to perform the requested service, and
then sends back a reply. Finally, the procedure call returns to the client. That's how EfficientIP
offers a new way of managing your Microsoft DHCP server and no longer requires the installation
of an agent. This simplifies drastically the Windows server management.
330
Prerequisites
To successfully manage an agentless Microsoft DHCP server you need:
• To ensure that the service DHCP is properly started. For more details, refer to the chapter
Services Configuration.
• A Microsoft Window Server 2008, 2008 R2, 2012 R2 or 2016. The server must:
• Have the TCP ports 135 and 445 open. They are used by the port mapper interface, the
services that indicates to the clients which port provides access to each service.
• Have Firewall policies that allow traffic between SOLIDserver and the Microsoft servers it
manages.
• In Windows Server 2008, RPC uses by default the dynamic port range 49152-65535. Note
that you can reduce the number of available ports, as long as you respect the minimum
3
number of ports required in the range is 255, via the netsh tool .
• The credentials of a member of the group DHCP Administrators. Users with insufficient privileges
cannot manage the server.
Adding an Agentless Microsoft DHCP Server

Before adding an Agentless Microsoft DHCP server make sure you meet the Prerequisites and
Limitations.
If your Microsoft DHCP server is integrated to an AD with several forests, you can use the expert
mode during the server addition to specify the domain of the AD that you want to manage.
To add an agentless Microsoft DHCP server
3. In the menu, select Add > Server > Microsoft DHCP. The wizard Manage a DHCP server
opens.
Table 25.6. Microsoft DHCP server basic parameters

Field Description
DHCP server name Type in an FQDN name for the server. This field is required.
Management IP address Type in the IPv4 address of the Microsoft DHCP server you want to man-
a
age . This field is required.
3
For information, refer to http://support.microsoft.com/kb/929851 .
331
Field Description
a
With the proper Network Configuration, if you enter the name of your DHCP server in this field and click on SEARCH ,
the IP address is retrieved from the DNS and displayed.

7. In the field Login, type in the name of user with sufficient managing privileges over the
Windows DHCP server.
8. In the field Password, type in the corresponding password.
9. If your Windows DHCP server is integrated to Active Directory and contains several forests:
a. Tick the box Expert mode (AD). The field AD domain appears
b. In the field AD domain, type in the full domain or subdomain.
10. In the field AD domain, type in the domain name.


Field Description
ties.
12. Click on OK to commit the server configuration. The report opens and closes. The server is
listed, the column Version indicates the Microsoft server version.
Limitations
The management of Microsoft DHCP servers within SOLIDserver has some limitations. For more
details regarding the MS servers limitations, refer to the documentation provided by Microsoft.
Server Limitations
• On your Windows server, you need to create or define a user that has administrator rights on
the MS DHCP server before managing it through SOLIDserver.
• On your Windows server, you need to create or define a user that has reading rights on the
MS DHCP server if you want that user to be able to view the server in SOLIDserver.
• SOLIDserver does not support Microsoft failover management. The channels are not listed in
the GUI, and you cannot configure any failover channel between any MS DHCP server and
332
any other kind of server (EfficientIP DHCP, EfficientIP DHCP Package or Nominum DCS). To
reproduce the Windows cluster configuration, you need to manage two MS DHCP servers with
a split-scope smart architecture.
• Any modification of the MS DHCP made on the Windows server directly are not automatically
transferred to SOLIDserver. The server synchronization is manual on the page All servers (edit
> synchronize).
• The Synchronization of an MS DHCP server within SOLIDserver does not work if the server
is managed through a smart architecture: the smart configuration overwrites the new data.
DHCP Options Limitations
• Encapsulated DHCP options are not supported by MS DHCP servers.
Lease Limitations
• The start date of a lease is unknown. SOLIDserver displays an arbitrary start date that corres-
ponds to the moment when the lease is detected.
• DHCP configurations involving a very large number of leases trigger refresh problems. By de-
fault, the registry database entry module.dhcp.refresh_server_time refreshes leases every 10
seconds, when there are a lot of leases it can overload the service and create a loop. To avoid
this problem, you need to increase the value of the registry entry.
ACL Limitations
• You cannot configure ACL on Microsoft servers.
Managing ISC DHCP Servers

Efficient IP provides its software versions through native packages of operating system. Installing
a DHCP package allows you to use the DHCP module of SOLIDserver at the best of its potential
on Linux: it allows you to manage an ISC server through an EfficientIP DHCP server and benefit
from all the options that come with it (statistics retrieved via SNMP...).
Since version 6.0.0, the addition of Linux Packages v4 that respected the SNMP protocol
and worked with SSL, is no longer supported. If you migrated your database with such servers,
4
refer to the guide SOLIDserver-Administrator-Guide-5.0.4.pdf available on our website .
Managing EfficientIP ISC Linux Packages

In the sections below are a set of procedures to successfully install the DHCP packages, formerly
known as EfficientIP ISC Linux Packages v5, on Linux Debian and CentOS/RedHat.
Installing the EfficientIP DHCP Package for Linux Debian 9 and prior - 64 bits
Prerequisites
• The DHCP package file, ipmdhcpxx-y.y.y-debianxx-amd64.deb, whose name provides you

with a number of information separated by hyphens: the type of package (ipmdhcpxx: a DHCP
package with a DHCP in version xx where xx is x dot x), the version of SOLIDserver (y.y.y);
the version of Debian (debianxx where xx is x dot x) and finally the Debian architecture (amd64).
4
At http://www.efficientip.com/services/support/, in the section Products & Documentation and in the folder /docs/5.0.4. Log in using
your credentials. If you do not have credentials yet, request them at www.efficientip.com/support-access.
333
In the procedure below, this file is referred to as <ipmdhcpxx-y.y.y-debianxx-amd64.deb>.

• The EfficientIP ISC package platform must have at least 20 Mb of free disk space.
• The EfficientIP ISC package may need certain libraries of your operating system, you must
5
have a shell access with root login in local, via ssh on the server to be installed.
• You must make sure that no other DNS/DHCP service on your Linux is running : it would inter-
fere with the BIND/ISC package installation.
• You must make sure that SOLIDserver and Debian are set to the same time and date.
• You must make sure that Apache server is up-to-date.
• You must make sure that the service dbus is installed.
• You must make sure that HTTPS (port 443), the DHCP service (port 67) and the failover ports
(647-667 and 847-867) are not blocked by a network filtering process (firewall).
If your Apache configuration already uses the port 443, you have to create an additional IP-
based VirtualHost dedicated to the DNS/DHCP management.
Installing the EfficientIP DHCP Package
You can install the EfficientIP DHCP Package on Debian Linux.
If you have not installed the DNS packages yet, you need to:
1. Follow the procedure To install the EfficientIP DHCP Package on Debian.

2. Follow the procedure To complete the DHCP package installation on Debian if the DNS
package is not installed.
If you already installed the DNS packages, you only need to follow the procedure To install
the EfficientIP DHCP Package on Debian below.
The installation procedure below includes the commands that make the web services configurable.
To install the EfficientIP DHCP Package on Debian

2. Stop and disable your DHCP software, using the following commands:
# service isc-dhcp-server stop
# update-rc.d -f isc-dhcp-server remove
3. Install the dependency packages, ONLY if you have not installed the EfficientIP DNS package,
using the following commands:
a. For Debian 8 and prior:

# apt-get install php5
# apt-get install sudo
# apt-get install snmpd
# apt-get install sqlite
# apt-get install php5-sqlite
b. For Debian 9:
# apt-get install php
5
You could also connect via telnet but, for security purposes, we recommend that you favor ssh.
334
# apt-get install sqlite

# apt-get install php-sqlite3
4. Install the EfficientIP DHCP package, using the following command:

# dpkg -i <ipmdhcpxx-y.y.y-debianxx-amd64.deb>
5. Make the web services configurable: in the directory /etc/sudoers.d , create the file ipmdhcp
containing the line below.
www-data ALL = NOPASSWD: /usr/local/nessy2/script/install_dhcpd_conf.sh, \
/usr/local/nessy2/script/install_dhcpd6_conf.sh
6. Set the users access rights as follows:

# chmod 440 /etc/sudoers.d/ipmdhcp
Note that you can change the password admin of the web service using the command below:
# htpasswd /usr/local/nessy2/www/php/cmd/dhcp/.htpasswd admin
If you have not installed the DNS package or are not planning on installing it, you must
now follow the procedure below.
To complete the DHCP package installation on Debian if the DNS package is not
installed
1. If relevant, open an SSH session.

2. Allow SNMP access to the DNS statistics: append the file /etc/snmp/snmpd.conf with the
following line.
view systemonly included .1.3.6.1.4.1.2440
3. Start the SNMP daemon, using the following command:

# service snmpd start
4. Create a self-signed certificate for Apache, using the following commands:

# cd /etc/apache2
# openssl genrsa -des3 -out server.key 4096
# openssl req -new -key server.key -out server.csr
# openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt
# openssl rsa -in server.key -out server.key.insecure
# mv server.key server.key.secure
# mv server.key.insecure server.key
5. Activate the SSL mode in Apache using the following command:

# a2enmod ssl
6. Make sure that a symbolic link to the default VirtualHost SSL configuration file is located in
the folder sites-enabled/ . If not, use the following command.

# ln -s /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled/
b. For Debian 8 and Debian 9:

# a2ensite default-ssl
335
7. Configure the web services.
a. For Debian 7 and prior, in the file /etc/apache2/sites-enabled/default-ssl, replace the

FULL section <VirtualHost *:443> with the configuration below.
<VirtualHost *:443>
ServerName 127.0.0.1
DocumentRoot /usr/local/nessy2/www/php
<Directory /usr/local/nessy2/www/php>
AllowOverride All
</Directory>
# Please note that the following, from "php_admin_value" to "site:/usr/local/share/pear",

# represents and must be written on a single line.
php_admin_value include_path
/usr/local/nessy2/www/php/include:/usr/local/nessy2/lib/php:/usr/local/nessy2/www/site:/usr/local/share/pear
php_admin_value file_uploads 1
php_admin_value upload_max_filesize 300000000
php_admin_value post_max_size 300000000
php_admin_value memory_limit 150000000
php_admin_value register_globals 0
php_admin_value short_open_tag 1
php_admin_value safe_mode 0
php_admin_value magic_quotes_gpc 0
SSLEngine on
SSLCertificateFile /etc/apache2/server.crt
SSLCertificateKeyFile /etc/apache2/server.key
SSLProtocol all -SSLv2
SSLCipherSuite HIGH:MEDIUM
# Please note that the following, from "SetEnvIf" to "force-response-1.0", represents and
# must be written on a single line.
SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown downgrade-1.0
force-response-1.0
</VirtualHost>
b. For Debian 8 and Debian 9, in the file /etc/apache2/sites-enabled/default-ssl.conf, replace

the FULL section <VirtualHost *:443> with the configuration below.
<VirtualHost *:443>
Require all granted
AllowOverride Authconfig
Options Indexes
</Directory>

SSLEngine on
336
force-response-1.0
</VirtualHost>
8. Disable the default site in Debian Apache configuration using the following commands.

# cd /etc/apache2/sites-enabled
# unlink 000-default

# a2dissite 000-default
9. Restart Apache using the following command:

# service apache2 restart
10. Make sure that the ipmdhcp package is running using the following command:
# service ipmdhcp status
If it is not running, use the following command:

# service ipmdhcp start
Once the configuration is complete, you can add an EfficientIP Package DHCP server to manage
your ISC server from SOLIDserver GUI. Refer to the procedure in the section Adding an ISC
DHCP Server for more details.
Installing the EfficientIP DHCP package for Linux CentOS/RedHat 7 and prior - 64 bits
Prerequisites
• The DHCP package file, ipmdhcpxx-y.y.y-redhatx.x86_64.rpm, whose name provides you with
a number of information separated by hyphens or a point: the type of package (ipmdhcpxx: a
DHCP package with a DHCP in version xx where xx is x dot x), the version of SOLIDserver
(y.y.y); the version of RedHat (redhatx) and finally the RedHat architecture (x86_64).
In the procedure below, this file is referred to as <ipmdhcpxx-y.y.y-redhatx.x86_64.rpm>.

• The EfficientIP ISC package platform must have at least 20 Mb of free disk space.
• The EfficientIP ISC package may need certain libraries of your operating system, you must
6
• You must make sure that SOLIDserver and RedHat/CentOS are set to the same time and date.
• You must make sure that HTTPS (port 443), the DHCP service (port 67) and the failover ports
(647-667 and 847-867) are not blocked by a network filtering process (firewall).
6
337
Installing the EfficientIP DHCP Package
You can install the EfficientIP DHCP Package on both RedHat and CentOS Linux.
If you have not installed the DNS packages yet, you need to:
1. Follow the procedure To install the EfficientIP DHCP Package on RedHat and CentOS.
2. Follow the procedure To complete the DHCP package installation on RedHat/CentOS if the
DNS package is not installed.
If you already installed the DNS packages, you only need to follow the procedure To install
the EfficientIP DHCP Package on RedHat and CentOS below.
The installation procedure below includes the commands that make the web services configurable.
To install the EfficientIP DHCP Package on RedHat and CentOS

2. Stop and disable your DHCP software, using the commands below.
• On RedHat:
# service isc-dhcp-server stop
# update-rc.d -f isc-dhcp-server remove
• On CentOS:
# service dhcpd stop
# chkconfig dhcpd off
3. Install the dependency packages, ONLY if you have not installed the EfficientIP DNS package,
using the following commands:
# yum install mod_ssl php php-pdo sudo net-snmp sqlite
4. Install the EfficientIP DHCP package, using the following command:

# rpm -ivh <ipmdhcpxx-y.y.y-redhatx.x86_64.rpm>
5. Make the web services configurable: in the directory /etc/sudoers.d , create the file ipmdhcp
apache ALL = NOPASSWD: /usr/local/nessy2/script/install_dhcpd_conf.sh, \
/usr/local/nessy2/script/install_dhcpd6_conf.sh

# chmod 440 /etc/sudoers.d/ipmdhcp
# htpasswd -c /usr/local/nessy2/www/php/cmd/dhcp/.htpasswd admin
If you have not installed the DNS package or are not planning on installing it, you must
To complete the DHCP package installation on RedHat/CentOS if the DNS package

is not installed
338
2. Disable the firewall using the following commands.
a. For RedHat/CentOS 6 and prior:

# service iptables stop
# chkconfig iptables off
b. For RedHat/CentOS 7:
# service firewalld stop
# chkconfig firewalld off
3. Disable selinux. In the file /etc/selinux/config, modify the line SELINUX=enforcing to match
the following one:
SELINUX=disabled
4. Reboot the system to take into account the selinux policy changes :
# reboot
5. In the file /etc/sudoers, disable requiretty by making it a comment as follows:

#Defaults requiretty
6. Allow SNMP access to the DHCP statistics. In the file /etc/snmp/snmpd.conf, in the section
entitled Access Control, enter the lines:
master agentx
view systemview included .1.3.6.1.4.1.2440
#You may need to specify another view, AllView or a custom one,
#if you edited the default SNMP configuration.


# cd /etc/httpd
9. Configure the web services. In the file /etc/httpd/conf.d/ssl.conf, replace the FULL section
<VirtualHost *:443> with the configuration below.

<VirtualHost *:443>
AllowOverride All
</Directory>

339
SSLEngine on
SSLCertificateFile /etc/httpd/server.crt
SSLCertificateKeyFile /etc/httpd/server.key
force-response-1.0
</VirtualHost>
<VirtualHost *:443>
Require all granted
Options Indexes
</Directory>

represents and
SSLEngine on
force-response-1.0
</VirtualHost>
10. Restart Apache using the following command line:

# service httpd start
11. Make sure that the ipmdhcp package is running using the following command line:
# service ipmdhcp status
If it is not running, use the following command line:

# service ipmdhcp start
Once the configuration is complete, you can add an EfficientIP Package DHCP server to manage
your ISC server from SOLIDserver GUI. Refer to the procedure in the section Adding an ISC
DHCP Server for more details.
340
Upgrading Packages
No matter the package version, to upgrade packages:
1. You must uninstall your current packages.

2. You must install the new package following the prerequisites and procedures detailed above
in the section Managing EfficientIP ISC Linux Packages.
Adding an ISC DHCP Server

Once you successfully installed your EfficientIP ISC Linux Package, you need to install an Effi-
cientIP DHCP package and configure it according to your needs to manage BIND servers though
the GUI.
The EfficientIP DHCP package is only available for DHCPv4 servers managed with SSL.
To add an ISC DHCP server for a Linux package
3. In the menu, select Add > Server > EfficientIP DHCP Package. The wizard Manage a DHCP
server opens.
Table 25.8. DHCP server basic parameters

Field Description
DHCP server name In this field, fill in a FQDN name for your server. This field is required.
Management IP address In this field, fill in the IPv4 address of your server. This field is required.
go to step 7.
7
7
341

Field Description
SNMP port The port used to retrieve the server statistics. By default, the port 161 is
used. If you changed the UDP port of your SNMP server, you must use the
same port. For more details, refer to the section Managing the SNMP Ser-
vice.
Use TCP Tick the box if you want to use the TCP protocol instead of the UDP when
the network link is not reliable.
between 1s and 5s or set it to 10s. By default, it is set to 5s.


Field Description
ties.
9. Click on OK to save the server configuration. The report opens and closes. The server is
listed.
Once the EfficientIP Package server is added, you can manage your ISC server in Linux from
the GUI.
Editing DHCP Servers

To edit any kind of DHCP server configuration, you need to open its properties page and edit the
panel(s) of your choice.
Before proceeding, note that:
• The panels that do not contain the button EDIT cannot be edited.
• The basic server parameters are detailed in the addition procedures of each kind of physical
server.
342
• As you can no longer add servers managed via SNMP to the GUI in version 6.0.0, editing the
management protocol from SNMP to SSL is non reversible.
If you want to add, edit or delete DHCP options, refer to the chapter Configuring DHCP Options.
To edit a DHCP server
4. At the end of the line of the server of your choice, click on . The properties page opens.
5. Open all the panels using .
6. In the panel of your choice, click on EDIT . The corresponding wizard opens.
7. Make the changes you need. Click on NEXT if need be to get to last page of the wizard.
visible again and refreshes.
Deleting DHCP Servers

At any time you can delete a server from the page All servers to stop managing it from SOLID-
server.
Keep in mind that you cannot delete a physical server if it is managed by a smart architecture.
To delete a DHCP server
4. Tick the server(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The server might be marked
Delayed delete until it is no longer listed.
Defining a DHCP Server as a Group Resource

Adding a server as one of the resources of a specific group allows the users of that group to
manage the server(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a server as a resource also grants access to every item it contains. For more
343
Chapter 26. Managing DHCP Scopes
SOLIDserver scopes constitute a level in the DHCP module and are used to determine the topology
of the network, apply DHCP options for a routable domain, describe network clients, and indicate
the addresses to be allocated to certain clients. In order to use the DHCP service, each terminal
network to be served must have a DHCP scope that matches its IP address and its netmask
(size). When a DHCP server serves clients with local physical networks, the scope is easily as-
similated to its broadcast domain. A scope belongs to a DHCP server and can contain several
DHCP ranges.
Browsing Scopes
The scopes are required in a dynamic addressing DHCP hierarchy, they are created directly
within a DHCP server.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 26.1. The scope in the DHCP hierarchy
Browsing the Scopes Database

To display the list of DHCP scopes
3. In the upper right corner, click on V4 to display the DHCPv4 scopes or V6 to display the
DHCPv6 scopes.
4. You can filter the list to display a specific scope. Type in the data you are looking for in the
search engine of the columns Name and/or Address and click on REFRESH to only display
the scope matching your search.
To display the list of scopes of a DHCP server
3. Click on the name of the server of your choice, the page All scopes opens and displays only
the server's scopes.
To display a DHCP scope properties page
1. Go to the list All scopes.

344
Managing DHCP Scopes
3. At the end of the line of the scope of your choice, click on . The corresponding scope
Customizing the Display on the Page All Scopes

Understanding the DHCP Scope Statuses

The column Status provides information regarding the scopes you manage.
Table 26.1. DHCP scope statuses

Status Description
OK The scope is configured
Delayed create The creation or update is delayed due to a scheduled configuration of the server.
The creation is automatically done after maximum of 1 minute.
Delayed delete The deletion is delayed due to a scheduled configuration of the server. The deletion
is automatically done after maximum of 1 minute.
Adding a DHCP Scope

The addition of a scope to a DHCP server defines a new extension to the network's topology.
Once created, the DHCP server is ready to receive a range of dynamic addresses.
Note that you can also import scopes, for more details refer to the section Importing Scopes.
You can add as many scopes as you need on the page All scopes of all the server or a specific
one. The procedure below creates a scope from the page All scopes with no server, otherwise
the creation process can be slightly shorter.
To add a DHCP scope
DHCPv6 scopes.
4. In the menu, select Add > DHCP scope or Add > DHCP scope (v6). The Add a DHCP scope
wizard opens.
5. In the list Select a DHCP server, select the DHCP server in which you want to create the
scope.
6. Click on NEXT . The next page of the wizard appears.
7. If you or your administrator created classes at the scope level, in the list DHCP scope class
345
8. Click on NEXT . The next page of the wizard appears.
9. Fill in the following fields to configure the scope parameters:
Table 26.2. DHCP scope configuration parameters

Field Description
Name Name the scope. This field is required.
Network address Type in the scope address. This field is required.
Netmask Select the shared physical network. This field is required.
Prefix Select the scope prefix. By default, the prefix is selected depending on the net-
mask you chose. The prefix selected edits the value of the field Netmask. This
field is required.
Shared network Type in the name of a shared network. The field auto-completes. If you leave
this field empty, a new shared network is created and named after the scope
start_address/prefix.
DHCP scope space name Select one of your existing IPAM spaces: the scope is part of it. This field is op-
tional.

Field Description
Properties.
11. Click on OK to commit the creation. The report opens and closes. The scope is listed.
Editing a DHCP Scope

To edit the main properties of a DHCP scope
1. Go to the scope of your choice properties page. For more details, refer to the procedure To
display a DHCP scope properties page.
DHCPv6 scopes.
3. In the panel Main properties, click on EDIT . The Edit a DHCP scope wizard opens.
4. If you or your administrator created classes at the scope level, in the list DHCP scope class
346
5. You can modify the Name, Shared network, DHCP scope space name and Advanced
Properties.
Applying DHCP Options at Scope Level

SOLIDserver allows to specify DHCP options at scope level in IPv4 addressing. All the options
you configure at scope level are thus inherited to all the DHCP addresses it distributes: DHCP
static reservations and DHCP dynamic.
Editing the Scope Options

SOLIDserver provides a powerful configuration assistant to set DHCP options. This assistant is
available from the property page of DHCP scopes. For more details regarding the DHCP options
configuration, refer to the chapter Configuring DHCP Options.
To edit a scope DHCP option
1. Go to the properties page of the scope of your choice. For more details, refer to the procedure
To display a DHCP scope properties page.
2. In the upper right corner, click on .
3. In the panel DHCP options, click on EDIT . The Configure DHCP options wizard opens.
4. Edit the parameters and options according to your needs.
For DHCPv4 scopes, in the drop-down list Option category, select the category of your
choice. The corresponding fields are displayed.
5. Click on OK to commit the modification. The report and closes. The modifications are listed
in the panel.
Performing Option Changes on Several Scopes At Once

SOLIDserver offers powerful tools to massively apply or remove options on DHCP scopes. Options
can be set on all scopes you select from the DHCP scope table. You can select scopes from
your one criterion by using column filtering for one server or through all DHCP server.
To add a DHCP option to one or several scopes
DHCPv6 scopes.
4. Filter the list to find the scope(s) to be modified.
5. Tick the scope(s).
6. In the menu, select Edit > Option > Add. The wizard Add DHCP scope options opens.
347
7. In the drop-down list Option Name, select an option.

8. In the field Value, type in the relevant value.
9. Click on OK to commit your option addition.The report opens and closes, the page refreshes.
If you open the scope properties page DHCP options panel, you can see all the DHCP options
and their value.
To edit the value of a DHCP option on one or several scopes
DHCPv6 scopes.
6. In the menu, select Edit > Option > Replace. The wizard Delete DHCP scope options opens.
7. In the drop-down list Option Name, select the option which value you want to replace.
8. In the field Replace, type in the value to be replaced (i.e. the value you set when adding the
option).
9. In the field By, type in the new value.
10. Click on OK to commit your changes. The report opens and closes, the page refreshes. If
you open the scope properties page panel DHCP options, you can see the DHCP option
new value.
To remove a DHCP option from one or several scopes
DHCPv6 scopes.
6. In the menu, select Edit > Option > Delete. The wizard Delete DHCP scope options opens.
7. In the drop-down list Option Name, select an option.
8. In the field Option value filter, type in the option value.
9. Click on OK to commit your option deletion. The report opens and closes. If you open the
scope properties page panel DHCP options, you can see that the DHCP option is no longer
listed.
Defining a Specific IPAM Space for a Scope

At any time you can associate DHCP scopes with IPAM spaces, either to define a space if you
did not when you added the scope or to set a different one.
Defining a specific space at scope level allows to apply policy rules from the IPAM module to
several addresses and avoid any overlapping of ranges and spreads of reserved addresses.
348
You can either define a specific space for a scope when you edit it or use the menu Edit to set
a space on one or several scopes at a time.
To edit a scope and change the space it is associated with
DHCPv6 scopes.
4. Right-click on the scope of your choice. The contextual menu opens.
5. Click on . The properties page opens.
7. In the drop-down list DHCP scope space name, select the space that you want to associate
with the scope.
8. Click on OK to commit your changes. The report opens and closes. The panel displays the
new space name.
To set the space of one or several scopes
DHCPv6 scopes.
4. Tick the scope(s) you want to edit. The scope(s) can already be associated with a space.
5. In the menu, select Edit > Set > Space. The wizard Edit the scope space opens.
6. In the drop-down list Space, select the space you want your scope(s) to be associated with
or None to remove the association.
7. Click on OK to commit the change. The report opens and closes. The new space is listed in
the column Scope space.
Once a scope is associated with a space, you can execute the DHCP to IPAM replication and
associate scopes with existing networks or create the corresponding network. As you can create
several terminal networks managing the same IP addresses in separate spaces, you can associate
these networks with scopes belonging to distinct DHCP servers.
Replicating Scope Data in the IPAM

The option IPAM replication allows to decide in which space you want to replicate scope data. If
you want to associate a scope with a space or change the space it is associated with, refer to
the section Defining a Specific IPAM Space for a Scope.
Before replicating your DHCP data into the IPAM, keep in mind that:
• The option IPAM replication behaves as follows:

• If you specify a space that has no matching network, a network is created, it is named like
the scope.
349
• If you do not specify any space, with the value None, SOLIDserver automatically creates a
network matching the scope in the first space that can receive it.
• The option IPAM replication can only specify a target space for scopes that are not configured
with any space yet.
Either no space was specified when you added it or you set the space of a scope and selected
None, as detailed in the procedure To set the space of one or several scopes.
• The option IPAM replication does not change the associated space, it sets a replication asso-
ciation. If you want to change the target of a scope already associated with a space, you must
edit as detailed in the section Defining a Specific IPAM Space for a Scope.
To replicate scope data in the IPAM
DHCPv6 scopes.
4. Tick the scope(s) of your choice.
5. In the menu, select Edit > IPAM replication. The wizard IPAM replication opens.
6. In the drop-down list Target space, select a space or None. For more details, refer to the
option behavior details.
7. Click on OK to commit the change. The report opens and closes. The new space is listed in
the column Scope space.
Note that you can also replicate DHCP range and static data to the IPAM. For more details, refer
to the sections Replicating Range Data in the IPAM and Replicating Static Data in the IPAM.
Configuring Multiple Scopes for a Network Segment

A shared network is a group of scopes serving an entire network segment as a single entity.
Typically, a shared network is used where a DHCP server is being used to support DHCP clients
on a single physical network that has multiple IP networks in use. This is sometimes referred to
as multinetting. This occurs when a network is depleted of available IP addresses and more ad-
dresses need to be used. For example, if a company has a single Class C network address, the
company has 254 IP addresses to use. If the company is growing and has used all of its addresses,
the company needs to add another Class C network address and route the data between the
two networks. Since these address ranges are not contiguous, they cannot belong to the same
scope. By creating a shared network, the DHCP server is able to manage both Class C networks
as a single entity.
Because the network administrator defines scopes and assigns them to network segments, a
client scope cannot be determined just by its network connection. The client is connected to a
network segment on which any number of IP scopes may be configured. Thus, when a request
arrives from a client, the DHCP server first determines from which network segment the message
was sent. If the client is requesting an existing address, the DHCP server can check the requested
address to determine whether it is from any of the IP scopes assigned to the client network seg-
ment. If it is, and if the address is available for the client, the server can assign that address to
the client.
350
If dynamic DHCP ranges appear within scopes using the same shared network, all address
ranges are offered independently. Once the first range is full, the ranges that are declared within
the same shared network are used one after the other until all addresses are used.
To add a DHCP scope to a shared network
1. Go to the properties page of the DHCP scope of your choice. For more details, refer to the
procedure To display a DHCP scope properties page.
3. If you created classes at scope level, in the list DHCP scope Class, select a class if need
be.
4. Click on NEXT . The last page of the wizard appears.
5. In the field Shared network, if you did not set a shared network when creating the scope,
the start IP address of the scope you are editing is displayed in the field. Delete the content
of the field and type in the start address of the scope of your choice following the format <IP-
address>/<prefix>. This field provides auto-completion.
Copying or Moving DHCPv4 Scopes

To assist you in the management, scopes can be copied and moved from one server to the other.
In both cases, make sure that the IP addresses they manage is not already managed by another
scope in the target space.
Migrating a scope also migrates the DHCP ranges and statics with IP address it contains. As for
the statics without IP migration, refer to the section Copying a DHCPv4 Static Without IP.
Keep in mind that if your physical server is managed through a smart, only the scope created on
the smart can be duplicated or moved.
To copy a scope to another server
3. In the upper right corner, click on V4 to display the DHCPv4 scopes.
4. Tick the scope(s) you want to duplicate.
5. In the menu, select Edit > Migrate. The Copying/Moving scopes wizard opens.
6. In the drop-down list Method, select Copy.
7. In the drop-down list Target server, select the server of your choice.
8. Click on OK to commit the scope duplication. The report opens and closes. The page All
scopes is visible again. Both scopes are listed and they share the same name, start address
and end address. The duplicate scope is in Delayed create in the target server.
To move a scope to another server
351
3. In the upper right corner, click on V4 to display the DHCPv4 scopes.

4. Tick the scope(s) you want to duplicate.
5. In the menu, select Edit > Migrate. The Copying/Moving scopes wizard opens.
6. In the drop-down list Method, select Move.
8. Click on OK to commit the RR migration. The report opens and closes. The page All scopes
is visible again. The scope is no longer listed as part of the first server. It now belongs to the
selected target server.
Deleting a DHCP Scope

The deletion of a DHCP scope makes the address ranges and leases it contains disappear. This
deletion restricts the network's topology.
To delete a DHCP scope
DHCPv6 scopes.
4. Filter the list if need be. For more details, refer to the procedure To display the list of DHCP
scopes.
5. Tick the box left of the scope(s) to be deleted.
6. In the menu, select Edit > Delete. The Delete wizard opens.
7. Click on OK to commit the deletion. The report opens and closes. The scope is no longer
listed.
DHCP Relay Agents

Rather than directly connecting the DHCP server to every network segment it serves, it is possible
to configure a DHCP relay agent on each network segment. Relay agents are configured with a
list of one or more DHCP servers, two servers must be configured for the DHCP failover. When
a relay agent receives a message from a DHCP client on a particular network segment, it records
the IP address of the interface on which it received the request in the field GiAddr of the message,
and then it forwards the message to the DHCP server. From there, the server directly responds
to the client.
The DHCP relay is a mechanism that allows the transfer of DHCP/BOOTP messages between
clients and servers of different networks. The routers used to interconnect these networks possess
for the most part the functionality of TCP/IP relay agents. To conform to RFC 1542 and deal with
the relay agent, each router must be able to recognizing BOOTP and DHCP messages and re-
laying them in an appropriate manner. A router equipped with the capacities of a BOOTP relay
agent generally relays DHCP packets, as well as all BOOTP packets transmitted on the network.
SOLIDserver supports DHCP relay transparently. If a scope has the same network address as
one of the interfaces of the DHCP server, then it is a local scope. This means that it belongs to
the same broadcast domain as the DHCP server. Otherwise, it is a relay scope.
352
BOOTP / DHCP relay on Cisco devices (IP helper)

If we consider two DHCP servers, with one on the network 191.24.1.0 and the other one on
110.44.0.0. To allow the IP broadcast from all hosts to be forwarded in unicast toward both
servers, set the configuration below.
interface ethernet1
ip helper-address 191.24.1.45
ip helper-address 110.44.0.125
BOOTP / DHCP relay on Juniper devices (IP helper)

If we consider that a DHCP server is in VLAN 20 with the IP address 20.20.20.2, the DHCP client's
computer is in VLAN 10 and a Juniper switch is configured as DHCP relay and performs inter
VLAN routing between the VLANs 10 and 20, set the configuration below.
set vlans vlan10 vlan-id 10 set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members
vlan10 set vlans vlan10 l3-interface vlan.10 set interfaces vlan unit 10 family inet address
10.10.10.1/24 set vlans vlan20 vlan-id 20 set interfaces ge-0/0/1 unit 0 family ethernet-switching
vlan members vlan20 set interfaces vlan unit 20 family inet address 20.20.20.1/24 set vlans vlan20
l3-interface vlan.20 set forwarding-options helpers bootp server 20.20.20.2 set forwarding-options
helpers bootp interface vlan.10
BOOTP / DHCP relay on HP devices (IP helper)

If we consider a DHCP server with the IP address 10.10.20.3 IP and a DHCP client's computer
is in VLAN 40, set the configuration below.
vlan 40 ip helper-address 10.10.20.3
Defining a DHCP Scope as a Group Resource

Adding a scope as one of the resources of a specific group allows the users of that group to
manage the scope(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a scope as a resource also grants access to every item it contains. For more
353
Chapter 27. Managing Fixed
Reservations
Managing DHCP Statics
A DHCP static is essentially a lease reservation that ensures a specified client always uses the
same IP address on a network. For clients who require a constant IP address, you can manually
configure an IP address or assign a DHCP static reservation, reserving a static allows to take
advantage of the DHCP options.
Static reservations can match DHCP, PXE or BOOTP clients based on based on their MAC ad-
dress or DHCP-client-identifier . These reservations can belong to a DHCP server directly, a
group, a scope or a range. All the DHCP options set on these containers apply to the reservations,
so if you edit the DHCP options, the devices configured with the options are automatically updated
when they request the lease renewal.
Every DHCP static reservation must have a unique name which is usually used to identify it but,
in particular contexts, can be used to enforce the client's hostname.
When it comes to statics, there is a main difference between DHCP managing IPv4 and IPv6
addresses. DHCPv6 introduces a new piece of information, the DHCP Unique Identifier (DUID).
It should not exceed 128 bits in total and allows to identify a client rather than an equipment. It
contains the MAC address, therefore this address is not a unique independent set of numbers
anymore, it corresponds to the last 48 to 64 bits of the DUID depending on its type.
There are three different types of DUID:
• DUID based on Link Layer (LL).

• DUID based on Link-Layer Address Plus Time (LLT).
• DUID Assigned by Vendor Based on Enterprise Number (EN).
The DUID default structure goes like this:
DUID-LLT
DUID type Hardware Time Stamp MAC Address
DUID-EN
DUID type Enterprise Vendor Vendor Identifier
DUID-LL
DUID type Hardware MAC Address
0 8 16 24 32 40 48 56 64 72 80 88 96 104 112 120 128
bits
Figure 27.1. Three different structures of DUID
With SOLIDserver 6.0.0, DHCP servers in IPv4 use the MAC address specified during the static
reservation to identify the clients' IP address and allocate them a lease as well as soon as they
are visible on the network. Once the lease is allocated, if the IPAM and DNS replication are
configured, the data is sent to the IPAM and the DNS.
354
Managing Fixed Reservations
Browsing DHCP Statics

The DHCP statics are the end point of a DHCP fixed reservation strategy. They can belong to a
DHCP group or directly to a DHCP server.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 27.2. The static reservation in the DHCP hierarchy
Browsing the DHCP Statics Database
To display the list of statics
3. On the right-end side of the menu, click on V4 to display the DHCPv4 statics or V6 to display
the DHCPv6 statics.
To display the list of statics of a DHCP server
3. Click on the name of the server of your choice. The scopes of this server are listed.
4. In the breadcrumb, click on All statics. The All statics page opens.
the DHCPv6 statics.
To display a DHCP static properties page
1. Go to the page All statics.

the DHCPv6 statics.
4. At the end of the line of the static of your choice, click on . The properties page opens.
On the statics properties page you can find the following information in separate panels:
• Main properties: sums up all the information filled in during the static creation (DHCP server,
scope and group, its name, IP address, client DUID or MAC address, class).
• Audit: displays all of the changes performed on the static by the user logged in. If they belong
to a group with access to the changes from all users, the panel displays all the operations ever
performed. For more details, refer to the section Allowing Users to Display All the Operations
Performed.
355
• DHCP options: displays all the DHCP options you can define. None of the default options are
listed except for the type of DHCP server. For more details, refer to the chapter Configuring
DHCP Options.
Customizing the Display on the Page All Statics
As EfficientIP DHCP servers in version 6.0.0 manage IPv4 static reservations like leases, two
new columns were added to the page All statics: Last seen that indicates the last time the client
was connected and Expiration that indicates when the lease expires.
Understanding the DHCP Static Statuses
The column Status provides information regarding the statics you manage.
Table 27.1. DHCP static statuses

Status Description
OK The static is operational.
Delayed create The creation is delayed due to a scheduled configuration of the server. The creation is
automatically done after maximum of 1 minute.
Delayed delete The deletion is delayed due to a scheduled configuration of the server. The deletion is
Adding a DHCP Static

Whether you work with DHCPv4 or DHCPv6, the statics reservation process is the same: it
identifies clients through their MAC to grant them permanent access to a server and a set of
DHCP options inherited from their container. You can associate the client's MAC address with a
specific IP address on your network or associate it with a static without IP address, this grants
your client access to one server or to the servers connected to a failover channel.
During the static reservation you must specify a MAC address and choose its type, the type
modifies the addresses display on the page. For more details regarding the supported MAC ad-
dresses types, refer to the appendix MAC Address Types References.
Keep in mind that:
• If you or your administrator configured IPAM to DHCP advanced properties, new statics may
be added for every new IP address created in the IPAM. For more details, refer to the chapter
in the section IPAM Advanced properties of the chapter Managing Advanced Properties.
• The rule 022 Check DHCP static duplicate hostnames allows to automatically check that two
different DHCPv4 statics do not have the same name on one DHCP server. This rule is is en-
abled by default and triggered when you are about to add a new static.
Note that you can also import statics, for more details refer to the section Importing Statics.
356
Adding DHCPv4 Statics
To set up static reservation you need a user identifier, the equipment MAC address, that you can
associate with an IP address.
Since version 6.0.0, EfficientIP DHCP servers manage the statics with IP address like
leases:
• Prerequisites:
• An EfficientIP DHCP server in version 6.0.0 or several EfficientIP DHCP servers in version
6.0.0 managed via a smart architecture, the failover cannot support the new behavior if it
one of the servers is not in version 6.0.0.
• New behavior:
• Adding a static with IP address also creates the corresponding lease whenever the client is
active on the network.
• You can associate one MAC address with several static reservations as long as you set
them each with a different IP address.
• Once the lease is active, if you set the IPAM and DNS replication, the corresponding entries
in the DNS are created. When the lease expires, the DNS entries are removed.
• If the IP address of the static is replicated in the IPAM, it has a specific Type and Status on
the page All addresses. For more details, refer to the section Understanding the IP Address
Type and Status.
• Limitations:
• The new static reservation management cannot be set on Microsoft DHCP servers, Nominum
DCS servers or EfficientIP server in versions prior to 6.0.0.
• If you migrated from 5.0.4 to 6.0.1, the statics configured with the option host-name are re-
named: the value of the option is used as the static name. If the static were not configured
with the option, their name is used as value of the option host-name.
To add a DHCPv4 static

3. In the menu, select Add > DHCP Static. The wizard Add a DHCP static opens.
4. In the drop-down list DHCP server, select the DHCP server of your choice.
6. In the list DHCP scope, select a scope or None if you do not want to assign an IP address
to your static, in this case the server DHCP options apply to the static.
8. If you or your administrator created classes at the static level, in the list DHCP static class,
select a class or None. Click on NEXT . The next page of the wizard opens.
9. Configure the static using the table below:
357
Table 27.2. DHCPv4 static configuration parameters

Field Description
Name You can name the static reservation, this name is used as value of the DHCP option
"host-name". This field is optional.
IP address Type in the IPv4 address you want to assign to the device. This field is only displayed
if you selected a scope.
MAC address Type in the MAC address of the device that should use the DHCP static. This field is
required.
MAC address type Select the protocol associated with the MAC address. The protocol corresponding
reference is displayed before the MAC address in the column MAC address. Ethernet
is selected by default. If you select Unknown, the field Type reference appears.This
field is required.
Type reference Specify the reference number of the unknown MAC address type. If the reference you
type in is already part of the database, it is automatically retrieved and visible when
editing the static. This field is required.
Group name You can select an existing DHCP group for the static. If you select a group, its DHCP
options apply to the static. The list only contains None if you have not created any
group yet. You can edit the DHCP group of one or several statics from the page All
statics, for more details refer to the section Editing the DHCP Group of DHCPv4
Statics.
10. Click on OK to commit the static creation. The report opens and closes. The static is listed.
If you added the static to an EfficientIP DHCP server in version 6.0.0 with an IP address belonging
to a range, once the client is connected they are listed on the page All leases and their information
updates the DNS if the IPAM and DNS replication is set.
Adding DHCPv6 Statics
To set up a static reservation with DHCPv6, you need an IP address and a user identifier: the
client DUID. Considering that the DUID can be quite long - for more details, refer to the introduction
of the section Managing DHCP Statics - you have the possibility to either put it in full in the DUID
field or put only the DHCPv4 equivalent of the MAC address, that is to say the last 48 to 64 bits,
looking like xx : xx : xx : xx : xx : xx or xx : xx : xx : xx : xx : xx : xx.
To add a DHCPv6 static

3. In the menu, select Add > DHCP Static (v6). The wizard Add a DHCP static opens.
4. In the drop-down list DHCP server, select the DHCP server of your choice.
6. In the list DHCP scope, select a scope or None if you do not want to assign an IP address
to your static, in this case the server DHCP options apply to the static.
7. Click on NEXT . The next page the wizard opens.
358
9. Configure the static using the table below:
Table 27.3. DHCPv6 static configuration parameters

Field Description
Name You can name the static reservation. This field is optional.
IP address Type in the IPv6 address that the device should use. This field is only displayed if you
selected a scope.
Client DUID Type in the equipment DUID. If you do not specify a Client DUID, you must fill in the
field MAC address.
MAC address Type in the MAC address, that is to say the six sets of hexadecimal digits of the
equipment DUID. If you do not specify the MAC address, you must fill in the field Client
DUID.
MAC address type Select the protocol associated with the MAC address. The protocol reference is dis-
played before the MAC address in the default column MAC address. Ethernet is
selected by default. This field is required.
Group name You can select an existing DHCPv6 group for the static. If you select a group, its
DHCP options apply to the static. The list only contains None if you have not created
any group yet.
10. Click on OK to commit the static creation. The report opens and closes. The static is listed.
Editing a DHCP Static

You can edit the properties of existing DHCPv4 or DHCPv6 statics from their properties page or
put them in a DHCP group from the page All statics.
Editing the Properties of a Static
At any time, you can edit your statics from their properties page.
To edit a DHCPv4 static

3. At the end of the line of the static you chose, click on . The properties page opens.
4. In the panel Main properties, click on EDIT . The wizard Edit a DHCP static opens.
6. Modify the information of your choice in the fields Name, IP address, MAC address, MAC
address type and/or Group name.
7. Click on OK to commit your edition. The report open and closes. The modifications are visible
in the panel.
To edit a DHCPv6 static

359
3. At the end of the line of the static you chose, click on . The properties page opens.
4. In the panel Main properties, click on EDIT . The wizard Edit a DHCP static opens.
6. Modify the information of your choice in the fields Name, IP address, Client DUID, MAC ad-
dress, MAC address type and/or Group name.
7. Click on OK to commit your edition. The report open and closes. The modifications are visible
in the panel.
Editing the DHCP Group of DHCPv4 Statics
At any time from the page All statics, you can put one or several DHCPv4 statics in the DHCP
group of your choice, or edit the group they belong to.
To put DHCPv4 statics in a DHCP group

3. Tick the static(s) you want to put in a different group.
4. In the menu, select Edit > Modify > Group. The wizard Modify the DHCP group of a static
opens.
5. In the drop-down list DHCP group, select the group of your choice.
6. Click on OK to commit the modification. The report opens and closes. The group is listed in
the column Group of the static.
Replicating Static Data in the IPAM

At static level, the option IPAM replication allows to replicate static data in IPAM addresses. Before
replicating your DHCP data in the IPAM, keep in mind that:
• You can only replicate statics with IP in the IPAM.

• The replicated DHCP information overwrites the IPAM information.
• If the static belongs to a scope for which the IPAM replication has been set, its data is replic-
ated as an IP address that belongs to the same terminal network.
Depending on your IPAM configuration, this IP address can belong to a pool, even if the
pool is read-only.
• If the static belongs to a scope for which no replication has been set, its data is replicated
as an IP address in the first terminal network or pool that can receive it. The pool can be
read-only.
• If you replicate a static with IP that matches an existing IP address:
• The IP address is renamed, it takes the name of the static.
• The MAC address of the IP address is edited, it takes the MAC address of the static.
360
• If you replicate a static with IP that has no corresponding IP address, an IP address is created.
It has the same name and MAC address than the static with IP.
• All the statics replicated edit the IP addresses Type to DHCP static and Status to Reserved.
• The option IPAM replication is independent at static level, replicating scopes or ranges does
not automatically replicates to the statics they contain. You must select statics and execute
the option to update the IPAM IP addresses with range data.
For more details regarding scope and range replication, refer to the sections Defining a Specific
IPAM Space for a DHCPv4 Scope and Replicating Range Data in the IPAM.
To replicate range data in the IPAM
3. In the upper right corner, click on V4 to display the DHCPv4 ranges or V6 to display the
DHCPv6 ranges.
4. Tick the range(s) of your choice.
6. Click on OK to commit the change. The report opens and closes.
The matching pool is visible on the IPAM page All pools.
Applying DHCP Options at Static Level

You can configure DHCP options at static level. Keep in mind that:
• You can edit the DHCP options on one static at a time or you can gather them in a DHCP
group and configure DHCP options on the Group itself. For more details, refer to the chapter
Managing DHCP Groups.
• The static inherits the DHCP options of its container, whether it is a server, group, scope or
range.
• The options set at static level override the options set on its container.
• By default, statics created on an EfficientIP DHCP server version 6.0.0 are configured with the
option host-name, its value is the static name.
For more details regarding DHCP options, refer to the chapter Configuring DHCP Options and/or
to the appendix DHCP Options.
To edit the DHCP options of a static
1. Go to the properties page of the static of your choice. For more details, refer to the procedure
To display a DHCP static properties page.
2. In the panel DHCP options, click on EDIT . The wizard Configure DHCP options opens.
3. Modify the fields of your choice. Note that, in DHCPv4, the drop-down list Options category
helps you filter the type of options.
listed in the DHCP options panel.
361
Copying a DHCPv4 Static Without IP

You can copy statics without IP from one server to the other, even if its MAC address is already
declared in the target server. Keep in mind that if your physical server is managed through a
smart, only the static created on the smart can be duplicated.
Statics with IP address are copied or moved when you migrate the scope they belong to.
To copy a static without IP in another server
3. In the upper right corner, click on V4 to display the DHCPv4 statics.
4. Filter the list of need be.
5. Tick the static(s) without IP you want to duplicate.
6. In the menu, select Edit > Migrate. The wizard Copying statics opens.
8. Click on OK to commit the scope duplication. The report opens and closes. The page All
statics is visible again. The static is display twice, in two different servers.
Deleting a DHCP Static

At any point, you can delete a static reservations.
Keep in mind that:
• If you or your administrator configured IPAM to DHCP advanced properties, deleting IP ad-
dresses in the IPAM also deletes the corresponding DHCP statics. For more details, refer to
the chapter in the section IPAM Advanced properties of the chapter Managing Advanced
Properties.
• If you or your administrator configured IPAM to DHCP and IPAM to DNS advanced properties,
adding a static with IP adds a lease on the page All leases when the client is active, once the
IPAM database is updated it updates the DNS to add the corresponding entries. When you
delete a static with IP, the corresponding DNS entries are deleted as well once the lease
expires.
To delete a DHCP static

the DHCPv6 statics.
4. Tick the static(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The static is no longer
listed.
362
Managing DHCP Groups

The DHCP group allows to apply one or more parameters to a group of static declarations.
Configuring a group is optional, the statics would work properly without separately as well. For
clients with statically assigned addresses, or for installations where only known clients should
be served, each such client must have a DHCP static declaration. If parameters are to be applied
to a group of declarations which are not related strictly on a per-network basis, the group declar-
ation can be used. Some sites may have departments which have clients on more than one IP
network, but it may be desirable to offer those clients a uniform set of parameters which are dif-
ferent than what would be offered to clients from other departments on the same IP network. For
clients that should be declared explicitly with DHCP static declarations, these declarations can
belong to a DHCP group declaration along with the parameters which are common to that depart-
ment.
You can add as many groups as you want but you cannot edit them. You can delete them and
replace them with new ones.
You can only add DHCP groups on EfficientIP DHCP servers. If you display the content of
any other type of DHCP server, the breadcrumb no longer displays the page All groups.
Browsing the Groups

The DHCP groups are an optional level of the DHCP fixed reservation organization. They can
be used to manage the statics DHCP options.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 27.3. The group in the DHCP hierarchy
Browsing the Groups Database
To display the list of DHCP groups
2. Click on Groups. The page All groups opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 groups or V6 to display
the DHCPv6 groups.
To display the list of groups of a DHCP server
4. In the breadcrumb, click on All groups. The page All groups of that server opens.
363
To display a DHCP group properties page
1. Go to the page All groups.

2. On the right-end side of the menu, click on V4 to display the DHCPv4 groups or V6 to display
the DHCPv6 groups.
Customizing the Display on the Page All Groups
Understanding the DHCP Group Statuses
The column Status provides information regarding the groups you manage.
Table 27.4. DHCP group statuses

Status Description
OK The group is operational.
Delayed create The creation is delayed due to a scheduled configuration of the server. The creation is
Adding a DHCP Group

At any point, you can add a group to an EffcientIP DHCP server. The purpose of a DHCP group
is to apply a set of DHCP options to the statics that you want to manage with it.
Even if you already created statics, you have the possibility to put them in the group of your
choice. For more details, refer to the section Editing the DHCP Group of DHCPv4 Statics.
You can add a group from the page All groups with both DHCPv4 and DHCPv6.
To add a DHCP group

2. In the upper right corner, click on V4 to display the DHCPv4 groups or V6 to display the
DHCPv6 groups.
3. In the menu, select Add > DHCP group or Add > DHCP group (v6). The wizard Add a DHCP
group opens.
4. In the list DHCP server, select the DHCP server in which you want to add the group.
6. If you or your administrator created classes at the group level, in the list DHCP group class,
364
7. In the field DHCP group name, type in the group name.

8. Click on OK to commit the addition. The report opens and closes. The group is listed.
Keep in mind that you cannot edit a group, you have to delete it.
Applying DHCP Options at Group Level

At group level you can configure DHCP options that are propagated to the statics of the group.
For more details regarding DHCP options, refer to the chapter Configuring DHCP Options and/or
to the appendix DHCP Options.
To edit the DHCP options of a group
1. Go to the properties page of the group of your choice. For more details, refer to the procedure
To display a DHCP group properties page.
3. Modify the fields of your choice.
4. Click on OK to commit your changes. The report opens and closes. The modifications are
listed in the DHCP options panel.
Deleting a DHCP Group

At any point you can delete a DHCP group if you no longer use it or if its configuration no longer
suits your needs.
Keep in mind that you cannot delete a group if it contains statics. You must first remove the
statics from the group and then follow the procedure below.
To delete a DHCP group

2. On the right-end side of the menu, click on V4 to display the DHCPv4 groups or on V6 to
display the DHCPv6 groups.
3. Filter the list to display the group you want to delete.
4. Tick the group(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The selected group is no
longer listed.
365
Chapter 28. Managing Dynamic
Addressing
Managing DHCP Ranges
Ranges must be declared in SOLIDserver for dynamic addressing. A DHCP range is a contiguous
suite of valid IP addresses which are available for lease to client computers on a particular scope.
A range belongs to just one DHCP scope, and contains the leases of the dynamic addresses.
Several ranges can be defined in the same scope if they do not overlap each other.
Since version 6.0.0, EfficientIP DHCP servers manage the statics with IP address like leases.
Therefore the statics added also create a lease whenever the MAC address declared is active
on the network, these leases can belong to your ranges and are listed on the page All leases. If
you configured the IPAM and DNS replication, they also create DNS entries. For more details,
refer to the section Adding DHCPv4 Statics.
Browsing the Ranges

The DHCP ranges are the third level of a DHCP dynamic addressing organization. They belong
to a scope and contain the leases.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 28.1. The range in the DHCP hierarchy
Browsing the Ranges Database
To display the list of DHCP ranges
3. On the right-end side of the menu, click on V4 to display the DHCPv4 ranges or V6 to display
the DHCPv6 ranges.
4. You can display a specific range through its using the columns Range. Fill in the field and
click on SEARCH .
5. You can filter the list to display a specific range. Type in start or end address in the search
engine of the column Range and click on REFRESH to only display the range matching your
search.
To display the list of ranges of a DHCP scope
366
Managing Dynamic Addressing

3. On the right-end side of the menu, click on V4 to display the DHCPv4 scopes or V6 to display
the DHCPv6 scopes.
4. Click on the name of the scope of your choice to visualize the ranges it contains.
To display a DHCP range properties page
1. Go to the page All ranges.

the DHCPv6 ranges.
4. At the end of the line of the range of your choice, click on . The properties page opens.
Customizing the Display on the Page All Ranges
Understanding the DHCP Range Statuses
The column Status provides information regarding ranges you manage.
Table 28.1. DHCP range statuses

Status Description
OK The range is configured
Delayed create The creation or update is delayed due to a scheduled configuration of the server. The
creation is automatically done after maximum of 1 minute.
Adding a DHCP Range

The addition of a new range provides free addresses to DHCP clients. You can add an IPv4 or
an IPv6 range from the page All ranges, each range is defined by its first and last address.
Note that you can also import ranges, for more details refer to the section Importing Ranges.
Keep in mind that if you or your administrator configured IPAM to DHCP advances properties,
new ranges may be added for every pool created in the IPAM. For more details, refer to the
chapter in the section IPAM Advanced properties of the chapter Managing Advanced Properties.
Adding DHCP Ranges
You can add as many DHCP ranges as you need. Note that by default:
• The DHCP range addition wizard provides a page dedicated to configuring Access Control
Lists (ACL) for EfficientIP DHCP servers. Keep in mind that the order of the elements of the
367
range's ACL list is important as each restriction or permission is reviewed following the
order you set in the list.
• You cannot add a range containing more than 1 million addresses. To edit this limit, refer to
the procedure To edit the registry key that defines the ranges maximum size.
To add a DHCPv4 range
1. Go to the DHCP tab homepage.If the homepage is not displayed, click on . The homepage
opens.
2. Click on Ranges. The page All ranges opens, the button V4 is blue.
3. In the menu, select Add > DHCP Range. The wizard Add a DHCP range opens.
4. In the list DHCP Server, select a server.
5. Click on NEXT . The scope selection page opens.
6. In the list DHCP Scope, select a scope.
8. If you or your administrator created classes at the range level, in the list DHCP range class,
9. Configure the DHCP range parameters following the fields below:
Table 28.2. DHCPv4 range parameters

Field Description
Start address First address of the range.
End address Last address of the range. If you edit this address, the field Size is automatically
updated.
a
Size Number of addresses in the range. If you edit this field, the field End address is
automatically updated.
Properties.
a
Note that you cannot add a DHCP range containing more than a million IP addresses.
10. If you are adding a range on an EfficientIP DHCP server, click on NEXT . The ACLs configur-
ation page opens, depending on the classes configured by your administrator.
You can set the ACL configuration of your choice, using Specific and/or General ACLs.
a. In the field Specific ACL, configure ACLs using the table below.
368
Table 28.3. Specific ACL configuration fields

Field Description
Specific ACL Type in the first letters of the name of an existing ACL, the auto-completion
provides a list matching your search. Select the ACL of your choice.
Allow This box allows to grant (tick) or deny (do not tick) access to the selected ACL.
The permission you choose edits the content of the field ACL.
ACL This field displays the configuration for the specified ACL: deny members of
"<ACL>" or allow members of "<ACL>". Once the configuration suits your needs
click on . The configuration is moved to the list DHCP range ACL.
b. In the field General ACL, configure ACLs using the table below.
Table 28.4. General ACL configuration fields

Field Description
General ACL Select unknown clients, known clients, all clients or dynamic bootp clients.
Allow This box allows to grant (tick) or deny (do not tick) access to the selected ACL.
The permission you choose edits the content of the field ACL.
ACL This field displays the configuration for the specified ACL: deny "<ACL>" or allow
"<ACL>". Once the configuration suits your needs click on . The configuration
is moved to the list DHCP range ACL.
c. In the list DHCP range ACL, all the configured ACLs are listed. Set the ACL order ac-
cording to your needs: select an ACl and move it up or down the list using and .
To delete an ACL, select it and click on .
11. Click on OK to commit the creation. The report opens and closes. The ACLs are listed in the
ACL panel of the range properties page.
If you want to add ranges containing more than a million addresses, you must edit the dedicated
registry database key.
To edit the registry key that defines the ranges maximum size

opens.
3. In the search engine of the column Name, type in module.dhcp.range_max_size. Only this
key is listed.
opens.
5. In the field Value, type in the value of your choice. The default value is 1000000 IPv4 ad-
dresses. For performance purposes, we strongly advise against setting a value greater than
7000000.
369
Adding DHCPv6 Ranges
You can add as many DHCPv6 ranges as you need. Note that the ACL configuration in not
available on IPv6 ranges.
To add a DHCPv6 range
opens.
2. Click on Ranges (v6). The page All ranges opens, the button V6 is blue.
3. In the menu, select Add > DHCP range (v6). The wizard Add a DHCP range opens.
4. In the list DHCP Server, select a server.
6. In the list DHCP Scope, select a scope.
8. If you or your administrator created classes at the range level, in the list DHCP range class,
9. Configure the DHCPv6 range following the table below:
Table 28.5. DHCPv6 range parameters

Field Description
Start address Type in the range start address, it edits the content of the field Size. By default,
the field automatically displays the selected scope start address. This field is
required.
End address Type in the range end address, it edits the content of the field Size. By default,
the field automatically displays the selected scope end address. This field is re-
quired.
Size Type in the number of addresses you want in the range. The number you type
in modifies the range end address.
10. Click on OK to commit the creation. The report opens and closes. The range is listed.
Editing a DHCP Range

Once created, DHCPv4 ranges can be modified as far as their ACL and size are concerned.
Editing a Range Properties
You can edit a DHCPv4 range advanced properties and ACLs once created from its properties
page.
You cannot edit a DHCPv6 range.The properties page only display all the information available.
To edit a DHCPv4 range
1. Open the properties page of the range of your choice. For more details, refer to the procedure
To display a DHCP range properties page.
370
2. In the panel Main properties, click on EDIT . The wizard Edit a DHCP range opens.
3. You cannot edit the range Start address, End address and Size.

Field Description
ties.
1
5. Click on NEXT . The page ACL configuration opens .
6. Configure or edit ACL following the table below:
Table 28.7. ACL configuration options

Field Description
Specific ACL Type in the name of the ACL you want to grant or deny access at this level in
the DHCP. The auto-completion allows you to find them more easily.
General ACL You can create exceptions to apply to unknown clients, known clients, all clients
or dynamic bootp clients.
Allow Tick this box if you want to allow the parameters set up in the fields Specific ACL
and General ACL. If you do not tick it, what you specified in those fields is denied.
ACL This field displays each ACL section configuration. It is gray by default because
its content depends on what you configured above. Once your configuration is
visible and suits your needs, click on . The configuration is then listed the
DHCP range ACL list.
DHCP range ACL This list sums up all the ACLs configured through the wizard.
7. Click on OK to commit the edition. The report opens and closes. The modifications are visible
in the panels Advanced properties and/or ACL.
Resizing a Range
With DHCPv4, you can resize ranges. Basically, you can edit the range start and/or end address
so that it includes more or less addresses. This shift in addresses is only possible if the addresses
included or excluded are not already used or part of another range.
So if your range is 192.168.0.10-192.168.0.125 you can decide to resize to 192.168.0.100-

192.168.0.105 indicating a start address shift of "90" and an end address shift of "-20".
1
For more details regarding the ACLs, refer to the section Restricting Access.
371
To resize a DHCPv4 range
opens.
ranges.
5. Tick the range(s) you want to resize.
6. In the menu, select Edit > Resize DHCP ranges. The wizard Resize ranges opens.
7. In the field Start address shift, type in the positive or negative shift for the range start address
that suits your needs. If you type in 0 (zero), the address stays the same.
8. In the field End address shift, type in the positive or negative shift for the range end address
that suits your needs. If you type in 0 (zero), the address stays the same.
9. Click on OK to commit the new size. The report opens and closes. The new range(s) size is
visible.
Replicating Range Data in the IPAM

At range level, the option IPAM replication allows to replicate range data in IPAM pools. Before
replicating your DHCP data in the IPAM, keep in mind that:
• The range data is replicated in pools of the IPAM.

• If the range belongs to a scope for which the IPAM replication has been set, its data is rep-
licated as a pool that belongs to the same terminal network.
• If the range belongs to a scope for which no replication has been set, its data is replicated
as a pool in the first terminal network that can receive it.
• You can replicate the range data in the IPAM if:
• No pool exists yet: a read-only pool is created and named DHCP.
• An existing matching the range size already exists. If the pool was not in read-only it is
marked read-only, the pool is renamed DHCP.
• You cannot replicate a range data in the IPAM if an existing pool already manages some of
the IP addresses of the range you selected.
• The option IPAM replication is independent at range level, replicating scopes does not auto-
matically replicates to the ranges they contain. You must select ranges and execute the option
to update the IPAM pools with range data.
For more details regarding scope replication, refer to the section Defining a Specific IPAM
Space for a DHCPv4 Scope.
To replicate range data in the IPAM
372
3. In the upper right corner, click on V4 to display the DHCPv4 ranges or V6 to display the
DHCPv6 ranges.
4. Tick the range(s) of your choice.
6. Click on OK to commit the change. The report opens and closes.
The matching pool is visible on the IPAM page All pools.
Applying DHCP Options at Range Level

It is possible to implement DHCP options to ranges. Therefore, the options configured at this
level are propagated to the DHCP leases delivered by said range. EfficientIP provides the DHCP
option inheritance in the following order: server, scope, range. For more details regarding DHCP
options, refer to the chapter Configuring DHCP Options.
Keep in mind that:
• You can only edit DHCP options at range level on DHCPv4 servers.
• The DHCP options configuration at range level is not supported on Microsoft DHCP
servers.
To edit DHCP range options
1. Display the chosen range properties page. For more details, refer to the procedure To display
a DHCP range properties page.
2. In the panel DHCP Options, click on EDIT . The wizard Configure DHCP options opens.
3. In the drop-down list Options category, select a category if need be. The Most used options
are displayed by default.
4. Make your modifications.
5. Click on OK to commit the changes. The report opens and closes. Every item modified is
Deleting a DHCP Range

When a network is no longer used, or whenever you wish, you can delete an existing range. The
deletion procedure is identical for IPv4 and IPv6 ranges.
Before deleting an existing range, remember to create a new one using a different range of ad-
dresses.
To delete a DHCP range
opens.
the DHCPv6 ranges.
ranges.
373
5. Tick the range you want to delete.

7. Click on OK to commit the deletion. The report opens and closes. The range is no longer
listed.
Managing DHCP Leases

When it comes to dynamic addressing, the lease is the lowest level of the DHCP hierarchy. A
lease corresponds to one IP address, listed in the IPAM module. Just like its name indicates it,
a lease is limited in time. When a client requests an IP address to a DHCP server, the server
delivers an IP address that is part of the scope that listens to the network area where the client
asked for an address. Which is why it is important to properly set up the DHCP server. Once you
created at least one scope and one range in a DHCP server you are able to deliver leases.
Keep in mind that if time is not accurate on your SOLIDserver, you cannot retrieve any
leases. For more details, refer to the section Configuring the NTP Server.
With SOLIDserver in DHCPv4, the maximum lease time is 24 hours (86400 seconds). By default,
the lease time is of 12 hours (43200 seconds). You can obviously change these parameters
either one a particular lease individually or at the range, scope or server level. As for DHCPv6,
you can configure the leases only at the server or scope level.
Since version 6.0.0, EfficientIP DHCP servers manage the statics with IP address like leases.
Therefore in IPv4:
• On the DHCP page All leases, all the clients are listed whether they requested access to the
server on parts of the network - defined through your scopes and ranges - or whether they
were identified through their MAC address. For more details, refer to the section Adding DHCPv4
Statics.
• On the IPAM page All addresses, if the IP address leased is also managed in the IPAM, the
columns Type and Status of the IP address reflect its use in the DHCP. For more details, refer
to the section Understanding the IP Address Type and Status.
Note that once your leases have expired, are released or are deleted, they are no longer listed
on the page All leases: they are moved to the page Leases tracking. For more details, refer
to the section Tracking Leases.
Browsing the Leases

The leases are the last level of the DHCP dynamic addressing hierarchy.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 28.2. The lease in the DHCP hierarchy
374
Browsing the Leases Database
To display the list of DHCP leases
2. Click on Leases. The page All leases opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 leases or V6 to display
the DHCPv6 leases.
4. You can filter the list via their IP address, creation date or expiration date.
To display the list of leases of a DHCP range
the DHCPv6 ranges.
4. Click on the name of the range of your choice to display the leases it contains.
To display a DHCP lease properties page
1. Go to the page All leases.

2. On the right-end side of the menu, click on V4 to display the DHCPv4 leases or V6 to display
the DHCPv6 leases.
4. At the end of the line of the lease of your choice, click on . The properties page opens.
Customizing the Display on the Page All Leases
Note that the columns on this page allow to display all the current IPv4 or IPv6 lease information,
like their Status, IP address, MAC address, MAC vendor, Start and End time and date; or even
OS name, MAC type, Circuit ID, Client DUID, Remote ID, Multi-status, Vendor ID, etc. To display
the lease logs, refer to the section Tracking Leases.
Understanding the DHCP Lease Statuses
The column Status provides information regarding the leases you manage.
Table 28.8. DHCP lease statuses

Status Description
OK The lease is configured
Delayed create The creation or update is delayed due to a scheduled configuration of the server. The
creation is automatically done after maximum of 1 minute.
375
Status Description
Defining the Lease Duration

When a DHCP client requests an IPv4 or an IPv6 address, it may suggest a lease duration in
the DHCPDISCOVER message. If the client requests a particular lease duration, the server
makes sure the requested lease time is within a range specified by the min-lease-time and max-
lease-time parameters. If the requested lease time is not within the specified range, it is set to
the value of min-lease-time if it is too short or to the value of max-lease-time if it is too long. If
the client does not request a specific lease duration, the lease duration specified in the default-
lease-time is used, and the same limits are applied.
EfficientIP DHCP server allows administrators to specify a default lease duration, a minimum
lease duration, and a maximum lease duration as defined below:
• default-lease-time specifies the duration of the lease that the DHCP server assigns if the client
requesting the lease does not ask for a specific expiration time.
• minimum-lease-time duration is used to force the DHCP client to take a longer lease than
the lease duration that it requests.
• maximum lease-time duration is used to define the longest lease that the DHCP server can
allocate. If a DHCP client asks for a longer lease than the maximum lease duration, then the
server limits the lease to the maximum lease duration.
Note that the maximum lease times does not apply to dynamic BOOTP leases. These
leases are not specified by the client and can exceed the maximum lease time configured.
DHCP lease duration is a topic of discussion among network administrators. Some use a lease
time of 6 months, some use lease time of 5 minutes. The right lease duration depends on each
network's context. Default lease duration on EfficientIP DHCP server is 12 hours.You can change
this default according to your requirements and set leases time at different levels, based on dif-
ferent factors. You can set a default lease time at the server, scope, range, group, DHCP class,
or static level of the EfficientIP DHCP organization.
To configure lease duration in DHCPv4
1. Go to the DHCP listing page of your choice: you can set up the lease duration at server,
scope, range, group or static level. You can also configure a DHCP class to set the lease
duration.
3. At the end of the line of the object of your choice, click on . The properties page opens.
5. In the drop-down list Option category, make sure Most used options is selected.
6. In the field Default lease time, you can set a default lease time in seconds. The lease time
is respected unless the client specifies another one when requesting a lease.
7. In the field Max lease time, you can set the maximum lease time in seconds.
8. In the field Min lease time, you can set the minimum lease time in seconds.
9. Click on OK to commit your configuration.The report opens and closes.The edited information
is now listed in the panel.
376
With IPv6 addressing, the procedure is the same except that you can only set it up from the two
highest levels in DHCP that is to say the servers themselves or the scopes.
To configure lease duration in DHCPv6
1. Go to the list All servers or the list All scopes to set up the lease duration.
5. In the field Default lease time, you can set a default lease time in seconds. The lease time
is respected unless the client specifies another one when requesting a lease.
6. In the field Max lease time, you can set the maximum lease time in seconds.
7. In the field Min lease time, you can set the minimum lease time in seconds.
8. Click on OK to commit your configuration.The report opens and closes.The edited information
is now listed in the panel.
Releasing Leases
In case of ranges overloading, the lease release feature can be helpful in order to punctually free
a critical case. This operation asks the DHCP server to simulate a DHCP release.
Releasing leases should not be done on a daily basis to resolve a lack of free space in a
range, in this case it is best to extend the range capacity as soon as possible.
Besides, keep in mind that a lease deletion can create IP addresses overlapping. Before
proceeding with the lease deletion, make sure that the impacted DHCP client is not liable to
connect to the network where the addresses were deleted.
To delete a DHCP lease
the DHCPv6 ranges.
4. Filter the list to find the lease(s) you want to delete.
5. Tick the lease(s) to be deleted.
7. Click on OK to commit the deletion. The report opens and closes. The selected leases are
no longer listed.
Converting IPv4 Leases into Statics

SOLIDserver allows you to convert leases to static reservations in order to register a MAC address
in one or several DHCP servers. No matter how you distributed the leases among servers, the
moment you convert a lease into a static, all the servers on the failover are notified and can grant
the MAC address the DHCP options you configured.
It is not possible to convert an IPv6 lease into a static but you can create IPv6 statics.
377
When you convert a lease to static, a static reservation is created with the same name as the
lease. This reservation can have an IP address or not:
• Converting into a static without IP address: the MAC address of the lease now connects
to the first available IP address on the network - no matter the server, scope or range managing
it. The purpose of the conversion is to configure DHCP options for the static reservation that
applies to the MAC address whenever it connects to the network.
• Converting into a static with IP address: the MAC address of the lease always connects to
the same IP address. The purpose of this conversion is to configure the same specific DHCP
options for a specific MAC address, or client, whenever they connect to the part of the network
that manages their IP address.
To convert an IPv4 lease into a static
3. On the right-end side of the menu, click on V4 to display the DHCPv4 leases.
4. Filter the list to find the lease(s) you want to convert.
5. Tick the lease(s) to be converted.
6. To convert a lease into a static without IP address, in the menu select Edit > Convert to
static > Without IP address. The wizard Convert lease to static without IP address opens.
7. To convert a lease into a static with IP address, in the menu, select Edit > Convert to static
> With IP address. The wizard Convert DHCP lease to DHCP static opens.
8. Click on OK to commit the conversion. The report opens and closes. The converted IP ad-
dresses are not listed anymore, you can find them in the lists All statics (in the menu select
Display > All statics).
Blacklisting Leases
Once delivered, you can blacklist a lease at any time. This converts the lease into a static without
IP. From that point on, the client MAC address cannot access to the DHCP servers or the failover
channel and therefore can no longer be delivered a lease.
Once a lease is blacklisted, the corresponding static without IP is immediately created. The client
MAC address is saved in the DHCP server configuration as blacklist-<MAC_address> to ensure
that any lease request is denied. This static is automatically configured with a set of ACL restric-
tions that prevent the connection to the server and its failover. In the meantime, the lease remains
valid until it expires, the next client request for renewal is denied. Once the lease duration is up,
the client MAC address is disconnected and unable to connect again.
2
Since version 6.0.0, EfficientIP DHCP servers manage the statics with IP address like leases .
The static reservations create leases, identified via their MAC address, that you can also blacklist:
a static without IP address automatically replaces the static with IP address you blacklisted.
To blacklist a lease
2
For more details, refer to the section Adding DHCPv4 Statics.
378
3. Tick the lease(s) you want to blacklist.

4. In the menu, select Edit > Blacklist lease. The report opens and closes. The lease is still
visible on the page All leases and disappears once it has expired. On the page All statics,
every blacklisted MAC address as the following Name: blacklist.
Tracking Leases
SOLIDserver keeps track of the leases delivered by all the DHCP servers you manage. You can
purge the lease history via two rules that allow to remove expired leases from the database after
a certain number of days. For more details refer to the sections and .
The lease logs are available on the page Leases tracking.
To track leases
2. Click on Leases tracking to track IPv4 leases or Leases tracking (v6) to track IPv6 leases.
The page All leases opens and displays the corresponding leases logs.
The page provides information on each lease through the columns:
Table 28.9. The columns available on the pages Lease tracking and Lease tracking (v6)
Field Description
IP address The IP address allocated.
MAC address The MAC address of the client that used the lease.
Start The lease allocation start time and date.
End The lease expiration time and date.
Server The name of the server that delivered the lease.
a
Client identifier The value of the option client-identifier sent by the client that requested the DHCPv4 lease.
a
Remote ID The remote ID provided by the relay agent that received the DHCPv4 lease request and
sent it to the server.
a
Circuit ID The circuit ID provided by the relay agent that received the DHCPv4 lease request and
sent it to the server.
a
Period The total lifespan of the DHCPv4 lease.
Name The name of the lease.
a
OS name The DHCP client OS name and version of the client to which the DHCPv4 lease was alloc-
ated.
Status The status of the lease.
a
This column is not available for DHCPv6 leases.
Purging Expired DHCP Leases
The IPv4 lease logs are automatically erased 60 days after the leases have expired, as set in
rule 012. You can change this rule configuration following the procedure below.
To edit the rule 012 that controls the automatic purge of IPv4 lease logs
opens.
2. In the menu, select System > Expert > Rules. The page Rules opens.
379
3. In the column Rule # search field, type in 012. The rule Purge DHCP leases history is listed.
4. In the column Instance, click on auto_purge_histo_dhcplease. The rule properties page
opens.
5. In the panel Main properties, click on EDIT . The wizard Edit a rule opens.
6. Click on NEXT . The page Rule filters appears.
7. If you want to schedule the purge, configure the fields according to the table below:
Table 28.10. Rule filters parameters

Field Description
Day(s) of the week Select a day or a period of days. By default, Every day is selected.
Date of the month Select a date. By default, Every day is selected.
Month Select a month. By default, Every month is selected.
Hour Select a specific time or one of the available schedules. By default, 23 is selected.
Minute Select a period of time, minutes-wise. By default, 15 is selected.
8. Click on NEXT . The Rule parameters appears.

9. In the field Number of days, type in the number of days beyond which an expired lease
should be removed from the logs. By default, the value is 60.
10. Click on OK to commit your modifications. The report open and closes. The rule properties
page is visible again.
You can at any time disable this rule.
To disable the rule 012
opens.
3. In the column Rule # search field, type in 012.
4. Tick the rule 012 and, in the menu, select Edit > Disable. The menu Disable opens.
5. Click on OK to commit your choice. The wizard closes, the page refreshes. The rule is
Disabled.
Purging Expired DHCPv6 Leases
The IPv6 lease logs are automatically erased 60 days after the leases have expired, as set in
rule 384. You can change this rule configuration following the procedure below.
To edit the rule 384 that controls the automatic purge of IPv6 lease logs
opens.
3. In the column Rule # search field, type in 384. The rule Purge DHCPv6 leases history is listed.
4. In the column Instance, click on auto_purge_histo_dhcplease6. The rule properties page
opens.
380
6. Click on NEXT . The page Rule filters appears.

7. If you want to schedule the purge, configure the fields according to the table below:

Field Description
8. Click on NEXT . The page Rule parameters appears.

9. In the field Number of days, type in the number of days beyond which an expired lease
should be removed from the logs. By default, the value is 60 days.
10. Click on OK to commit your modifications. The report open and closes. The rule properties
You can at any time disable this rule.
To disable the rule 384
opens.
3. In the column Rule # search field, type in 384.
4. Tick the rule 384 and, in the menu, select Edit > Disable. The menu Disable opens.
5. Click on OK to commit your choice. The wizard closes, the page refreshes. The rule is
Disabled.
Displaying the Relay Agent Information (Option 82)

To put it simply, DHCPv4 Option 82 is the DHCP Relay Agent Information option. The DHCP
relay agent and Option 82 are defined in RFC 3046. Option 82 was designed to allow a DHCP
relay agent to insert circuit specific information into a request that is being forwarded to a DHCP
server. Specifically the option works by setting three sub-options: Circuit ID, Remote ID and GI-
ADDR.
• The Circuit ID field generally contains information describing the port location that the DHCP
request is coming in from. It may contain additional information that helps describe which IP
address should be assigned out, such as the VLAN ID, a wireless modem or an ATM virtual
circuit. This value must be unique for a particular switch or router that is providing the Relay
Agent function. The value must also stay the same if modules are installed or removed in the
Switch or Router that implements the Relay Agent. Therefore, having subfields representing
the Module, Slot and Port is highly recommended.
• The Remote ID field is intended to carry information describing the device at the remote end
of the link. However, in Ethernet systems, this is typically the MAC address of the Relay Agent.
This is not particularly useful since the MAC address would change if the Relay Agent was
ever replaced. Building a DHCP server database using the MAC address of the Relay Agent
would require that the table be rebuilt every time one of the Relay Agents was replaced. Some
381
vendors have modified this field to use the IP address of the Relay Agent or some other string
describing the Relay Agent. This field must be unique to the entire network.
• The GIADDR (or Gateway Address) field is part of the normal DHCP message. It contains the
IP address of the Relay Agent. Since IP addresses must be unique, this field is unique for the
entire network.
By combining the GiAddr and the Circuit ID, a network wide unique string can be created. This
string can be used for table lookup in the DHCP server. We called this string a pseudo MAC ad-
dress, since most DHCP servers do a MAC to IP mapping in their databases.
In its default configuration, the DHCP Relay Agent Information Option passes along port and
agent information to SOLIDserver DHCP server. It is useful in statistical analysis for instance, as
it indicates where an assigned IP address physically connects to the network. It may also be
used to make DHCP decisions based on where the request is coming from or even which user
is making the request. For more details regarding its implementation, refer to the chapter Config-
uring DHCP Options.
This information is only available on EfficientIP DHCP servers and is not available on the other
vendors' DHCP servers. For EfficientIP servers, you can display the Circuit ID (DHCP lease circuit
ID) and Remote ID (DHCP lease remote ID) columns on the page All leases. For more details,
refer to the section Customizing the List Layout.
The Relay Agent Information with DHCPv6
With DHCPv6, the client ID, circuit ID and remote ID are not supported. It is impossible therefore
to retrieve these pieces of information separately, much less display them in a listing template
on the leases page. This information might be delivered by the agent in DHCPv6 but the appliance
does not retrieve it at the server level.
The equivalent of the option 82 relay agent would be the DHCPv6 option 9 (relay message option)
and the option 47 (relay data option).
Restricting Access
When a DHCP client requests an IP address, SOLIDserver offers an address from a range asso-
ciated with the network segment for that client. In addition to identifying DHCP clients and alloc-
ating addresses to them, you might want to identify clients for other reasons.
For instance, you can control the access to leases or restrict IP address allocation to DHCP clients
the network administrators do not know. Some network areas might want to group clients in some
way or you might have to allocate dynamic IP addresses for known clients on a particular network
segment and for unknown clients on the same network segment but on a different IP network.
No matter the way you want to control access, you can use access control lists, or ACL.
382
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 28.3. The ACL in the DHCP hierarchy
This configuration is not available on Microsoft Windows servers. Access control is only
available on EfficientIP SOLIDserver appliances and on ISC DHCP delivered in EfficientIP's
packages for Linux, Solaris and FreeBSD.
Granting Access to Known Clients

If you want to set up a SOLIDserver that provides dynamic IP addresses only to known clients,
you first need to declare static reservations for these clients with a client identifier or a MAC ad-
dress, without specifying an IP address for them. Then, you must configure the DHCP server not
to provide IP addresses to unknown clients, in order to limit access to DHCP clients for which
static reservations exist. To apply this mechanism you have to setup the Allow Known Client ACL
on the DHCP ranges.
DHCPv6 does not support ACLs configuration, you can only use access control lists on DH-
CPv4 objects.
To grant DHCP access only to known clients
1. Go to the properties page of the range of your choice. For more details, refer to the procedure
To display a DHCP range properties page.
2. In the panel ACLs, click on EDIT . The wizard Edit a DHCP range opens.
3. Click on NEXT to skip the range main information. The next page of the wizard appears.
4. In the section Specific ACL, do not modify anything.
5. In the section General ACL, in the drop-down list select known clients.
6. In the section Allow, tick the box. The field ACL displays allow known clients.
7. Click on . allow known clients is now presetn in the list DHCP range ACL.
8. Click on OK to commit your changes. The report opens and closes. The modification is visible
in the panel ACL.
Restricting Access Using ACLs

SOLIDserver offers a construct called ACL that you can use to group DHCPv4 clients in a more
general manner than you can do with a static reservation. Like static reservations, ACLs can be
used as a client membership to control how addresses are allocated. DHCP clients become
members of ACLs either because they match an ACL matching rule or because they match an
entry of that ACL. ACLs can be applied to allow or deny the dynamic allocation from a range of
IP addresses. Once an ACL is defined it can be used several times to restrict the access to a
range.
The DHCP module provides two different lists regarding ACLs:
383
• The page All ACLs is accessible through the Display menu on the DHCP homepage and from
the pages All servers, scopes, ranges and leases.
• The page ACL Entries that is only accessible through the breadcrumb on the page All ACLs.
Adding, Editing and Copying ACLs
From the page All ACLs you can add ACLs that grant or deny access to the DHCPv4 servers of
your choice. The ACL is a succession of checks that ultimately make sure that all the parameters
you want or refuse from your DHCPv4 clients toward the DHCP server of your choice are respec-
ted. There are a number of predefined ACLs available upon creation if you want to apply specific
behaviors or simply reuse the syntax and configure a custom-made ACL. Among them, only the
MAC address checks a list of data rather than parameters.
To add an ACL
2. In the menu, select Display > All ACLs. The page All ACL opens.
3. In the menu, select Add > ACL. The wizard opens.
4. In the list DHCP server, select one of your DHCPv4 servers.
5. Click on NEXT . The page DHCP ACL parameters opens.
6. In field ACL name, type in the name of the ACL to be created.
7. In the drop-down list Predefined ACL, you can select one of the available ACLs. The ACL
syntax is displayed in the field ACL rule and can be edited. By default, None is selected and
nothing is displayed in the field ACL rule.
8. In the field ACL rule, type in or modify the syntax if need be.
9. Click on OK to commit your configuration. The report opens and closes. The ACL is listed.
Once added, the ACL can be configured to be even more efficient. For instance, if you used the
MAC address ACL or an ACL comparing a list of information, you can define an ACL Entry to
set up the corresponding parameters, and make sure, for example, that the access list is granted
or denied only to the MAC address of your choice.
To edit an ACL
4. At the end of the line of the ACL of your choice, click on . The properties page opens.
5. In the panel Main properties, click on EDIT . The wizard DHCP ACL parameters opens.
6. Edit the fields Predefined ACL and ACL rule according to your needs. Note that you cannot
rename an ACL.
visible again.
At any time, you can copy an ACL from one server to the other. This ACL duplication copies the
ACL entries as well. However, once copied, you still have to assign each new ACL in the target
server to use it.
384
Keep in mind that if your physical server is managed through a smart, only the ACL created on
the smart can be duplicated.
To copy an ACL
4. Tick the ACL(s) you want to copy.
5. In the menu, select Edit > Migrate. The wizard Copying ACLs opens.
7. Click on OK to commit your changes. The report opens and closes. On the unfiltered All
ACLs list, the duplicate ACLs are listed.
If you migrate an ACL to a smart architecture that manages physical servers, the ACL is copied
to the smart and then pushed to the physical server: it stays in Delayed create until it is successfully
pushed.
Adding ACL Entries
Once you added an ACL, you can add ACL entries to the ACL to define the rule that governs the
ACL you are adding. Note that you can only add or delete ACL Entries, you cannot edit them
even from their properties page.
To add an ACL Entry
3. In the breadcrumb, click on ACL Entries. The page ACL Entries opens.
4. In the menu, select Add > ACL Entry. The wizard Add an ACL data opens.
5. In the list DHCP server, select one of your DHCPv4 servers.
7. In the list DHCP ACL, select the ACL of your choice.
9. In the field ACL Entry, type in your condition following the a MAC format of two hexadecimal
characters separated by a semi-colon. If your ACL is a matching MAC address, type in the
matching MAC address.
10. Click on OK to commit your addition. The report opens and closes. The ACL Entry is listed,
it named after the server it belongs to and its value matches what you typed into the ACL
Entry field.
Configuring the PXE

The PXE (Preboot eXecution Environment) is used to boot hosts using a network interface inde-
pendently of available data storage devices or installed operating systems. The PXE protocol is
a combination of DHCPv4 and TFTP protocol. Note that there is no Preboot eXecutable Environ-
ment boot standard for IPv6 yet.
385
DHCP is used to locate the appropriate boot server or servers, with TFTP used to download the
initial bootstrap file. After it downloads the file, the host reboots and sends another IP address
request. When such a PXE client starts up, it first requests an IP address in order to download
the file it needs to boot.
The client, wishing to remotely boot an operating system image, broadcasts a DHCPDISCOVER
packet as per the DHCP protocol. This packet is transmitted to acquire an IP address. The client
also sends PXE protocol specific DHCP option 60 (Vendor Class Identifier) along with this
packet. The DHCP server responds to the above DHCPDISCOVER packet by sending a DH-
CPOFFER packet that contains the IP Address allocated to the client. In a PXE remote boot, the
DHCP server also sends:
• A special tag (option 60, with the value set to the string "PXEClient") to identify that it is capable
of configuring a PXE client.
• The next server to specify the server host address from which the initial boot file is to be
loaded.
• The filename to specify the name of the initial boot file to be loaded by a DHCP client.
The client downloads the executable file using either standard TFTP (port69) or MTFTP (port
assigned in Boot Server Ack packet). The file downloaded and the placement of the downloaded
code in memory is dependent on the client's CPU architecture. After it downloads the boot file,
the client reboots and sends a new DHCPDISCOVER.
You can set a different lease time for PXE boot requests to manage your dynamic ranges better.
The DHCP server can allocate an IP address with a shorter lease time to hosts that send PXE
boot requests in order to release IP addresses faster.
Necessary Parameters for PXE

Usually, to implement the PXE protocol, DHCP options and/or BOOTP parameters must be
configured:
• Next-server (BOOTP parameter) specifies the host address of the server from which the initial
boot file (specified in the filename statement) is to be loaded. The value of this option should
be a numeric IP address. If no next-server parameter applies to a given client, the DHCP
server IP address is used.
• TFTP-server-name (DHCP option #66) is used to identify a TFTP server when the Next-
server (BOOTP parameter) field in the DHCP header has been used for DHCP options.
• Filename (BOOTP parameter) specifies the name of the initial boot file to be loaded. The value
of this option should be the name of a file that is recognizable to whatever file transfer protocol
the client is expected to use to load the file. Some clients might prefer to receive this information
in the bootfile-name option.
• Bootfile (DHCP option #67) specifies the name of the boot file to be used when the file field
is used to carry options.
These options can be configured at multiple levels: server, scope, static reservation, DHCP group
or dynamic range.
The PXE parameters configuration only applies to DHCPv4. For now, it is impossible to set
them with IPv6 addressing.
386
To configure the next-server and the filename options in DHCPv4
1. Go to the properties page of the server, scope, range, group or static of your choice.
3. In the drop-down list Option category, select the BootP Compatible option. The two options:
next-server and filename are listed among the options.
4. In the field next-server, type in the IP address of the server from which the initial boot file
should be loaded.
5. In the field filename, type in the name of the initial boot file to be loaded.
6. Click on OK to commit your configuration. The report opens and closes. The modifications
are listed in the panel DHCP options.
Duplicated Lease with PXE

The PXE client uses two stages in its IP address request. The first is done by the hardware
firmware, and the second one by the operating system. On some configuration the hardware can
request IP address by using DHCP parameters that differ from the operating system, and then
have two different DHCP leases for the same device. For instance, the first DHCP lease is de-
livered by the PXE stage by using the MAC address as lease identifier, and the operating system
receives another DHCP lease based on a client identifier (sent by the client) instead of the MAC
address. In this case the DHCP server believes it negotiates IP addresses for two different clients,
one based on its MAC address and the other one on its client identifier.
To avoid this issue, SOLIDserver manages leases by setting a different lease time for PXE boot
request. SOLIDserver allows you to allocate an IP address with a shorter lease time to hosts that
send PXE boot requests, so IP addresses are not leased longer than necessary. By default the
lease duration for PXE client is set to 5 minutes (300 seconds). It can be changed by following
the next procedure.
To change the lease time for PXE client
3. In the search engine of the column Name, type in PXE. The PXE clients ACLs are listed.
6. In the drop-down list Option category, select Most used options.
7. In the fields Default lease time and Max lease time, type in the durations of your choice.
These values are in seconds, by default they are set to 300 seconds (5 minutes)
8. Click on OK to commit the configuration. The report opens and closes. The modifications
are listed in the panel DHCP options.
Preventing IP Address Duplication

The ping check feature tells the DHCP server whether to send a ping request to check an IP
address before offering it to a DHCP client using either IPv4 or IPv6. The ping check feature can
protect the DHCP against address overlapping.
387
When the DHCP server is considering dynamically allocating an IP address to a client, it first
sends an ICMP echo request (a ping) to the address being assigned. It waits for a second, and
if no ICMP echo response has been heard, it assigns the address. If a response is heard, the
lease is abandoned, and the server selects another free IP address and sends it a ping. The
DHCP server continues this process until it finds an IP address that does not respond to the ping.
The DHCP server then sends a DHCPOFFER message with the unused IP address to the DHCP
client.
To enable the ping check with DHCPv4
1. Go to the properties page of the DHCPv4 server of your choice.

3. In the drop-down list Option category, select Server parameters.
4. In the drop-down list Ping check, select Yes.
5. In the field Ping timeout, you can set up a timeout if necessary.
If the DHCP server determines that it should send an ICMP echo request (a ping) because
the ping-check statement is true, ping-timeout allows you to configure how many seconds
the DHCP server should wait for an ICMP Echo response to be heard, if no ICMP Echo re-
sponse has been received before the timeout expires, it assigns the address. If a response
is heard, the lease is abandoned, and the server does not respond to the client. If no value
is set, the ping-timeout is of 1 second by default.
6. Click on OK to commit the update. The report opens and closes. The modifications are listed
in the panel DHCP options.
With DHCPv6, the procedure is similar. Only a few wizard-related steps change.
To enable the ping check with DHCPv6
1. Go to the properties page of the DHCPv6 server of your choice.

3. In the drop-down list Ping check, select Yes.
4. In the field Ping timeout, you can set up a timeout if necessary.
If the DHCP server determines that it should send an ICMP echo request (a ping) because
the ping-check statement is true, ping-timeout allows you to configure how many seconds
the DHCP server should wait for an ICMP Echo response to be heard, if no ICMP Echo re-
sponse has been received before the timeout expires, it assigns the address. If a response
is heard, the lease is abandoned, and the server does not respond to the client. If no value
is set, the ping-timeout is of 1 second by default.
5. Click on OK to commit the update. The report opens and closes. The modifications are listed
in the panel DHCP options.
388
Chapter 29. Managing Failover Channels
SOLIDserver allows you to display all the failover channels for the DHCP smart architectures it
manages. The page All failover channels provides you with detailed information on all the failover
channels of the smart architectures you manage.
DHCP Failover Principles and Operational States

The DHCPv4 synchronization mechanism is called failover because it was initially intended to
provide a way for one DHCP server to act as a primary server and for a second DHCP server to
act as a backup. In most of the basic failover configurations, the secondary server does not reply
to the DHCP client requests when it is in contact with the primary, it simply synchronizes updates
from the primary. In an EfficientIP DHCP configuration, both the primary and secondary servers
provide simultaneously the DHCP service by default. You can change this configuration and
make sure that only the primary or the secondary server responds. For more details regarding
the Master/backup and Load-balancing configurations of the failover, refer to the section Operating
in Normal State.
Keep in mind that the failover mechanism is not available when it comes to IPv6 addressing.
DHCP Safe Failover Principles

The failover based on load balancing involves three principles:
1. The primary and the secondary failover servers divide the dynamic ranges of free addresses
that they have to serve into free and backup addresses. Free addresses are available for the
primary server to allocate to its clients and backup addresses are available for the secondary
server to allocate to its clients.
2. Until the servers have not exchanged leases allocation details, they can still allocate or renew
leases within the range of addresses they manage but the lease time always corresponds to
the Maximum Client Lead Time (MCLT). By default, it is set to 1 hour. Therefore, as long as
the servers do not communicate or have not exchanged information - during the first allocation,
in communications-interrupted... - all leases are set to 1 hour.
3. In normal operation, an address that has been assigned to one client cannot be assigned to
another client unless both DHCP servers agree that the first client is no longer using it.
By default, the failover is based on load-balancing, it is Balanced, on One-to-One and One-to-

Many smart architectures.
DHCP Failover Operational States

There are several DHCP operational states in the failover protocol: Operating in Normal State ,
Operating in Communications-interrupted State and Operating in Partner-down State .
In the GUI, the page All failover channels provides the column State that includes detailed inform-
ation regarding each state. For more details regarding this column, refer to the table The different
failover states
Operating in Normal State
In Normal state, only one server responses to the messages sent by DHCP clients. The failover
configuration you chose when setting up the failover defines which server responses to clients.
389
Managing Failover Channels
Failover Channel
DHCP 1 DHCP 2
local range local range
1 allocates new 14 15 responds to 28 1 responds to 14

15 allocates new 28
address existing addresses existing addresses address
16
19
2
1
Figure 29.1. DHCP failover operating in normal state
When configuring a One-to-One or One-to-Many smart architecture, the drop-down list Split
leases allows to choose if the primary server or the secondary server should respond to the
DHCP clients requests or choose to balance the responses between the servers. In other words,
when configuring your smart architecture, you can set the failover to respect a master/backup
configuration or a load balancing configuration.
Which is why in Normal state, a server might seem to ignore a client request.
• Master/Backup Configuration
If you choose this configuration, you can decide which server of the failover answers to all the
requests: either the primary (Prefer master) or the secondary (Prefer backup). For more details,
refer to the sections DHCPv4 One-to-Many Smart Architecture and DHCPv4 One-to-One Smart
Architecture.
• Load Balancing Configuration
If you choose this configuration, you can balance the responses equally and make both servers
respond to the DHCP clients' requests. The standard load-balancing algorithm specifies which
server answers DHCP requests: this deterministic hash algorithm operates on the clients' in-
formation, their MAC address, to equally assign a set of clients to one server and the rest to
the other server. The hash is performed on every broadcast message sent out by DHCP clients,
it produces a number between 0 and 255 that the servers are able to interpret and divide
equally. In addition, when configured in load balancing, EfficientIP DHCP servers are able to
detect if a client has not received a response yet from its failover peer. Thanks to the field secs
of the DHCP client message, the server identifies which clients are making a request for the
first time (the field value is zero) or if it is a retry (the field value is nonzero). In the case of a
retry, the first available server responds no matter the DHCP client hash number.
Operating in Communications-interrupted State
When operating in Communications-interrupted state, each server is operating independently

but assumes that its partner is still operating.
The secondary server might be operating and simply unable to communicate with the other
server or might not be operating. Each server responds to the full range of DHCP client messages
that it receives, but in such a way that graceful reintegration is always possible when its partner
comes back and contacts it again.
390
Communications-Interrupted
DHCP 1 DHCP 2
local range
local range
1 allocate new 14 15 no response to 28 1 no response to 14 15 allocate new 28

address existing addresses existing addresses address
2020 23
16 19
16
55 3
1 2
1
Site A Site B
Figure 29.2. DHCP failover operating in communications-interrupted state
Operating in Partner-down State
For a variety of reasons, is it possible that one member of a DHCP failover pair might stop oper-
ating. This could be the result of a planned or unplanned outage. In order to provide the best
possible service when one member of a failover pair is down, the other can be placed in the
Partner-down state.
When operating in Partner-down state, a server assumes that its partner is not currently operating
but does make allowances for the other server's set of DHCP clients as long as the MCLT has
not passed. That way, any lease that was allocated by the other server while they were in com-
munication-interrupted state has expired and the remaining server can safely allocate leases to
all the DHCP clients of the failover. Once the MCLT> expires, the server responds to all DHCP
client requests, it can reclaim any available IP address that belongs to its peer.
Partner-Down
DHCP 1 DHCP 2
local range local range
1 allocates new address and 28 1 28

responses to exsting addresses
16
19
2
1
Figure 29.3. DHCP failover operating in partner-down state
Once the peer server comes back up, it automatically connects to its failover channel to change
back to the Normal operational state. Once again, it has to wait until the MCLT passes to reclaim
its DHCP clients.
391
SOLIDserver allows to manually switch a server to Partner-down. It allows to better control the
DHCP service, for instance before moving a server: the administrator can manually switch the
secondary server of a failover channel to Partner-down. For more details regarding this option,
refer to the section Switching a DHCP server to Partner-down.
In a One-to-One DHCP smart architecture, the administrator can also set an Automatic switch
to partner-down delay (in hours) after which a server in Communications-interrupted state should
automatically switch to Partner-down. For more details, refer to the section DHCPv4 One-to-One
Smart Architecture of the chapter Managing DHCP Smart Architectures.
Browsing the DHCP Failover Channels Database

To display the list of DHCPv4 failover channels
2. In the menu, select Display > All failover channels. The page All failover channels opens.
To display the list of DHCPv6 failover channels
2. In the menu, select Display > All failover channels (v6). The page All failover channels
opens.
To display a failover channel properties page
2. Click on Failover channels or Failover channels (v6). The corresponding page opens.
4. At the end of the line of the failover channel of your choice, click on . The properties page
opens.
Getting Familiar with the Failover Channels' Columns

The DHCP module provides a failover channels page both in IPv4 and IPv6.
In contrast with One-to-One and One-to-Many smart architectures that include as many failover
channels as physical secondary servers, the failover channel of a Single-Server or a Split-Scope
architecture is virtual. It links the managed server(s) to the smart architecture that act as a con-
figuration backup for the dhcpd.conf file. For more details, refer to the section DHCP Failover
Principles and Operational States.
The concept of failover channels is not very widespread in IPv6. Still, awaiting for its implement-
ation, SOLIDserver already offers a listing page for the virtual failover channels that provides a
backup of the smart architectures configuration. For more details, refer to the DHCPv6 architec-
tures of the section Implementing DHCP Smart Architectures.
The DHCPv4 Failover Channels Columns

The DHCPv4 page All failover channels displays 10 columns described in the table below.
392
The Split-Scope and Single-Server smart architecture provide few information on this page
as their failover is virtual and therefore cannot be edited. For both architectures, None is displayed
in every column except Name, Smart DHCP and Status.
Table 29.1. The columns on the page All failover channels in IPv4
Column Description
Name The name of each failover channel that you set when creating the smart architecture.
Server The name of the server or smart architecture.
Type The failover channel type: either Primary or Secondary.
Local address The IP address of the primary server, or Master, in the smart architecture.
Local port The port number dedicated to the failover on the smart architecture primary server.
Remote address The IP address of the secondary server of the smart architecture.
Remote port The port number dedicated to the failover on the smart architecture secondary server.
Split The leases' split configuration between the servers: Balanced, Prefer backup or Prefer
master.
State The failover operational state, either Normal, Startup, Recovering, Partner-Down, Commu-
nications-interrupted, Down, Unknown state or N/A. For more details, refer to the table
The different failover states below.
Multi-status Messages regarding the failover channel: emergency, warning, critical, error or informa-
tional, if relevant. For more details, refer to the section Understanding the Column Multi-
Status.
Status The failover channel status: either OK, Delayed create or Delayed delete.
The column State indicates the failover operational state:
Table 29.2. The different failover states

Failover state Description
Normal The server is configured and functions correctly. The failover
channel is operational.
Startup The failover channel is synchronizing. The failover channel is oper-
ational.
Recovering The server is recovering from a partner-down state. The failover
channel is operational.
! Partner-down The other server of the failover is Down. The failover channel is
operational.
Communications-interrupted The server is in communications-interrupted. The failover channel
is (not?) operational.
Down The server is down. The failover channel is not operational.
Unknown state The failover configuration for the smart architecture is incorrect. The
failover channel is not operational.
N/A The failover channel is virtual, therefore returning a state is not ap-
plicable, as is the case of Split-Scope and Single-Server smart ar-
chitectures.
The DHCPv6 Failover Channels Columns

The DHCPv6 page All failover channels displays 9 columns. Considering that the failover channel
in IPv6 is basically virtual as it is, the State column remains empty.
The Split-Scope and Single-Server smart architecture provide few information on this
page. For both architectures, you can find N/A displayed in the port related columns.
393
Table 29.3. The columns on the page All failover channels in IPv6
Column Description
Name The name of each failover channel that you set when creating the smart architecture.
Type The failover channel type: either Primary or Secondary.
Local address The IP address of the primary server, or Master, in the smart architecture.
Local port The port number on the smart architecture primary server dedicated to the failover.
Remote address The IP address of the secondary server in the smart architecture.
Remote port The port number of the smart architecture secondary server dedicated to the failover.
State The connection state between the two servers. As nowadays there is no failover per se
in IPv6, this column is empty.
DHCP name The smart architecture name.
Status The failover channel status: either OK, Delayed create or Delayed delete.
Multi-status Messages regarding the failover channel: emergency, warning, critical, error or informa-
tional, if relevant. For more details, refer to the section Understanding the Column Multi-
Status.
Switching a DHCP server to Partner-down

There are several DHCPv4 operational states in the failover protocol: Normal, Communications-
interrupted and Partner-down. When one of the managed servers is unable to communicate with
the other, or is down, the failover channel switches to the Communications-interrupted state. At
that point, you can choose to place the other server in the Partner-down state and keep making
allowances. There are two ways of switching a server in partner-down: either you automate the
switch or you switch the running server manually.
You can automate the switch for servers managed via One-to-One smart architectures, the ad-
ministrator can also set an Automatic switch to partner-down delay (in hours) after which a
server in Communications-interrupted state should automatically switch to Partner-down. For
more details, refer to the section DHCPv4 One-to-One Smart Architecture of the chapter Managing
DHCP Smart Architectures.
To manually switch a server to partner-down, you can simply break the failover channel following
the procedure below, SOLIDserver automatically switches the right server to Partner-down. For
more details, refer to the section DHCP Failover Operational States.
To manually switch a server to partner-down
2. Click on Failover channels. The page All failover channels opens.
3. Tick the failover channel(s) you want to break.
4. In the menu, select Edit > Switch to partner-down. The Switch to partner-down wizard
opens.
5. Click on
OK to commit your modifications. The report opens and closes. The page All failover
channels is visible again. In the column State, the failover channel has switched to Partner-
down.
394
Chapter 30. Configuring DHCP Options
The DHCP dynamically distributes addresses, but also offers the possibility of providing config-
uration information and other specific controls to the servers clients. These pieces of information
are called DHCP options.
Most standard DHCP options are currently detailed in the RFC 2132 recommendation, "DHCP
Options and BOOTP Vendor Extensions". Even if most DHCP servers offer several options, the
vast majority of DHCP clients are generally conceived to request and take charge of just a sub-
part of the ensemble of standard RFC options.
SOLIDserver offers to manage 4 types of DHCP option:
• Internal options of the DHCP server: these options allow to configure the global behavior of
the DHCP server when it processes DHCP requests. These options do not have DHCP option
code number and they are only available on the EfficientIP's DHCP engine provided with
SOLIDserver appliances or ISC DHCP software. These options are not sent to the DHCP client.
For more details regarding internal server options, refer to the section Server Parameters in
the appendix MAC Address Types References.
• Client side options: these options are sent from the DHCP client to the DHCP server to
achieve predefined series of actions, for instance vendor-class or hostname options. If these
options can be processed by the server, their content cannot be configured from the server
side.
• Predefined server side options: these options are predefined and they cannot be modified.
Most of these options are common and include options like: routers, domain-name, name-
server. These options sent from the server to the client describe network configuration settings
and various services available on the network.
• Custom server side options: these options can be added and/or modified according to the
DHCP clients requirements. These options sent from the server to the client describe network
configuration settings and various services available on the network.
SOLIDserver allows you to apply, edit or delete DHCP options.
EfficientIP's DHCP organization allows you to apply DHCP options on three hierarchical levels:
the server, the scope and the range. Microsoft DHCP servers do not allow options configur-
ation on DHCP ranges.
ACL
SCOPE RANGE LEASE
GROUP
STATIC OPTION
Figure 30.1. The DHCP option in the DHCP hierarchy
In the above configuration plan, the DHCP server options and maximum lease time have been
defined to the DHCP server globally; these two options are propagated to the scope and the
range.
395
Configuring DHCP Options
You might also observe that the default router has been configured both in the DHCP scope and
range. Only, in this case, the default router defined by the range is taken into account.
When it comes to DHCPv6, the options configuration of EfficientIP DHCP servers is roughly the
same, you can configure options at server and scope level that should propagate to the lower
levels.You can also set options at group level or directly on a specific static reservation. However,
it is not possible to set DHCP options to a range or a lease.
Setting DHCP Options

DHCP options can be configured from the properties pages of different DHCPv4 objects such
as: server, scope, range, static, group, and ACL. In IPv6, the DHCP options can be set at server,
scope, static and group level: there are no ACLs and the range DHCP options are not editable.
The options setting apply to a DHCP client according to a defined precedence. Options are
arranged into a hierarchy in order to respect the following ranking:
• An option set at ACL level overrides all other options.

• An option set at static level overrides options at the following levels: group, range, scope and
server.
• An option set at group level overrides options at scope and server level.
• An option set at range level overrides options at scope and server level.
• An option set at scope level overrides options at server level.
• An option set at server level is overridden by all other options.
Options can be indifferently applied to the DHCP objects. However the application of options on
this hierarchy depends on the technical constraints of the devices of your network: the
devices/clients connected to the network can have an impact on the configuration efficiency.
Basically, the options should be configured by starting from the top of the DHCP tree hierarchy
(server) in order not to configure the same options over and over again on each object. Usually
options specified at server level are global or applied for a default setup. Everything that was set
at server level propagates onto the lower objects, therefore you can configure a common set of
options and then add other options to the other objects to match clients needs. If you do not
configure the same options repeatedly to several objects, your DHCP configuration is simpler to
manage.
The vendors' DHCP servers that SOLIDserver can manage do not share the same internal archi-
tecture and cannot be managed in the same way. For instance, contrary to EfficientIP DHCP
server, Microsoft DHCP server does not support the configuration of options at range level. Be-
sides, only the options identified by a number are supported by the Microsoft DHCP service.
To configure DHCP options in DHCPv4 or DHCPv6
2. Click on DHCP servers, Scopes, Ranges or Statics. The corresponding list opens.
3. On the right-end side of the menu, click on V4 to display the DHCPv4 objects or V6 to display
the DHCPv6 objects.
Keep in mind that DHCP options are not available on DHCPv6 ranges.
396
6. Edit the fields of your choice. For more details regarding options parameters, refer to the
part Customizing DHCP Options below.
7. Click on OK to commit the changes. The report opens and closes. The modifications are
visible in the panel.
Customizing DHCP Options

SOLIDserver allows to define DHCP custom options for specific DHCP clients like special terminal
devices or IP phones. Each value of DHCP option is built by the DHCP server according to a
predefined data type, structure of data types or array of types. The graphical user interface allows
the administrator of a DHCP server to define the custom data type according to the requirements
of the DHCP clients.
To add a custom DHCP option in DHCPv4
3. In the menu, select Display > All option definitions. The page All option definitions opens,
i.e. the list of all the DHCPv4 options defined at server level.
4. In the menu, select Add > Option definition. The wizard opens.
5. In the list DHCP server, select the server on which you want to specify the custom option.
7. In the field Option name, name the custom option. The option is named option <your-option-
name> in the column Name.
8. In the field Option space, you can fill in the option space parameter that is used to build en-
capsulated options.
If the space name you chose does not exist, it is created. If you do not you specify anything,
the default space dhcp is used.
9. In the field Option code, enter an option code. This code is a number between 1 and 255.
Keep in mind that if you are creating a code within the dhcp space, you must define a code
greater than 128. The option codes included between 1 and 128 are usually reserved: using
a code included in that range of numbers would overwrite existing options.
10. In the drop-down list Parameter counter, select the number of parameters you want to set
for that option. You can select up to 6 parameters with the corresponding number of fields
appearing.
11. In the drop-down list Parameter <number>, you have to choose one of the parameters below:
Table 30.1. DHCP options parameter types

Parameter type Description
IP address An IPv4 address.
Boolean A flag accepting a value of either true or false (or yes or no).
Text An ASCII text string (the same as the text data type) or a list of hexadecimal characters
separated by colons Formatting to distinguish an ASCII text string from a hexadecimal
string is important.
397

8 bits value A numeric range of the following possible values 8-bit unsigned integer: from 0 to 255
or signed: from -128 to 127.
16 bits value A numeric range of the following possible values 16-bit signed integer: from -32,768
to 32,767
32 bits value An ASCII text string (the same as the text data type) or a list of hexadecimal characters
string is important. For more details, refer to the section below.
Encapsulate ... The option parameter Encapsulate <option space> is only available for smart architec-
tures managing DHCPv4 servers. It allows to encapsulate options and information,
for instance Encapsulate MSFT, Encapsulate MSUCClient, etc. The <option space>
available in the list may vary.
Keep in mind that the encapsulated options' type is binary but equivalent to the text format.
Its value is set in hexadecimal and looks as follows: \x01\xA2\x45\x12.
If you selected more than one Parameter counter, you need to repeat this step for each one
them.
12. In the section Type is array, tick the box if you want to specify an array of the parameters
you configured.
13. The field Type sums up the selected parameters. Each letter that appears in this field corres-
ponds to a parameter. For instance, if you specify an array of IP addresses the type should
be IA, if you specify an array of repeated addresses plus a boolean the type should be IfA.
14. Click on OK to commit your changes. The report opens and closes. The option is listed.
With DHCPv6, you also have the possibility to add custom options. However, there are fewer
parameters available.
To add a custom DHCP option in DHCPv6
3. In the menu, select Display > All Option Definitions (v6). The page All option definitions
opens, i.e. the list of all the DHCPv6 options defined at server level.
5. In the list DHCP server, select the server on which you want to specify the custom option.
7. In the field Option name, name the custom option. The option is named "option youroption-
name" in the Name column.
8. In the field Option space, you can fill in the option space parameter that is used to build en-
capsulated options.
If the space name you chose does not exist, it is created. If you do not you specify anything,
the default space dhcp6 is used.
9. In the field Option code, enter an option code. This is a number from 1 to 255.
If you are creating a code within the dhcp space, you must define a code greater than 128.
The option codes included between 1 and 128 are usually reserved: using a code included
in that range of numbers would overwrite existing options.
398
10. In the drop-down list Parameter counter, select the number of parameters you want to set
for that option. You can select up to 6 parameters with the corresponding number of fields
appearing. In each drop-down list, you have to choose one of the parameters below:
Table 30.2. DHCPv6 options parameter types

IP address An IPv4 address.
Boolean A flag accepting a value of either true or false (or yes or no).
Text An ASCII text string (the same as the text data type) or a list of hexadecimal characters
string is important.
8 bits value A numeric range of the following possible values 8-bit unsigned integer: from 0 to 255
or signed: from -128 to 127.
16 bits value A numeric range of the following possible values 16-bit signed integer: from -32,768
to 32,767
32 bits value An ASCII text string (the same as the text data type) or a list of hexadecimal characters
string is important. For more details, refer to the section below.
Encapsulate server With DHCPv6, only the Encapsulate server option is available to the servers managed
through a smart architecture.
11. In the section Type is array, tick the box if you want to specify an array of the parameters
you configured.
12. The Type fields, sums up the selected parameters. Each letter that appears in this field
corresponds to a parameter. For instance, if you specify an array of IP addresses the type
should be IA, if you specify an array of repeated addresses plus a boolean the type should
be IfA.
13. Click on OK to commit your changes. The report opens and closes. The option is listed.
DHCP Vendor Class Identifier

The vendor class identifier option is used by DHCP clients to specify their vendor type and con-
figuration if need be. The information is a string of n octets, interpreted by servers. Vendors may
choose to define specific vendor class identifiers to convey particular configuration or other
identification information about a client. For example, the identifier may encode the client's
hardware configuration. Servers not equipped to interpret the class-specific information sent by
a client must ignore it (although it may be reported). On the contrary, the servers that respond
should only use option 43 to return the vendor-specific information to the client.
With DHCPv6, the RFC 3315 defines the Vendor-specific Information Option. SOLIDserver
provides it through the option dhcp6.vendor-opts (option 17) in the list All option definitions.
Option 82: Relay Agent Information

To put it simply, DHCPv4 Option 82 is the DHCP Relay Agent Information option. The DHCP
relay agent and Option 82 are defined in RFC 3046. Option 82 was designed to allow a DHCP
relay agent to insert circuit specific information into a request that is being forwarded to a DHCP
server. Specifically the option works by setting three sub-options: circuit ID, remote ID and GIAD-
DR.
399
• The field circuit ID generally contains information describing the port location that the DHCP
request is coming in from. It may contain additional information that helps describe which IP
address should be assigned out, such as the VLAN ID, a wireless modem or an ATM virtual
circuit. This value must be unique for a particular switch or router that is providing the Relay
Agent function. The value must also stay the same if modules are installed or removed in the
Switch or Router that implements the Relay Agent. Therefore, having subfields representing
the Module, Slot and Port is highly recommended.
• The field remote ID is intended to carry information describing the device at the remote end of
the link. However, in Ethernet systems, this is typically the MAC address of the Relay Agent.
This is not particularly useful since the MAC address would change if the Relay Agent was
ever replaced. Building a DHCP server database using the MAC address of the Relay Agent
would require that the table be rebuilt every time one of the relay agents was replaced. Some
vendors have modified this field to use the IP address of the Relay Agent or some other string
describing the relay agent. This field must be unique to the entire network.
• The GIADDR (or Gateway Address) field is part of the normal DHCP message. It contains the
IP address of the Relay Agent. Since IP addresses must be unique, this field is unique for the
entire network.
By combining the GIADDR and the circuit ID, a network wide unique string can be created. This
string can be used for table lookup in the DHCP server. We called this string a pseudo MAC ad-
dress, since most DHCP servers do a MAC to IP mapping in their databases.
In its default configuration, the DHCP Relay Agent Information option passes along port and
agent information to SOLIDserver DHCP server. It is useful in statistical analysis, as well as, in-
dicating where an assigned IP address physically connects to the network. It may also be used
to make DHCP decisions based on where the request is coming from or even which user is
making the request.
The following actions should be performed by the SOLIDserver DHCP when receiving a DHCP-
DISCOVER or DHCPREQUEST message with Option 82 set:
1. Relay Agent Information option is inserted by the DHCP relay agent when forwarding client-
originated DHCP packets to a DHCP server.
2. Relay Agent Information option is inserted by the DHCP relay agent when forwarding client-
originated DHCP packets to a DHCP server.
3. Servers recognizing the Relay Agent Information option may use the information to select the
IP address or other parameter assignment policies through the SOLIDserver ACL.
4. Switch or Router (as the DHCP relay agent) intercepting the DHCP requests, appends the
circuit ID with remote ID into the option 82 fields and forwards the request message to
SOLIDserver DHCP server.
The following procedure explains how to create an ACL rule allowing to restrict the IPv4 address
range to select or to send specific DHCP options according to the option 82 sent to the SOLID-
server DHCP server.
To create an ACL based on the option 82: Circuit ID within the leases user interface
3. Click on the name of the DHCPv4 server of your choice. The page All scopes of that server
opens.
400
4. In the menu, select Display > All ACLs. The page All ACLs of that server opens.
5. In the menu, select Add > ACL. The wizard DHCP ACL parameters opens.
6. In the field ACL name, name your ACL.
7. In the drop-down list Predefined ACL, select None.
8. In the field ACL rule, type in the command below.
match if (substring(option agent.remote-id,0,6) = "dslam1");
It sets up an ACL that filters the DHCP option 82 as long as the first letters of the client's
remote-id match dslam1. You can set the keyword of your choice instead.
9. Click on OK to commit the ACL addition. The report opens and closes. The ACL is listed.
Once the ACL is created, you can apply it to a DHCPv4 range to allow or restrict the access to
all clients that match this ACL rule. ACL can also be used to send specific DHCP options to the
clients that match this ACL rule. Edit the properties of the ACL to setup its DHCP option policies.
The Relay Agent Information with DHCPv6

With DHCPv6, the client ID, circuit ID and remote ID are not supported. It is impossible therefore
to retrieve these pieces of information separately, much less displaying them in a listing template
on the leases page. This information might be delivered by the agent in DHCPv6 but the appliance
does not retrieve it at server level.
The equivalent of the option 82 relay agent would be the DHCPv6 option 9 (relay message option)
and the option 47 (relay data option).
Option 43: Vendor Specific Information

Option 43 was designed to exchange vendor-specific information between DHCPv4 servers and
clients. It was defined in the RFC 2132 as part of the DHCP Options and BOOTP Vendor Exten-
sions.
Within SOLIDserver, the vendor-specific information is stored in an ACL. Any client matching the
vendor information is attributed a set of options that you can configure through option definitions.
To properly setup option 43 on a DHCPv4 server in the GUI you need to:
1. Retrieve the vendor-class identifier from the DHCP handshake.

2. Create a new ACL that contains the vendor-class identifier.
3. Create as many DHCP option definitions as needed using the ACL as option space.
4. Configure the server ACL DHCP options to:
a. Set the Vendor option space that triggers the option 43 behavior on all the clients matching
the vendor-class identifier.
b. Set the value of your choice on all the option definitions you created.
Once the configuration is complete, the clients matching the vendor-class identifier are automat-
ically attributed the option definitions specified.
To retrieve the vendor-class identifier
1. With a packet analyzer, perform a network capture of the DHCP handshake.
401
2. Open the network capture.

3. In the Bootstrap Protocol section, look for the Vendor class identifier. It is listed between
double quotes among the options, as illustrated below.
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 1
Transaction ID: 0x12adb727
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server To address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 172.16.206.2 (172.16.206.2)
Client MAC address: Polycom_e5:fa:69 (00:04:f2:e5:fa:69)
Client hardware address padding: 00000000000000000000
Server host name not given
Boot file name not given
Magic cookie: DHCP
Option: (t=53,l=1) DHCP Message Type = DHCP Discover
Option: (t=57,l=2) Maximum DHCP Message Size = 1456
Option: (t=55,l=20) Parameter Request List
Option: (t=12,l=16) Host Name - "SEP0004f2e5fa69"Option: (t=60,l=14) Vendor class identifier
= "Nortel-223x-A"
Option: (t=61,l=7) Client identifier
End Option
To create a new ACL that includes the vendor-class identifier
2. In the menu, select Display > All ACLs. The page All ACLs opens.
3. In the menu, select Add > ACL. The wizard opens.
4. In the list DHCP server, select the DHCPv4 server of your choice.
5. Click on NEXT . The page DHCP ACL parameters opens.
7. In the drop-down list Predefined ACL, select None.
8. In the field ACL rule, type in the command below.
match if option vendor-class-identifier = "<%found-value>";
To create a DHCP option definition that uses the ACL value as option space
2. In the menu, select Display > All option definitions. The page All option definitions opens.
4. In the list DHCP server, select the DHCPv4 server for which you configured the ACL.
5. Click on NEXT . The page DHCP option definition opens.
6. Configure the option. The accepted code, parameter counter, and type should be mentioned
in your device documentation.
a. In the field Option name, name your option.

b. In the field Option space, type in the ACL name.
c. In the field Option code, type in a code following your device documentation.
402
d. In the drop-down list Parameter counter, select a value following your device document-
ation.
e. In the drop-down list Parameter 1, select a value following your device documentation.
f. In the section Type is array, tick or untick the box following your device documentation.
7. Click on OK to commit the creation. The report opens and closes. The option is listed as
follows: <option-space-name>.<option-name>.
Repeat this procedure for as many option definitions as needed: each definition creates a field
in the DHCP options configuration wizard which value you can set in the procedure below.
To configure the server with your DHCP option
3. In the menu, select Display > All ACLs. The page All ACLs of that server opens.
6. Click on to expand all the panels.
8. Configure the vendor-specific identifier match:
a. In the drop-down list Option category, select Basic. The wizard refreshes.
b. In the drop-down list Vendor option space, select your option, it is listed as follows
Vendor <your-option-name>.
9. Configure the value of your option definitions:
a. In the drop-down list Option category, select Vendor <your-option-name>. The wizard
refreshes.
b. Fill in all the option definition fields you created. They are all displayed as follows: <your-
option-definition-name> (<your-option-code>). The value expected in each field depends
on what settings your configured when creating the option definition.
10. Click on OK to commit the changes. The report opens and closes. The option is listed in the
panel.
• In the panel Main properties, the field Rule contains the value of your ACL: the vendor-
specific identifier match conditions.
• In the panel DHCP options, you can see:
1. The field Vendor option space that displays your option name.
2. A field for each of your option definitions named as follows: <your-option-name>.<your-
option-definition-name> followed by the value you just set in the DHCP option config-
uration wizard.
403
Chapter 31. Monitoring and Reporting
DHCP Data
SOLIDserver provides tools dedicated to monitoring DHCP servers and generating reports. Note
that these tools only apply to DHCP objects managing IPv4 addressing:
• The alerts that you can set on the DHCP pages allow to customize your monitoring. For more
details, refer to the chapter Managing Alerts.
• A set of statistics are available in dedicated panels of the properties page of DHCP servers,
as detailed in the section Monitoring DHCP Servers From their Properties Page.
• A set of data sampling analytics are available on the page Analytics, as detailed in the section
Monitoring DHCP Servers From the Page Analytics.
• A set of rules allow to monitor your servers, as detailed in the section Monitoring DHCP
Servers Using Rules.
• A number of reports on IPv4 servers and scopes are available, as detailed in the section
Generating DHCP Reports.
Monitoring DHCP Servers From their Properties Page

On the properties page of a physical or smart DHCP server, some panels are dedicated to
monitoring queries and changes. The monitoring panels are the following:
• DHCP server leases <server-name> displays a leases dedicated chart for physical servers,
if relevant.
• DHCP server statistics <server-name> displays query dedicated charts for the physical
servers.
• State log displays the server logs.
• Audit displays all the latest changes performed on the server by the user logged in.
Note that the server analytics panel and lease statistics panel display data retrieved using SNMP,
therefore, the graphs are empty if the SNMP is not configured properly. To edit the SNMP para-
meters of an EfficientIP DHCP server refer to the section Editing the SNMP Monitoring Parameters
of an EfficientIP DHCP Server.
Keep in mind that you can zoom in and out of the charts or decide the period and data to display.
For more details refer to the section Charts.
To display a DHCP physical server leases statistics
3. At the end of the line of the physical server of your choice, click on . The properties page
open.
4. Open the panel DHCP server leases <physical-server-name> using .
Once the panel is open, you can use the buttons under the chart to: move back or forward
the start time displayed; zoom in and out ; refresh the data .The drop-down list allows
404
Monitoring and Reporting DHCP
Data
to restrict or expand the period of time displayed: Last 3 hours (selected by default), Current
hour, Day, Week, Month, Year.
To display a DHCP physical server analytics
open.
4. Open the panel DHCP server analytics <physical-server-name> using .
To display a DHCP server state log
open.
4. Open the panel State log using . The panel content retrieves the server state in the logs:
OK , KO, Invalid settings... and the time and date for each.
To display a DHCP server audit
open.
4. Open the panel Audit using . The panel displays the latest changes in the database.
Each occurrence specifies the Date and time it occurred, the Service used, the User perform-
ing the operation and the server basic information: DHCP name, DHCP type and Architecture
if relevant.
By default, it lists the changes carried out by the user logged in, but if they belong to a group
with access to the changes from all users, the panel displays all the operations ever per-
formed. For more details, refer to the section Allowing Users to Display All the Operations
Performed.
Monitoring DHCP Servers From the Page Analytics

The data sampling on the page Analytics provides DHCP message dedicated Top 50 lists for
the EfficientIP DHCP physical servers you manage. There are some limitations detailed in the
section DHCP Analytics Limitations.
405
Data
The analytics functionality is enabled by default and samples the DHCP messages over specific
periods of time. By default, it offers 5-minute samples. If you want to set a shorter or bigger
periodicity, refer to the section Configuring the Analytics Retrieval.
You can set up an alert on the entries displayed. For more details, refer to the chapter Managing
Alerts.
Accessing the Page Analytics

The page Analytics offers dedicated Top 50 data samples based on the DHCP messages of the
physical servers.
The Top 50 information compares data retrieved over a specific periodicity, a limited period of
time, that is set by default to a sample time of 5 minutes. You can edit the sampling period. For
more details, refer to the section Configuring the Periodicity.
To display the page Analytics of a specific physical server
3. Click on the name of the physical server of your choice. The page All scopes opens.
4. In the breadcrumb, click on Analytics. The page Analytics of the server opens.
Each column provides and compares message information over the specified sample time:
Table 31.1. The columns on the page Analytics

Column Description
Server The name of the physical server. Click on a server name to display only the analytics of
that server.
Start date The time and date when the data retrieval started.
End date The time and date when the data retrieval stopped. The end date respects the number of
minutes set in the periodicity.
Period The periodicity set for the sample of messages. It is set on a physical server properties
page. For more details, refer to the section Configuring the Periodicity.
Address The IP or MAC address of the requesting client, or the IP address of the relay agent. This
column is not displayed for Message types.
Message type The DHCP message type: DISCOVER, OFFER, REQUEST, ACKNOWLEDGE, NOT
ACKNOWLEDGE, RELEASE, DECLINE, INFORM or other. This column is only displayed
for Message types.
Total messages The total number of messages in the DHCP logs during the selected period.
Number of hits The exact number of times a certain message type was requested by the IP or MAC address
for the selected period. For instance, the number of DISCOVER messages for a specific
IP address during a 5-minute period.
Total ratio The percentage of Number of hits compared with the Total messages for the selected
period. For instance, the percentage that represents the DISCOVER messages of a spe-
cific IP address compared with all the messages in the logs during a 5-minute period.
Nb of hits / type The number of hits matching the selected message type during the selected period. For
instance, the number of DISCOVER messages during a 5-minute period. This column is
not displayed for Message types.
Relative ratio The percentage of Number of hits compared with the Nb of hits / type during the selected
period. For instance, the percentage that represents the DISCOVER messages of a spe-
cific IP address compared with all the DISCOVER messages in the logs during a 5-minute
period.This column is not displayed for Message types.
406
Data
Note that the columns Start date and End date can be filtered using the keyword last to display
the data retrieved in the last X minutes, X being the periodicity set for the server. If no data is
retrieved in that period, the list is empty.
Displaying the DHCP Analytics

From the page Analytics, you can display physical servers data samples retrieved from its mes-
sages. It focuses by default on a sample period of 5 minutes to draw Top 50 comparisons.
To display specific DHCP analytics data
1. Go to the page Analytics of the DHCP physical server of your choice.

2. Under the menu, in the drop-down list Display, select the data of your choice. The page re-
freshes, the selected data is displayed.
All available analytics are detailed in the table below.

3. Under the drop-down list, you can tick the box Automatic refresh to automatically refresh
the data listed every minute. To edit the page refresh frequency, refer to the section Editing
the Automatic Refresh Frequency.
You can edit the sample time. For more details, refer to the section Configuring the Periodicity.
Table 31.2. DHCP analytics

Statistic Description
Top 50 DISCOVER (MAC) The top 50 clients who sent the most DISCOVER messages during the
configured Period, identified using their MAC address.
Top 50 OFFER (MAC) The top 50 clients who received the most OFFER messages during the
Top 50 OFFER (IP) The top 50 clients who received the most OFFER messages during the
configured Period, identified using their IP address.
Top 50 REQUEST (MAC) The top 50 clients who sent the most REQUEST messages during the
Top 50 REQUEST (IP) The top 50 clients who sent the most REQUEST messages during the
Top 50 INFORM (IP) The top 50 clients who sent the most INFORM messages during the
Top 50 RELAY The top 50 most used DHCP relay agents during the configured Period,
identified using their IP address.
Top 50 "Peer holds all free leases" The top 50 DHCP relay agents on which the failover channel refused
leases during the configured Period, identified using their IP address.
Top 50 "Unknown network segment" The top 50 clients who received unknown network segment messages
during the configured Period, identified using their IP address.
Top 50 "Unknown subnet" The top 50 clients who received message unknown subnet messages
during the configured Period, identified using their IP address.
Message types All the messages sent and received by the DHCP server during the con-
figured Period, identified using their type.
No matter the selected Analytics, the values displayed are representative of a specific Period of
time.
407
Data
Configuring the Analytics Retrieval

You can configure the analytics retrieval according to your needs. You can edit the sampling
period, or periodicity, the page automatic refresh frequency, the data retrieval frequency and
even its purge frequency.
Editing the Automatic Refresh Frequency
On the page Analytics, the box Automatic refresh allows to automatically refresh the page display
every 60 seconds. You can edit this frequency via a registry database key.
To edit the analytics automatic refresh frequency

opens.
3. In the column Name, type in www.dhcp.stat.refresh and hit Enter. The key is the only one
listed.
4. In the column Value, click on the value. The wizard registry database edit a value opens.
5. In the field Value, type in the number of seconds of your choice. By default, it is set to 60.
the new key value is visible.
Configuring the Periodicity
By default, the data sampling compares the DHCP messages over a periodicity of 5 minutes.
The sample time specified in the column Period on the page Analytics.
You can configure a shorter or larger periodicity on each physical server individually.
Note that no matter the periodicity, the data is available on the page at a frequency specified
through the rule 381. To edit that rule, refer to the next section.
To edit the DHCP analytics periodicity of a physical server
opens.
4. Open the panel DHCP analytics. It indicates if the retrieval is enabled and the periodicity.
5. Click on EDIT . The wizard Configure DHCP analytics opens.
6. In the drop-down list Periodicity (min.), select the period of your choice: 1, 5, 10 or 15
minutes. By default, 5 is selected.
7. Click on OK to commit your changes. The page refreshes, the properties page is visible
again.
408
Data
Configuring the DHCP Analytics Retrieval Frequency
The frequency to which the analytics are displayed on the page Analytics is set by the rule 381,
Retrieval of the DHCP analytics data. By default, every 5 minutes it displays the data comparison
results for messages sampled during 1, 5, 10 or 15 minutes, depending on the configured peri-
odicity.
No matter the periodicity you set on the physical server, the data is available in the GUI depending
on the rule configuration.
To edit the rule 381 that sets the DHCP analytics data retrieval
opens.
3. In the column Rule #, type in 381 and hit Enter. The rule is the only one listed.
4. At the end of the line, click on . The properties page opens.
6. Click on NEXT . The page Rule filters opens.
7. Edit the drop-down lists Day(s) of the week, Date of the month, Month, Hour and/or Minute
according to your needs. By default, only the drop-down list Minute is set to Every 5 minutes.
again.
Configuring the DHCP Analytics Purge Frequency
You can configure the purge mechanism of the analytics retrieval. By default, it is based on:
• The data age. The rule 383, Configuration of the DHCP analytics purge, deletes data older
than 30 days. You can set it to delete data earlier or later.
• A lines count. A registry key deletes data if the analytics database exceeds 100,000 lines -
each Top 50 and Message types can reach that many lines. You can set a lower or higher
threshold.
Both thresholds work together: once the number of days or the number of lines is met, the un-
wanted data the deleted.
No matter the way you want to purge your database, keep in mind that if you set very high
thresholds, you may slow down your appliance because the database contains too much
information.
To edit the rule 383 that purges the DHCP analytics
opens.
409
Data

7. Edit the drop-down lists according to your needs. By default the rule is executed daily at
23:30.
Table 31.3. Filters of the rule 382

Column Default value
8. Click on NEXT . The page Rule parameters opens.

9. In the field Number of days, type in the number of days above which you want the logs
database to be purged. By default it is set to 30, logs older than thirty days are automatically
deleted.
again.
To create a threshold to purge DHCP analytics

opens.
3. In the menu, select Add > Registry item. The wizard Registry database Add an item opens.
4. In the field Name, type in dhcp.stats.limit.
5. In the field Value, type in the number of lines above which the data is purged. The default
value is 100,000.
the key is listed.
Exporting the Analytics

From the page Analytics, you can export the data listed in a CSV, HTML, XML, XLS or PDF file.
Like any other export, you can retrieve the data immediately or schedule it. For more details,
refer to the section Configuring Exports.
Disabling the Analytics

At any time, you can stop retrieving the analytics for any physical server.
To disable the DHCP analytics retrieval on a physical server
410
Data
opens.
4. Open the panel DHCP analytics. It indicates if the retrieval is enabled and its periodicity.
5. Click on EDIT . The wizard Configure DHCP analytics opens.
6. Untick the box Enable analytics collection. The page refreshes, the drop-down list Periodicity
(min.) is no longer visible.
again. In the panel, the field Enable analytics collection is marked no.
DHCP Analytics Limitations

• The analytics are only available for EfficientIP DHCP servers.
• Only the first 50 entries matching the selected data are listed. Therefore, if on the selected
period of time, 100 pieces of information are identical, the GUI only displays the first 50.
• You might slow your appliance down if you edit the purge mechanism to include more lines or
keep data longer than the default 30 days.
Monitoring DHCP Servers Using Rules

In order to monitor DHCP servers efficiently, SOLIDserver allows you to add advanced rules to
monitor DHCP events: monitor the scope/range usage or set up an alert dedicated to monitoring
the server status.
In the following procedures, we are going to configure a monitoring process to add the rules 105
and 082 that respectively check DHCP scope/range usage and send an alert if a DHCP scope
is full.
Before using the monitoring rules, make sure the server is responding.
To add the rule 105 that checks scopes and ranges usage
opens.
3. In the menu, select Add > Rule. The Add a rule wizard opens.
4. In the drop-down list Module, select DHCP.
5. In the drop-down list Event, select Execution of a scheduled rule.
6. In the list Rule, select (105) Check DHCP scope/range usage.
7. In the field Rule name, name the rule. That name is then listed in the column Instance.
8. In the field Comment, you can type in a comment if you want.
10. Set the schedule parameters:
Table 31.4. Scheduled rules parameters

Field Description
411
Data
Field Description
Hour Select a specific time or one of the available schedules. By default, Every hour is se-
lected.
Minute Select a period of time, minutes-wise. By default, Every minute is selected.

12. In the field Maximum scope usage, type in the in percent the maximum scope usage of your
choice. By default, 90 is typed in.
13. Click on OK to commit your rule addition. The report opens and closes. The rule is listed.
Once the rule 105 is added, add the rule 082. Make sure the SNMP service is configured properly.
To add the rule 082 that sends an alert when a scope is full
2. In the drop-down list Module, select DHCP.
3. In the drop-down list Event, select Event.
4. In the list Rule, select (082) Send an alert if a DHCP scope is full.
5. In the field Rule name, name the rule. That name is then listed in the column Instance.
9. Fill in at least one of the rule parameters fields:
a. In the field IP address of the SNMP trap, type in the IP address of the appliance that
should receive the SNMP trap.
b. In the field Send a mail to, type in the email address that should receive the notification.
Thanks to these two rules, if scopes from your DHCP servers exceed the percentage of usage
specified in the rule 105, you are automatically notified via email and/or SNMP trap.
Besides, you can display DHCP scope/range usage, in the panel State log of the scope properties
page.
Generating DHCP Reports

EfficientIP provides DHCP dedicated reports at server and scope level.
Table 31.5. Available DHCP reports

Page Report
All servers Clients Most Used OS
Server Data Exchanges
Server Options Comparison
412
Data
Page Report
Server Usage Chart
Most Used Networks
Server Usage Evolution Charts
All scopes Clients Most Used OS
Scopes Options Comparison
Scopes Summary
For more details regarding the reports and their generation, refer to the section Managing Reports.
413
Part VI. DNS Management
The Domain Name System (DNS) is a hierarchical distributed naming system which main function is to
convert an IP address into an intelligible domain name (name resolution) or a domain name into an IP address
(reverse resolution).
The DNS namespace can be seen as a reversed tree of domains, also called zones.
Figure 139. Representation of the DNS hierarchy: a reverse tree of delegations
At the root of the structure, the highest zone is represented by a silent dot ( . ) followed, in order, by the Top-
Level Domains (TLDs) - divided into generic TLDs (gTLD) like .com, .org, .net and country code TLDs
(ccTLD) like .us, .fr or .uk - and the Second-Level Domains (SLDs). The whole access path to a domain
reads from right to left: SLD.TLD . At the top of the reverse tree, there are 13 root servers listed alphabetically
from A to M and spread out worldwide. They all gather the same information regarding the TLDs and, to
avoid being saturated by queries, they delegate names and IP addresses to accredited registrars.
In theory, a client that wants to access a web page would have to follow the whole hierarchy from the root
down to the sub-domain. For that reason, DNS servers offer a combination of authoritative, recursive or
cache functionalities.
Within SOLIDserver, the DNS has a dedicated module. From its dashboard, or homepage, you can access
Figure 140. The DNS dashboard
The DNS hierarchy can include up to 4 levels of organization:
• Server: the highest level of the hierarchy. It can contain views, zones and records. For more details, refer
to the chapters Managing DNS Servers and Configuring DNS Servers. One or several servers can be
managed via a smart architecture to ensure service availability and prevent data or configuration loss.
For more details, refer to the chapters Deploying DNS Smart Architectures and Managing DNS Smart
Architectures.
• View: an optional level that belongs to a server and contains zones. It allows to grant or limit user access
the data of your choice. Depending on who queries a domain, they receive different responses. For more
details, refer to the chapters Managing DNS Views and Configuring DNS Views.
• Zone: the second level of the DNS hierarchy. They contain resource records and can be set to resolve
names or IP addresses. For more details, refer to the chapters Managing DNS Zones and Configuring
DNS Zones.
• RR: the lowest level of the hierarchy. They define zone characteristics. For more details, refer to the
chapter Managing DNS Resource Records.
The DNS module also provides:
• DDNS. You can configure Dynamic Domain Name Server to dynamically take into account in the DNS
any IP address assignment updates in the DHCP. For more details, refer to the chapter Implementing
Dynamic Update.
• RPZ. You can create and manage Response Policy Zones and set specific policies. For more details,
refer to the chapter DNS Firewall (RPZ).
• Hybrid DNS. You can set up a hybrid DNS service that can switch from BIND to NSD or Unbound and
vice versa. For more details, refer to the chapter Hybrid DNS Service.
• Guardian.You configure your DNS service and protect your network from DDoS attacks. For more details,
refer to the chapter DNS Guardian.
• DNSSEC.You can configure the Domain Name System Security Extensions to use a server as a resolver
or sign your zones. For more details, refer to the chapter DNSSEC.
• HSM. You can further secure Master DNSSEC zones with Hardware Security Module encryption. For
more details, refer to the chapter HSM.
• Monitoring and Reporting. There are many ways for the reporting and monitoring of DNS servers traffic
and activity. For more details, refer to the chapter Monitoring and Reporting DNS Data.
• Automation of IPAM and DHCP resources creation.The advanced properties allow to automate creations
in the IPAM or DHCP when you create DNS resources. For more details, refer to the chapter Managing
Chapter 32. Deploying DNS Smart
Architectures
The current approach of DNS service management is mainly limited at the single server manage-
ment level, restricting service configuration and management with a server per server approach
even if it is performed from a centralized platform. This approach is insufficient to ensure service
reliability, security and easiness of management. It could weaken your DNS architecture because:
• Increases the risk of misconfigurations.

• No Best Practices enforcement to ensure the high security of the network services architecture.
• No automation of architecture deployment and management.
• Difficult and risky architecture changes.
Indeed, even if the configuration has been simplified with the GUI, it is still complex, expensive
and requires experts to deploy and configure all servers in coherent architectures of DNS-DHCP
services. The smart architecture is a new approach to DNS services management to drastically
simplify deployment and administration of your network service.Thanks to the smart architecture,
SOLIDserver offers the capability of managing your DNS services not only at server level but at
the architecture level.
The smart architecture offers a library of DNS architectures that are ready to apply on a set of
servers. All the DNS smart architectures designed for more than one server can contain
several Master servers. This sets up an even more secure environment: if one Master server
crashes or stops responding, the other one takes over and ensures service availability.
The DNS smart architecture library includes:
• Master/Slave.
• Multi-Master.
• Stealth.
• Single-Server.
• Farm.
Smart architecture supports EfficientIP SOLIDserver servers and legacy DNS servers such as:
• Microsoft Windows Server DNS.

• ISC BIND9.
• Nominum ANS.
Smart architecture allows managing other DNS servers supporting DDNS (RFC2136) with the
single ability of updating the domains and not the server configuration or the zone configuration.
In that way, the server configuration and the zone configuration must be done locally on the
server. This configuration is useful when you are only allowed to update zones on a DNS partner.
Master/Slave Smart Architecture

Master/Slave DNS architecture is widely used on the Internet. SOLIDserver supports the Mas-
ter/Slave DNS architecture within as a smart architecture. A master DNS configuration contains
416
Deploying DNS Smart Architectures
one or more zones files for which this DNS server is authoritative. The term master is related to
the location of the zone data rather than any other operational characteristics. A master is reques-
ted to transfer zone data to one or more slave servers whenever the zone file change. The
master DNS obtains the zone data locally as opposed to a slave DNS, which obtains its zone
data via a zone transfer operation from the master DNS.
DNS
Master
DNS DNS
Slave Slave
Figure 32.1. DNS Master/Slave smart architecture
Multi-Master Smart Architecture

The DNS Multi-Master architecture is usually selected to allow updates on all servers. Multi-
Master smart architecture supports all DNS servers, including Microsoft DNS servers integrated
or not in Active Directory, EfficientIP DNS, BIND servers, Nominum ANS engines or all DNS
servers supporting DDNS. It can even reproduce Microsoft's Multi-Master behavior.
DNS
Master
DNS DNS
Master Master
Figure 32.2. DNS Multi-Master smart architecture
With the smart architecture, updating a DNS server can be done from the management console,
from a DHCP allocation or from Microsoft DNS clients that update themselves their names by
using the Dynamic DNS (DDNS) mechanism:
• When a Multi-Master smart architecture is updated from the management console, the config-
uration is automatically pushed toward all the DNS servers belonging to the smart architecture.
• When a DNS server receives a dynamic update from a DNS client, the Multi-Master smart ar-
chitecture replicates the update to all the DNS servers it manages. This replication is automatic
and does not require any manual operations.
• When a DHCP server offers a new IP address, the SOLIDserver IPAM appliance updates the
Multi-Master smart architecture and, consequently, all the DNS servers it manages.
417
A primary DNS server is eliminated as a single point of failure. Traditional DNS replication is
single-master; it relies on a primary DNS server to update all the secondary servers. Unlike tra-
ditional DNS replication, Directory Server Replication is Multi-Master. Changes made to a zone
can be replicated to one or more Directory Servers. Which is why we recommend that you refer
to your vendor information regarding the Directory Server used and its replication capabilities.
Stealth Smart Architecture

A Stealth DNS architecture is a set of visible DNS servers and a stealth DNS server. A stealth
DNS server is defined as a name server that does not appear in the list of the visible DNS servers,
which means that its NS resource record is not published among the zone and it does not answer
queries from DNS clients and other name servers. Stealth architectures are used in contexts that
are sometimes called demilitarized zone (DMZ) or Split servers, and can be defined as having
the following characteristics:
• Your organization needs to deploy DNS servers on the Internet.

• Your organization does not want the world to see any of its internal hosts either by interrogation
(query or zone transfer) or in the event the DNS service or external servers are compromised.
DNS Hidden
Master
DNS Slave DNS

Pseudo
Master
Slave
Figure 32.3. DNS Stealth smart architecture
The visible secondary DNS server contains only slave zones, then it is less exposed to DNS at-
tacks because the real authoritative primary server is hidden. Zone transfers can be allowed from
the secondary servers as required but they do not transfer or accept transfers from the stealth
server.
One of the main advantages of this architecture is that the primary server can be offline for
maintenance without causing any interruption to DNS service within the expiration duration (30
days) set for the validity of its zone data.
Single-Server Smart Architecture

A Single-Server architecture manages one DNS server. This allows to keep the server configur-
ation and data in case anything were to happen to the physical server: SOLIDserver would save
the configuration and apply it to the next server you add to the architecture.
418
Single
DNS
Figure 32.4. DNS Single-Server smart architecture
This architecture is therefore a backup in itself. Moreover, managing a physical server through
a Single server architecture eases up any migration or change of architecture. If after a few
weeks, for instance, you want to set up a Master/Slave architecture, you can edit the smart archi-
tecture, change it to Master/Slave, add another physical server and define which one acts as a
master and which one as a slave.
Farm Smart Architecture

The Farm architecture allows to control the DNS service through one or several load balancers.
The load balancer receives the DNS clients requests and redirects each query to the least used
DNS server at the time of the request. That way, the DNS load is balanced and the service
availability is heightened. The load balancer sends the DNS queries to a set of known DNS
servers that send back the information needed. The organization of the DNS servers in a Farm
architecture is based on the principle of the Master/Slave architecture with one Master server
and as many Slave servers as needed.
DNS
Master
DNS
Slaves
Figure 32.5. DNS Farm smart architecture
The Farm architecture is especially useful for huge configurations where the use of load balancers
is necessary.
419
Chapter 33. Managing DNS Smart
Architectures
Once you chose the smart architecture(s) that suit your needs in the chapter Deploying DNS
Smart Architectures, you can manage them following the sections below.
Browsing DNS Smart Architectures

Smart architectures are managed from the page All servers, listed like physical servers and
preceded by the icon . For more details, refer to the section Browsing DNS Servers.
Understanding the Smart Architecture Statuses

The column Status provides information regarding the smart architectures' configuration.
Table 33.1. Smart architecture statuses

Column Description
OK The smart architecture is operational.
Invalid settings The smart architecture does not contain any physical server or is missing one or
several.
Locked synchronization The server configuration is not viable. This status can be displayed on EfficientIP
DNS and EfficientIP DNS Package servers after importing a BIND archive file not
properly formed or containing non-supported BIND options. For more details, refer
to the section The Status Locked Synchronization.
In addition, the column Sync provides additional information regarding the exchanges, synchron-
ization, between the smart architecture and the physical server(s).
Table 33.2. Smart architecture synchronization statuses

Column Description
Synchronized The smart architecture has successfully synchronized the server(s) it manages.
Busy The smart architecture is synchronizing the server(s).
Locked synchronization The synchronizing failed as the server configuration is not viable: the smart architec-
ture cannot send the configuration file to the physical server(s). For more details,
refer to the section The Status Locked Synchronization.
The Status Locked Synchronization

SOLIDserver provides a consistency check for the smart architectures. Once you configured a
smart architecture with the server(s) you want to manage, the smart configuration is checked
before it is sent to the physical server(s): this ensures the consistency of the configuration and
avoids pushing useless information to the server:
• If the check is conclusive, the information is sent to the server and its status is Synchronized
in the column Sync of the page All servers.
1
• If any error is found, the verification stops and the server status changes to Locked Synchron-
ization once the page is refreshed. To get a valid synchronization status again, you need to
1
The error could be a corrupt configuration file, or an include file missing from the page Local file listing.
420
Managing DNS Smart Architectures
"undo" the latest changes. This action loads a new synchronization and uploads the status
accordingly.
Once the server is in Locked synchronization, the corrupted configuration file is automatically
stored locally on the appliance and available for download in the Local Files Listing. It is named
<server_name>-named.conf. We advice that you take a look at this file because after the first
found error, the check stops and returns the Locked synchronization status. So if there are sev-
eral errors, the status is returned over and over again until the file is conclusive and can be sent
to the physical server.
You can check for failure in the configuration file from the GUI or via CLI.
To check for failure in a DNS configuration file from the GUI
1. Go to the Administration tab. If the homepage is not displayed click on . The homepage
opens.
2. In the section Monitoring, click on Logs visualization. The page Syslog opens.
3. In the drop-down list SOLIDserver, verify that the local appliance is selected. Only the host-
4. In the drop-down list Services, select ipmserver. The logs appear.
5. In the search engine of the column Log, type in CHECK DNSCONF.The relevant logs appear,
the server name is between brackets.
To check for failure in a DNS configuration file via CLI

# ls -la /data1/exports/*-named.conf
# /usr/local/nessy2/bin/named-checkconf /data1/exports/<server_name>-named.conf
Adding a DNS Smart Architecture

A smart architecture can be configured without DNS servers. It allows you to create the architecture
that suits your needs before applying it to one or more DNS servers. It also provides a backup
of the management configuration of the server it manages. If your DNS server crashes, you delete
it and add a new one on which you apply the same architecture, SOLIDserver remembers the
former server's configuration and apply it to the new one.
There are five different kinds of smart architectures: Master/Slave, Multi Master, Stealth, Farm
and Single-Server. Keep in mind that every DNS smart architecture sets up an active/active
configuration. The smart architectures Farm, Master/Slave, Multi-Master and Stealth can
manage several Master servers. This sets up an even more secure environment: if one Master
server crashes or stops responding, the other one takes over and ensures service availability.
Once the configuration is completed, the DNS smart architecture is listed as a real server on the
page All servers, the column Type indicates the kind of smart architecture.
421
In the procedures below, we are going to describe the configuration of the DNS smart architectures
with the DNS servers they manage, but you can go through the configuration without adding any
server and do it later. For more details, refer to the part Adding a DNS Server into a Smart Archi-
tecture.
Master/Slave Smart Architecture

The Master/Slave Smart Architecture is designed to manage at least 2 DNS servers with one
DNS server as master and the other(s) as slave (i.e. backup).
To configure a DNS Master/Slave smart architecture
3. In the menu, click on Add > Server > DNS smart architecture. The wizard Add a DNS server
opens.
Table 33.3. DNS smart architecture basic parameters

Field Description
DNS server name Type in a FQDN name for your server. This field is required.
module (IPAM or DHCP). It's mainly useful when dealing with migrations. Keep
in mind that the smart architecture still receives data if your network configuration
allows it. If you tick the box, any behavior set via the drop-down list Advanced
properties has to be applied to the smart architecture later on. Before unticking
Use DNS as DNSSEC re- Tick the box to activate DNSSEC validation. If you activate the DNSSEC para-
solver meters on a smart architecture, all the servers that compose it become DNSSEC
compliant. For more details, refer to the chapter DNSSEC.
page All servers.
to the chapter Managing Advanced Properties; the DNS properties are detailed
in the section Configuring DNS Advanced Properties.
Properties.

6. In the list DNS smart architecture, select Master/Slave.
422
DNS
Master
DNS DNS
Slave Slave
Figure 33.1. DNS Master/Slave smart architecture
7. Click on NEXT . The page DNS servers role configuration opens.

8. You can select the DNS servers that you want to manage through the smart architecture:
a. In the drop-down list Available DNS servers, select the master server and click on +
MASTER . The server is moved to the Master DNS servers list. You can add several
master servers if you want, in which case if one crashes the other takes over. To remove
a server from the list, select it and click on .
b. In the drop-down list Available DNS servers, select a slave server and click on + SLAVE .
The server is moved to the Slave DNS servers list. Repeat this action for as many slave
servers as needed. To remove a server from the list, select it and click on .
If you do not want to publish one or several name servers/load balancers or enable HSM for
this architecture, go to step 10.
9. If you want to publish one or several name servers/load balancers or enable HSM for this
architecture, tick the Expert mode box. The page reloads.
a. Click on NEXT . The page Advanced settings appears.

b. In the field NS record, type in the name server of your choice. It can also be the hostname
of an external load balancer.
c. Click on ADD .The name server is moved to the Published name servers list. Each record
listed is saved for each zone and displayed on the page All RRs of the physical servers
managed by the smart architecture.
Repeat these actions for as many NS records as needed.
You can edit the content of the list. Click on an entry, it is displayed again in the field,
edit it and click on UPDATE or click on DELETE to remove it from the list. If you made
d. You can tick the box Force Hybrid DNS compatibility if you intend to manage BIND
servers that you might switch to Hybrid in the future. For more details, refer to the chapter
Hybrid DNS Service.
e. Click on NEXT . The page last page of the wizard appears.
f. Tick the box Enable HSM to start signing Master zones managed by the smart architec-
ture using an HSM. For more details, refer to the chapter HSM.
is listed as a DNS server and marked Smart (master/slave) in the column Type. You can
423
During the first addition of a DNS smart architecture, the option allow-transfer is by
default configured with the ACL admin. Within SOLIDserver admin corresponds to any,
so you might want to change the ACL and restrict the option use as it is inherited by the
server's zones. For more details, refer to the chapter Limiting Zone Transfers at Server Level.
Multi-Master Smart Architecture

The Multi-Master Smart Architecture is designed to manage at least 2 DNS servers: both of them
being Masters, there is no Slave server in this configuration. From the management console, a
DNS client or a DNS server automatically replicates and updates data on all the DNS servers
within this architecture.
To configure a DNS Multi-Master smart architecture
opens.

Field Description
page All servers.
Properties.

6. In the list DNS smart architecture, select Multi-Master.
424
DNS
Master
DNS DNS
Master Master
Figure 33.2. DNS Multi-Master smart architecture

8. You can select physical servers to manage through the smart architecture:
a. In the drop-down list Available DNS servers, select a server.

b. Click on + MASTER . The server is moved to the Master DNS servers list. You can add
several master servers if you want, in which case if one crashes the other takes over.
To remove a server from the list, select it and click on .
If you do not want to configure any name server or load balancer for this architecture, go to
step 10.
9. If you want to publish one or several name servers or load balancers for this architecture,
tick the Expert mode box. The page reloads.

d. The field Compatible with a Hybrid DNS Engine is marked Yes.
e. You can tick the box Force Hybrid DNS compatibility if you intend to manage BIND
Hybrid DNS Service.
f. Click on NEXT . The page last page of the wizard appears.
g. Tick the box Enable HSM to start signing Master zones managed by the smart architec-
is listed as a DNS server and marked Smart (multi-master) in the column Type. You can
425
Stealth Smart Architecture

The Stealth Smart Architecture is designed to manage at least 3 DNS servers: a true Master
server hidden from the world, a visible Master server used as decoy and Slave server(s) that do
not transfer or accept transfers from the hidden Master server. The Master server can be offline
for maintenance without causing any interruption to DNS service within the expiration duration
(30 days) set for the validity of its zone data.
To configure a DNS Stealth smart architecture
opens.

Field Description
page All servers.
Properties.

6. In the list DNS smart architecture, select Stealth.
426
DNS Hidden
Master
DNS Slave DNS

Pseudo
Master
Slave
Figure 33.3. DNS Stealth smart architecture

HIDDEN-MASTER . The server is moved to the Hidden-master DNS server(s) list. Repeat
this action for as many master servers as needed. To remove a server from the list,
select it and click on .
b. In the drop-down list Available DNS servers, select the slave server you want to use as
pseudo master and click on + PSEUDO-MASTER . The server is moved to the field Pseudo-
master DNS server (slave server used as decoy). To remove the server from the field,
click on .
c. In the drop-down list Available DNS servers, select a slave server and click on + SLAVE .
step 10.

Hybrid DNS Service.
427

is listed as a DNS server and marked Smart (stealth) in the column Type. You can display
or hide the physical servers managed through your smart architecture using the button
Single-Server Smart Architecture

The Single-Server Smart Architecture is designed to manage only one DNS physical server.
To configure a DNS Single-Server smart architecture
opens.

Field Description
page All servers.
Properties.

6. In the list DNS smart architecture, select Single-Server.
428
Single
DNS
Figure 33.4. DNS Single-Server smart architecture

8. You can select the DNS server that you want to manage through the smart architecture:
a. In the drop-down list Available DNS servers, select the server.

b. Click on + MASTER . The server is moved to the Master DNS servers list. To remove a
server from the list, click on .
step 10.

Hybrid DNS Service.
is listed as a DNS server and marked Smart (single-server) in the column Type. You can
429
Farm Smart Architecture

The Farm Smart Architecture is essentially a Master/Slave architecture that allows to have a set
of master and slave servers accessible through one or several external load balancers that redirect
the clients toward the least used server and avoid overloading the service.
To configure a DNS Farm smart architecture
opens.

Field Description
page All servers.
Properties.

6. In the list DNS smart architecture, select Farm.
430
DNS
Master
DNS
Slaves
Figure 33.5. DNS Farm smart architecture

MASTER . The server is moved to the Master DNS servers list. You can add several
master servers if you want, in which case if one crashes the other takes over. To remove
a server from the list, select it and click on .
b. In the drop-down list Available DNS servers, select a slave server and click on + SLAVE .
9. Click on NEXT . The page Advanced settings opens.

10. Finish the Farm configuration.
a. In the field NS record, type in the hostname of your external load balancer if need be.
It can also be a name server.
b. Click on ADD . The name is moved to the Published name servers list. Each record is
saved for each zone and displayed on the page All RRs of the physical servers managed
by the smart architecture.
Repeat these actions for as many load balancers or NS records as needed.
From now on, the DNS clients send their request to one or more load balancers that
redirect the requests to the least used server. Note that to run properly, your load balan-
cer must be configured to list all the DNS servers managed by the smart architecture
and should be manually updated if you change the list of physical servers managed by
the architecture.
11. If you want to display the Hybrid dedicated fields, tick the box Export mode.
a. The field Compatible with a Hybrid DNS Engine is marked Yes.

b. You can tick the box Force Hybrid DNS compatibility if you intend to manage BIND
Hybrid DNS Service.
431
c. Click on NEXT . The page last page of the wizard appears.

d. Tick the box Enable HSM to start signing Master zones managed by the smart architec-
is listed as a DNS server and marked Smart (farm) in the column Type. You can display or
the right-end side of the menu.
Editing a DNS Smart Architecture

Once created, you can edit a DNS smart architecture: change the servers it manages, edit the
servers' role or even change the smart architecture type.
Adding a DNS Server into a Smart Architecture

Once smart architecture is properly configured and applied, you can add DNS servers whenever
you want. First add a DHCP server following the section Managing DNS Servers. Make sure you
added all the necessary physical servers into the smart architecture because, depending on the
DHCP smart architecture you chose, if you do not complete the configuration the smart architecture
may not run properly.
When you add one or more DNS servers into a smart architecture, the smart data is auto-
matically replicated from the architecture to the DNS servers it manages. So if the smart
architecture is empty (first use), the configuration file of the physical DNS server it manages is
completely overwritten.
To add a DNS server into a smart architecture
page opens.
4. In the panel Main properties, click on EDIT . The wizard Edit a DNS server opens.
5. In the list DNS server type, make sure DNS smart architecture is selected. Click on NEXT .
The next page of the wizard opens.

Field Description
432
Field Description
page All servers.
Properties.
7. In the list DNS smart architecture, modify the type of DNS smart architecture if need be.
Click on NEXT . The page DNS servers role configuration opens.
8. In the drop-down list Available DNS servers, select the DNS server of your choice.
9. Define the role of the server using the buttons + HIDDEN MASTER , + PSEUDO MASTER , + MASTER or
+ SLAVE depending on the smart architecture. The selected server is moved to the corres-
ponding Hidden-master, Pseudo-master, Master or Slave DNS servers list.You can remove
the server from the list using . Repeat these actions for as many servers as needed.
10. If you are editing a Farm architecture or if you configured NS records on another architecture,
click on NEXT . The page Advanced settings opens. For more details regarding this page,
refer to the last steps of the relevant smart architecture addition procedure in the section
Adding a DNS Smart Architecture.
11. Click on OK to commit your changes. The report opens and closes. You can display or hide
the physical servers managed through your smart architecture using the button on the
right-end side of the menu.
Removing a DNS Server from a Smart Architecture

Whenever you want to, you can remove one or more DNS servers from a DNS smart architecture.
When you remove one, the configuration applied on this server is conserved on the previously
removed DNS server.
To remove a DNS server from a smart architecture
page opens.
433
7. Select the server to remove and click on . The server is moved back to the drop-down list
Available DNS servers. Repeat this action for the other servers you want to remove.
9. Click on OK to commit your modifications. The report opens and closes. If your smart archi-
tecture is still managing physical servers, you can display or hide them using the button
Changing the DNS Servers Role within a Smart Architecture

You can easily modify the role of the DNS servers managed by any smart architecture. For in-
stance, you can change a master server into a slave server within a Master-Slave smart architec-
ture at any given time.
To change the role of a DNS server within a smart architecture
page opens.
6. Click on NEXT .
7. Click on NEXT . The page DNS servers role configuration of the wizard opens.
8. Select the server you want to modify and click on next to the corresponding list. The
server is moved back to the drop-down list Available DNS servers. Repeat this action for
any server whose role you want to change.
ponding list. Repeat these actions for the other servers.
the right-end side of the menu. The column Role displays the server(s) new role.
Changing the Type of a DNS Smart Architecture

The type of a DNS smart architecture can be easily changed while keeping all DNS configuration
and data you already set. For instance, you already have a DNS smart architecture configured
in Master-Slave that includes two DNS servers -one in master and the other in slave- and you
plan to change your DNS configuration type from Master-Slave to Multi-Master. By editing the
smart architecture, you can change its type and configure the role of servers.
434
To edit a DNS Smart Architecture type
page opens.
5. In the list DNS server type, make sure DNS smart architecture is selected. Click on NEXT .
The next page of the wizard opens.

Field Description
page All servers.
Properties.
7. In the list DNS smart architecture, modify the type of your DNS smart architecture. Click on
NEXT . The page DNS servers role configuration opens.
8. Select the server you want to modify and click on next to the corresponding list. The
server is moved back to the drop-down list Available DNS servers. Repeat this action for
any server whose role you want to change.
ponding list. Repeat these actions for the other servers.
If you selected the Master/Slave, Mutli-Master, Stealth or Single-Server architecture, go to

step 12.
11. If you selected the Farm architecture, click on NEXT . The page Advanced settings opens.
435
a. In the field NS record, type in the hostname of your external load balancer if need be.
It can also be a name server.
b. Click on ADD . The name is moved to the Published name servers list. Each record is
saved for each zone and displayed on the page All RRs of the physical servers managed
by the smart architecture.
Repeat these actions for as many load balancers or NS records as needed.
From now on, the DNS clients send their request to one or more load balancers that
redirect the requests to the least used server. Note that to run properly, your load balan-
cer must be configured to list all the DNS servers managed by the smart architecture
and should be manually updated if you change the list of physical servers managed by
the architecture.
12. Click on OK to commit your changes. The report opens and closes. The page All servers is
visible again. The column Type displays your changes.
Enabling HSM on a DNS Smart Architecture

If you have not enabled the HSM feature upon addition of the smart architecture, you can do it
at any time. However, it requires that the smart architecture manages an EfficientIP DNS server,
configured as Master, with the feature enabled as well. For more details, refer to the chapter
HSM.
To enable HSM on DNS smart architectures
page opens.
5. Click on NEXT until the wizard displays the box Enable HSM.
6. Tick the box Enable HSM to start signing Master zones managed by the smart architecture
using an HSM.
7. Click on OK to commit your changes. The report opens and closes. The page All servers is
visible again. The column Type displays your changes.
Deleting a DNS Smart Architecture

At any time, you can decide to stop managing your DNS servers through the smart architectures.
You might not need to delete a smart architecture, editing it might be enough. For more details,
refer to the section Changing the Type of a DNS Smart Architecture.
Before deleting a smart architecture, keep in mind that:
• Deleting a smart architecture does not delete any data from the physical server: it means that
you stop managing the server via the smart architecture. However, the configuration backup
436
of the smart architecture is deleted, so if the physical server crashes after the smart archi-
tecture deletion, you have to configure everything again manually.
• You cannot delete a smart architecture if it is still managing DNS servers.
To delete a DNS smart architecture
3. If the smart architecture is managing DNS servers, remove them. For more details, refer to
the section Removing a DNS Server from a Smart Architecture.
4. Tick the smart architecture you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The smart architecture is
no longer listed. All the servers that used to be managed are listed as DNS servers of
whatever kind in the list Type.
Defining a DNS Smart Architecture as a Group Resource

Adding a smart architecture as one of the resources of a specific group allows the users of that
group to manage the architecture in question as long as they have the corresponding rights and
Granting access to a smart architecture as a resource also makes every physical server it contains
available. For more details, refer to the section Assigning Resources to a Group in the chapter
Managing Groups.
437
Chapter 34. Managing DNS Servers
The server is the highest level of the DNS hierarchy. It allows to resolve host queries and access
specific areas of a network, as server can be:
• Authoritative: A server that has authority over a number of domain names and can delegate
them.
• Recursive: A server that might contain information, if not it directs the querying host toward
the relevant DNS server to solve the query.
• Cache: A server that retrieves information (query results) and keeps it saved in order not to
have to query the same information over and over again.
You can create and manage 6 different types of servers: Efficient IP DNS, Efficient IP DNS
Package Microsoft DNS (including via AD), Nominum ANS, Generic DNS and Amazon Route
53. You can manage them independently or a via a smart architecture. For more details, refer to
the chapters Deploying DNS Smart Architectures and Managing DNS Smart Architectures.
In theory, when a host wishes to access a particular domain, a website for instance, a query is
sent to a DNS server that processes the resolution as follows:
1. The DNS client host sends a sequence of queries through a resolver to a recursive DNS
server;
2. The recursive server contacts the authoritative servers of the root domain. One of them returns
the IP address (an NS record) of the server that has authority over the concerned TLD;
3. The recursive server uses the IP address to connect to the TLD authoritative server and obtain
the IP address of the server that has authority over the zone;
4. The recursive server uses the IP address to connect to the zone authoritative server and obtain
the queried results;
5. The recursive server sends the results back to the DNS client.
.
Root Iterative
Server
.com
1 TLD Iterative
3 Server
5
DNS Client DNS Recursive

Server 4
.efficientip.com
Domain Iterative
Server
Figure 34.1. Diagram of a DNS query of www.efficientip.com via a recursive server
438
Managing DNS Servers
Obviously, such a mechanism would saturate the root zone. Which why a server can combine
recursive, cache and or authoritative functionalities.
Browsing DNS Servers

You can manage all your DNS servers from the page All servers.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 34.2. The server in the DNS hierarchy
Browsing the DNS Servers Database

To display the list of DNS servers
1. Go to the DNS tab.

2. Click on All servers in the breadcrumb. The page All servers opens.
To display the properties of a DNS server
3. At the end of the line of the server of your choice, click on . The server properties pages
opens.
On the properties page of a physical server, the panel DNS server statistics displays all queries
statistics in a set of graphs. Note that if you enabled the service DNS Guardian, this page also
contains a set of graphs dedicated to DNS Guardian. For more details, refer to the chapter DNS
Guardian.
Customizing the Display on the Page All Servers

Some columns provide more specific information regarding your servers:
Table 34.1. Available columns on the page All servers

Column Description
Guardian Provides information on the service DNS Guardian on the line of the servers compat-
ible with it. For more details, refer to the chapter DNS Guardian.
DNSSEC Indicates if the server is used as a DNSSEC resolver (Yes) or not (No). For more
details, refer to the chapter DNSSEC.
439
Understanding the DNS Server Statuses

The column Status provides information regarding the servers you manage.
Table 34.2. DNS server statuses

Status Description
OK The server is operational.
Timeout The server does not answer anymore due to a scheduled configuration of the server.
License The license used in SOLIDserver is not compliant with the added server: the license
is invalid.
Invalid credentials The SSL credentials are invalid.
Syntax error The server configuration could not be parsed properly.
Invalid settings There was a setting error during the server declaration. For instance, some settings
were added to a server that does not support them or a smart architecture is not
managing any physical server.
Invalid time The server editions performed from the GUI are not pushed to the server because
SOLIDserver time and date are incorrect. You must use the UTC system on the ap-
pliance, especially when managing Amazon Route 53 servers.
Insufficient privileges The provided account does not have sufficient privileges to remotely manage the
MS server.
Unmanaged The server is not available due to a disabling operation.
Invalid resolver SOLIDserver cannot resolve the AWS DNS service. The Amazon services are un-
reachable and the Amazon Route 53 server cannot be managed. Make sure that
the DNS resolvers declared on the page Network configuration are valid.
Unknown The server is not synchronized yet.
Unknown An error occurred that SOLIDserver could not identify.
Locked synchronization The server configuration is not viable. This status can be displayed on EfficientIP
DNS and EfficientIP DNS Package servers after importing a BIND archive file not
properly formed or containing non-supported BIND options. For more details, refer
to the section The Status Locked Synchronization.
Note that the column Sync changes in accordance with the column Status. While the server
synchronization is not OK yet, the column Sync might be Busy; it can also be in Locked
synchronization.
The column Multi-status provides you with emergency, warning, critical, error or informational
messages regarding the server compatibility with Hybrid. For more details, refer to the section
Managing EfficientIP DNS Servers

SOLIDserver provides a proprietary DNS server called EfficientIP DNS that allows to manage
your own server: you can manage its configuration and the data it contains.
From the GUI, you can:
• Add EfficientIP DNS servers, as detailed Adding an EfficientIP DNS Server.

• Edit EfficientIP DNS servers. For more details, refer to the section Editing DNS Servers.
• Delete EfficientIP DNS servers. For more details, refer to the section Deleting DNS Servers.
440
• Configure EfficientIP DNS servers. For more details, refer to the chapter Configuring DNS
Servers.
Before managing a new server make sure that the DNS service is correctly started. For
Adding an EfficientIP DNS Server

From the page All servers you can add an EfficientIP DNS Server. Once you added to the list,
you can manage its configuration and all its data.
The SNMP protocol is no longer supported as managing protocol for a server. Therefore:
• You can no longer add a DNS server managed via SNMP.

• Your existing servers in version 4.0.x or prior, migrated to 6.0.0, are still managed via SNMP
and listed in the GUI. However, the management of these servers is not detailed in this guide.
For more details, refer to the guide SOLIDserver-Administrator-Guide-5.0.4.pdf .
We recommend that you manage your server with SSL instead.
Before adding the server, keep in mind that the server name is very important. This name is
used to publish the NS records of the zone(s) that the server will manage. Besides, DNS clients
must be able to resolve this name when they query the server, so in each zone you must either
create an A record or glue records to ensure that they can.
To add an EfficientIP DNS server
3. In the menu, select Add > Server > EfficientIP DNS. The wizard Add a DNS server opens.
4. If you or your administrator created classes at the server level, in the list DNS server class
Table 34.3. DNS server basic parameters

Field Description
DNS server name Type in a DNS resolvable fully qualified domain name (FQDN) for your server.
Management IP address Type in the IPv4 address of your server. This field is required.
Isolated Tick this box if you do not want your server configuration to update the module
IPAM or DHCP, any advanced property set via the drop-down list Advanced
properties has to be applied to the server later on. This option is mainly useful
when dealing with migrations. Keep in mind that the server still receives data if
your network configuration allows it. Before unticking the box make sure that the
configuration you set suits your needs.
page All servers. This field is optional.
441
skip this step.
1

Field Description
Use TCP Tick the box if you want to use the TCP protocol instead of the UDP when the
network link is not reliable.
SNMP profile The SNMP profile used to retrieve the statistics. By default, standard v2c is se-
lected. The list contains the default profiles (standard v1, standard v2c and
standard v3) and the ones you may have created. Each profile has its own level
of security and enables the definition of a global security policy. For more details,
refer to the section Managing SNMP Profiles.
8. Click on NEXT . The page last page of the wizard appears.

9. Tick the box Enable HSM to start signing Master zones managed by the server using an
HSM. For more details, refer to the chapter HSM.
10. Depending on the administrator configuration, you may be able to fill in the advanced prop-
erties fields following the table below.

Field Description
Properties.
11. Click on OK to commit your creation. The report opens and closes. The server is listed. The
server might appear Busyin the column Status. It changes to OK after a while.
During the first DNS server addition, the allow-transfer option is by default configured
with the ACL admin. Within SOLIDserver admin corresponds to any, so you might need to
1
442
change the ACL and restrict the option use as it is inherited by the server zones. For more
details, refer to the chapter Limiting Zone Transfers at Server Level.
Once added, you can edit your server to secure its data exchanges with SOLIDserver. For more
details, refer to the section Securing the Management of DNS Servers Using a TSIG Key.
Editing the SNMP Monitoring Parameters of an EfficientIP DNS Server

Once added to the page All servers, you can edit the SNMP parameters to monitor your server.
The SNMP protocol is no longer supported as managing protocol for a server. If you want
to edit the SNMP parameters of a legacy server managed via SNMP, refer to the guide SOLID-
2
server-Administrator-Guide-5.0.4.pdf available on our website .
To edit the SNMP monitoring parameters of an EfficientIP DNS server
4. In the panel SNMP monitoring parameters, click on EDIT . The wizard SNMP parameters
opens.
5. Edit the monitoring parameters according to your needs:

Field Description
SNMP version The version of the SNMP protocol used to retrieve the statistics. It can be either
v1, v2c or v3. By default, v2c is selected.
6. Click on NEXT . The page SNMP profile opens.

page.
2
443
are currently working with. For more details, refer to the section Managing SNMP Profiles.
Managing Agentless Microsoft DNS Servers

You can manage Microsoft DNS servers without installing any WinDNS agent, which is why we
call them Agentless Microsoft DNS servers.
SOLIDserver can reproduce the Microsoft's Multi-Master behavior with the smart architec-
ture Multi-Master. This architecture supports Microsoft DNS server, SOLIDserver DNS, BIND
server and Nominum's ANS server as well. For more details, refer to the section Multi-Master
Smart Architecture.
Since version 6.0.0, SOLIDserver no longer supports Microsoft DNS servers with agent.
Understanding the Agentless Server Management

The Agentless Microsoft DNS server management through SOLIDserver is based on the Microsoft
Remote Procedure Calls (MSRPC). This inter-process communication technique provides an
efficient method to extend the notion of conventional, or local procedure calling, in such a way
that there is no need to have the called procedure and the calling procedure in the same space
of addresses anymore. The two processes can either be on the same system or on different
systems as long as they have a network connecting them. That way, programmers of distributed
applications avoid the details of the interface with the network. Plus, the transport independence
of RPC isolates the application from the physical and logical elements of the data communications
mechanism and allows the application to use a variety of transports.
Through MSRPC, the client first calls a procedure to send a data packet to the server. Upon re-
ception of the packet, the server calls a dispatch routine to perform the requested service, and
then sends back a reply. Finally, the procedure call returns to the client. That's how EfficientIP
offers a way of managing your Microsoft DNS server without requiring the installation of an agent.
Prerequisites
To successfully manage an agentless Microsoft DNS server you need:
• To ensure that the service DNS is properly started. For more details, refer to the chapter Ser-
vices Configuration.
• A Microsoft Window Server 2008, 2008 R2, 2012 R2 or 2016. The server must:
• Have the TCP ports 135 and 445 open. They are used by the port mapper interface, the
services that indicates to the clients which port provides access to each service.
• Have Firewall policies that allow traffic between SOLIDserver and the Microsoft servers it
manages.
• In Windows Server 2008, RPC uses by default the dynamic port range 49152-65535. Note
that you can reduce the number of available ports, as long as you respect the minimum
3
number of ports required in the range is 255, via the netsh tool .
• The credentials of a member of the groups DnsAdmins and Domain Admins. Users with insuf-
ficient privileges cannot manage the server.
3
For information, refer to http://support.microsoft.com/kb/929851 .
444
• The zones of the MS Agentless DNS server must allow the server management IP address in
their statement allow-transfer.
Adding an Agentless Microsoft DNS Server

Before adding an Agentless Microsoft DNS server make sure you meet the Prerequisites.
If your Microsoft DNS server is integrated to an AD with several forests, you can use the expert
mode during the server addition to specify the domain of the AD that you want to manage.
To add an agentless Microsoft DNS server
3. In the menu, select Add > Server > Microsoft DNS (agentless). The wizard Add a DNS
server opens.
5. Configure the server basic parameters:

Field Description
DNS server name Type in an FQDN name for the server. This field is required.
a
Management IP address Type in the IPv4 address of the Microsoft DNS server you want to manage . This
field is required.
Description Type in a description if you want. This field is optional.
a
With the proper Network Configuration, if you enter the name of your DNS server in this field and click on SEARCH ,
the IP address is retrieved from the DNS and displayed.

Field Description
445
Field Description
Properties.

8. In the field User, type in the name of a user with sufficient management privileges over the
Windows DNS server.
9. In the field Password, type in the corresponding password.
10. If your Windows DNS server is integrated to Active Directory and contains several forests:
a. Tick the box Expert mode (AD). The field AD domain appears
b. In the field AD domain, type in the full domain or subdomain.
11. Click on OK to commit your creation. The report opens and closes. The server is listed, the
column Version indicates the Microsoft server version.
Limitations
The management of Microsoft DNS servers within SOLIDserver has some limitations. For more
details regarding the MS servers limitations, refer to the documentation provided by Microsoft.
Server Limitations
Server Refresh Limitations

The DNS server parameters, the list of zones and their parameters have to be refreshed
manually. However, the content of the zones is still refreshed automatically every 3600
seconds (by default).
AD Integrated Server Limitations
The AD configuration of the AD integrated DNS servers often includes security settings that
prevent the creation or modification of the DNS zones.
Forward Parameter Limitations
If the Forward parameter is set to != none at server level but a list of forwarders is provided
anyway, the forwarders are pushed onto the MS DNS server.
ACL Limitations
Microsoft behavior when processing an ACL allow-update
Table 34.9. Limitations for the ACL allow-update

Allow-update Set To MS Behavior
admin;any; The update rights are granted to anyone.
any; The update rights are granted to anyone.
admin; If the zone is AD integrated, the update is changed to Secure Only.
Any other parameter The update is impossible, the allow-update is set to no update.
446
Microsoft behavior when processing an ACL allow-transfer
Table 34.10. Limitations for the ACL allow-transfer

Allow-transfer Set To MS Behavior
any; The transfer rights are granted to anyone.
No parameter is set The transfer rights are granted to anyone.
none; The transfer rights are not granted to anyone.
eip_ns_only; Only the transfer of the zone NS resource records is granted.
Any other parameter If ACLs are set, they are ignored.
Any other parameter If IP addresses are listed, the allow-transfer is granted to the Specified IP Address
List and to the zone NS resource records.
Zone Limitations
Reverse Addressing Limitation in IPv6

The zones e164.arpa (phone numbers dedicated reverse mapping domain suffix) and ip6.int
(deprecated reverse mapping name space) are not supported by Microsoft.
Forwarding Limitation
Microsoft does not support the creation of Forward zones with the forwarding parameter set
to None.
Notify Limitation
If nothing is specified during the Notify configuration then by default, the Notify is set to NS
only.
AD Integrated Limitation
The AD replication behavior set on the zones of an Active Directory integrated Microsoft DNS
server cannot be edited. Once set, you cannot edit or remove the replication behavior selected,
you must delete the zone and recreate it with the configuration that suits your needs.
RR Limitations
The Agentless MS DNS server management supports the following resource records: SOA, A,
NS, PTR, MX, CNAME, SRV, TXT and AAAA.
Managing BIND DNS Servers

SOLIDserver provides its software versions through native packages of operating system. Installing
the DNS package allows you to use the DNS module of SOLIDserver at the best of its potential
on Linux: it allows you to manage your BIND server through an EfficientIP DNS server, which
incidentally provides all the options that come with it (statistics retrieved via SNMP...).
Since version 6.0.0, the addition of Linux Packages v4 that respected the SNMP protocol
and worked with SSL is no longer supported. If you migrated your database with such servers,
4
refer to the guide SOLIDserver-Administrator-Guide-5.0.4.pdf available on our website .
Managing EfficientIP BIND Linux Packages

In the sections below are a set of procedures to successfully install the DNS packages, formerly
known as EfficientIP BIND Linux Packages v5, on Linux Debian and CentOS/RedHat.
4
447
Installing the EfficientIP DNS Package for Linux Debian 9 and prior - 64 bits
Prerequisites
• The DNS package file, ipmdns-y.y.y-debianxx-amd64.deb, whose name provides you with a
number of information separated by hyphens: the type of package (ipmdns, so a DNS package),
the version of SOLIDserver (y.y.y); the version of Debian (debianxx where xx is x dot x) and
finally the Debian architecture (amd64).
In the procedure below, this file is referred to as <ipmdns-y.y.y-debianxx-amd64.deb>.

• The EfficientIP BIND package platform must have at least 20 Mb of free disk space.
• The EfficientIP BIND package may need certain libraries of your operating system, you must
5
• You must make sure that SOLIDserver and Debian are set to the same time and date.
• You must make sure that the service dbus is installed.
• You must make sure that HTTPS (port 443) and the DNS service (port 53) are not blocked by
a network filtering process (firewall).
Installing the EfficientIP DNS Package
You can install the EfficientIP DNS Package on Debian Linux.
If you have not installed the DHCP packages yet, you need to:
1. Follow the procedure To install the EfficientIP DNS Package on Debian.

2. Follow the procedure To complete the DNS package installation on Debian if the DHCP
package is not installed.
If you already installed the DHCP packages, you only need to follow the procedure To install
the EfficientIP DNS Package on Debian below.
The procedure below includes the commands that make the web services configurable.
To install the EfficientIP DNS Package on Debian

2. Stop and disable your DNS software: If you are using NSD or Unbound, refer to the related
proprietary documentation. In the case of BIND, use the following commands:
# service bind9 stop
# update-rc.d -f bind9 remove
3. Install the dependency packages, ONLY if you have not installed the EfficientIP DHCP
package, using the following commands:
5
448

# apt-get install php5

# apt-get install php
4. Install the EfficientIP DNS package, using the following command:

# dpkg -i <ipmdns-y.y.y-debianxx-amd64.deb>
5. Make the web services configurable: in the directory /etc/sudoers.d, create the file ipmdns
www-data ALL = NOPASSWD: /usr/local/nessy2/script/install_named_conf.sh, \
/usr/local/nessy2/script/push_default_zone_params.sh, \
/usr/local/nessy2/script/push_dnssec_keys_zones.sh, \
/usr/local/nessy2/script/move_dnszone_file.sh, \
/usr/local/nessy2/script/restore_named_conf.sh, \
/usr/local/nessy2/script/delete_zone_file.sh, \
/usr/local/nessy2/script/restore_zone_file.sh, \
/usr/local/nessy2/script/install_keytab.sh, \
/usr/local/nessy2/bin/rndc

# chmod 440 /etc/sudoers.d/ipmdns
# htpasswd -c /usr/local/nessy2/www/php/cmd/dns/.htpasswd admin
If you have not installed the DHCP package or are not planning on installing it, you must
To complete the DNS package installation on Debian if the DHCP package is not
installed

2. Allow SNMP access to the DNS statistics: append the file /etc/snmp/snmpd.conf with the
following line.
view systemonly included .1.3.6.1.4.1.2440


# cd /etc/apache2
5. Activate the SSL mode in Apache using the following command:
449
# a2enmod ssl
6. Make sure that a symbolic link to the default VirtualHost SSL configuration file is located in
the folder sites-enabled/ . If not, use the following command.

# ln -s /etc/apache2/sites-available/default-ssl /etc/apache2/sites-enabled/

# a2ensite default-ssl
7. Configure the web services.
a. For Debian 7 and prior, in the file /etc/apache2/sites-enabled/default-ssl, replace the

FULL section <VirtualHost *:443> with the configuration below.
<VirtualHost *:443>
AllowOverride All
</Directory>

SSLEngine on
force-response-1.0
</VirtualHost>
b. For Debian 8 and Debian 9, in the file /etc/apache2/sites-enabled/default-ssl.conf, replace

the FULL section <VirtualHost *:443> with the configuration below.
<VirtualHost *:443>
Require all granted
Options Indexes
</Directory>

450

SSLEngine on
force-response-1.0
</VirtualHost>
8. Disable the default site in Debian Apache configuration using the following commands.

# cd /etc/apache2/sites-enabled
# unlink 000-default

# a2dissite 000-default

# service apache2 restart
10. Make sure that the ipmdns package is running using the following command:
# service ipmdns status

# service ipmdns start
Once the configuration is complete, you can add an EfficientIP Package DNS server to manage
your BIND server from SOLIDserver GUI. Refer to the procedure in the section Adding a BIND
DNS Server for more details.
Installing the EfficientIP DNS Package for Linux CentOS/RedHat 7 and prior - 64 bits
Prerequisites
• The DNS package file, ipmdns-y.y.y-redhatx.x86_64.rpm, whose name provides you with a
number of information separated by hyphens or a point: the type of package (ipmdns, so a
DNS package), the version of SOLIDserver (y.y.y); the version of RedHat (redhatx) and finally
the RedHat architecture (x86_64).
In the procedure below, this file is referred to as <ipmdns-y.y.y-redhatx.x86_64.rpm>.

• The EfficientIP BIND package platform must have at least 20 Mb of free disk space.
• The EfficientIP BIND package may need certain libraries of your operating system, you must
6
6
451
• You must make sure that SOLIDserver and RedHat/CentOS are set to the same time and date.
• You must make sure that HTTPS (port 443) and the DNS service (port 53) are not blocked by
a network filtering process (firewall).
Installing the EfficientIP DNS Package
You can install the EfficientIP DNS Package on both RedHat and CentOS Linux.
If you have not installed the DHCP packages yet, you need to:
1. Follow the procedure To install the EfficientIP DNS Package on RedHat and CentOS.
2. Follow the procedure To complete the DNS package installation on RedHat/CentOS if the
DHCP package is not installed.
If you already installed the DHCP packages, you only need to follow the procedure To install
the EfficientIP DNS Package on RedHat and CentOS below.
The installation procedure below also includes the commands that make the web services con-
figurable.
To install the EfficientIP DNS Package on RedHat and CentOS

2. Stop and disable your DNS software, using the following commands:
# service named stop
# chkconfig named off
3. Install the dependency packages, ONLY if you have not installed the EfficientIP DHCP
package, using the following commands:
# yum install mod_ssl php php-pdo sudo net-snmp
4. For RedHat/CentOS version 5 or 6, you must install the dependency packages:
a. Install the repository EPEL:

# yum install epel-release
b. Install the library GeoIP in the repository epel-release:

# yum install GeoIP
5. Install EfficientIP DNS package, using the following command:

# rpm -ivh <ipmdns-y.y.y-redhatx.x86_64.rpm>
6. Make the web services configurable: in the directory /etc/sudoers.d, create the file ipmdns
452
apache ALL = NOPASSWD: /usr/local/nessy2/script/install_named_conf.sh, \

/usr/local/nessy2/script/push_default_zone_params.sh, \
/usr/local/nessy2/script/push_dnssec_keys_zones.sh, \
/usr/local/nessy2/script/move_dnszone_file.sh, \
/usr/local/nessy2/script/restore_named_conf.sh, \
/usr/local/nessy2/script/delete_zone_file.sh, \
/usr/local/nessy2/script/restore_zone_file.sh, \
/usr/local/nessy2/script/install_keytab.sh, \
/usr/local/nessy2/bin/rndc

# chmod 440 /etc/sudoers.d/ipmdns
# htpasswd -c /usr/local/nessy2/www/php/cmd/dns/.htpasswd admin
If you have not installed the DHCP package or are not planning on installing it, you must
To complete the DNS package installation on RedHat/CentOS if the DHCP package

is not installed

2. Disable the firewall using the following commands.

# service iptables stop
# chkconfig iptables off
# service firewalld stop
# chkconfig firewalld off
3. Disable selinux. In the file /etc/selinux/config, modify the line SELINUX=enforcing to match
the following one:
SELINUX=disabled
Note that changing the selinux policy requires you to restart the system.
4. Reboot the system to take into account the selinux policy changes :
# reboot
5. In the file /etc/sudoers, disable requiretty by making it a comment as follows:

#Defaults requiretty
6. Allow SNMP access to the DNS statistics. In the file /etc/snmp/snmpd.conf , in the section
entitled Access Control, enter the lines:
master agentx
view systemview included .1.3.6.1.4.1.2440
#You may need to specify another view, AllView or a custom one,
#if you edited the default SNMP configuration.

453

# cd /etc/httpd
9. Configure the web services. In the file /etc/httpd/conf.d/ssl.conf, replace the FULL section
<VirtualHost *:443> with the configuration below.

<VirtualHost *:443>
AllowOverride All
</Directory>
# Please note that the following data, from "php_admin_value" to "site:/usr/local/share/pear",

SSLEngine on
# Please note that the following data, from "SetEnvIf" to "force-response-1.0", represents
# and must be written on a single line.
force-response-1.0
</VirtualHost>
<VirtualHost *:443>
Require all granted
Options Indexes
</Directory>
# Please note that the following data, from "php_admin_value" to "site:/usr/local/share/pear",

SSLEngine on
454
# Please note that the following data, from "SetEnvIf" to "force-response-1.0", represents
# and must be written on a single line.
force-response-1.0
</VirtualHost>

# service httpd restart
11. Make sure that the ipmdns package is running using the following command:
# service ipmdns status

# service ipmdns start
Once the configuration is complete, you can add an EfficientIP Package DNS server to manage
your BIND server from SOLIDserver GUI. Refer to the procedure in the section Adding a BIND
DNS Server for more details.
Upgrading Packages
No matter the package version, to upgrade packages:
1. You must uninstall your current packages.

2. You must install the new package following the prerequisites and procedures detailed above
in the section Managing EfficientIP BIND Linux Packages.
Adding a BIND DNS Server

Once you successfully installed your EfficientIP BIND Linux package, you need to install an Effi-
cientIP DNS package and configure it according to your needs to manage BIND servers though
the GUI.
To add a BIND DNS server for a Linux package
3. In the menu, select Add > Server > EfficientIP DNS Package. The wizard Add a DNS server
opens.
455

Field Description
Management IP address Type in the IPv4 address of your server. This field is required.
go to step 7.
7

Field Description
SNMP port The port used to retrieve the server statistics. By default, the port 161 is used. If you
changed the UDP port of your SNMP server, you must use the same port. For more
details, refer to the section Managing the SNMP Service.
Use TCP Tick the box if you want to use the TCP protocol instead of the UDP when the network
link is not reliable.
SNMP profile The SNMP profile used to retrieve the statistics. By default, standard v2c is selected.
The list contains the default profiles (standard v1, standard v2c and standard v3) and
the ones you may have created. Each profile has its own level of security and enables
the definition of a global security policy. For more details, refer to the section Managing
SNMP Profiles.
SNMP retries The number of connection attempts when the server is in timeout. You can set it
between 0 and 5. By default, it is set to 2 attempts.
SNMP timeout The number of seconds between each connection attempt. You can set it between

Field Description
7
456
Field Description
Properties.
9. Click on OK to commit the creation. The report opens and closes. The list is visible again.
The server appears in the list with status Busy. It changes to OK after a while.
During the first DNS server addition, the allow-transfer option is by default configured
with the ACL admin. Within SOLIDserver admin corresponds to any, so you might need to
change the ACL and restrict the option use as it is inherited by the server zones. For more
details, refer to the chapter Limiting Zone Transfers at Server Level.
Once the EfficientIP Package server is added, you can manage your BIND server in Linux from
the GUI.
Managing Generic DNS Servers

SOLIDserver can manage generic DNS servers that are not: EfficientIP, Microsoft, or EfficientIP
BIND packages. However, the possibilities for managing such servers are more restricted than
they are for other DNS servers. If these DNS servers support dynamic DDNS updating as de-
scribed in RFC 2136, the contents of their zones can be administered by SOLIDserver manage-
ment console. The Generic DNS management imports the data through zone transfers from the
remote DNS server. The remote DNS server must allow zone transfers. This can be performed
by configuring the IP address of the SOLIDserver management to which the data should be im-
ported.
Adding a Generic DNS Server

To fully configure and manage a Generic DNS server, you need to follow three procedures in
order to:
• Add a Generic server to the list All servers.

• Configure its TSIG parameters if need be.
• Add the DNS zones that should be managed through the server.
To add a generic DNS server
3. In the menu, select Add > Server > Generic DNS. The wizard Add a DNS server opens.
5. Fill in the fields below:
457

Field Description
Management IP address Type in the IP address of your server. This field is required.
6. Click on OK to commit the addition. The server is listed in the page All servers.
To add generic DNS server zones
3. Click on the name of the Generic server. The page All zones opens.
4. In the menu, select Add > DNS zone. The wizard Add a DNS zone opens.
5. If you or your administrator created classes, the list DNS zone class is visible. Select a class
or None.
7. In the list DNS zone type, select Master.
8. In the list DNS zone resolution, select Name.
9. Click on NEXT , the next page opens.
Table 34.15. Master zone creation fields

Field Description
Name Type in the zone name you chose. It should strictly conform with the syntax given
in RFC1034.
Space Select the space tied to that zone. Assigning IP addresses in the selected space
updates the DNS zone you are creating.

12. The fields on that page are automatically filled. However you can edit them following the
table below. All the fields are required.
Table 34.16. Zone advanced parameters

Field Description
Primary server Specify the primary Master server for the zone.
Responsible Specify the administrator email address for the zone.
Serial number The zone serial number. It is automatically incremented for each zone change.
Refresh The refresh period for slave server(s). When the selected period is reached, the
slave server(s) read the Master SOA record and, if their data is not up-to-date,
trigger a zone transfer to get the latest version of the zone.
Retry The retry interval if the server fails to reach the master during a refresh cycle.
458
Field Description
Expire The period after which the records are considered to be no longer valid/authorit-
ative and the server stops responding to queries for the zone.
Minimum The negative caching period of the zone, in seconds. This period is used as TTL
for every NXDOMAIN returned to clients querying unexisting records.
TTL The TTL (Time to Live) of the SOA, its duration, in seconds. The drop-down list
next to the input field allows to select durations in human-readable format.
You can set the value by default for the parameters above, except for the Primary server
and Serial number. For more details, refer to the procedure To configure the default SOA
parameters below.
13. Click on OK to commit the creation. The report opens and closes. The report opens and
closes. The zone is listed and marked Delayed create before being marked OK.
Managing Nominum ANS Servers

In addition to traditional DNS servers, SOLIDserver allows you to manage Nominum authoritative
name servers (ANS).
To fully configure and manage a Nominum DNS server, you first need to prepare the ANS security
key, or password, related to said server and follow the procedures below in order to:
• Add a Nominum server to the list All servers.

• Add the DNS zones that should be managed through the server.
Adding a Nominum ANS Server

From the DNS All servers list you can add a Nominum ANS server.
To add a Nominum ANS server
3. In the menu, select Add > Server > Nominum ANS. The wizard Add a DNS server opens.
5. Fill in the fields below:

Field Description
Management IP address Type in the IP address of your server. This field is required.
459
Field Description
ANS key Type in the security key, or password, configured on the Nominum server. This
field is required.

Field Description
Properties.
7. Click on OK to commit the addition. The server is listed on the page All servers.
Adding Zones to a Nominum ANS Server

Once you created a Nominum ANS server, you can add your zones from its All zones list.
To add ANS server zones
3. Click on the name of the Nominum ANS server. The page All zones opens.
5. If you or your administrator created classes at zone level, in the list DNS zone class select
a class or None. Click on NEXT . The next page of the wizard opens.
7. In the list DNS zone resolution, select Name.
460
Table 34.19. Master zone creation fields

Field Description
Name Type in the zone name you chose. It should strictly conform with the syntax given
in RFC1034.
Space Select the space tied to that zone. Assigning IP addresses in the selected space
updates the DNS zone you are creating.

11. The fields on that page are automatically filled. However you can edit them following the
table below. All the fields are required.
Table 34.20. Zone advanced parameters

Field Description
Primary server Specify the primary Master server for the zone.
parameters below.
12. Click on OKto commit the creation. The report opens and closes. The zone is listed and is
marked Delayed create before being marked OK.
Managing Amazon Route 53 Servers

SOLIDserver supports the management of Route 53 DNS servers.These servers provide a cloud
based Anycast DNS service available for Amazon Web Service (AWS) account owners.
From the DNS All servers page, you can add your Route 53 server using your AWS account
credentials. Once listed in the GUI, you can add, edit and/or delete the server zones and resource
records.
Prerequisites
• You must have an AWS account with a subscription to the service Amazon Route 53.
• You must have an Amazon user that should only have access to the service Amazon Route
53 and sufficient rights to manage the service.
461
For security reasons, we strongly recommend that you create this user through the Amazon
IAM module. Besides, the user needs an Access Key ID and a Secret Access Key to manage
the service, you should also generate these keys using the module IAM.
• Before adding the server to SOLIDserver, you should have your AWS account Access Key ID
and Secret Access Key ready.
• You must use the UTC system to ensure that SOLIDserver and the AWS account are set at
the same time. For more details, refer to the procedure To set your appliance time zone and/or
date format.
• Make sure SOLIDserver is able to contact the AWS services using REST and HTTPS. Other-
wise, even if you add the server to the GUI, it stays in Timeout.
Limitations
Amazon Route 53 Server Limitations
• SOLIDserver only supports unique zone names within one server.
If your Amazon Route 53 server contains several zones named the same way, none of them
can be managed through the GUI.
• DNSSEC is not supported on Amazon Route 53 servers.
• The edition options are limited:
• You can only edit the Main properties and Group access panels of an Amazon Route 53
server managed outside a smart architecture.
• Once an Amazon Route 53 server is managed through a smart architecture, you can only
edit the panel Group access on the server properties page.
• Converting master zones to slave on Amazon Route 53 servers deletes all the records of
the original master zone.
• Some options are not supported on Amazon Route 53 servers:
• You cannot edit the access control of an Amazon Route 53 server or its zone.
• You cannot edit the options of an Amazon Route 53 server or its zone.
These options cannot be edited either from SOLIDserver or from the service Amazon Route
53 itself.
• Some AWS options are not supported by SOLIDserver: the record options Heatlh Check and
Routing Policy are not supported.
If any AWS zone contains records configured with these options, the entire zone is not syn-
chronized.
Amazon Route 53 Zone and Record Limitations
Before managing an AWS server from the GUI, we recommend that you check the prerequisites,
specificities and limitations of the AWS zones and records you are managing. They are all listed
in the sections Managing Amazon Route 53 Zones.
Adding an Amazon Route 53 Server

When adding an Amazon Route 53 server, you do not need to provide an IP address. Thanks to
the AWS account credentials, SOLIDserver identifies your Amazon Route 53 server and commu-
nicates directly with it using REST protocol.
462
If you have several AWS accounts, you can manage all your Amazon Route 53 servers from the
GUI.
Once you comply with the Prerequisites, you can follow the procedure below.
To add an Amazon Route 53 server
3. In the menu, select Add > Server > Amazon Route 53. The wizard Add a DNS server opens.

Field Description
DNS server name Specify the FQDN name of your server. This field is required.

Field Description
Properties.

8. In the field Access Key ID, type in your AWS account Access Key ID.
9. In the field Secret Access Key, type in the corresponding Secret Access Key.
10. Click on OK to commit the addition. The server is listed on the page All servers.
Once you added an Amazon Route 53 server:
463
• The server stays in Invalid time if SOLIDserver and the AWS account are not set at the same
time. SOLIDserver must be set to UTC. For more details, refer to the procedure To set your
appliance time zone and/or date format.
• If you edit the content of an Amazon Route 53 server directly from the AWS account, you need
to synchronize the server in SOLIDserver GUI. For more details, refer to the procedure To
synchronize DNS servers.
• If your internal network policies prevent you from accessing Amazon services directly, you
might need to set a proxy server via a registry database entry to handle Amazon Route 53 re-
quests, as described below.
To set a proxy server for Amazon Route 53

opens.
3. In the search field Name, type in module.dns.route53.proxy and filter the list.
4. In the column Value, click on the corresponding value. The wizard Registry database Add
an item opens.
5. In the field Value, type in the server configuration as follows: <hostname_or_ip>:<port>.
If need be, you can also define the access credentials as follows: <username>:<pass-
word>@<hostname_or_ip>:<port>.
6. Click on OK to commit your changes. The report opens and closes. The page refreshes
and the key is listed.
Managing an Amazon Route 53 Server With a Smart Architecture

All the smart architectures can manage Amazon Route 53 servers, either alone or in addition to
other physical servers:
• Single-server: no requirement.
• Multi-Master: in addition to at least one Master server and with no Slave server.
• Master/Slave: in addition to at least one Master server and one Slave server.
• Farm: in addition to at least one Master server and one Slave server.
• Stealth: in addition to at least one Hidden-master server and one Pseudo-master server.
Before adding your server to a smart:
• We recommend that you tick the AWS server and generate the report Route 53 Incompatib-
ilities. That way you can edit the server if need be and make sure that the server you manage
through the smart is properly configured. For more details, refer to the section DNS Server
Reports.
• Make sure your AWS server status is OK.
Once you manage an Amazon Route 53 server with a smart architecture:
• It has the role Cloud.
464
• It cannot be set as Master or Slave.

• Only the Master zones of the other physical servers managed through the smart architecture
are replicated on the Amazon Route 53 server.
• Only the supported configuration settings of the other physical servers managed through the
smart architecture are pushed to the Amazon Route 53 server. For more details, refer to the
section Limitations.
• The smart architecture management remains the same: the smart architecture replicates all
the server options and content from one server to the other. However, all the configuration
settings that are incompatible with Amazon Route 53 servers, or not supported, are not replicated
and displayed in the Multi-Status column.
• Any changes performed from the GUI - zones or records addition, edition or deletion - automat-
ically refresh the server, it then replicates the information to your AWS account server.
• You cannot delete the awsdns NS records from the list All RRs of the smart architecture. The
resolution of the Amazon Route 53 server zones rely on them.
Adding an Amazon Route 53 Server When Creating a Smart Architecture
You can add an Amazon Route 53 server to the management of the smart while creating the
smart architecture.
This allows to automate the synchronization of the AWS server content. Therefore, all your zones
and records are retrieved by the smart and replicated to all the physical servers you might manage
as well with the new smart.
To add an Amazon Route 53 server to a smart architecture you are creating
opens.
4. Fill in the basic parameters. Click on NEXT . The next page of the wizard opens. For more
details, refer to the section Adding a DNS Smart Architecture.
5. In the list DNS smart architecture, select an architecture. Click on NEXT . The page DNS
servers role configuration opens.
6. If you are creating a Single-Server smart architecture:
a. In the drop-down list Available DNS servers, the AWS server is listed.
b. Click on + MASTER to add it to the Master DNS server(s) list and manage it via the smart
architecture. Being an AWS server, it actually is not Master, it is the only server of the
smart. For more details regarding the box Expert mode, refer to the section Single-
Server Smart Architecture.
7. If you are creating a Master/Slave, Stealth or Multi-Master smart architecture:
a. At the bottom of the page, tick the box Cloud settings. Two fields appear.
b. In the drop-down list Available Cloud DNS servers, select the Amazon Route 53 server
of your choice.
c. Click on + CLOUD . The selected server is moved to the Cloud DNS servers list.
465
d. If you want to add other servers to the smart architecture, refer to the section Adding a
DNS Smart Architecture.
8. If you are creating a Farm smart architecture:
a. At the bottom of the page, tick the box Cloud settings. Two fields appear.
b. In the drop-down list Available Cloud DNS servers, select the Amazon Route 53 server
of your choice.
c. Click on + CLOUD . The selected server is moved to the Cloud DNS servers list.
d. If you want to add other servers to the smart architecture, refer to the section Adding a
DNS Smart Architecture.
e. Click on NEXT . The page Advanced settings opens, finish the configuration following
the procedure in the section Farm Smart Architecture.
9. Click on OK to commit your creation. The report opens and closes. The smart architecture
is listed, if you do not see the servers it manages, click on .
Adding an Amazon Route 53 Server in an Existing Smart Architecture
If you add an Amazon Route 53 server to an existing smart architecture managing other servers,
keep in mind that the zones it contains rely on a specific set of NS records to run properly. Without
all these records, the zones are not viable.
Therefore, the smart architecture automatically:
• Retrieves the content of the AWS server.

• Replicates the content of your AWS server (all the additional NS records) on all the physical
servers managed. The All RRs list of all the servers should therefore contain awsdns records.
To add an Amazon Route 53 server into an existing smart architecture
page opens.
5. If need be, edit the server basic parameters. For more details, refer to the section Adding a
DNS Smart Architecture. Click on NEXT . The next page of the wizard opens.
6. In the list DNS smart architecture, edit the type of DNS smart architecture if need be. Click
on NEXT . The page DNS servers role configuration opens.
7. At the bottom of the page, tick the box Cloud settings. Two fields appear.
8. In the drop-down list Available Cloud DNS servers, select the Amazon Route 53 server of
your choice. Only the servers that are not already managed by a smart architecture are listed.
9. Click on + CLOUD . The selected server is moved to the Cloud DNS servers list.
click on NEXT . The page Advanced settings opens. For more details, refer to the relevant
smart architecture addition procedure in the section Adding a DNS Smart Architecture.
466
11. Click on OK to commit your changes. The report opens and closes. The synchronization,
sends the physical servers information to your AWS account server. You can display the
smart architecture physical servers on the list All servers using the button in the upper
right corner.
You can check that the replication is properly performed on the page All RRs of the smart archi-
tecture. They should be all listed and OK.
On the page All zones, the column Multi-status indicates any replication problems.
Removing an Amazon Route 53 Server from a Smart Architecture
At any time, you can stop managing an AWS server via a smart architecture.
To successfully remove an AWS server from a smart:
1. Follow the procedure To remove an Amazon Route 53 server from a smart architecture.
2. If your smart architecture manages other servers, follow the procedure To delete Amazon
Route 53 NS resource records: you should remove the awsdns NS records as they are no
longer relevant for the smart architecture.
To remove an Amazon Route 53 server from a smart architecture
page opens.
5. Click on NEXT . The smart architecture dedicated page opens.
7. Depending on the smart architecture you are editing, in the field Master DNS server(s) list
or Cloud DNS servers list, select the server to remove and click on .
The server is moved back to the list Available DNS servers or Available Cloud DNS servers.
9. Click on OK to commit your modifications. The report opens and closes. If your configuration
is still managing DNS servers, you can display them in the list All servers using the button
in the upper right corner.
To delete Amazon Route 53 NS resource records
3. In the column Zone, click on the name of the zone of your choice to display the RRs it con-
tains.
4. In the column Type, filter the list to only display NS records.
467
5. In the field Value, filter the list to display awsdns records.

6. Tick the record(s) you want to delete.
8. Click on OK to validate the deletion. The RR is marked Delayed delete and is then no
longer listed.
Managing Amazon Route 53 Zones

From the GUI you can manage the existing zones of an Amazon Route 53 server and add, edit
or delete AWS zones as well.
However, there are some prerequisites, specificities and limitations to take into account.
Prerequisites
• The zone name must be unique: if several zones of the Amazon Route 53 server share the
same name on your AWS account, you cannot manage any of them.
• The zone name must be FQDN and include a TLD.
• Make sure that SOLIDserver is using UTC system, otherwise any changes made from the GUI
cannot be pushed to your AWS account server.
AWS Zones Specificities
• You can only add or import Master zones. For more details, refer to the sections Adding a
Master Zone and Importing Zones.
• Your zone contains by default an SOA specific to Amazon Route 53 and four awsdns NS re-
cords.
• On the zones properties page, the Name servers panel lists all the NS records of the zone.
• Adding, editing or deleting zones automatically refreshes the server and replicates your changes
to the AWS account server.
• The report Zones NS and IP addresses allows you to retrieve the IP address of each of your
NS records. For more details, refer to the section DNS Zone Reports.
Limitations
• If your AWS zones contain records configured with the options Heatlh Check and Routing
Policy, they cannot be synchronized. These options are not supported by SOLIDserver. You
must remove these options directly via your AWS account to then be able to synchronize and
manage the zone via the GUI.
Managing Amazon Route 53 Records

From the GUI you can manage the existing records of your AWS zones, as well as add, edit or
delete Amazon Route 53 resource records.
However, there are some prerequisites, specificities and limitations to take into account.
Prerequisites
• Make sure that SOLIDserver is using UTC system, otherwise, any change made from the GUI
cannot be pushed to your AWS account server.
468
AWS Records Specificities
• Each zone contains by default four NS records with the value awsdns, specific to Amazon
Route 53 servers.
• Each zone contains by default an SOA record named after one the NS records. For that reason,
even if the server is managed by a smart architecture, the SOA name is not overwritten by the
name of the smart architecture server.
Limitations
• Only a set of records is supported by Amazon Route 53 servers: NS, MX, A, AAAA, PTR,
CNAME, TXT and SRV. For more details, refer to the section Adding Resource Records.
• If your server is managed via a smart architecture, you can add other types of records, but
their status is N/A and they are not taken into account, or replicated, by your Amazon Route
53 server.
• AWS records configured with the options Heatlh Check and Routing Policy are not supported.
If a zone contains them, it cannot be synchronized.
• The AWS zones resolution relies on the awsdns NS records, so you cannot delete them from
a zone, an AWS server or a smart architecture managing an AWS server.
However, if you stop managing an Amazon Route 53 server via a smart architecture, you can
remove the awsdns records from the smart architecture All zones list as they are no longer
relevant.
Synchronizing DNS Servers

The synchronization of most servers is automatic but administrators can synchronize servers
manually to integrate faster changes made to the zones or views databases.
Amazon Route 53 servers must be synchronized if they were edited directly from the AWS account.
Some data, like the panel Sources of physical servers, is only visible once the server has been
successfully synchronized at least once.
To synchronize DNS servers
3. Tick the zone(s) you want to synchronize.
4. In the menu, select Edit > Synchronize. The wizard Synchronization opens.
5. Click on OK to commit the synchronization. The report opens and closes. The page reloads.
Editing DNS Servers

To edit any kind of DNS server configuration, you need to open its properties page and edit the
panel(s) of your choice.
Before proceeding, note that:
• The panels that do not contain the button EDIT cannot be edited.
469
• The basic server parameters are detailed in the addition procedures of each kind of physical
server.
• The SNMP protocol is no longer supported as managing protocol for a server, so editing
the management protocol from SNMP to SSL is non reversible.
For more details regarding all the server configuration possibilities (forwarding, recursion, transfer,
blackhole, sortlist, etc.), refer to the chapter Configuring DNS Servers.
You can edit EffcientIP, Nominum and Generic servers to secure their data exchanges with
SOLIDserver. For more details, refer to the section Securing the Management of DNS Servers
Using a TSIG Key.
To edit a DNS server
5. Open all the panels using .
6. In the panel of your choice, click on EDIT . The corresponding wizard opens.
7. Make the changes you need. For an EfficientIP server, from the panel Main Properties you
can:
a. Tick the box Use DNS as DNSSEC resolver, to enable DNSSEC resolution on the
server. For more details, refer to the chapter DNSSEC.
b. Tick the box Enable HSM to start signing Master zones using an HSM. For more details,
refer to the chapter HSM.
8. Click on NEXT if need be until you get to the last page of the wizard.
visible again and refreshes.
Securing the Management of DNS Servers Using a TSIG

Key
You can use TSIG keys to secure all the data exchanges between EfficientIP, Nominum and
Generic servers and SOLIDserver. They are not supported by Microsoft servers.
By default, EfficientIP servers provide TSIG keys on the properties page of each DNS physical
server. You must edit the server main properties to specify the existing TSIG key you want to
use and secure data exchanges.
If you want to add the TSIG key, refer to the section Configuring DNS Keys.
Note that once added on the properties page of a server:
• TSIG keys can be used in any of the server statements or in the statements of its views and
zones.
470
At zone level you can set up dynamic update if you use the TSIG key specified on the server
in the statement allow-update, for more details refer to the section Configuring DNS Update
Authorizations on a Zone.
• TSIG keys can be added to the ACL admin of the server. This allows to automatically secure
the statement allow-transfer that, by default, grants access to the ACL admin. For more details,
refer to the section Configuring Access Control Lists For a Server.
If you manage your physical servers from a smart architecture, the TSIG keys of the smart archi-
tecture are pushed to the properties of each of the physical servers it manages. So keep in mind
that a TSIG key must be unique to each server, you cannot use the same for several servers.
To select a TSIG key for EfficientIP and Nominum servers
3. Right-click over the name of the EfficientIP DNS, EfficientIP DNS Package and Nominum
server of your choice, click on . The wizard Edit a DNS server opens.
4. Click on NEXT until you get to the last page of the wizard.
5. Tick the box Configure TSIG parameters if it is not already ticked.
6. In the drop-down list TSIG key name, select the key of your choice.
visible again.
To configure a TSIG key for Generic servers
3. At the end of the line of the Generic server of your choice, click on . The properties page
opens.
6. Tick the box Configure TSIG parameters if it is not already ticked.
7. In the field TSIG key name, specify the name of the key.
8
8. In the drop-down list TSIG key method, select the method that suits your needs . If you are
not using an access key for this server, select None.
9. In the field TSIG key value, specify your key value.
visible again.
Deleting DNS Servers

At any time you can delete a server from the page All servers, this way you stop managing them
from SOLIDserver.
Keep in mind that you cannot delete a physical server if it is managed by a smart architecture.
8
The standardized protocol for key codes is HMAC-MD5.
471
To delete a DNS server
4. Tick the server(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The server might be marked
Defining a DNS Server as a Group Resource

Adding a server as one of the resources of a specific group allows the users of that group to
manage the server(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a server as a resource also makes every item it contains available. For more
472
Chapter 35. Configuring DNS Servers
This chapter details the possible server configurations on its properties page, whether smart or
physical. Any configuration set at server level is inherited by all the views and zones of the
server.
Most options provide ACL configuration fields, keep in mind that in these fields the order of the
elements listed is important: each restriction or permission is reviewed following the order set in
the list.
If you configure any of these options at view or zone level, the value set at server level is
overridden.
Configuring DNS Forwarding at Server Level

A forwarder is a DNS server that is designated to facilitate forwarding of queries for other DNS
servers. By using a forwarder, you can manage name resolution for names outside of your network,
such as names on the Internet, and improve the efficiency of name resolution for the computers
in your network.
Without having a specific DNS server designated as a forwarder, all DNS servers can send
queries outside of a network using their root hints. As a result, a lot of internal, and possibly crit-
ical, DNS information can be exposed on the Internet. In addition to this security and privacy issue,
this method of resolution can result in a large volume of external traffic that is costly and inefficient
for a network with a slow Internet connection or a company with high Internet service costs.
The forwarding facility can be used to create a large site-wide cache on a few servers, reducing
traffic over links to external name servers. Forwarding is used only for queries for which the
server is not authoritative and does not have the answer in its cache.
Configuring a Forwarders List on a Smart Server

If you specify a list of forwarders on a smart server, you can set the forwarding to:
• first: the DNS server queries the forwarders first, if none of the forwarders in the list are respons-
ive, the server looks for the answer itself.
• only: the DNS only forward queries to the forwarders in order to avoid an answer seeking.
• none: the forwarding is disabled. This is the default value.
SOLIDserver selects the best forwarder from the list of forwarders and sends the query to the
forwarder with the lowest round trip time (RTT). RTT is a measurement of how long a remote
name server takes to respond to queries. Each time an EfficientIP DNS server sends a query to
a forwarder, it starts an internal clock. When it receives a response, it stops the clock and stores
the amount of time it took for that the forwarder to respond. When SOLIDserver has to choose
which forwarder to query, it simply chooses the one with the lowest RTT.
Keep in mind that any configuration set at view or zone level overrides the server level
configuration.
To configure a forwarders list
473
Configuring DNS Servers

3. At the end of the line of the server of your choice (smart or physical), click on . The prop-
erties page opens.
4. Open the panel Forwarding using .
5. Click on EDIT . The wizard Forwarding configuration opens.
6. In the field Add a forwarder, type in the address of a forwarder or its name and click on
SEARCH to retrieve its IP address.
7. Click on ADD to move it to the list Forwarders. Repeat these actions for as many forwarders
as needed.
8. In the field Forward mode, select the mode of your choice according to the table below.
Table 35.1. Forward mode options

Option Description
None The server does not send the queries to the forwarder. This option is set by default. Selecting
this option, clears the list Forwarders.
First The server sends the queries to the forwarder(s) and, if it does not receive any answer,
attempts to find an answer on its own.
Only The server only forwards queries to the forwarder(s) listed.
9. Click on OK to commit the forwarders configuration. The report opens and closes. The
properties page refreshes and displayed the new settings.
Configuring Specific Forwarding for a Physical Server Managed Through a

Smart
SOLIDserver allows administrators to set a specific forwarding configuration for physical servers
managed through a smart architecture already configured with forward options.
The forwarding configuration set on a smart is automatically inherited by the physical servers it
manages, now you can choose to edit the type of forward option on a physical server. This option
is in turn inherited by the views, zones and records of the physical server and allows you to
customize the forwarding on your network.
Keep in mind that once the Forward option is set on a smart you cannot set it to none on the
physical servers it manages, but you can choose a different forward mode.
configuration.
To configure a specific forward mode on a physical server
3. Make sure the physical servers managed by your smart architectures are displayed. If not,
on the right-end side of the menu, click on .
opens.
474
5. Open the panel Forwarding using . The forward mode and forwarders list displayed the
smart architecture settings that were pushed to the physical server.
6. Click on EDIT . The wizard Forwarding configuration opens.
7. Tick the box Overwrite the smart settings. The page refreshes and displays the forward
fields.
8. Set your forwarders list:
a. In the field Add a forwarder, type in the address of a forwarder or its name and click on
SEARCH to retrieve its IP address.
b. Click on ADD to move it to the list Forwarders. Repeat these actions for as many forward-
ers as needed.
9. In the field Forward mode, select the mode of your choice: First or Only. You cannot set the
forwarding to None once it has been set on the smart. The page refreshes. For more details
regarding these modes, refer to the table Forward mode options in the section above.
10. Click on OK to commit the forwarders configuration of the physical server. The properties
page is visible again. In the panel Forwarding, the message Smart configuration is overwritten
is displayed above your mode and forwarders configuration.
At any time, you can reverse you changes and use the configuration set on the smart archi-
tecture: edit the panel Forwarding, untick the box Overwrite the smart settings and click on OK
to commit your changes.
Configuring DNS Recursion at Server Level

In principle, authoritative name servers are sufficient for the operation of the Internet. However,
with only authoritative name servers operating, every DNS query must start with recursive queries
at the root zone of the DNS and each user system must implement resolver software capable of
recursive operations. To improve performance, recursive servers cache the results of the lookups
they perform. The processes of recursion and caching are intimately connected, then the terms
recursive server and caching server are often used synonymously. The length of time for which
a record may be retained in the cache of a caching name server is controlled by the field Time
To Live (TTL) of each resource record. Typically, such caching servers, also called DNS caches,
also implement the recursive algorithm necessary to resolve a given name starting with the DNS
root through to the authoritative name servers of the queried domain. By default the DNS recursion
function is enabled in SOLIDserver DNS.
A recursive query requires the DNS server to return requested DNS data, or locate the data
through queries to remote DNS servers. When a DNS server receives a query for DNS data it
does not have, it first sends a query to any specified forwarders. If a forwarder does not respond
with any return, it resends the same query to the next configured forwarder until it receives an
answer. If it receives no answer or a negative answer, then it sends a non-recursive query to
specified internal root servers. If no internal root servers are configured, the DNS server sends
a non-recursive query to the Internet root servers.
475
Enabling and Disabling the Recursion

If the recursion is enabled, the server always provides recursive query behavior if requested by
the client. If it is disabled, the server only provides iterative query behavior - normally resulting
in a referral. If the answer to the query already exists in the cache, it is returned irrespective of
the value of this statement. This statement essentially controls caching behavior in the server.
By default, the DNS recursion is enabled. The DNS properties page displays the panel Recur-
sion that allows you can set different DNS recursion configurations.
configuration.
To enable the DNS recursion
4. Open the panel Recursion using . If the Recursion is set to No, click on EDIT . The wizard
Recursion configuration opens.
5. In the drop-down list Recursion, select Yes.
6. In the field Recursive-clients, type in the number of clients that you want to serve recursively.
If you leave the field empty, the default value, 1000, is applied. For more details, refer to the
section Limiting the Number of Clients Served Recursively.
7. Click on NEXT . The page Allow recursion opens. For more details, refer to the section Limiting
the Recursion at Server Level.
8. Click on OK to commit the recursion enabling.
To disable the DNS recursion
4. Open the panel Recursion using . If the Recursion is set to Yes, click on EDIT . The wizard
5. In the drop-down list, select No.
6. Click on NEXT . The page Allow recursion opens.
7. Click on OK to terminate the recursion disabling.
Limiting the Recursion at Server Level

By default, the EfficientIP DNS is allowed to serve all clients that send recursive queries. You
can restrict it by defining a match list defining IP address(es) which are allowed to issue recursive
queries to the server. Limiting the recursion allows to specify which hosts are allowed to make
recursive queries through the DNS server. If the restriction of the recursion (allow-recursion) is
not set then the restriction of caching (allow-query-cache) is applied if set, otherwise the restriction
of queries (allow-query) is used if set, or the default (localnets; localhost;) is used. If the answer
to the query already exists in the cache, it is returned irrespective of this statement.
476
configuration.
To set an allow-recursion match list at server level
4. Open the panel Recursion using and click on EDIT . The wizard Recursion configuration
opens.
5. Click on NEXT . The page Allow recursion opens.
Using the drop-down lists Type and Restriction, you can configure as many restrictions as
you need: grant or deny access to networks, IP addresses, ACLs, and keys. Type contains
the following options:
Table 35.2. Restriction and permission parameters

Type Description
Network address Allow or deny an entire network. In the field Network address, type in an IPv4 address
following the format <ip-address>/<prefix>.
IP address Allow or deny an IP address (of an appliance, user, host...). In the field IP address,
type in the IP address.
a
ACL Allow or deny an ACL defined at server level in the drop-down list ACL: admin , any,
none, localhost and localnets. The ACL list also includes specific ACL created at
server level. For more details, refer to the section Configuring Access Control Lists
For a Server.
TSIG key Allow or deny a DNS key defined at server level in the panel Keys.
a
The ACL admin is used by EfficientIP's management platform to configure and exchange data with DNS servers.
Once a restriction/permission is configured as needed, click on ADD . The configuration is

visible in the list ACL values: denied hosts appear preceded by an exclamation mark (!).
Make sure the order of the entries in the list suits your needs: the order of the elements listed
is important as each restriction or permission is reviewed following the order you set in the
list. To organize the list, use the buttons and .
You can edit the entries of the list. Click on an entry, its configuration is displayed in the
fields again, edit the entry and click on UPDATE or click on DELETE to remove an entry from
the list. If you made changes that you do not want to save, click on CANCEL .
6. Click on OK to commit the recursion authorizations/restrictions configuration. The report
opens and closes. The properties page is visible again.
Limiting the Number of Clients Served Recursively

The statement recursive-clients allows to define the number of simultaneous recursive lookups
the server performs on behalf of its clients. In other words, it allows you to set or limit the number
of clients that your BIND server serves at the same time.
Once you set the recursion to yes, the recursive-client statement is enabled. To disable the re-
cursive-clients statement, you must disable the recursion.
The statement default value is 1000, meaning that 1000 simultaneous lookup requests can be
answered by the server. The minimum value is 1 and the maximum value is 4294967295.
477
You can set this statement on a smart architecture or on a physical server.
To limit the number of clients served recursively
4. Open the panel Recursion using . If the Recursion is set to No, click on EDIT . The wizard
5. In the drop-down list, select Yes.
6. In the field Recursive-clients, the default value 1000 is displayed. Edit the value if need be,
the accepted values are between 1 and 4294967295.
7. Click on NEXT . The page Allow recursion opens. For more details regarding the recursion
configuration, refer to the section Limiting the Recursion at Server Level above.
Configuring DNS Notify Messages at Server Level

The DNS notification promotes consistency between primary and secondary servers as it allows
to notify slave zones of changes performed on the master zone. Configuring the Notify at server
level allows to set the changes notification once, for all the master zones managed by the primary
server. It obviously implies that this primary server contains master zones already configured
1
with corresponding slave zones on the secondary server . Once the notification is sent to slave
zones, the administrator decides if a zone transfer is relevant. For more details, refer to the section
Limiting Zone Transfers at Server Level.
Within SOLIDserver, the notification configuration is done from the panel Notify of the properties
page. This panel displays:
• The type of notification configured for the server. You can set the Notify to Yes or Explicit or
No.
• The Also notify statement IP address and port. This statement allows to notify the managing
smart server of any slave zones updates.
Keep in mind that by default the also notify statement is unset. This implies that the smart
server is informed of the changes performed on slave zones when it refreshes, every hour,
and not instantly.
• The Allow notify directive of the server slave zones. For instance, you can allow all the servers
of a network to notify the slave zones of your server or only a few.
Note that there is an implicit allow-notify directive set when you add a slave zone: when you
set the Master IP address of the slave zone you are allowing the master zones of this server
to send notify messages to your slave zone.
configuration.
1
In this paragraph, to simplify the explanation, we work on the assumption that one server, the master server, contains only master
zones and another, the secondary one, contains only slave zones. It is evidently not accurate: usually a server would manage both
master and slave zones. However, it is customary to configure corresponding slave and master zones that are managed by a different
server.
478
To configure notify messages at server level
4. Open the panel Notify using and click on EDIT . The wizard Notifying configuration opens.
5. In the drop-down list Notify, configure the server notification behavior following the table
below.
Table 35.3. DNS server notify types

Field Description
No No notify message is sent when changes are performed in the master zones.
Yes The notify messages are sent to the target of the NS records of the master zone. They are
also sent to the IP address(es) specified in the field IP address below.
Explicit The notify messages are only sent to the IP address(es) specified in the field IP address
below.
6. If you selected Yes or Explicit, you can set the IP address and port of the server(s) which
slave zones should receive the messages:
a. In the field IP address, type in the IP address of another server. The notify messages
are sent if you chose the notify type Yes or Explicit.
b. In the field Port, you can specify the port number that should receive the notify messages
on the server you specified in the previous field.
c. Click on ADD . The IP address and port number are displayed in the list Also notify as
follows: <ip-address> port: <port-number>. Repeat these actions for as many servers
as needed.
You can edit the content of the list. Click on an entry, its configuration is displayed in
the fields again, edit the entry and click on UPDATE or click on DELETE to remove it from
7. Click on NEXT . The page Allow notify opens. It allows to specify if the server slave zones
can receive master zones notification messages.
Table 35.4. Restrictions and permissions parameters

Type Description
a
For a Server.
479
Type Description
a

8. Click on OK to commit the configuration. The report opens and closes. The properties page
is visible again. Your configurations are displayed in the panel Notify.
Restricting DNS Queries at Server Level

The DNS queries can be restricted through the options allow-query and allow-query-cache. They
both set an ACL list for IP addresses and/or network addresses, so keep in mind that the order
of the elements listed in the field ACL values is important as each restriction or permission
is reviewed following the order you set in the list.
Allow query
SOLIDserver allows to specify which hosts are allowed to issue DNS queries. The allow query
properties can be configured for an entire server including all the zones it contains. By default,
queries are allowed from the local host (localhost) and the local networks (localnets).
configuration.
To set an allow-query match list at server level
You can apply the procedure below, at zone level as well.
4. Open the panel Access control using . This panel displays different options: Allow-query,
Allow-query-cache, Allow-transfer and Blackhole.
5. Click on EDIT to change the configuration. The wizard opens.
6. On the page Allow query, set up the allow query match list.
480

Type Description
a
For a Server.
a

7. Click on NEXT twice to skip the pages Allow-query-cache and Allow transfer.
8. On the page Blackhole, click on OK to commit the allow-query configuration. The report
Allow query cache

SOLIDserver allows to set a list of the IP addresses that are allowed to issue queries on the
local cache. The allow-query-cache properties are configured at server level and apply to the
zones managed through the server.
Allow-query-cache statement particularities

The allow-query-cache is independent from the allow-query statement but closely linked to
the allow-recursion statement.
If the recursion is set to no, the cache cannot be queried, so it is useless to set an allow-
query-cache match list.
If the recursion is set to yes and the allow-recursion statement is not defined, by default the
localhost and localnets are permitted to query the server cache.
If the recursion is set to yes and the allow-recursion statement is defined with a specific match
list, the local cache access is granted to all the entries of the allow-recursion match list.
The match list defined controls recursive behavior as recursive queries would be useless without
access to the local cache. Typically, if a host is in the allow-recursion match list, it could access
the server the first time and get query result. However, if it is not part of the allow-query-cache
match list then it would not be able to make the same query a second time as it would be saved
on the cache to which it does not have access. On the contrary, if a host is in the allow-query-
cache match list but not in the allow-recursion match list, it would only get results for queries
already sent by another host with the proper access rights. Hence the need to configure carefully
both these statements to avoid conflicts and absurd access configurations.
481
Keep in mind that any configuration set at view level overrides the server level configuration.
To set an allow-query-cache match list at server level
6. Click on NEXT to skip the page Allow-query.
7. On the page Allow-query-cache, set up the allow query cache match list.

Type Description
a
For a Server.
a

8. Click on NEXT twice to skip the page Allow-transfer and open the page Blackhole.
9. Click on OK to commit the allow-query-cache configuration. The report opens and closes.
The properties page is visible again.
Limiting Zone Transfers at Server Level

DNS zone transfer is a type of DNS transaction employed to replicate and synchronize all copies
of the zone used at each server configured to host the zone. SOLIDserver denies zone transfers
by default to all DNS server. SOLIDserver supports the allow-transfer server option that allows
to specify which hosts, networks, or TSIG keys are granted or denied the right to do transfers for
all the zones it maintains.
482
configuration.
To set an allow-transfer match list at server level
You can also apply the procedure below at zone level.
5. Click on EDIT to change the configuration. The wizard opens, each page corresponds to an
option.
6. Click on NEXT twice to skip the pages Allow-query and Allow query cache.
7. On the page Allow-transfer, setup the transfer match list.

Type Description
a
For a Server.
a

8. Click on NEXT . The page Blackhole opens.
9. Click on OK to commit the transfer authorization configuration. The report opens and closes.
The properties page is visible again.
483
Configuring a Blackhole
SOLIDserver allows to set a list of the IP addresses and network addresses you consider as
spam. The blackhole properties can be configured for an entire server including all the zones it
contains. By default, queries are allowed from the local host and the local networks: all the ad-
dresses listed in the list cannot receive any response from the server or zones. The queries remain
unanswered, in other words, ignored.
To set a blackhole match list at server level
6. Click on NEXT to skip the pages Allow-query, Allow query cache and Allow-transfer.
7. On the page Blackhole, set up the restrictions. You can deny access to networks and IP
addresses, they can all be listed in the list ACL values. The table below details the available
options of the field Type:
Table 35.8. Blackhole parameters

Type Description
Network address Deny query responses to an entire network. In the field Network address, type in an
IPv4 address following the format <ip-address>/<prefix>.
IP address Deny query responses to an IP address (of an appliance, user, host...). In the field IP
address, type in an IPv4 or IPv6 address.

8. Click on OK to commit the blackhole configuration. The report opens and closes. The prop-
erties page is visible again.
Configuring Client Resolver Cache Options at Server Level

From the properties page of an EfficientIP DNS server using the SSL protocol, you can edit the
two options dedicated to client resolver cache memory via the panel Options:
lame-ttl
This option defines the amount of time a client should keep in its cache the information sent
bay a lame server that has been queried directly. It allows to limit the time the information is
kept as, coming from a lame server, it might not be up-to-date and therefore potentially erro-
neous.
484
max-cache-size
This option limits the size of the cache memory of a server or view. When the cache memory
size reaches this threshold, the server causes records to expire prematurely. The value 0
can be set to purge the cache only when the records TTL expires.
These options can be set at server or view level. For more details regarding the configuration on
views, refer to the section Configuring Client Resolver Cache Options at View Level. Keep in
mind that any configuration set at view level overrides the server level configuration.
To set the option lame-ttl at server level
2. Click on DNS servers. The page opens.
4. Open the panel Options using and click on EDIT .The wizard Options configuration opens.
5. In the field Lame-ttl, type in the value of your choice. This value is in seconds can be set
between 30 and 1800. The default value is 600, the maximum value is 1800 seconds.
6. Click on OK to commit your configuration. The report opens and closes. The properties page
is visible again and displays the value you defined.
To set the option max-cache-size at server level
5. In the field Max-cache-size, type in the value of your choice to set the cache memory size.
This value is in bytes. The default value is 100m.
Configuring EDNS Options at Server Level

The Extension mechanisms for DNS allow to add information to DNS messages and therefore
send out larger packages or packages containing more parameters. The EDNS, also known as
EDNS (0), has been defined in RFC 6891.
If you configured DNSSEC on your server or are managing records that relay IPv6 information,
we strongly recommend configuring EDNS: in both cases, the messages sent out usually exceed
512 bytes.
Within SOLIDserver, two EDNS options can be configured at server and view level on EfficientIP
DNS servers using the SSL protocol:
edns-udp-size
This option sets the EDNS UDP buffer size advertised by the server when querying a remote
server. It is set in bytes and allows to specify the size of the packets that you receive.
Typically, you would set this option to enable UDP answers to pass through broken firewalls
485
that block fragmented packets and/or packets greater than 512 bytes. The value set for this
option is a preference.
max-udp-size
This option sets the maximum EDNS UDP message size sent by the server. It is set in bytes
and allows to specify the maximum size of the packets that you send to a remote server.
Typically, this option would be set to enable UDP answers to pass through broken firewalls
that block fragmented packets and/or packets greater than 512 bytes.
For more details regarding the configuration on views, refer to the section Configuring EDNS
Options at View Level. Keep in mind that any configuration set at view level overrides the
server level configuration.
To set the option edns-udp-size
5. In the field Edns-udp-size, type in the size of received packets of your choice. This value is
in bytes, and must be set between 512 and 4096. The default value is 4096.
To set the option max-udp-size
5. In the field Max-udp-size, type in the maximum size of the packets you send. This value is
in bytes and must be set between 512 and 4096. The default value is 4096.
Improving the Server Performance

SOLIDserver allows to configure the statement minimal-responses at server level.This statement
can be used to reduce the size of the outgoing data and improve performances.
Enabling minimal-responses allows the server to only add records to the authority and additional
data sections of the response if they are specifically required by the protocol. For instance, these
sections are included in the delegations and negative responses.
By default, the statement minimal-responses is set to yes on BIND servers.
This statement can be set on a physical server or on a smart architecture.
486
To set the minimal-responses statement at server level
5. In the drop-down list Minimal-responses, select yes or no according to your needs. By default,
the statement is set to yes on BIND servers.
is visible again and displays your minimal-responses configuration.
Configuring a Sortlist at Server Level

The option sortlist is actually a statement that allows to set a preferential response order for equal
A resource records, forming an RRset. In other words, it modifies the response packet received
by the client resolver. It allows to put an end to cyclic round-robin responses to queries for the
IP networks of your choice.You can define as many sortlist statements as you want on EfficientIP
DNS servers using the SSL protocol. For each network of client IP addresses, you can set the
order of the records of an A RRset: this list can contain all of the A records of the RRset if you
want. The server checks if the client resolver IP address matches the sortlist defined and modify
its response accordingly.
Within the GUI, the statement configuration is closely linked to the statement syntax in the zone
file. Here below is an example of the sortlist statement syntax in the zone file:
In a zone file, the statement would look as follows for the zone many.example.com :
// zone file example.com
$ORIGIN example.com.
many IN A 192.168.3.6
IN A 192.168.4.5
IN A 192.168.5.5
IN A 10.2.4.5
IN A 172.17.4.5
The client-side server has a sortlist statement, set as follows:

options {
....
sortlist {
{// 1st preference block start
192.168.4/24; // 1st client IP selection matches any of these
{10.2/16; // return any of these response IPs as 1st preference
172.17.4/24; // 2nd preference
};
}; // end first block
{ // second preference block
192.168.5/24; // 2nd client IP selection matches any of these
{192.168.4/24; // return any of these response IPs as 1st preference
172.18.4/24; // 2nd preference
10.2/16; // 3rd preference
};
}; // end second block
}; // end sortlist
};
As you can see after the client IP, the response preferences are defined one after the other and
separated by a semi-colon.
487
To define a sortlist statement at server level
5. In the field Client address, type in the client IP address/subnet. It must be composed of an
IPv4 address containing 1 to 4 bytes followed by the prefix: <IP address>/<prefix>.
6. In the field Sort address, type in a list of IP addresses or subnets followed by a semi-colon.
These addresses correspond to the value of an A record of the RRset for which you create
the sortlist. The statement respects the order in which you typed in the addresses. The value
must respect the format <IP address>/<prefix>; even if you only type in one sort address.
7. Once both fields are filled, click on ADD to move the client and sort addresses to the field
Sortlist. Both values are displayed as follows: {<client-IP-address>/<prefix> {<sort-IP-ad-
dress>/<prefix>;};}; . By default, this field is empty.
is visible again and displays your sortlist as follows: {<client_address_field_value>;
{<first_sort_address>;<second_sort_address;<etc>};}; .There is one sortlist per client address
defined.
Limiting the Number of Responses of a Server

The management of the Response Rate Limiting (RRL) from the GUI helps you mitigate the DNS
amplification attacks targeting a victim.
Amplification attacks are Distributed Denial of Service (DDoS) tactics in which an attacker uses
the IP address of any computer to send high volumes of forged queries using an authoritative
DNS server. The attacker queries are usually small-sized but designed to generate large re-
sponses, thus generating an amplified traffic toward the victim. Considering that the attacker
mimics the query format of the server, the client only sees a large number of responses and
cannot know if the response is real or malicious. This high volume of responses is likely to make
the victim's computer overload and eventually collapse.
In light of the increasing number of DDoS attacks on the Internet, in 2012 by Paul Vixie and
Vernon Schryver proposed RRL as a method for preventing a caching server from being used
in a DNS Amplification attack. It allows to maintain the type of queries that have been made, that
way the server keeps track of the queries made and can limit the number of responses returned
without changing the nature of the DNS.
Prerequisites
To be able to use this option:
• You must have SOLIDserver in version 5.0.4 or greater.

• You must manage an EfficientIP DNS server in version 5.0.4 or greater.
• If necessary, install the EfficientIP DNS packages in version 5.0.4 or greater. For more details,
refer to the section Managing BIND DNS Servers.
488
Configuring the RRL Parameters

RRL has to be configured from a DNS server, or smart architecture, properties page.
If you set it on a smart architecture that manages different types of servers, it only applies to the
relevant servers. The settings are ignored by all the servers that do not support it.
To limit the number of responses of a server

6. In the field Maximum number of responses per second, type in the number of your choice.
This field defines a threshold of responses which, once met, drops all the additional queries
unless you set a Slip value.
The field default value is 0, meaning the option is disabled. You can set a value between 1
and 1000. We recommend that you set the value at 10 or higher.
7. In the field Slip, you can type in a number between 0 and 10. This option allows to add an
extra bit to the server responses, the Truncated (TC) bit, and makes the requestor use TCP
to resend the query once they receive the truncated response.The number specified in the
field defines every how many queries the TC bit and TCP are forced.
If the field is empty or set to 0, all the similar queries are dropped. If set to 1, the TC is set
in the response to every query. If set to 2, it is set in the response to every other query. If
set to 3, it is set in the response to every third query, etc.
We recommend that you set the Slip value to 1 because it limits cache poisoning attacks
- it is worthless for attackers performing volumetric or PPS DDoS attacks - and is less CPU
consuming for flooded resolvers.
8. If you are configuring a BIND server, in the section Log only you can tick the box. It allows
to prevent the rate limiting function from operating and only display in the logs what would
have happened.
On NSD servers, ticking the box disables RRL altogether.

is visible again. The settings are visible in the panel Options.
Limitations
• RRL cannot be set at view or zone level, it can only be configured for a whole server.
• RRL can only be configured on EfficientIP DNS servers or smart architectures.
• If RRL settings are configured on a smart architecture managing servers that are not compatible
with RRL, for these servers the RRL configuration is ignored and the Multi-Status column
provides details regarding incompatibilities.
• RRL can be set on a BIND/NSD Hybrid server but the option Log only disables RRL on NSD
servers.
489
Configuring DNS64
SOLIDserver provides, for EfficientIP and BIND servers, a panel on the properties page dedicated
to configuring DNS Extensions for Network Address Translation from IPv6 Clients to IPv4 Servers,
or DNS64.
This mechanism was described in RFC 6147 and allows to rely on a NAT64 server to synthesize
IPv6 addresses and enable communication between IPv6-only clients and IPv4-only DNS servers
and get a valid response to their queries. Which is why DNS64 mechanism is useless on its own.
SOLIDserver does not include a NAT64 server but provides a wizard to configure DNS64 with
the settings that you configured on your own NAT64 server.
Once NAT64 is configured, you can configure DNS64 on the server of your choice. All the fields
available in the GUI are optional, DNS64 can perform the synthesis using only the address and
prefix of the NAT64. It relies on your NAT64 server IPv6 address to IPv4 address translation
settings to synthesize AAAA records from A records. The synthesis is performed as follows:
1. DNS64 uses the NAT64 server address and prefix configuration as the start of the synthesized
IPv6 address.
2. The target IPv4 address is appended to the address and prefix in hexadecimal form.
3. The suffix is appended at the end of the synthesized IP address to get a 128 bit address to
send back to the client in the AAAA record.
When your DNS64 configuration is over, two reverse zones are automatically created. That way,
even the reverse queries of IPv6 clients can be synthesized and answered.
The mechanism is completely transparent: the client does not know that the queried server only
manages IPv4 related data as, after querying it, the client receives records that can be used in
an IPv6 environment.
Prerequisites
• You must have SOLIDserver in version 5.0.0 or greater.
• You must manage:
• An EfficientIP DNS server in version 5.0.0 or greater; or
• A BIND server in version 9.8 or higher (EfficientIP BIND package).
• You must manage your server through SSL.
• You must have a NAT64 server configured on your network.
• You must have the NAT64 server address and prefix ready when you start configuring. Note
that depending on your NAT64 server vendor, you might not be able to set the address and
prefix of your choice. In this case you must use the ones provided by the vendor during the
DNS64 configuration.
Limitations
• DNS64 can "break" DNSSEC. For more details, refer to the substatement break-dnssec.
• DNS64 cannot be configured on Hybrid DNS engines.
490
DNS64 Supported Substatements

SOLIDserver supports the configuration of a set of DNS64 substatements listed below. By default
all substatements are unset in the GUI as they are all optional, the fields are empty or set to
None.
dns64-server
Allows you to specify the name of a server. The server you declare in that field should be
the server for which you are configuring DNS64. Once the substatement is set, the server
name is saved in the SOA of the reverse zones that DNS64 automatically creates, that way
the server can be queried in reverse without further configuration.
Default value: N/A

dns64-contact
Allows you to specify the email address of the contact managing the server - declared in the
substatement dns64-server - and the zones it contains. The contact is saved as well in the
SOA of the reverse zones that DNS64 automatically creates. No need to specify a contact
if you did not specify dns64-server substatement.
Default value: N/A

address
Allows you to specify the IPv6 address set on the NAT64 server following the syntax <start-
of-IPv6-address>:: . Depending on the NAT64 server of your network, you can either set the
address of your choice or use the one already set on the NAT64 server. Without the prefix,
filling this field is useless.
Default value: N/A

prefix
Allows you to specify the prefix set on the NAT64 server. It should be: 32 bits, 40 bits, 48
bits, 56 bits, 64 bits or 96 bits. Depending on the NAT64 server of your network, you can
either set the prefix of your choice or use the one already set on the NAT64 server. No need
to specify a prefix if you did not specify an address.
Default value: N/A

suffix
Allows you to specify a suffix following the syntax ::<end-of-IPv6-address>. The suffix is ap-
pended to the synthesized IP address (composed as follows: <address-field-value>:<queried-
ipv4-address-in-its-hexadecimal-form>).
Default value: :: . No need to specify a suffix if you specified a 96 bits prefix, BIND default
value is automatically applied.
break-dnssec
Allows you to interact with DNSSEC. If you set it to yes, DNS64 synthesizes the responses
authoritative and recursive queries even if the resulting records are considered invalid by the
queried signed zones. Which is why it is considered to "break" DNSSEC. If set to no, the
DNS64 synthesis is not performed if zones are signed with DNSSEC.
Default value: None.

recursive-only
Allows you to decide to use DNS64 synthesis in case of recursive queries. If set to yes, only
the server responses to recursive queries are synthesized. If set to no, all the server responses
are synthesized.
491
Default value: None.

client
Allows you to set or use existing ACLs to define which DNS clients get a synthesized response
to their queries.
Default value: none. If you only specify an address and prefix this value is automatically ap-
plied.
mapped
Allows you to set or use existing ACLs to prevent DNS64 from synthesizing some IPv4 ad-
dresses of your network. Any IPv4 address listed in the ACLs is ignored by DNS64 and
therefore never returned as an IPv6 address in the response.
Default value: any. If you only specify an address and prefix this value is automatically applied.
exclude
Allows you to set or use existing ACLs to exclude a list of IPv6 addresses. As DNS64 is
dedicated to synthesizing IPv6 addresses from IPv4 addresses, if any zone contains AAAA
records DNS64 ignores the zone. Therefore it ignores the A records it might contain. Setting
up the exclude substatement allows to ignore the AAAA records of a zone, your exclude
substatement ACL must contain all the IPv6 addresses declared in your AAAA records. That
way you can make sure that DNS64 synthesizes all the A records of the zone. The IPv6 ad-
dresses you declare must be part of or match the range of addresses declared for the NAT64
server (address and prefix).
Default value: none. If you only specify an address and prefix this value is automatically ap-
plied.
Configuring DNS64 On a Server

You can configure DNS64 from the properties page of a physical server or a smart architecture.
To configure DNS64 on a server
4. Open the panel DNS64 using and click on EDIT . The wizard DNS64 configuration opens.
5. Fill in the fields DNS64 Server, DNS64 Contact following the expected format detailed in the
section DNS64 Supported Substatements.
6. In the drop-down list Prefix, select 32 bits, 40 bits, 48 bits, 56 bits, 64 bits or 96 bits. For
more details, refer to the section DNS64 Supported Substatements.
7. Once you selected a Prefix, the field and drop-down lists Address, Suffix, Break-dnssec
and Recursive-only appear. Fill them in according to your needs. For more details, refer to
the section DNS64 Supported Substatements.
Note that the field Suffix is not displayed if you select the Prefix 96 bits.
You can choose to only configure the Address and Prefix for your DNS64 server and contact.
In which case, SOLIDserver sets the substatement client, mapped and exclude to their
DNS64 Supported Substatements. To do so, click on NEXT until the last page of the wizard
and click on OK to commit your configuration.
492
8. Click on NEXT . The page DNS64 configuration: Client opens.
You can define an ACL that lists the DNS clients that get a synthesized response to their
queries. For more details regarding the substatement, refer to the section DNS64 Supported
Substatements.

Type Description
a
For a Server.
a

All the entries of the ACL values constitute your ACL.
9. Click on NEXT . The page DNS64 configuration: Mapped opens.
You can define an ACL that lists the IPv4 addresses that are ignored by DNS64. The ACL
configuration is detailed in the step 6 of this procedure. For more details regarding the sub-
statement, refer to the section DNS64 Supported Substatements.
10. Click on NEXT . The page DNS64 configuration: Exclude opens.
You can define an ACL that lists the IPv6 addresses that are ignored by DNS64. The ACL
configuration is detailed in the step 6 of this procedure. For more details regarding the sub-
statement, refer to the section DNS64 Supported Substatements.
is available again, the panel DNS64 displays your configuration.
To disable DNS64, you must open the wizard DNS64 configuration, empty all the fields and select
None in the drop-down lists.
493
Configuring DNS Sources at Server Level

Configuring DNS source allows to set physical interfaces at server level that are systematically
used for all notify operations and zone transfer. This information can only be set on EfficientIP
DNS physical server using the SSL protocol and is inherited by the server views and zones and
displayed accordingly on their properties page.
From the Sources and Sources V6 panels, through their IP address, you can configure physical
interfaces that should be used for the server transfer and notify options. These panels only appear
after the first synchronization of the physical server. When editing these panels, you can define
the following statements:
query-source
This statement allows to define the IPv4 address and/or port used as the source of the
server or view outgoing queries. By default, BIND uses any server or view interface IP address
and a random port for outgoing queries.
Using a fixed port number allows to control UDP operations but can be extremely dangerous:
it can lead to cache poisoning if used with any caching DNS server definition as any attacker
would need to guess the transaction ID to get both the specified interface IP address and
port number. This statement is displayed on servers and views properties page.
query-source-v6
transfer-source
This statement allows to determine the IPv4 address of the physical interface used to execute
the zones transfer on the server. You can also specify a port for this statement. It is only
valid for slave zones and its configuration is therefore displayed on the physical server, views
and slave zones properties page.
transfer-source-v6
use-alt-transfer-source
This statement allows to set the use of an alternate interface IP address for the transfer if
the transfer-source or the transfer-source-v6 were to fail. This statement configuration is
displayed on the physical server, view and slave zones properties page.
This statement definition is only configurable from the panel Sources but applies to interfaces
whether they were identified through an IPv4 or an IPv6 address.
Its default value is no if the server contains views and yes if the server does not contain any
view.
494
alt-transfer-source
This statement allows to determine the alternate IPv4 address of the interface used to execute
the zones transfer on the server if the transfer-source fails and if the use-alt-transfer-source
is enabled. You can also specify a port for this statement. Its configuration is displayed on
the physical server, views and slave zones properties page.
alt-transfer-source-v6
the zones transfer on the server if the transfer-source-v6 failed and if the use-alt-transfer-
source is enabled.You can also specify a port for this statement. Its configuration is displayed
on the physical server, views and slave zones properties page.
notify-source
This statement allows to define the IPv4 address of the physical interface used for all the
server outgoing notify operations. You can also specify a port for this statement. It is used
by master zones and its configuration is therefore displayed on the physical server, views
and master zones properties page.
notify-source-v6
This statement allows to define the IPv6 address of the physical interface used all the server
outgoing notify operations.You can also specify a port for this statement. It is used by master
zones and its configuration is therefore displayed on the physical server, views and master
zones properties page.
configuration.
To set IPv4 DNS sources at server level
opens.
4. Open the panel Sources using and click on EDIT . The wizard Configuration: Sources
opens.
5. Configure the transfer statements. Make sure to specify the IP address of an interface already
declared on SOLIDserver, otherwise, all the transfer operations would fail.
a. In the field Query-source address, type in the IPv4 address of the interface used for
outgoing queries.
b. In the field Query-source port, you can type in the port number used for outgoing
queries. Keep in mind that specifying a port number can lead to cache poisoning if DNS
server definitions are not set properly.
c. In the field Transfer-source address, type in the IPv4 address to be used for the zones
transfer operations. Specify an interface that you already configured on the appliance.
d. In the field Transfer-source port, you can specify which port on the interface should be
used.
e. In the drop-down list Use-alt-transfer-source, set the use of an alternate interface if
need be.
495
Table 35.10. Use-alt-transfer-source parameters

none This is the default value of the use-alt-transfer-source statement. If your server contains
views, it corresponds to no. If your server does not contain any view, it corresponds
to yes.
no This value disable the use of an alternate interface if the transfer set via transfer-source
or transfer-source-v6 fails. Go to step 6 to set the notify-source statements related
fields.
yes This value enables the use of an alternate interface if the transfer set via transfer-source
or transfer-source-v6 fails. In this case, you need to set the alternate interface IP address
(and port if you want) through the alt-transfer-source and alt-transfer-source-v6 state-
ments in the following steps.
The use-alt-transfer-source statement applies to the alternate interfaces declared through

IPv4 address (Alt-transfer-source address) and IPv6 address (Alt-transfer-source ad-
dress-v6).
f. If you enabled the use of an alternate interface, in the field Alt-transfer-source address,
type in the IPv4 address of the alternate interface. It must also be configured on the
appliance.
g. If you enabled the use of an alternate interface, in the field Alt-transfer-source port,
you can specify which port on the interface should be used.
6. Configure the notify statement. Make sure to specify the IP address of an interface already
declared on SOLIDserver, otherwise, all the notify operations would fail.
a. In the field Notify-source address, type in the IPv4 address to be used for outgoing
notify operations. Specify an interface that you already configured on the appliance.
b. In the field Notify-source port, you can specify which port on the interface should be
used.
is visible again and displays the values you defined.
To set IPv6 DNS sources at server level
opens.
opens.
declared on SOLIDserver, otherwise all the transfer operations would fail.
a. In the field Query-source-v6 address, type in the IPv6 address of the interface used for
outgoing queries.
b. In the field Query-source-v6 port, you can type in the port number used for outgoing
496
c. In the field Transfer-source-v6 address, type in the IPv4 address to be used for the
zones transfer operations. Specify an interface that you already configured on the appli-
ance. If you defined the use-alt-transfer-source statement in the Sources panel, it applies
to the alternate interfaces declared in IPv4 (Alt-transfer-source address) and IPv6 (Alt-
transfer-source address-v6).
d. In the field Transfer-source-v6 port, you can specify which port on the interface should
be used.
e. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
source-v6 address, type in the IPv6 address of the alternate interface. It must also be
configured on the appliance.
f. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
source-v6 port, you can specify which port on the interface should be used.
declared on SOLIDserver, otherwise, all the notify operations would fail.
a. In the field Notify-source-v6 address, type in the IPv6 address to be used for the outgoing
b. In the field Notify-source-v6 port, you can specify which port on the interface should
be used.
Authenticating the Zones Dynamic Update from the Server

Within SOLIDserver, dynamic update relies on TSIG keys and can only be configured for the
master zones if the server they belong to is properly configured and secured. Keep in mind that
configuring dynamic update can be dangerous as any client could update the server data. You
can configure dynamic update on all DNS servers except Amazon Route 53 DNS servers. For
more details regarding dynamic update, refer to the chapter Implementing Dynamic Update.
To set up dynamic update, you must:
1. Secure the server with a unique TSIG key. For more details, refer to the section Securing the
Management of DNS Servers Using a TSIG Key.
2. Configure the server for dynamic update:
• Either edit the default ACL admin to include the same TSIG key to its permissions.
• Or create a new ACL that includes the TSIG key to its permissions. For more details, refer
to the section Configuring Access Control Lists For a Server.
3. Configure the statement allow-update of your master zones with the same TSIG key. For more
details, refer to the section Configuring DNS Update Authorizations on a Zone.
Note that if you edited the ACL admin of the server, the configuration is complete because,
by default, the ACL admin of the physical server is specified in the statement allow-update of
the master zones.
Note that instead of configuring the ACL admin to allow the securing TSIG key, you could allow
the IP address of SOLIDserver and restrict the default permissions. However, allowing updates
497
based on the requestor IP address is insecure, we strongly recommend using the TSIG key
protocol filtering rather than an IP address based filtering.
To edit the ACL admin of a server to allow dynamic update
opens.
4. In the panel ACL, in the list DNS ACLs select admin.
5. Click on EDIT . The wizard ACL configuration Edit a DNS server opens.
6. Delete the ACL any to make sure that only SOLIDserver can edit the server and its content:
a. In the list ACL values, select any. The fields Type, Restriction and ACL are refreshed.
b. Click on DELETE . The ACL is no longer listed.
7. Specify your TSIG key:
a. In the drop-down list Type, select TSIG key.

b. In the drop-down list Restriction, select Allow.
c. In the field Key, select the same TSIG key than the one you used to secure the server.
For more details, refer to the section Securing the Management of DNS Servers Using
a TSIG Key.
d. Click on ADD . The TSIG key is moved to the list ACL values.
visible again.
9. Once the ACL admin is configured with the TSIG key, the master zones it contains are all
configured for dynamic update as the statement allow-update grants by default access to
this ACL.
To add an ACL that allows dynamic update
4. Open the panel ACL using .
5. Click on ADD . The wizard ACL configuration opens.
7. In the drop-down lists Type, select TSIG key.
8. In the drop-down lists Restriction, select Allow.
9. In the field Key, select the same TSIG key than the one you used to secure the server. For
more details, refer to the section Securing the Management of DNS Servers Using a TSIG
Key.
10. Click on ADD . The TSIG key is moved to the list ACL values.
498
11. Click on OK to commit your ACL configuration changes. The report opens and closes. The
properties page is visible again.
12. Once the ACL is created, you must add it to the permissions of the statement allow-update
of the master zone(s) of the server. For more details, refer to the section Configuring DNS
Update Authorizations on a Zone.
Configuring Access Control Lists For a Server

The Access Control List (ACL) is a match list that allows to grant or deny access to a network
device, IP address, TSIG keys or even another ACL. For more details regarding TSIG keys, refer
to the section Configuring DNS Keys.
When set at server level, the ACLs can be used on the views and zones of the server. Once
created, you can use an ACL to configure the statements allow-recursion, allow-notify,
allow-query, allow-query-cache, allow-transfer, blackhole at any of relevant level of the
DNS hierarchy. You could, for instance, create one ACL that specifies which part of the network
is denied access or the IP address of the server that should always receive the notification
messages, etc.
Note that by default EfficientIP servers provide the ACL admin. You can edit it according to your
needs but you cannot delete it.
To create an ACL at server level
5. Click on ADD . The wizard ACL configuration opens.
7. Configure the ACL according to your needs.

Type Description
a
For a Server.
a

499
All the entries of the ACL values constitute the content of your ACL.
8. Click on OK to commit your ACL configuration. The report opens and closes. The properties
page is visible again. Your ACL is listed in the panel ACL.
Once created, an ACL includes permissions and restrictions that you allow or deny access
to depending on the configuration you set:
• If you allow access to the ACL, every permission it contains are granted access to,
every restriction it contains are denied access to.
• If you deny access to the ACL, the contrary is set: every permission it contains are
denied access to, every restriction it contains are granted access to.
You can add as many ACL as you want on a server.
To edit an ACL at server level
5. In the list DNS ACLs, select an ACL and click on EDIT . The wizard ACL configuration opens.
6. To add permissions and restrictions to the ACL:
a. In the drop-down lists Type, select Network address, IP address, ACL or TSIG key.
b. In the drop-down lists Restriction, select Allow or Deny.
c. In the last drop-down list, specify or select the value of your choice. Fore more details,
refer to the procedure To create an ACL at server level.
d. Once a restriction/permission is configured as needed, click on ADD . The configuration
is visible in the list ACL values: denied hosts appear preceded by an exclamation mark
(!).
7. To edit the permissions and restrictions of the ACL:
a. In the list ACL values, select an entry. The fields above the list reload and display the
current configuration.
b. Edit the fields according to your needs. If you made changes that you do not want to
save, click on CANCEL .
c. When you changes are made, click on UPDATE . The fields reload, the entry is edited.
8. To change the order of the permissions and restrictions:
500
a. In the list ACL values, select an entry.

b. Move it up or down the list using the buttons and .
9. To delete permissions and restrictions:
a. In the list ACL values, select an entry. The fields above the list reload and display the
current configuration.
b. Click on DELETE . The entry is no longer listed.
10. Click on OK to commit your ACL configuration changes. The report opens and closes. The
properties page is visible again.
To delete an ACL at server level
1. Make sure the ACL is not used in any statement of the server, view or zone.
6. In the list DNS ACLs, select an ACL your want to delete.
7. Click on DELETE . The wizard DELETE opens.
8. Click on OK to commit the ACL deletion. The report opens and closes. The ACL is no longer
listed.
Configuring DNS Keys

SOLIDserver supports the use of Transaction SIGnatures (TSIG) keys to encrypt and authenticate
every DNS data exchange between SOLIDserver itself and the physical servers.
The information is encrypted via a technique called HMAC (Keyed-Hashing for Message Authen-
tication, see RFC 2104) which employs a shared secret and a one-way cryptographic hash
function to sign data. This shared secret is used a password known only to the two parties involved
in the exchange.
From the properties page of EfficientIP servers, Nominum servers and smart architectures you
can add, edit and delete TSIG keys. Once a key is added, you can use it:
• To secure the server with a unique TSIG key. For more details, refer to the section Securing
the Management of DNS Servers Using a TSIG Key.
• In your ACLs at server, view and/or zone level. For more details, refer to the chapters Config-
uring DNS Servers, Configuring DNS Views and Configuring DNS Zones.
• When adding and editing slave zones, RPZ or not, and stub zones. For more details, refer to
the chapters Managing DNS Zones and DNS Firewall (RPZ).
• To set up dynamic update for you master zones. For more details, refer to the sections Config-
uring Access Control Lists For a Server and Authenticating the Zones Dynamic Update from
the Server.
501
To add a TSIG key
4. Open the panel Keys using and click on ADD . The wizard Add a DNS key opens.
5. In the field Key name, name the key.
6. Click on NEXT . The wizard TSIG Key configuration opens.
7. A valid HMAC-SHA512 key is automatically set in field TSIG Key value. If need be, edit the
parameters described below:
Table 35.12. DNS key configuration parameters

Field Description
Key name The key name, is a string starting with a letter or underscore, followed by any number
of letters, numbers, or underscores.
Key algorithm The key algorithm can be either hmac-sha512, hmac-sha384, hmac-sha256, hmac-
sha224, hmac-sha1 or hmac-md5 (obsolete).
TSIG Key value The key value is the secret to be used by the algorithm, and is treated as a base-64
encoded string.
8. Click on OK to commit the creation of the key. The report opens and closes. The properties
To edit a TSIG key
4. Open the panel Keys using and select the key you want to edit.
5. Click on EDIT . The wizard TSIG Key configuration opens.
6. In the field TSIG Key value, modify the data as needed.
7. Click on OK to commit your modifications. The report opens and closes. The properties page
is visible again.
To delete a TSIG key
1. Make sure the key is no longer used in any statement of the server, view or zone.
5. Open the panel Keys using .
6. In the list DNS keys, select the key you want to delete in the list DNS keys.
7. Click on DELETE . The wizard Delete opens.
502
8. Click on OK to commit the key deletion. The report opens and closes. The properties page
is visible again and the key is no longer listed.
Including Non-Supported DNS Settings

SOLIDserver provides the possibility to include parameters in BIND configuration files that are
not supported by SOLIDserver.
Only administrators with a good understanding of BIND configuration files should perform
these operations.
The prerequisites, limitations and procedures to follow are all described in the appendix Config-
uring Non-Supported BIND Options.
Once the non-supported options are included to the configuration file, they are processed like
any other option unless their syntax is incorrect or the option itself was already set. In which case,
the included options are ignored until the proper changes have been made.
Configuring Anycast DNS

DNS anycast is a methodology useful if your deployment includes multiple geographically distrib-
uted sites. It improves the service high availability and reliability by improving the redundancy of
the DNS service. Your DNS clients always query the same IP address(es) but their packets are
systematically routed to the nearest server in the topology. The term "nearest" does not apply to
the servers geographical repartition: if the closest server is down, the clients are redirected to
the nearest running server in the topology. This avoids using remote servers based on the IP
address alone and ensures that DNS clients are querying their local servers first. It can be imple-
mented on recursive and authoritative DNS servers.
SOLIDserver allows to implement anycast via the routing protocols OSPF, BGP and IS-IS
and relies on a host-based routing software, a Quagga package, already stored on the appliance.
No matter the protocol chosen keep in mind that:
• Once anycast is implemented, the routers are able to redirect clients to the nearest server if
need be.
• The Quagga configuration is automatically saved in the appliance backup file.
Implementing Anycast Using OSPF

OSPF is an intra network protocol. Successfully implementing anycast using OSPF on your network
requires:
1. Meeting the Prerequisites to implement anycast.

2. Configuring the Appliance for OSPF Anycast to make sure it uses the Quagga package that
enables anycast.
3. Configuring the Quagga Package for OSPF Routing to set the configuration that suits your
needs.
4. Making Sure DNS Anycast Was Properly Configured for OSPF once the configuration is
complete.
503
Prerequisites
• Several servers in a pool must share 1 or anycast IPs.

• The servers must advertise their IP(s) to their neighboring routers.
• The routers exchange the routes information. That way if one server fails, the routers automat-
ically recompile the routing tables to redirect the DNS clients.
• The 3 steps anycast configuration must be completed on all the appliances that manage a
DNS server that you intend to include to the anycast routing scheme. This applies whether the
servers are managed via a smart architecture or not.
With this type of topology, the anycast IP address is advertised from multiple locations and the
router ends up choosing the best path to that IP address, according to the metric in use by the
routing protocol. Once you finished the configuration detailed in the sections below, the DNS
servers managed via SOLIDserver use anycast.
Configuring the Appliance for OSPF Anycast
SOLIDserver contains a Quagga package that must be taken into account in the system config-
uration file to be used.
To successfully configure the package you must:
1. Meet the Prerequisites.

2. Edit the file /etc/rc.conf to make sure it takes the package into account.
3. Delete the files /tmp/running_conf.cf* and /tmp/previous_conf.cf*.
4. Reboot the appliance. After the reboot, these files running_conf.cf* and previous_conf.cf* are
created again and take into account the changes.
5. Configure the Quagga package. For more details, refer to the section Configuring the Quagga
Package for OSPF Routing.
To configure the appliance for anycast DNS
1. Edit the system configuration file.
a. Open a shell session and connect to your appliance with root credentials.
b. Open the file /etc/rc.conf to edit it.
c. Enable Quagga and make sure the file is configured as follows:
quagga_daemons="zebra ospfd"2
quagga_enable="YES"
d. Add the following line to the file to specify the anycast dedicated IP address:
# Expected syntax: ifconfig_<interface-name>_alias0="inet <IP-address> netmask <netmask>"
# Example:
ifconfig_<interface-name>_alias0="inet <IP-address> netmask <netmask>"
e. Save your changes.
2
To configure the appliance for both OSPF and BGP, you can specify the following: quagga_daemons="zebra bgpd ospfd" .
504
2. Delete the files /tmp/running_conf.cf* and /tmp/previous_conf.cf* using the

command:
rm /tmp/running_conf.cf* /tmp/previous_conf.cf*
3. Reboot the appliance using the command:

reboot
Now you need to configure the package following the section below.
Configuring the Quagga Package for OSPF Routing
Once you configured the appliance to take into account the Quagga package, as detailed in the
section Configuring the Appliance for OSPF Anycast, you can configure the package and OSPF
routing.
The package configuration implies:
1. Making sure that the firewall rule 36 using the OSPF protocol is enabled. Basically, this ensures
that anycast management traffic and inbound messages are allowed.
2. Creating the Quagga and OSPF dedicated configuration files.
3. Restarting Quagga.
4. Checking the logs.
To make sure the anycast dedicated firewall rule is enabled
1. Go to the Administration tab. If the homepage is not displayed, click on .

2. In the breadcrumb, click on Network configuration. The page Network configuration opens.
3. Click on the link Firewall. The page Firewall rules opens.
4. In the column Protocol, type in ospf and hit Enter. The rule is the only one listed.
5. In the column Action, make sure it is marked allow.
To create the quagga dedicated configuration files
1. Open a shell session and connect to your appliance with root credentials.
2. Go to the directory /data1/etc/quagga .
3. In this directory, create the zebra configuration file using the following commands:
# emacs zebra.conf
It should contain the appliance hostname, administrator passwords, anycast IP address,

anycast VIP(s) address and log file location like in the example below.
# more /data1/etc/quagga/zebra.conf | grep -v \!
hostname dns-anycast-1
password mypassword
enable password mypassword
# Specify the name of the interfaces used by your clients. "bge1" and "lo0" are examples.
interface bge1
ip address 192.168.53.2/24
interface lo0
ip address 192.168.55.2/32
log syslog debugging

log facility syslog
505
4. In this directory, create the OSPF configuration file using the following commands:
# emacs ospfd.conf
It should contain the appliance hostname, authentication details, response time, interfaces
dedicated to OSPF, access list and log file location like in the example below.
# more /data1/etc/quagga/ospfd.conf | grep -v \!
# Specify the proper interface. "bge1" was specified in zebra.conf in our example.
interface bge1
ip ospf authentication message-digest
ip ospf message-digest-key 1 md5 mypassword
ip ospf priority 0
ip ospf hello-interval 1
ip ospf dead-interval 5
router ospf
log-adjacency-changes
ospf router-id 192.168.53.2
area 20 authentication message-digest
area 20 nssa
network 192.168.53.0/24 area 20
redistribute connected metric-type 1
distribute-list ANYCAST out connected
!
access-list ANYCAST permit 192.168.55.2/32

log facility syslog
To restart quagga
2. Check the Quagga status using the following command:
/usr/local/etc/rc.d/quagga status
3. Restart Quagga using the following command:

/usr/local/etc/rc.d/quagga restart
To check quagga log file
2. In the file /var/log/zebra.log you can check the Quagga dedicated logs. If everything
went well, you should have three lines similar to the ones below:
// example of a sucssessfull configuration
Feb 25 09:46:02 dns1-anycast ospfd[18600]: Packet[DD]: Neighbor 192.168.53.1 Negotiation done

(Master).
Feb 25 09:46:02 dns1-anycast ospfd[18600]: AdjChg: Nbr 192.168.53.1 on bge1:192.168.53.2: Loading
-> Full (LoadingDone)
Feb 25 09:46:02 dns1-anycast ospfd[18600]: nsm_change_state(192.168.53.1, Loading -> Full):
scheduling new router-LSA origination
Making Sure DNS Anycast Was Properly Configured for OSPF
You can make sure that DNS anycast is successfully implemented, on the router itself and on
SOLIDserver, via a set of commands that ensure that the IP addresses used during the configur-
ation are part of the routes.
506
To display the OSPF routes on Cisco routers
1. Connect to SOLIDserver via a shell session.

2. Run the following command:
router>show ip route
Codes: C - connected, 5 - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, 0 - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route
Gateway of last resort is not set
192.168.56.0 32 is subnetted 1 subnets

0 N1 192.168.56.2 [110/21] via 192.168.53.2, 00:26:02, FastEthernet0/1
C 192.168.54.0/24 is directly connected, FastEthernetO/0
C 192.168.53.0/24 is directly connected, FastEthernetO/l
router>
To display the OSPF neighbors on Cisco routers
1. Connect to your Cisco router via a shell session.

router>show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface

192.168.53.2 1 FULL/BDR 00:00:38 192.168.53.2 FastEthernet0/0
To display the OSPF neighbors on SOLIDserver

2. Run the following command to connect to the zebra service:
# vtysh
Hello, this is Quagga (version 1.0.20160315).
Copyright 19962005 Kunihiro Ishiguro, et al.
dns1anycast#
3. Run the command

router>show ip ospf neighbor
Neighbor ID Pri State Dead Time Address Interface RXmtL RqstL DBsmL
192.168.53.1 1 FULL/DR 36.591s 192.168.53.1 eth0:200.0.0.1 0 0 0
Implementing Anycast Using BGP

BGP is an inter network protocol that establishes communication between two AS (Autonomous
System) numbers. Successfully using anycast for BGP routing protocol on your network requires:

2. Configuring the Appliance for BGP Anycast to make sure it uses the Quagga package that
enables anycast.
3. Configuring the Quagga Package for BGP Routing to set the configuration that suits your
needs.
507
4. Making Sure DNS Anycast Was Properly Configured for BGP once the configuration is com-
plete.
Prerequisites
Anycast implementation prerequisites:

BGP routing protocol prerequisites, you must have the following information ready:
• Make sure the network flows are properly configured, as detailed in the appendix Matrices of
Network Flows.
• Have the following information ready:
• The local AS number, EfficientIP AS number.
• The remote AS number, the client AS Number.
• The Anycast IP address.
• The Neighbor IP address.
Configuring the Appliance for BGP Anycast

2. Edit the rc.conf file to make sure it takes the package into account.
Package for BGP Routing.
508

quagga_daemons="zebra bgpd"3
quagga_enable="YES"
# Example:
ifconfig_bge1_alias0="inet 192.168.53.2 netmask 255.255.255.0"
Save your changes.

command:

reboot
Configuring the Quagga Package for BGP Routing
section Configuring the Appliance for BGP Anycast, you can configure the package for BGP
routing.
1. Creating the Quagga and BGP dedicated configuration files.

# emacs zebra.conf

password mypassword
# Specify the name of the interfaces used by your clients. "bge1" and "lo0" are examples.
interface bge1
ip address 192.168.53.2/30
interface lo0
ip address 192.168.55.2/32
3
To configure the appliance for both BGP and OSPF, you can specify the following: quagga_daemons="zebra bgpd ospfd" .
509

log facility syslog
4. In this directory, create the BGP configuration file using the following commands:
# emacs bgpd.conf
It should contain the appliance hostname, authentication details, response time, interfaces
dedicated to BGP, access list and log file location like in the example below.
# more /data1/etc/quagga/bgpd.conf | grep v \!
password zebra
log syslog
router bgp 64500
bgp routerid 192.168.53.2
network 192.168.56.1/32
timers bgp 5 10
neighbor 192.168.53.1 remoteas 65000
neighbor 192.168.53.1 softreconfiguration inbound
neighbor 192.168.53.1 activate
To restart quagga

Making Sure DNS Anycast Was Properly Configured for BGP
To make sure that DNS anycast is successfully implemented, on the router itself and on
SOLIDserver, you can use a set of commands that ensure the IP address used during the con-
figuration are part of the routes.
To display the BGP routes on Cisco routers

router#show ip route
Codes: C connected, S static, I IGRP, R RIP, M mobile, B BGP
D EIGRP, EX EIGRP external, O OSPF, IA OSPF inter area
N1 OSPF NSSA external type 1, N2 OSPF NSSA external type 2
E1 OSPF external type 1, E2 OSPF external type 2, E EGP
i ISIS, su ISIS summary, L1 ISIS level1, L2 ISIS level2
ia ISIS inter area, * candidate default, U peruser static route
o ODR, P periodic downloaded static route
192.168.56.0/32 is subnetted, 1 subnets

B 192.168.56.1 [20/0] via 192.168.53.2, 00:02:57
C 192.168.53.0/24 is directly connected, FastEthernet1/0
To display the BGP neighbors on SOLIDserver
510

# vtysh
dns1anycast#
3. Run the following command to display the routes.

dns1-anycast# show bgp neighbors
BGP neighbor is 192.168.53.1, remote AS 65000, local AS 64500, external link
BGP version 4, remote router ID 192.168.53.1
BGP state = Established, up for 00:01:41
Last read 00:00:00, hold time is 10, keepalive interval is 3 seconds
Neighbor capabilities:
4 Byte AS: advertised
Route refresh: advertised and received(old & new)
Address family IPv4 Unicast: advertised and received
Graceful Restart Capabilty: advertised
Message statistics:
Inq depth is 0
Outq depth is 0
Sent Rcvd
Opens: 2 2
Notifications: 1 0
Updates: 2 0
Keepalives: 50 43
Route Refresh: 0 0
Capability: 0 0
Total: 55 45
Minimum time between advertisement runs is 30 seconds
For address family: IPv4 Unicast
Inbound soft reconfiguration allowed
Community attribute sent to this neighbor(both)
0 accepted prefixes
Connections established 2; dropped 1
Last reset 00:02:02, due to BGP Notification send
Local host: 192.168.53.2, Local port: 27184
Foreign host: 192.168.53.1, Foreign port: 179
Nexthop: 192.168.53.2
Nexthop global: ::
Nexthop local: ::
BGP connection: non shared network
Estimated round trip time: 105 ms
Read thread: on Write thread: off
To display the BGP summary on SOLIDserver

# vtysh
dns1anycast#
3. Run the following command to display the summary.

dns1-anycast# show bgp summary
IPv4 Unicast Summary:
---------------------
BGP router identifier 192.168.53.2, local AS number 64500
RIB entries 1, using 112 bytes of memory
Peers 1, using 6960 bytes of memory
Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd
192.168.53.1 4 65000 48 58 0 0 0 00:01:52 0
Total number of neighbors 1
511
Implementing Anycast Using IS-IS

IS-IS is a link-state routing protocol, operating by reliably flooding link state information throughout
a network of routers. Successfully using anycast for IS-IS routing protocol on your network requires:

2. Configuring the Appliance for IS-IS Anycast to make sure it uses the Quagga package that
enables anycast.
3. Configuring the Quagga Package for IS-IS Routing to set the configuration that suits your
needs.
4. Making Sure DNS Anycast Was Properly Configured for IS-IS once the configuration is com-
plete.
Prerequisites
Anycast implementation prerequisites:

Configuring the Appliance for IS-IS Anycast

2. Edit the rc.conf file to make sure it takes the package into account.
Package for IS-IS Routing.
512

quagga_daemons="zebra isisd"4
quagga_enable="YES"
# Example:
ifconfig_lo0_alias0="inet 192.168.99.8 netmask 255.255.255.0"
Save your changes.

command:

reboot
Configuring the Quagga Package for IS-IS Routing
section Configuring the Appliance for IS-IS Anycast, you can configure the package for IS-IS
routing.
1. Creating the Quagga and IS-IS dedicated configuration files.

3. Checking the logs.
# emacs zebra.conf

password mypassword

log facility syslog
4
To configure the appliance for both BGP and OSPF, you can specify the following: quagga_daemons="zebra bgpd ospfd" .
513
4. In this directory, create the IS-IS configuration file using the following commands:
# emacs isisd.conf
It should contain interfaces used for IS-IS communication and for anycast, an IS-IS address
and log file location like in the example below:
# more /data1/etc/quagga/isisd.conf | grep v \!
password mypassword
interface em3
ip router isis ISIS_0
interface lo0
ip router isis ISIS_0
router isis ISIS_0

net 49.0001.1720.1600.2002.00
is-type level-1
metric-style wide
log facility syslog
To restart quagga

To check quagga log file
2. In the file /var/log/zebra.log you can check the Quagga dedicated logs using the fol-
lowing command:
# tail f /var/log/zebra.log
Making Sure DNS Anycast Was Properly Configured for IS-IS
To make sure that DNS anycast is successfully implemented, on the router itself and on
SOLIDserver, you can use a set of commands that ensure the IP address used during the con-
figuration are part of the routes.
To display the IS-IS routes and neighbors status on Cisco routers

router> show ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
514
+ - replicated route, % - next hop override
[...]
192.168.99.0/32 is subnetted, 1 subnets
i L1 192.168.99.8 [115/20] via 192.168.1.50, 00:00:33, FastEthernet0/0
[...]
router> show clns neighbors

System Id Interface SNPA State Holdtime Type Protocol
dns-anycast-1 Fa0/0 000c.29ef.d8bb Up 28 L1 IS-IS
To display the IS-IS neighbors status on SOLIDserver

% vtysh
Copyright 1996-2005 Kunihiro Ishiguro, et al.
dns-anycast-1#
3. 3. Run the following command to display info on IS-IS neighbor:

dns-anycast-1# show isis neighbor
Area ISIS_0:
System Id Interface L State Holdtime SNPA
router em3 1 Up 8 ca01.025d.0000
dns-anycast-1# show isis hostname

Level System ID Dynamic Hostname
1 1720.1600.1001 router
* 1720.1600.2002 dns-anycast-1
Integrating Cisco Umbrella

SOLIDserver embeds a DNSCrypt proxy which allows you to forward all the DNS queries it re-
5
ceives to the Cisco Umbrella Cloud .
DNSCrypt is a protocol that authenticates communications between a DNS client and a DNS
resolver. It prevents DNS spoofing. It uses cryptographic signatures to verify that responses ori-
ginate from Cisco Umbrella and haven’t been tampered with.
To successfully configure SOLIDserver for Cisco Umbrella:
1. Via Cisco Umbrella web interface, create a network device and retrieve its API key and secret
strings.
2. Via SOLIDserver GUI, configure the IP address dedicated to Umbrella as the only forwarder
for your local DNS appliance.
3. Via SOLIDserver CLI, configure and launch the proxy DNSCrypt.
Note that the DNSCrypt protocol uses the port 443, in TCP and UDP, which is usually reserved
to HTTPS. It is possible that some equipments, such as firewalls, IDP or IPS detect a wrongful
use of the port. Make sure these equipments are configured to allow this traffic.
5
For more details on Cisco Umbrella services, refer to the proprietary website at https://umbrella.cisco.com/.
515
To configure the appliance for Cisco Umbrella
1. Retrieve your Cisco Umbrella parameters
a. Connect to your Cisco Umbrella web interface using your credentials.

b. In the left panel, click on Admin > API Keys. The page refreshes.
c. Tick the box Umbrella Network Devices.
d. Click on CREATE . The page refreshes and displays Your Key and Your Secret strings.
Keep note of these values, you need them later on and they disappear after you leave
this page.
e. Tick the confirmation box and click on CLOSE .
2. Configure the DNS forwarder via the GUI
a. Go to the DNS tab. If the homepage is not displayed, click on . The homepage opens.
b. Click on DNS servers. The page All servers opens.
c. At the end of the line of the server or smart architecture you intend to connect to Cisco
Umbrella Cloud, click on . The properties page opens.
d. Open the panel Forwarding using .
e. Click on EDIT . The wizard Forwarding configuration opens.
f. In the field Add a forwarder, type 127.0.1.53 which is the IP address dedicated to the
proxy DNSCrypt.
g. Click on ADD to move it to the list Forwarders.
h. In the field Forward mode, select Only.
i. Click on OK to commit the configuration. The report opens and closes. The properties
page refreshes and displayed the new settings.
j. Repeat step c to i for each server or smart architecture on which you plan to deploy
DNSCrypt.
3. Configure and launch the proxy DNSCrypt via the CLI
b. Retrieve your DNSCrypt parameters.
i. Launch the script umbrella_setup, using the API key and secret copied beforehand,
and indicate the device name of your choice, as follows:
/usr/local/nessy2/script/umbrella_setup <Your-Cisco-Umbrella-API-Key>
<Your-Cisco-Umbrella-API-Secret> <Your-Cisco-Umbrella-API-Key>
<Your-Cisco-Umbrella-Device-Name>
The result should look as follows:

server 127.0.1.53 {
edns-opendns yes;
edns-opendns-orgid <your-Cisco-Umbrella-Organization-ID>;
edns-opendns-deviceid "<your-Cisco-Umbrella-Device-ID>";
};
516
ii. Copy the lines returned.
c. Edit the DNS global include file.
i. Open the file /data1/etc/namedb/global_include.conf to edit it.

ii. Add the copied lines to the file to specify DNSCrypt global parameters.
iii. Save your changes.
d. Edit the DNS options include file.
i. Open the file /data1/etc/namedb/options_include.conf to edit it.

ii. Add the following line to the file to specify DNSCrypt options parameters:
listen-on { !127.0.1.0/24; any ; };
iii. Save your changes.
e. Edit the system configuration file.
i. Open the file /etc/rc.conf to edit it.

ii. Enable the proxy DNSCrypt as follows:
dnscrypt_proxy_enable="YES"
iii. Add the following line to the file to specify the IP address dedicated to the proxy
DNSCrypt:
ifconfig_lo0_alias53="inet 127.0.1.53 netmask 255.0.0.0"
iv. Save your changes.
f. Restart the network configuration using the command:

/etc/netstart
g. Start the service dnscrypt-proxy using the command:

/usr/local/etc/rc.d/dnscrypt-proxy start
h. Restart the service ipmdns using the command:

/usr/local/etc/rc.d/ipmdns.sh restart
Now, every DNS query trafficking through the appliance is directly forwarded to the
Cisco Umbrella Cloud for resolution using your organization ID and device ID, and
therefore, your Umbrella policies.
i. Repeat all the steps for each appliance you want to configure.
517
Chapter 36. Managing DNS Views
Within some DNS servers, you can create and administer views to serve one version of a zone
to one set of clients and a different version of a zone to another set of clients. Views provide a
different answer to the same DNS query, depending on the IP source of the query or the IP where
the client packet is received. You can create multiple views of a given zone, with a different set
of records in each of them. Same resource records can also exist in multiple zones in order to
serve common records.
Browsing DNS Views

Within the DNS module, the view is the second level of the hierarchy. It allows you to manage
zones, and therefore in extension, resource records. Keep in mind that also this level of the
hierarchy is optional, once you create views, all the zones have to be managed via a view
whether all zones are managed through a unique view or several views.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 36.1. The view in the DNS hierarchy
Browsing the DNS Views Database

To display the list of DNS views
2. Click on DNS views. The page All views opens.
To display the DNS views of a specific server
3. Click on the name of the server of your choice. The list of All zones of the server is displayed.
4. In the breadcrumb, click on All views. The list of views of the chosen server opens.
To display a view properties page
3. At the end of the line of the view of your choice, click on . The properties page opens.
518
Managing DNS Views
Customizing the Display on the Page All Views

Understanding the DNS View Statuses

The column Status provides information regarding the views you manage.
Table 36.1. DNS view statuses

Status Description
OK The view is operational.
Delayed create The view is being created.
Delayed delete The view is being deleted.
You can also rely on the column Multi-status to monitor your view configuration with messages
regarding the compatibility with Hybrid. For more details, refer to the section Understanding the
Column Multi-Status.
Adding DNS Views

SOLIDserver allows you to create as many views as you need. During the creation of the view,
you have to name it and specify:
• The list match clients: it indicates which clients can access or not the view. It sets up a filter
based on the IP address of the client requesting a specific resource. That way you can decide
which particular IP address, or network, can access the zone(s) you are managing via a view.
Intranet View
interface 10.0.0.0
10.0.0.1 => pc1.mycomp
10.0.0.2 => pc8.mycomp
filtering on
10.0.0.0
Extranet View
interface 192.168.0.0
192.168.0.24 => pc1.mycomp
192.168.0.45 => sv8.mycomp
192.168.0.81 => pc8.mycomp
Intranet View
space
network 10.0.0.0
filtering on
192.168.0.0
Extranet View
space
network 192.168.0.0
Figure 36.2. A DNS view configuration using match clients
• The list match destinations: it indicates where are directed the clients. It sets up a filter based
on the interface used by the client when querying the DNS server. Obviously, this criterion is
only useful if you have several interfaces configured for one appliance.
519
Managing DNS Views
Intranet View
interface 10.0.0.0
10.0.0.1 => pc1.mycomp
filtering on 10.0.0.2 => pc8.mycomp
interface
10.0.0.0
Extranet View
interface 192.168.0.0
192.168.0.24 => pc1.mycomp
192.168.0.45 => sv8.mycomp
192.168.0.81 => pc8.mycomp
Intranet VLAN
filtering on
interface
192.168.0.0
Extranet VLAN
Figure 36.3. A DNS view configuration using match destinations
Keep in mind that if you create views after creating zones, all the zones are moved to that
view. If you need several views, you have to create a another view and then move the zones in
the view of your choice. For more details regarding zones migration, refer to the section Copying
or Moving DNS Zones. You cannot manage a set of zones through the views and others zones
without the created views.
To add a DNS view
3. In the menu, select Add > DNS view. The DNS server selection wizard opens.
4. In the field DNS server, select the server on which you are adding a view.
5. Click on NEXT . The page Add a DNS view opens.
6. If you or your administrator created classes at the view level, in the list DHCP view class
7. In the field DNS view name, type in an explicit name. This name cannot contain special
characters. It can contain letters and numbers, for instance external, internal1 and internal2
are correct view names.

Field Description
Properties.
520
Managing DNS Views
If you want to create a view and configure it later, click on NEXT until to get to the last page
of the wizard and click on OK to commit the creation. For more details regarding the default
configuration settings of a view, refer to the last step of this procedure.
9. Click on NEXT . The page Match clients opens.
10. Configure the list ACL values:
a. Using the drop-down lists Type and Restriction, you can configure as many restrictions
as you need: grant or deny access to networks, IP addresses, ACLs, and keys. Type
contains the following options:

Type Description
Network address Allow or deny an entire network. In the field Network address, type in an IPv4
address following the format <ip-address>/<prefix>.
a
ACL Allow or deny an ACL defined at server level in the drop-down list ACL: admin ,
any, none, localhost and localnets. The ACL list also includes specific ACL created
at server level. For more details, refer to the section Configuring Access Control
Lists For a Server.
a
The ACL admin is used by EfficientIP's management platform to configure and exchange data with DNS
servers.
b. Once a restriction/permission is configured as needed, click on ADD .The value is moved

to the list ACL values. In the list, denied hosts appear preceded by an exclamation mark
(!).
fields again, edit the entry and click on UPDATE or click on DELETE to remove the entry
from the list. If you made changes that you do not want to save, click on CANCEL .
c. Repeat these actions for as many restrictions and permissions as needed.
d. Make sure the order of the values in the list ACL values suits your needs: the order of
the elements listed is important as each restriction or permission is reviewed following
the order you set in the list. If not, select a value and use the buttons and to organize
the list.
11. Click on NEXT . The page Match destinations opens.

12. Configure the list ACL values following the step 9 of this procedure.
13. Click on NEXT . The page DNS views order opens.
14. In the field DNS views order, the view you are creating is listed. Once you created more than
one view, you can order the list using and . The match client and match destination
configurations of each view of your server are then reviewed following the views order set
in this field.
15. Click on OK to validate the creation of the view. The report opens and closes. The configur-
ation details are listed in the Match related columns.
By default, if you do not configure anything on the Match clients list a key named key view-
name is listed in the corresponding column. The key of any other view, existing or to be
created, is automatically denied access and listed for each view as follows: ! key otherview-
521
Managing DNS Views
name. Besides, the Match destinations default value is always the any ACL. If you do not
edit or delete it, it grants access to anyone and is therefore listed in the corresponding column.
The views addition automatically edits the Match-clients column of the existing view(s) to ensure
that they deny access to each other and manage separate zones and RRs. Any time you add a
new view, all the views change status from OK to Delayed create during the Match-clients criteria
modification. Once it is done, they all change back to OK.
Once you added a view, any extra view is put at the bottom of the list DNS views order, unless
you change their order yourself.
Editing DNS Views

Once a view is created, you can edit its configuration through its properties page. Before editing
a view, keep in mind that:
• You cannot edit the name of a view.

• The list match-clients allows to grant or restrict access to the zones managed by the view
based on the source IP address of the incoming DNS requests.
1
• The list match-destinations allows to set the destination address of the incoming DNS requests
based on the interface used for the request. If you did not set several interfaces, it is useless
to configure the match-destination.
• The lists match-clients and match-destinations are access control lists in essence. Therefore,
the order of the elements listed in both lists is important as each restriction or permission is
reviewed following the order you set in the list.
To edit a DNS view
3. Put your mouse over the Name of the view you want to edit. The contextual menu appears.
4. Click on . The wizard Add a DNS view opens.
5. If you or your administrator created classes at the view level, in the list DHCP view class
6. Edit the advanced properties or the value of the drop-down list Advanced properties if need
be. For more details, refer to the section Configuring DNS Advanced Properties.
8. Edit the ACL Value list according to your needs:
a. You can edit the content of the list. Click on an entry, its configuration is displayed in
the fields again, edit the entry and click on UPDATE . If you made changes that you do
not want to save, click on CANCEL . For more details regarding the available settings,
refer to the procedure Configure the list ACL values
1
The destination IP address is actually a DNS server interface.
522
Managing DNS Views
b. You can reorganize the order of the entries in the list. Select them one by one in the list
and click on or until the order suits your needs. Each restriction or permission is
reviewed following the order you set in the list.
c. You can remove an entry from the list: select it and click on DELETE . To deselect the
entry click on CANCEL .

10. Edit the ACL Value list following the step 7.
11. Click on NEXT . The page DNS views order opens. For more details, refer to the section
Editing the Order of the Views below.
12. Click on OK to commit the Match clients criteria changes. The report opens and closes. The
new list is displayed in the list Match clients of the panel Main properties.
Editing the Order of the Views

Once you created several views on a server, you can order them. The Order set is displayed in
the column Order. If you only have one view on a server, its value is 0.
Ordering views on a server allows to specify in which order the match client and match destination
configurations of each view (ACL, networks, etc.) are reviewed. This, in turn, impacts the DNS
client queries responses. The order of the views you set is followed strictly: once a match is
found, the rest of the restrictions and permissions are ignored. The first view reviewed is 0, the
second on is 1, and so forth. This order is saved in the DNS server configuration.
To edit the order of the views
3. Click on the name of the smart server of your choice. Only the views of the selected server
are displayed.
4. Right-click over the Name of the view of your choice. The contextual menu opens.
5. Click on . The Add a DNS view wizard opens.
6. The field DNS view name is gray to indicate that it cannot be edited.
7. In the drop-down list Advanced properties, edit the value and corresponding fields if need
be. For more details, refer to the section Configuring DNS Advanced Properties.
10. Click on NEXT . The page DNS views order opens.
11. In the field DNS views order, order the views according to your needs using and .
12. Click on OK to commit the views order changes. The report opens and closes. The page
refreshes. The new order set is visible in the column Order.
Deleting DNS Views

At any moment you can delete a view. Before deleting a view, keep in mind that:
523
Managing DNS Views
• The views must be deleted one by one.

• Deleting one view deletes the zone(s) it manages, as well as all the RRs the zone(s) manage
on the physical server. So if you want to delete a view but not the zones it contains, migrate
the zones to a different view before deleting it. For more details regarding zones migration,
refer to the section Copying or Moving DNS Zones.
• Deleting a view, removes it from the DNS views order list: the list is updated. This order is also
updated in the DNS configuration.
• If you only have one view, deleting it does not delete the zone(s) it manages but only the con-
tainer itself: the view is therefore no longer listed on the server All views page.
• If zones inherited class parameters from the deleted view, their value and the source of their
value remain the same: the Inheritance property of each class parameter is forced to Inherited
or Set to match the configuration of the deleted view.
If you want get rid of all the views and manage zones via the DNS server itself, refer to the section
Going Back to Managing Zones Without Views.
To delete a view
4. Tick the view you want to delete.
6. Click on OK to commit the view deletion. The report opens and closes. The view is Delayed
delete before it is no longer listed. In the meantime, the zones and RRs it managed are deleted
as well if you had several created views.
Defining a DNS View as a Group Resource

Adding a view as one of the resources of a specific group allows the users of that group to
manage the view(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a view as a resource also makes every item it contains available. For more
Going Back to Managing Zones Without Views

At any time you might want to stop managing your zones with views. Considering that the way
you delete views has an impact on the database and different behaviors you need to be careful.
First, keep in mind that no matter how many views you created, the last view listed on the page
All views of a specific server can be deleted on its own: it does not delete the zones it manages.
With that in mind, we recommend that you follow the steps below to successfully get rid of the
views when you no longer need them.
To successfully remove all views
1. Choose the view that shold be deleted last.
524
Managing DNS Views
2. Migrate all the zones you want to keep in that view. For more details regarding zones migra-
tion, refer to the section Copying or Moving DNS Zones.
3. One by one, tick and delete the unwanted views. For more details, refer to the procedure
To delete a view.
4. Once the only remaining view is the one that holds all the zones you want to work with, tick
it and delete it. The zones and RRs it contains are kept and still listed in the pages All zones
and All RRs of the server. Now you can manage them through the server directly.
525
Chapter 37. Configuring DNS Views
Like servers, views can be configured individually to set a series of behaviors for the zones they
contain.
Any configuration set at view level overwrites what was set at server level (whether physical or
smart).
Configuring DNS Forwarding at View Level

At view level you can set forwarders and override the configuration set at server level. All the
zones managed by the view inherit the new settings.
Configuring a Forwarders List on a View

From the list All views of a smart architecture, you can edit the forward configuration of a view.
This configuration edition applies to the view on all the physical servers managed by the architec-
ture.
If the view belongs to a server not managed via a smart architecture, it only applies to the zones
of the server.
To configure a forwarders list for a view
2. Click on DNS servers. The DNS list All servers opens.
3. Click on the name of the smart architecture of your choice. The page All zones opens.
4. In the breadcrumb, click on All views. The page All views of the smart architecture opens.
6. Open the panel Forwarding using and click on EDIT . The wizard opens.
7. Click on NEXT until the page Forwarding configuration appears.
8. In the field Add a forwarder, type in the address of a forwarder.
as needed.

Option Description
None The view uses the forward configuration set at server level.
First The server sends the queries to the forwarder(s) you just set and, if it does not receive any
answer, attempts to find an answer.
526
Configuring DNS Views
Configuring Specific Forwarding for a View on a Physical Server Managed

Through a Smart
At view level, you can also set a specific forwarding configuration for views on physical servers
managed through a smart architecture already configured with forward options.
Just like for servers, the forwarding configuration set on a smart view is automatically inherited
by the views of the physical servers managed through that smart, but you can edit the type of
forward option for a view directly on the physical server. This option is in turn inherited by the
zones and records of the view and allows you to customize the forwarding on your network.
Keep in mind that once the Forward option is set on a smart you cannot unset it on the views of
the physical servers it manages. Setting the option to None means at view level that the view
inherits the server configuration.
To configure a specific forward mode on a physical server view
4. Click on the name of the physical server of your choice. The page All zones of the physical
server opens.
5. In the breadcrumb, click on All views. The page All views of the physical server opens.
7. Open the panel Forwarding using . The value of the field Forward and of the list Forwarders
are inherited from the server.
8. Click on EDIT . The wizard opens.
9. Click on NEXT until the page Edit a DNS view appears.
fields.
11. Set your forwarders list:
a. In the field Add a forwarder, type in the address of a forwarder.

ers as needed.
12. In the field Forward mode, select the mode of your choice: First or Only. You cannot set the
forwarding to None once it has been set on the smart. The page refreshes. For more details
regarding these modes, refer to the table Forward mode options in the section above.
13. Click on OK to commit the forwarders configuration of the physical server. The properties
page is visible again. In the panel Forwarding, the message Smart configuration is overwritten
is displayed above your mode and forwarders configuration.
527
At any time you can reverse your changes and use the configuration set at server level (smart
of physical): edit the panel Forwarding, untick the box Overwrite the smart settings and click on
OK to commit your changes.
Configuring DNS Notify Messages at View Level

Configuring the Notify at view level allows to set the changes notification for all the master zones
it contains. Once the notification is sent to slave zones, the administrator decides if a zone
transfer is relevant. For more details, refer to the section Limiting Zone Transfer at View Level.
• The notification type configured for the view,

• The slave zones that receive the notify messages through their managing view (Also notify),
• The allow-notify directive of the view slave zones. For instance, you can allow all the servers
of a network to notify the slave zones of your server or only a few.
Note that there is an implicit allow-notify directive set when you add a slave zone: when you set
the Master IP address of the slave zone you are allowing the master zones of this server to send
notify messages to your slave zone.
Keep in mind that any configuration set at view level overrides the server level configuration
and any configuration set at zone level overrides the view level configuration.
To configure notify messages at view level
2. Click on DNS views. The DNS list All views opens.
4. Open the panel Notify using and click on EDIT . The wizard opens.
5. If you or your administrator created classes, the DNS view class list is visible. Select a class
or None and click on NEXT . The next page of the wizard opens.
6. Do not edit the advanced properties configuration and click on NEXT . The page Notify opens.
7. In the drop-down list Notify, configure the view notification behavior following the table below.
Table 37.2. DNS view notify types

Field Description
No With this option, no notify message is sent when changes are performed in the master
zones.
Yes With this option, the notify messages is sent to the target of the NS records of the master
zone. It is also sent to the IP address(es) specified in the field IP address below.
Explicit With this option, the notify messages is only sent to the IP address(es) specified in the field
IP address below.
a. In the field IP address, type in the IP address of another server. The notify message is
sent if you chose the notify type Yes or Explicit.
528
follows: <ip-address> port: <port-number>. You can repeat these actions for as many
servers as needed.
fields again, edit the entry and click on UPDATE or click on DELETE to remove the entry
9. Click on NEXT . The page Allow notify opens. It allows to specify if the view slave zones can
receive master zones notification messages.

Type Description
a
For a Server.
a

is visible again. Your configurations are displayed in the panel Notify.
Configuring DNS Recursion at View Level

The recursion settings at server level are inherited by the views. However, you can change these
settings at view level to customize the recursion configuration on the network: the changes oper-
ated on view are inherited by the zones managed through the view.
Enabling and Disabling the Recursion on a View

The recursion statement essentially controls caching behavior in the view and the zones it man-
ages.
529
From the view properties page, you can edit its recursive behavior through the panel Recursion.
By default, its content is inherited from the server.
To enable the DNS recursion on a view
3. Click on the name of the server of your choice. The page All zones opens.
6. Open the panel Recursion using .
7. Click on NEXT until you get to the page Recursion configuration.
8. Open the panel Recursion using . If the Recursion is set to no, click on EDIT . The wizard
opens.
9. Click on NEXT until you open the page Recursion configuration.
10. In the drop-down list Recursion, select yes.
11. Click on NEXT . The page Allow recursion opens. For more details regarding the recursion
configuration, refer to the section Limiting the Recursion at View Level below.
To disable the DNS recursion on a view
6. Open the panel Recursion using . If the Recursion is set to yes, click on EDIT . The wizard
opens.
7. Click on NEXT until you open the page Recursion configuration.
8. In the drop-down list Recursion, select no.
9. Click on OK to commit your changes. The report opens and closes. The page refreshes, in
the panel the recursion is disabled.
Limiting the Recursion at View Level

By default, the view inherits the server recursion settings (permissions and restrictions).
Once the recursion is restricted at view level, it overrides the server recursion configuration
and applies to the zones it contains.
To set an allow-recursion match list at view level
530

6. Open the panel Recursion using and click on EDIT . The wizard opens.
7. Click on NEXT until you get to the page Recursion configuration.
8. Using the drop-down lists Type and Restriction, you can configure as many restrictions as

Type Description
a
For a Server.
a

9. Click on OK to commit the recursion authorizations/restrictions configuration. The report
Restricting DNS Queries at View Level

The DNS queries can be restricted through the allow-query and allow-query-cache options. They
both set an ACL list for IP addresses and/or network addresses, so keep in mind that the order
of the elements listed in the field ACL values is important as each restriction or permission
is reviewed following the order you set in the list.
Allow Query
SOLIDserver allows to specify which hosts are allowed to issue DNS queries.
The allow-query configuration set at view level overrides the allow query defined at server level.
Once the statement is set for a view, it applies to all the zones it contains.
531
To set an allow query match list at view level
Allow query cache and Allow-transfer.
5. Click on EDIT . The wizard Add a DNS view opens.
6. In the field DNS view name, the view name is displayed in gray to indicate you cannot edit
it.
7. In the drop-down list Advanced properties, you can select Default or All and edit the config-
uration if need be. For more details, refer to the chapter Managing Advanced Properties.
8. Click on NEXT . The page Allow-query opens.
9. Set up the allow-query match list.

Type Description
a
For a Server.
a

10. Click on NEXT twice to skip the page Allow-query-cache and open the page Allow-transfer.
11. Click on OK to commit the DNS query restrictions on your view. The report opens and closes.
The properties page is visible again, your configuration is listed in the list Allow-query of the
panel Access control.
532
Allow Query Cache

SOLIDserver allows to specify which hosts are allowed to issue DNS queries on the local view
cache.
The allow query cache configuration set at view level overrides the allow query cache
defined at the server level. Once the statement is set for a view, it applies to all the zones it
contains.
Allow-query-cache statement particularities

The allow-query-cache is independent from the allow-query statement but closely linked to
the allow-recursion statement.
If the recursion is set to no, the cache cannot be queried, so it is useless to set an allow-
query-cache match list.
If the recursion is set to yes and the allow-recursion statement is not defined, by default the
localhost and localnets are permitted to query the server cache.
If the recursion is set to yes and the allow-recursion statement is defined with a specific match
list, the local cache access is granted to all the entries of the allow-recursion match list.
The match list defined controls recursive behavior as recursive queries would be useless without
access to the local view cache. Typically, if a host is in the allow-recursion match list, it could
access the view the first time and get query result. However, if it is not part of the allow-query-
cache match list then it would not be able to make the same query a second time as it would be
saved on the cache to which it does not have access. On the contrary, if a host is in the allow-
query-cache match list but not in the allow-recursion match list, it would only get results for
queries already sent by another host with the proper access rights. Hence the need to configure
carefully both these statements to avoid conflicts and absurd access configurations.
To set an allow query cache match list at view level
it.
9. Click on NEXT . The page Allow query cache opens.
10. Set up the allow-query-cache match list.
533

Type Description
a
For a Server.
a

11. Click on NEXT . The page Allow-transfer opens.
The properties page is visible again, your configuration is listed in the list Allow-query-cache
of the panel Access control.
Limiting Zone Transfer at View Level

by default to all DNS server but supports the allow-transfer property at view level to allow you to
specify which hosts, networks, or TSIG keys are granted or denied the permission to do transfers
for all the zones of the view.
The allow-transfer option configuration basically creates an ACL dedicated to controlling transfers
so keep in mind that the order of the elements listed in the field ACL values is important as
each restriction or permission is reviewed following the order you set in the list.
The allow-transfer property set at view level overrides the allow query defined at server level.
Once the statement is configured at view level, it applies to all the zones it contains.
To set an allow transfer match list at view level
534
it.
9. Click on NEXT . The page Allow query cache opens.
11. Set up the allow-transfer match list.

Type Description
a
For a Server.
a

The properties page is visible again, your configuration is listed in the list Allow-transfer of
the panel Access control.
Configuring Client Resolver Cache Options at View Level

From the properties page of a view belonging to a smart architecture managing EfficientIP DNS
servers using the SSL protocol, you can edit the lame-ttl and max-cache-client options.
These options set at view level override the server level configuration. Once they are con-
figured at view level, they apply to all the zones it contains.
535
For more details regarding these two options, refer to the section Configuring Client Resolver
Cache Options at Server Level.
To set the lame-ttl option at view level
2. Click on DNS views. The page opens.
5. In the field Lame-ttl, type in the value of your choice. This value is in seconds can be set
between 30 and 1800. The default value is 600, the maximum value is 1800 seconds.
To set the max-cache-size option at view level
5. In the field Max-cache-size, type in the value of your choice to set the cache memory size.
This value is in bytes. The default value is 100m.
Configuring EDNS Options at View Level

servers using the SSL protocol, you can edit the edns-udp-size and max-udp-size options.
These options set at view level override the server level configuration. Once they are con-
figured at view level, they apply to all the zones it contains.
For more details regarding these options, refer to the section Configuring EDNS Options at
Server Level.
To set the edns-udp-size option at view level
5. In the field Edns-udp-size, type in the size of received packets of your choice. This value is
in bytes, and must be set between 512 and 4096. The default value is 4096.
536
To add a DNS key at view level
5. In the field Max-udp-size, type in the maximum size of the packets you send. This value is
in bytes and must be set between 512 and 4096. The default value is 4096.
Configuring a Sortlist at View Level

servers using the SSL protocol, you can edit the sortlist statement can be edited at view level.
Like any other configuration option, the settings defined at server level are edited by the view.
Editing them at view level overwrites the server level configuration and applies to the zones
managed by the view.
For more details regarding the sortlist statement, refer to the section Configuring a Sortlist at
Server Level.
To define a sortlist statement at view level
5. In the field Client address, type in the client IP address/subnet. It must be composed of an
IPv4 address containing 1 to 4 bytes followed by the prefix: <IP address>/<prefix>.
6. In the field Sort address, type in a list of IP addresses or subnets followed by a semi-colon.
These addresses correspond to the value of an A record of the RRset for which you create
the sortlist. The statement respects the order in which you typed in the addresses. The value
must respect the format <IP address>/<prefix>; even if you only type in one sort address.
is visible again and displays your sortlist as follows: {<client_address_field_value>;
{<first_sort_address>;<second_sort_address;<etc>};}; .There is one sortlist per client address
defined.
Configuring DNS Sources at View Level

The Sources configuration is only available for views managed through an EfficientIP DNS
physical server using the SSL protocol.
Configuring DNS sources allows to set physical interfaces at view level to be systematically used
for all notify operations and zone transfer. DNS sources configuration can be inherited from the
537
server. If set at view level, it is inherited by the zones. The inheritance details are visible on both
the views and zones properties page.
interfaces to be used for the view transfer and notify options. When editing these panels, you
can define the following statements:
query-source
query-source-v6
transfer-source
transfer-source-v6
view.
alt-transfer-source
538
notify-source
notify-source-v6
To set IPv4 DNS sources at view level
opens.
declared on SOLIDserver, otherwise, all the transfer operations would fail.
a. In the field Query-source address, type in the IPv4 address of the interface used for
outgoing queries.
b. In the field Query-source port, you can type in the port number used for outgoing
c. In the field Transfer-source address, type in the IPv4 address to be used for the zones
d. In the field Transfer-source port, you can specify which port on the interface should be
used.
e. In the drop-down list Use-alt-transfer-source, set the use of an alternate interface if
need be.

to yes.
fields.
539
The statement use-alt-transfer-source applies to the alternate interfaces declared through

dress-v6).
f. If you enabled the use of an alternate interface, in the field Alt-transfer-source address,
appliance.
g. If you enabled the use of an alternate interface, in the field Alt-transfer-source port,
declared on SOLIDserver, otherwise all the notify operations would fail.
a. In the field Notify-source address, type in the IPv4 address to be used for outgoing
used.
To set IPv6 DNS sources at view level
opens.
a. In the field Query-source-v6 address, type in the IPv6 address of the interface used for
outgoing queries.
b. In the field Query-source-v6 port, you can type in the port number used for outgoing
c. In the field Transfer-source-v6 address, type in the IPv4 address to be used for the
ance. If you defined the use-alt-transfer-source statement in the panel Sources, it applies
d. In the field Transfer-source-v6 port, you can specify which port on the interface should
be used.
e. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
f. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
540
be used.
541
Chapter 38. Managing DNS Zones
When deploying a name server, it is important to understand the difference between a zone and
a domain. A zone is a delegated point within a DNS structure, and is made up of adjoining elements
of the domain structure, which are governed by a name server.
SOLIDserver allows you to create and manage 6 types of zones: Master, Slave, Forward, Stub,
Hint and Delegation-Only. Each type of zone provides specific options that you can set when
creating or editing the zones.
If you want to create RPZ zones, refer to the chapter DNS Firewall (RPZ).
Browsing DNS Zones

As far as the DNS hierarchy is concerned, the zone is the third level. It is compulsory to create
a zone to manage resource records.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 38.1. The zone in the DNS hierarchy
Browsing the DNS Zones Database

To display the list of zones
2. In the breadcrumb, click on All zones. The page All zones opens.
From the DNS homepage, you can access directly name (direct), reverse, master, slave, forward
and stub zones by clicking on each zone type dedicated button.
To display the list of zones of a specific server
2. Click on DNS zones. The page All zones opens.
3. In the column Server, click on the name of the server of your choice to display the zones it
contains.
To display a zone properties page
3. At the end of the line of the zone of your choice, click on . The properties page opens.
542
Managing DNS Zones
On the DNS zone properties page of a physical server you can find the following information in
separate panels:
• Main properties: sums up the main information regarding the zone. In the case of our zone:
the zone name, type, resolution, server, view, IPAM space it is linked to, responsible user email
address, refresh frequency, lifespan, etc. In other words, everything there is to know about the
zone apart from specific configurations that are all displayed in dedicated panels.
• Advanced properties: displays the advanced properties set at zone level. You cannot edit
them from this panel, to make any changes use the button EDIT in the panel Main properties
and change them on the dedicated page.
• Name servers: displays the server(s) that have authority over the zone or over the domain sub-
zone(s).
• Forwarding: displays the servers toward which are redirected the DNS queries for that zone.
• Groups access: displays the groups that have the zone listed as a resource and the rights and
delegations the users have over it.
• Ticket: displays the users that issued a ticket through the Workflow module to modify or delete
the zone. This panel cannot be edited from the properties page.
• Notify: displays the IP addresses of the servers that should be notified of any change made
on the master zone. These servers contain slave zone(s) named after the current master zone.
• Access control: displays the allow-query, allow-transfer and allow-update access permissions
and restrictions to query the master zone, transfer the zone data or update the zone.
• Sources: displays the IPv4 interface(s) used to send the zone notifications.
• Sources V6: displays the IPv6 interface(s) used to send the zone notifications.
• State log: displays the server status evolution log; OK or KO (i.e. Timeout) and at what time it
changed status. This panel cannot be edited, it simply provides information.
• Audit: displays all of the latest changes performed on the zone by the user logged in. If they
belong to a group with access to the changes from all users, the panel displays all the operations
ever performed. For more details, refer to the section Allowing Users to Display All the Opera-
tions Performed.
Customizing the Display on the Page All Zones

Understanding the DNS Zone Statuses

The column Status provides information regarding the zones you manage.
Table 38.1. DNS zone statuses

Status Description
OK The zone is operational.
Busy The zone is synchronizing.
Delayed create The zone creation is delayed due to a server load or a server unavailability. The
creation is automatically pushed when the server is available.
Delayed delete The zone deletion is delayed due to a server load or a server unavailability. The de-
letion is automatically pushed when the server is available.
Timeout The zone is not available.
543
Managing DNS Zones
Status Description
Unknown The zone is not synchronized yet.
Not authoritative The zone configuration is incorrect: in the SOA another server was set as authoritative.
Refused The DNS server refuses the transfer between the current zone and the management
platform, check the parameter allow-transfer of the zone or server properties page.
No RR There is no RR to transfer for the zone. That status can be displayed for a forward
zone.
Unmanaged The zone is not available due to a disabling operation.
Moreover, the column Multi-status provides you with emergency, warning, critical, error or inform-
ational messages regarding the compatibility with Hybrid. For more details, refer to the section
Adding DNS Zones

You can add as many zones as you want on the page All zones. Each zone type follows a spe-
cific procedure detailed in the sections below:
• Adding a Master Zone

• Adding a Slave Zone
• Adding a Forward Zone
• Adding a Stub Zone
• Adding a Hint Zone
• Adding a Delegation-Only Zone
• SOLIDserver can be used for Hosting Active Directory Domain Zones.
Note that you can also import zones, for more details refer to the section Importing Zones.
If you want to create RPZ zones, refer to the chapter DNS Firewall (RPZ).
Adding a Master Zone

A master zone stocks the original zone important records for a certain name space and answers
the other name servers queries regarding this space name.
The most common use of Master zones is to configure them with a slave zone of the same name
that stores all its records, in a Master/Slave configuration where the master server contains the
master zones and the slave server contains the slave zones. However, if you want to make the
DNS available at all times, you can use a multiple master configuration. In which case, all DNS
servers are master servers for each zone. This disposition requires to propagate any change,
made to a zone file or the DNS configuration, to every DNS server configured as master.
Therefore, we recommend that you manage your master servers through a DNS Multi-Master
smart architecture. For more details regarding its configuration, refer to the section Multi-Master
Smart Architecture.
If you want to create an RPZ master name zone, refer to the chapter DNS Firewall (RPZ).
To add a master zone
544
Managing DNS Zones

4. In the field DNS server, select the server of your choice.
6. If the server selected contains several views, the view selection page opens:
a. In the drop-down list View, select a view.

b. Click on NEXT . The next page of the wizard opens.
If your server contains only one view, the page is not displayed. Your view is selected auto-
matically and specified in the zone details on the next page of the wizard.
If your server does not contain any view, the page is not displayed.
7. If you or your administrator created classes at the zone level, in the list DNS zone class select
a class or None. Click on NEXT . The next page of the wizard appears.
9. In the list DNS zone resolution: select Name or Reverse and click on NEXT . The next page
of the wizard opens.
10. Configure the zone's basic parameters.
a. For a Name zone:
Table 38.2. DNS name zone basic parameters

Field Description
Name Type in the zone name. It should strictly conform to the syntax given in
a
RFC1034 (page 7). If you are adding an Amazon Route 53 zone, you must
include the zone TLD. This field is mandatory.
Space You can select an existing IPAM space to associate with the zone or None.
The selected space is updated by the zone records if you configure the
dedicated advanced properties. For more details, refer to the section Config-
uring DNS Advanced Properties.
a
Available on IETF website at http://tools.ietf.org/html/rfc1034.
b. For a Reverse zone:
Table 38.3. DNS reverse zone basic parameters

Field Description
Name The name of the reverse domain, it auto-completes with the address you
type in the next field. The suffix displayed changes according to the Reverse
type selected.
IP address / IPv6 ad- Type in the IP address for the zone. The address you type in completes the
dress reverse domain name, it should be composed of a maximum of three bytes
(xxx.xxx.xxx). This field is mandatory.
Reverse type Select the reverse resolution method: IPv4 in-addr.arpa, E164 arpa, IPv6 int
or IPv6 arpa. Once selected, the extension is automatically displayed in the
field Name. This field is mandatory.
545
Managing DNS Zones
Field Description
IPv4 in-addr.arpa You can select this field to configure IPv4 reverse-mapping.
E164 arpa You can select this field to configure telephone number mapping for the
zone, it uses the phone numbers dedicated reverse mapping domain suffix
(e164.arpa).
IPv6 int You can select this field to configure IPv6 reverse-mapping. Note that this
extension is deprecated, so unless your IPv6 configuration is older than 2001
we recommend that you use the IPv6 arpa extension. For more details, refer
a
to RFC 4159 .
Ipv6 arpa You can select this field to configure IPv6 reverse-mapping.
View Select the view in which the zone should be created. If there are no views
in the selected server, the list is empty.
Space Select one of the IPAM spaces that should be tied to that zone or None. The
selected space is updated by the DNS zone you are creating.
a
11. If you are managing an Active Directory integrated Microsoft DNS server, you might want to
configure the Expert Mode and/or AD integrated parameters. If not, go to step 11.
Table 38.4. DNS zone expert mode parameters

Field Description
Expert Mode If you manage a Microsoft DNS server via a smart architecture, tick this box to
complete the AD configuration. The box AD integrated appears.
AD integrated If your server is AD integrated, tick this box to set your replication preferences.
The drop-down list AD Replication appears. This option is not available for Hint
zones.
AD replication You can configure the zone content and parameters replication via the option:
All DC in the AD Domain (default), All DNS servers in the AD domain or All DNS
servers in the AD forest. By default, the replication is set to All DC in the AD
Domain (default) for zones created in a smart architecture.
All DC in the AD domain: select this option to replicate the zone parameters
and content to all the Domain Controllers of the AD domain. This option is selec-
ted by default, it is the only option available for zones created in a smart archi-
tecture. This option is not available for Stub zones.
All DNS servers in the AD domain: select this option to replicate the zone
parameters and content to all the DNS servers of the AD domain.
All DNS servers in the AD forest: select this option to replicate the zone para-
meters and content to all the DNS servers of the AD forest.
Note that the column AD integrated on the page All zones allows to display the AD integration
configuration (Yes, No, N/A) of each zone. For more details, refer to the section Customizing
the List Layout.
erties fields following the table below:

Field Description
546
Managing DNS Zones
Field Description
Properties.

14. The fields on that page are compulsory and automatically filled. However you can edit them:
Table 38.6. DNS zone advanced parameters

Field Description
Primary server Specify the primary Master server for the zone. When you create a zone on a
smart server, it is automatically filled and cannot be edited.
parameters below.
15. Click on OKto commit the creation. The report opens and closes. The zone is listed and is
marked Delayed create before being marked OK.
During the first Master zone addition, the allow-update option is by default configured
with the ACL admin. Within SOLIDserver admin corresponds to any, so you might want to
change the ACL and restrict the option use. For more details, refer to the section Configuring
DNS Update Authorizations on a Zone. Note that you can also configure such ACL for sev-
eral zones at once. For more details, refer to the section Setting Authorizations.
You can edit a master zone at any time. For more details, refer to the section Editing a Master
Zone.
Note that you can configure default values for the SOA record that is automatically created when
you add a master zone.
To configure the default SOA parameters
2. In the menu, select Tools > Default configuration. The wizard Default SOA parameters
opens.
3. Edit the fields with the values you want to be automatically used when adding a master zone:
547
Managing DNS Zones
Table 38.7. DNS zone default SOA parameters

Field Description
Expiration The period after which the records are considered to be no longer valid/authorit-
4. Click on OK to commit the creation. The report opens and closes. When adding a master
zone, the DNS zone advanced parameters now auto-completes with the values you indicated
for the SOA.
Adding a Slave Zone

A slave zone has one purpose, to respond to requests made to other servers that have authority
over the domain queried.
They are usually created on slave name servers that receive their information from master name
servers through a zone transfer, the master zone and the slave zone on each server are named
the same. During the zone transfer, the master zone sends a NOTIFY to all the slave zone(s) it
knows. The zone content is only sent to the slave zones authorized to receive the transfer, the
other zones receive an error message. Note that several master servers can be configured for
one slave server.
If you want to create an RPZ slave name zone, refer to the chapter DNS Firewall (RPZ).
To add a slave zone

matically.
548
Managing DNS Zones
8. In the list DNS zone type, select Slave.
9. In the list DNS zone resolution, select Name or Reverse.
a. For a Name zone:

Field Description
a
a

Field Description
type selected.
(e164.arpa).
a
to RFC 4159 .
a
erties fields:
549
Managing DNS Zones

Field Description
Properties.

14. Set up the list of master servers for the zone using the table below:
Table 38.11. DNS slave zone parameters

Field Description
a
Master IP address Type in the master server IP address. This field is mandatory.
Port You can type in the number of the port dedicated to communicating with the
slave zone. This field is optional.
TSIG key In the drop-down list, select a TSIG key set at server level. This field is optional.
For more details, refer to the section Securing the Management of DNS Servers
Using a TSIG Key.
a
The master zones of the server you specify through this IP address is automatically allowed to send notify messages
of any changes to the slave zone you are creating.
Once the IP, port and key are configured, click on ADD . The configuration is listed in the list
Masters. Repeat these actions for as many servers as needed. You can select a master in
the list to DELETE or UPDATE it once created.
15. Click on OK to commit the slave zone creation. The report opens and closes. The zone is
listed and is marked Delayed create before being marked OK.
Adding a Forward Zone

A forward zone, or redirector, allows to redirect all recursive requests for a zone toward a selected
list of servers. The listed servers search local zones to resolve the recursive requests to which
they cannot respond.
To add a forward zone

550
Managing DNS Zones
matically.
8. In the list DNS zone type, select Forward.
a. For a Name zone:

Field Description
a
a

Field Description
type selected.
(e164.arpa).
a
to RFC 4159 .
551
Managing DNS Zones
Field Description
a
12. If you are managing a Microsoft DNS server through a smart architecture, you might want
to configure the parameters of the Expert Mode:

Field Description
zones.
erties fields:

Field Description
Properties.

15. Configure the forwarders and forward mode for the zone. The fields Forwarders list and
Forward Mode are mandatory.
a. In the field Add a forwarder (IP), type in the IP address of the master server to which
the queries should be forwarded and click on ADD .
The IP address is moved to the Forwarders list. Repeat these actions for as many
servers as needed. The order of the servers in the list is not important.
552
Managing DNS Zones
• To update a forwarder, select an IP address in the list, its is displayed in in the field
Add a forwarder (IP): change the needed data and click on UPDATE .
• To delete a forwarder, select its IP address in the list and click on DELETE .
b. Select a Forward Mode for the zone, it can be either First, Only or None. This field is
mandatory.
Table 38.16. DNS forward zone parameters

Forward mode Description
First Select this option if you want the zone to first send a query to the forwarder,
if not answered, it issues queries directly. This mode is selected by default.
a
Only Select this option if you only want the zone to forward queries.
None Select this option if you configured a forward at server level in which case
the forwarding is set by default.
a
If you manage reverse forward zones for private or reserved addresses on a BIND server, you must select
the forward mode Only.
Once the server IP address and the forward mode are configured, click on . The
configuration is listed in the Forwarders list.
16. Click on OK to commit the zone creation. The report opens and closes. The zone is listed
and is marked Delayed create before being marked OK.
Adding a Stub Zone

A stub zone is similar to a slave zone, with the exception that it does more than simply replicate
the name servers of a master zone. Stub zones can be used to force the resolution of a domain,
particularly for a restrained collection of servers. They are not part of the DNS standard zones,
they are specific to BIND implementations.
The stub zone cannot be added into Generic DNS servers.
To add a stub zone

matically.
553
Managing DNS Zones
8. In the list DNS zone type, select Stub.
a. For a Name zone:

Field Description
a
a

Field Description
type selected.
(e164.arpa).
a
to RFC 4159 .
a
12. If you are managing a Microsoft DNS server through a smart architecture, you might want
to configure the parameters of the Expert Mode:
554
Managing DNS Zones

Field Description
zones.
erties fields:

Field Description
Properties.

Table 38.21. DNS stub zone parameters

Field Description
Master IP address Type in the master server IP address. This field is mandatory.
Port You can type in the number of the port dedicated to communicating with the
slave zone. This field is optional.
TSIG key In the drop-down list, select a TSIG key set at server level. This field is optional.
For more details, refer to the section Securing the Management of DNS Servers
Using a TSIG Key.
555
Managing DNS Zones
and is marked Delayed create before being marked OK. A stub zone only contains an
SOA and NS RRs.
Adding a Hint Zone

A hint zone is aimed at querying root servers. By default, EfficientIP DNS servers embed a hint
zone that is updated automatically but not listed on the page All zones. If you manage your DNS
with another type of server, keep in mind that the hint zone is relevant only for name servers that
provide recursive services.
The hint zone updates the local server cache with a list of the 13 root-servers saved in the form
of A records (from a.root-servers.net to m.root-servers.net). Therefore, one hint zone per server
or view is enough. When the server starts up, it uses the hint zone to query a root zone and obtain
the complete list of the current authoritative root servers. This list is then used by the name
server as a starting point for any domain query, if there is no locally defined zone (slave or master)
or cached answers. A hint zone should be updated every 12 months or whenever there are dis-
crepancies returned in the log messages, when the DNS server loads for instance.
Note that the hint zone can also contain an internal list and be used locally; in this case, the
configuration is running an internal name service on a closed network, or the name server is not
defined but recursive queries are required.
The hint zone cannot be added into a Microsoft server.
To add a hint zone
4. In the field DNS server, select the server on which you are adding a zone.

matically.
8. In the list DNS zone type, select Hint.
556
Managing DNS Zones
erties fields:

Field Description
Properties.
12. Click on OK to commit the zone creation. The report opens and closes. The zone is listed,
named and marked OK.
Adding a Delegation-Only Zone

The delegation-only zone allows to send an NXDOMAIN response to any query received without
an explicit or implicit delegation in the authority section. They are usually created on caching/re-
cursive servers.
When a zone is declared as delegation-only, it does not contain any record. You can use deleg-
ation-only zones to filter out wildcard or synthesized data from NAT boxes or from authoritative
name servers whose undelegated (in-zone) data is of no interest.They can also be used to enforce
the delegation-only status of infrastructure zones (e.g. COM, NET, ORG).
The name of the delegation-only zone is the domain for which you send the NXDOMAIN response,
any subdomain responds normally.
The Delegation-Only zone cannot be added into a Microsoft server.
To add a delegation-only zone
4. In the field DNS server, select the server on which you are adding a zone.

matically.
557
Managing DNS Zones
8. In the list DNS zone type, select Delegation-Only.
a. For a Name zone:

Field Description
a
a

Field Description
type selected.
(e164.arpa).
a
to RFC 4159 .
a
558
Managing DNS Zones
Keep in mind that the name of your delegation-only zone is a domain that, once querried,
sends an NXDOMAIN response to the client.
erties fields:

Field Description
Properties.
and marked OK.
Hosting Active Directory Domain Zones

SOLIDserver can be configured to update native Microsoft DNS servers and host DNS zones
coming from AD domains.
On Active Directory integrated Microsoft DNS servers, when you add Master, Slave, Forward or
Stub zones the box AD integrated allows to set up the AD replication of your choice. Note than
once set, you cannot edit the AD replication configuration unless you delete the zone and recreate
it. For more details, refer to the sections Adding a Master Zone, Adding a Slave Zone, Adding a
Forward Zone or Adding a Stub Zone.
Keep in mind that the DNS Multi-Master smart architecture can reproduce Microsoft's Multi-
Master behavior. For more details, refer to the section Multi-Master Smart Architecture.
Synchronizing DNS Zones

It is possible to refresh the management database with the content of one or more zones that
have not been edited from SOLIDserver. This synchronization is done automatically after a
period defined by the refresh parameter of the zone (SOA), but the administrator can force a
synchronization at any time to update the zone data.
To retrieve the entire content of a zone, you can use the option Force full synchronization. For
more details, refer to the section Forcing SOLIDserver to Retrieve the Full Content of a Zone.
To synchronize zones
4. In the menu, select Edit > Status > Synchronize. The wizard Synchronization opens.
559
Managing DNS Zones
5. Click on OK to commit the synchronization. The report opens and closes when the synchron-
ization is over. The page reloads.
Forcing SOLIDserver to Retrieve the Full Content of a Zone

The option Force full synchronization resets the serial number of the SOA of a zone. This action
allows SOLIDserver to retrieve and upload the complete content of a zone managed from the
GUI, contrary to a regular synchronization that performs an incremental retrieval of a zone records
which only retrieve the latest changes.
Resetting the SOA serial ensures that the entire zone data is up to date. For instance, this option
is useful if you restored a server that you used to manage, as you might have a synchronization
drift between the data that SOLIDserver stored locally and all the changes that have been per-
formed directly on the server since you last managed it.
To force the full synchronization for your zones
4. In the menu, select Tools > Expert > Force full synchronization. The wizard Synchronization
opens.
5. Click on OK to commit the full synchronization. The report opens and closes when the syn-
chronization is over. The page reloads.
Editing DNS Zones

SOLIDserver allows you to edit all zone types.
If you want to edit RPZ zones, refer to the chapter DNS Firewall (RPZ).
Editing a Master Zone

After Adding a Master Zone, you can always edit the zone configuration parameters from its
properties page or from the page All zones itself, using in the contextual menu.
You cannot edit the AD replication configuration of the zones of an Active Directory integrated
Microsoft DNS server.
To edit a master zone
4. In the panel Main properties, click on EDIT . The wizard Edit a DNS zone opens.
The top gray area sums up the zone parameters: its Name, Type, Server and View.
560
Managing DNS Zones
6. Edit the Space and Advanced properties if need be:
Table 38.26. Space and Advanced properties fields

Field Description
Space You can select an existing IPAM space to associate with the zone or None. The
selected space is updated by the zone records if you configure the dedicated
advanced properties. For more details, refer to the section Configuring DNS
Properties.
Note that you cannot edit any other parameter, including the configuration of the parameters
AD integrated and AD replication.
8. Edit the advanced parameters if need be:

Field Description
9. Click on OK to commit the modifications. The report opens and closes. The changes are
visible in the panel Main properties.
You can also add and delete NS records, for multiple master zones at once, from the page All
zones.
561
Managing DNS Zones
Editing a Slave Zone

After Adding a Slave Zone, you can always edit the zone configuration parameters from its
properties page or from the page All zones itself, using in the contextual menu.
To edit a slave zone
The top gray area sums up the zone parameters: its Name, Type, Server and View.

Field Description
Properties.
8. If you want to add another master server, refer to the step 14 of the procedure To add a
slave zone.
9. If you want to edit a server, select it in the list Masters, the parameters configured appear
in the fields Master IP address, Port and TSIG key: modify the content of any field according
to your needs and click on UPDATE . The server is modified in the list.
10. If you want to delete a server, select it in the list Masters and click on DELETE . The server is
no longer listed in the list.
562
Managing DNS Zones
11. Click on OK to commit the changes. The report opens and closes. The changes are visible
in the panel Main properties.
Editing a Forward Zone

After Adding a Forward Zone, you can always edit the zone from its properties page or from the
page All zones itself, using in the contextual menu.
Keep in mind that:
• The panel Main properties of a forward zone only allows to edit the zone classes and the ad-
vanced properties, if relevant.
• The panel Forwarding allows to edit the forwarding configuration, as detailed in the procedure
below.
• You cannot edit the AD replication configuration of the zones of an Active Directory integrated
To edit a forward zone
4. In the panel Forwarding, click on EDIT . The wizard Edit a DNS zone opens.

Field Description
Properties.
563
Managing DNS Zones
8. If you want to add another forwarding master server refer to the step 14 of the To add a
forward zone procedure.
9. In the fields Add a forwarder (IP) and Forward Mode, fill in the address of the master server
and select if the zone should forward Only or send a query First.
10. If you want to delete a server, select it in the list Forwarders list and click on . The server
is no longer listed in the list.
in the panels Main properties and Forwarding.
Editing a Stub Zone

After Adding a Stub Zone, you can always edit the zone configuration parameters from its prop-
erties page or from the page All zones itself, using in the contextual menu.
To edit a stub zone

Field Description
Properties.
8. If you want to add another master server refer to the step 14 of the To add a stub zone pro-
cedure.
564
Managing DNS Zones
9. If you want to edit a server, select it in the list Masters, the parameters configured appear
in the fields Master IP address, Port and TSIG key: modify the content of any field according
to your needs and click on UPDATE . The server is modified in the list.
10. If you want to delete a server, select it in the list Masters and click on DELETE . The server is
no longer listed in the list.
in the panel Main properties.
Editing a Hint Zone

After Adding a Hint Zone, you can always edit the zone from its properties page or from the page
All zones itself, using in the contextual menu.
Keep in mind that you can only edit the advanced properties of a hint zone.
To edit a hint zone
6. Edit the Advanced properties if need be:

Field Description
Properties.
in the panel Advanced properties.
Editing a Delegation-Only Zone

After Adding a Delegation-Only Zone, you can always edit the zone configuration parameters
from its properties page or from the page All zones itself, using in the contextual menu.
565
Managing DNS Zones
To edit the properties of a delegation-only zone

Field Description
Properties.
7. Click on OK to commit the changes. The report opens and closes, the properties page re-
freshes. The changes are visible in the panels Main properties and Advanced properties.
Converting DNS Zones

When managing EfficientIP DNS servers, you can convert multiple DNS zones at once from
master to slave and vice versa. The other zone types cannot be converted.
Note that:
• During a conversion from slave to master, you can choose to delete the old NS records it
contains.
• Converting master zones to slave on servers that do not support slave zones (e.g. Route53
and Unbound) deletes all the records of the original master zone.
To convert slave zones to master
3. Tick the slave zone(s) you want to convert.
566
Managing DNS Zones
4. In the menu, select Edit > Convert > To master. The wizard Zone conversion from slave to
master opens.
5. In the drop-down list Remove old NS you can decide what to do with the zone's NS records:
a. Select Yes to delete the NS record of the former slave zone.

b. Select No to keep them in the master zone for future use.
6. Click on OK to commit the conversion. The report opens and closes. The page reloads. The
converted zone is displayed on the page.
To convert master zones to slave
3. Tick the master zone(s) you want to convert.
4. In the menu, select Edit > Convert > To slave. The wizard Zone conversion from master to
slave opens.
5. In the field IP of master server, specify the IP address of the master server that now has
authority over the zone(s).
Adding or Removing an NS Record

SOLIDserver allows to add and delete the same NS RR, at once, for multiple Master and Hint
zones.
To add or remove an NS RR for multiple zones
3. Tick the Master or Hint zone(s) for which you want to add/delete an NS RR.
4. In the menu, select Edit > Convert > Add/Delete an NS RR. The wizard Add/Delete an NS
RR opens.
5. If you want to remove an NS RR from the selected zone(s), in the field NS value to delete
type in the value of the record.
6. If you want add an NS RR to the selected zone(s), in the field NS value to add type in the
value of the record.
7. Click on OK to commit the modifications. The report opens and closes. The page All zones
reloads.
8. In the column Name, click on the name of the zone(s) you edited to display the records it
now contains.
567
Managing DNS Zones
Copying or Moving DNS Zones

At some point you might need to migrate or copy zones from one DNS server or view to the
other. In this case, you need to use the Migrate option. Note that this option has nothing to do
with the zones database replication of the DNS command allow-transfer.
Copying or moving a zone also applies to the records it manages.
To copy a zone
3. Tick the zone (s) you want to copy on another server or view.
4. In the menu, select Edit > Migrate. The wizard Copying/Moving zones opens.
6. In the drop-down list Target server, select the DNS server where you want to copy the se-
lected zone. The wizard refreshes.
7. If the selected server has views, the drop-down list Target view appears, select the view of
your choice. The wizard refreshes.
8. Tick the box Asynchronous to run the creation of records in the background. This option
shortens the process but the records do not appear instantly on the page All RRs.
9. Click on OK to commit the zone duplication. The report opens and closes. The page All
zones is visible again and displays the duplicated zone. If you selected a view, the zone is
also listed in the list All zones of said view.
To move a zone
3. Tick the zone (s) you want to copy on another server or view.
4. In the menu, select Edit > Migrate. The wizard Copying/Moving zones opens.
6. In the drop-down list Target server, select the DNS server where you want to move the se-
lected zone. The wizard refreshes.
7. If the selected server has views, the Target view drop-down list appears, select the view of
your choice. The wizard refreshes.
8. Tick the box Asynchronous to run the creation of records in the background. This option
shortens the process but the records do not appear instantly on the page All RRs.
9. Click on OK to commit the zone migration. The report opens and closes. The page All zones
is visible again and displays the migrated zone. If you selected a view, the zone is also listed
on the page All zones of said view.
Setting Properties on Multiple DNS Zones

You can configure properties for multiple zones at once from the page All zones. This allows to
set common properties for several zones, among these properties you can set IPAM spaces,
568
Managing DNS Zones
forwarders, master servers or configure authorizations for specific users. Keep in mind that you
can define new settings or use the parameters of existing zones.
Setting a Space
You can associate multiple zones, of any type, with the same IPAM space.
To set a space for multiple zones
3. Tick the zone(s) for which you want to set a space.
4. In the menu, select Edit > Properties > Set space. The wizard Set a Space opens.
5. In the drop-down list Space, select the space of your choice.
6. Click on OK to commit the modifications. The report opens and closes. On the properties
page of the zone(s), the space is visible in the panel Main properties.
Setting Authorizations
SOLIDserver allows to set different types of authorizations and restrictions at zone level to limit
zone transfers and queries or manage DNS update. You can set the same authorizations prop-
erties for multiple zones at once.
Keep in mind that:
• You can configure the allow-transfer authorization only for master and slave zones.
• You can configure the allow-query authorization only for master, slave and stub zones.
• You can configure the allow-update authorization only for master zones.
To set allow-transfer or allow-query properties for multiple zones
3. Tick the zone(s) for which you want to set allow-transfer or allow-query properties.
4. In the menu, select Edit > Properties > Set authorizations > Allow-transfer or Allow-query.
The wizard Set zone transfer authorizations or Set zone queries authorizations opens.
5. In the field Source, you can choose:
To set your authorization with new data, following step 6.
To use existing authorization parameters, following step 7.

6. If you want to set new authorization parameters for the selected zone(s):
a. In the drop-down list Source, select New settings.

b. Using the drop-down lists Type and Restriction, you can configure as many restrictions
569
Managing DNS Zones

Type Description
a
Lists For a Server.
a
servers.
Once a restriction/permission is configured as needed, click on ADD . The configuration

(!). Make sure the order of the entries in the list suits your needs: the order of the ele-
ments listed is important as each restriction or permission is reviewed following the order
you set in the list. To organize the list, use the buttons and .
fields again, edit the entry and click on UPDATE or click on DELETE to remove an entry
7. If you want to use existing authorization parameters for the selected zone(s):
a. In the drop-down list Source, select Use existing zone parameters.The wizard refreshes
and the drop-down list Zone appears.
b. In the drop-down list Zone, select the zone whose properties you want to apply to your
selection.
visible on the zone(s) properties page, in the panel Main properties.
To set allow-update properties for multiple zones
3. Tick the zone(s) for which you want to set allow-update properties.
4. In the menu, select Edit > Properties > Set authorizations > Allow-update. The wizard Set
zone update authorizations opens.
5. In the field Source, you can choose:
To configure a new update policy for your zone, following step 6.
To configure an update policy using existing zone parameters, following step 7.
To configure an update policy using GSS-TSIG, following step 8.

6. If you want to configure a new update policy parameters for the selected zone(s):
570
Managing DNS Zones
b. Using the drop-down lists Type and Restriction, you can configure as many restrictions

Type Description
a
Lists For a Server.
a
servers.
Once a restriction/permission is configured as needed, click on ADD . The configuration

(!). Make sure the order of the entries in the list suits your needs: the order of the ele-
ments listed is important as each restriction or permission is reviewed following the order
you set in the list. To organize the list, use the buttons and .
fields again, edit the entry and click on UPDATE or click on DELETE to remove an entry
7. If you want to set the properties of an existing zone to the selected zone(s):
selection.
8. If you want to set a specific update policy:

b. Tick the box Use GSS-TSIG/update-policy. The wizard refreshes, the update-policy re-
lated fields replace the other fields of the wizard.
c. Configure the dynamic update permissions and restrictions for your zone:
Table 38.35. Update-policy configuration parameters

Option Description
Permission Specify if you grant or deny update-policy rights. This field applies to all the other fields
detailed below.
Identity Specify the GSS-TSIG key sent by the client when they try to update the zone. It may
look like <ad-server-name>$@<full-ad-domain> . Its use depends on the Matchtype
you select, it can therefore partially depend on the Tname.
Matchtype Select the matchtype that suits your needs: subdomain, krb5-self, krb5-subdomain,
ms-self or ms-subdomain, described below. The matchtype only applies to the record
type specified in the list Any.
571
Managing DNS Zones
Option Description
subdomain allows to define the subdomain being updated. You must specify the
domain in the field Tname following the format <domain>.<tld> , everything left of the
specified <domain> becomes a match.
wildcard allows to define the record being updated. You must specify the record's
name in the field Tname using at least one wildcard (*). It can contain only a wildcard,
in which case any record name can match.
krb5-self allows to define a rule based on Kerberos machine principal
(host/QDN@REALM).The record being updated matches the QDN part of the Principal.
The matching REALM must be specified exactly in the fields Identity and Tname.
krb5-subdomain allows to define a rule based on Kerberos machine principal
(host/QDN@REALM). The subdomain being updated matches the QDN part of the
Principal.The matching REALM is what is specified the field Identity, or any subdomain
of the specified Identity.
ms-self allows to define a rule based on AD format principal (machinename$@REALM)
to update machinename.realm in the DNS. The matching REALM must be specified
exactly in the fields Identity and Tname.
ms-subdomain allows to define a rule based on AD format principal (machine-
name$@REALM) to update machinename.realm in the DNS. The matching REALM
is what is specified the field Identity, or any subdomain of the specified Identity.
Tname Specify a value to which applies the Matchtype subdomain, krb5-self, krb5-subdomain,
ms-self or ms-subdomain. The expected format is detailed above, with each Matchtype.
RR type Select which record type(s) the configuration set in the previous fields applies to. It can
be Specific or Any.
Specific Configure permissions for the record types of your choice via the lists Available types
and Selected type(s). In the list Available types, select A, AAAA, CNAME, HINFO,
AFSDB, MX, PTR, NS, SRV, TXT, WKS, NSAP or DNAME and click on to move it
to the list Selected type(s). Repeat this action for as many record types as you need.
Any Allows to apply the configuration to all the update-policy record types: A, AAAA, CNAME,
HINFO, AFSDB, MX, PTR, NS, SRV, TXT, WKS, NSAP and DNAME.
d. Once you configured the fields, click on ADD . Your update-policy entry is moved to the
Update-policy list. The page refreshes.
e. You can configure as many entries as you want.
To organize the list, use the buttons and . Each restriction or permission is reviewed
and processed following the order set in the list.
9. Click on OK to commit the configuration. The report opens and closes. The changes are
Setting Forwarders
You can associate multiple master, slave, forward and stub zones to the same forward parameters
at once.
To set forwarders for multiple zones
3. Tick the zone(s) for which you want to set properties.
572
Managing DNS Zones
4. In the menu, select Edit > Properties > Set forwarders. The related wizard opens.
5. If you want to set the properties of an existing zone to the selected zone(s):
selection.
6. If you want to set new properties to the selected zone(s):

b. In the drop-down list Forward mode, select Default, None, First or Only according to
your needs. If you select Only or First, the field Add a forwarder (IP) appears.
c. If you selected First or Only, set your forwarders list:
i. In the field Add a forwarder (IP), type in the address of a forwarder.

ii. Click on ADD to move it to the list Forwarders. Repeat these actions for as many
forwarders as needed.
7. Click on ADD . The configuration is displayed in the list ACL at the bottom.
8. Repeat the operation with as many configuration parameters as needed.
Setting Master Servers

You can associate multiple slave and stub zones to the same master server(s) at once.
To set a master server for multiple zones
3. Tick the zone(s) for which you want to set properties.
4. In the menu, select Edit > Properties > Set master servers. The wizard Set several master
servers opens.
5. In the field Master IP address, type in the IP address of the master server that communicates
with the selected slave zone(s).
6. In the field Port, specify a port number on the master server dedicated to the communication
with the selected slave zone(s).
7. In the field TSIG key, type in the TSIG key chosen to identify the zone(s) from the master
server.
8. Click on ADD . The configuration is displayed in the list ACL at the bottom.
9. Repeat the operation with as many configuration parameters as master servers.
573
Managing DNS Zones
Forcing the Update of DNS Zones' Content

By default, SOLIDserver is programed to update the zones' content every hour. If you know
changes were made locally on the zones of the master or slave servers you manage, you can
update the content of one or several zones at a time from the GUI, and force a notify, refresh or
retransfer right away if needed.
Keep in mind that these options are based on RNDC commands, so only BIND and EfficientIP
DNS servers support them.
You cannot use these options on Hybrid DNS servers. For more details, refer to the chapter Hybrid
DNS Service.
Forcing DNS Zone Notification

When the records of a zone are edited, slave servers have to be notified of this change to ask
for a zone transfer. Notify messages can be sent to name servers and/or IP address(es).
SOLIDserver automatically triggers the notification when you are Configuring DNS Notify Messages
at Zone Level, but you can force the notification for master and slave zones at any time.
The option Force notify allows to send a notify, or also-notify if it is configured, on the zone(s)
you select. It uses the information of NS records named like the zone you selected.
Keep in mind that the option cannot work if the zone selected does not contain at least one NS
record named after the zone itself, or if the Notify is disabled on the zone,
To force master zones notification
3. Tick the zone(s), slave or master, that you want to send a notify from. The notify is sent only
if the zone contains NS records named like the zone.
4. In the menu, select Edit > Command > Force notify. The wizard Force zone notification
opens.
5. Click on OK to commit your choice. The report opens and closes when the operation is over.
The page reloads.
Forcing DNS Zones Refresh

When the records of a master zone are edited, you can force the related slave zone(s) to retrieve
the new values. Records from the master zone(s) that are not present in the slave zone(s) you
want to refresh are not added. To force their creation, refer to the section Forcing DNS Zones
Retransfer.
To force slave zones refresh
3. Tick the slave zone(s) for which you want the master zone to refresh the records.
4. In the menu, select Edit > Command > Force refresh. The wizard Force zone refresh opens.
574
Managing DNS Zones
5. Click on OK to commit your choice. The report opens and closes when the operation is over.
The page reloads.
Forcing DNS Zones Retransfer

When the records of a master zone are edited and new records are added, you can force the
related slave zone(s) to retrieve all the new values and records it now contains. This operation
triggers the creation and update, within the selected slave zone(s), of both the records present
in the master zone(s) and their values.
If your slave zone contained more records than the master zone, the option force retransfer deletes
the outdated records. Keep in mind that these changes are performed right away in the DNS
database, but you need to synchronize the zone(s) after a force retransfer to see the changes
in the GUI. For more details, refer to the section Synchronizing DNS Zones.
To retrieve only the values of the records contained in the slave zone(s), but not the new records,
refer to the section Forcing DNS Zones Refresh.
To force slave zones retransfer
3. Force the retransfer of the zone(s) your choice:
a. Tick the slave zone(s) for which you want the master zone to retransfer the records.
b. In the menu, select Edit > Command > Force retransfer. The wizard Force zone retrans-
fer opens.
c. Click on OK to commit your choice. The report opens and closes when the operation is
over. The page reloads.
4. Synchronize the zone(s) to see the changes in the GUI:
a. Tick the zone(s) you want to synchronize.

b. In the menu, select Edit > Status > Synchronize. The wizard Synchronization opens.
c. Click on OK to commit the synchronization. The report opens and closes when the
synchronization is over. The page reloads.
Disabling and Enabling DNS Zones

All existing zones can be enabled and disabled from the management console, providing a viable
option for stopping the availability of zones on one or several servers in one operation. This option
is especially helpful when you have to move or repair servers for particular zones. When you
disable a zone, its status switches to Unmanaged.
To enable/disable a zone
3. Tick the zones you want do disable.
575
Managing DNS Zones
4. In the menu, select Edit > Status > Enable or Disable. The wizard opens.
5. Click on OK to commit the zone deactivation. The report opens and closes. The zone status
changes to OK or Unmanaged.
Deleting DNS Zones

The deletion procedure is the same for every type of zones. Deleting a zone also deletes all the
resource records it contains.
To delete a zone
4. Tick the zone(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The zone is marked
Defining a DNS Zone as a Group Resource

Adding a zone as one of the resources of a specific group allows the users of that group to
manage the zone(s) in question as long as they have the corresponding rights and delegations
granted.
Granting access to a zone as a resource also makes every item it contains available. For more
576
Chapter 39. Configuring DNS Zones
Like servers and views, zones can be configured individually to set a series of behaviors for the
records they contain. Any configuration set at zone level overwrites what was set at server
(whether physical or smart) and view level.
Managing DNS Zone Delegation

DNS provides the option of dividing up the namespace into one or more zones, which can then
be stored, distributed and replicated to other DNS servers. When considering dividing your DNS
namespace to make additional zones, take into account the following reasons to use additional
zones:
• A need to delegate management of part of your DNS namespace to another location or depart-
ment within your organization.
• A need to divide one large zone into smaller zones to distribute traffic loads among multiple
servers, improve DNS name resolution performance, or create a more fault-tolerant DNS en-
vironment.
• A need to extend the namespace by adding numerous subdomains at once, to accommodate
the opening of a new branch or site for instance.
If, for any of these reasons, you could benefit from delegating zones, it might make sense to re-
structure your namespace by adding additional zones. When choosing how to structure zones,
you should use a plan that reflects the structure of your organization. When delegating zones
within your namespace, be aware that for each new zone you create, you need delegation records
(NS) in other zones that point to the authoritative DNS servers for the new zone. This is necessary
both to transfer authority and to provide correct referral to other DNS servers and clients of the
new servers being made authoritative for the new zone.
To make a server known to others outside of the new delegated zone, two RRs are needed in
the parent zone to complete delegation to the new zone. These RRs include:
• An NS RR to effect the delegation. This RR is used to advertise that the server named is an
authoritative server for the delegated subdomain.
• An A RR (also known as a glue record) is needed to resolve the name of the server specified
in the NS RR to its IP address. The process of resolving the host name in this RR to the deleg-
ated DNS server in the NS RR is sometimes referred to as glue chasing. In reality, the A record
is not required when it comes to configuring zones delegation; however, if you add it, you save
the DNS client some time as you give in one query the authoritative server of the child zone
and IP address. That way, there is no need to query twice to first get the server and then its
IP address.
Configuring Delegation at Zone Level

At zone level, setting up the delegation implies editing the properties of the zone with the appro-
priate data.
To configure a name server for a zone
2. Click on DNS zones. The list All zones opens.
577
Configuring DNS Zones
4. in the panel Name Servers, click on EDIT . The wizard Authoritative DNS servers opens.
5. In the field DNS server, type in the name of the server of your choice. Repeat these actions
for as many servers as needed.
6. Click on ADD . The server is moved to the list Authoritative DNS servers.
7. Click on NEXT . The page Delegated data opens.
8. In the field Delegation, type in the name of the RR and the server you want to delegate it
following the syntax: RRname > dnsserver.name.
9. Click on ADD . Your data is moved to the list Delegated data. Repeat these actions for as
many RRs and servers as needed.
10. Click on OK to commit the configuration. The report opens and closes. The configuration
parameters are visible in the panel.
Configuring delegation only creates the NS record. For more details regarding the A record addi-
tion, refer to the section Configuring the Delegation at Record Level.
Using the Classless in-addr.arpa Delegation

SOLIDserver allows you to configure a classless in-addr.arpa delegation for networks containing
less than 256 IP addresses, as defined in the RFC 2317. Typically, it is used to delegate reverse
DNS lookup for part of that network to other DNS servers.
In the parent master reverse zone, the classless in-addr.arpa delegation creates CNAME resource
records for each address you want to delegate. It also creates an NS RR for each delegated
server. Note that the NS record of each delegated server can be created in a domain different
from in-addr.arpa using a suffix for the CNAME RRs value. For the reverse lookup to function
properly, the delegated server(s) should contain the PTR records associated to each address.
To add a classless in-addr.arpa delegation
2. Click on Reverse zones. The page All zones opens and displays all the reverse zones.
3. In the column Name, click on the master reverse zone you want to delegate a part of. It
should be composed of a maximum of three bytes (xxx.xxx.xxx.in-addr.arpa). The page All
RRs opens and displays the RRs of the zone.
4. In the menu, select Add > Classless in-addr.arpa delegation. The wizard Add a classless
in-addr.arpa delegation opens.
5. In the field Start address, type in the first address of the range you want to delegate. By
default, the first available address of the zone id displayed in this field.
6. In the field Delegation range size, type in the number of addresses you want to delegate.
7. In the field Delegated NS, type in the name of the DNS server) that should be authoritative
over the range of addresses. Use to add this server name the Delegated NS list.Repeat
these actions for as many servers as needed. Use to remove a server name from the list.
8. In the drop-down list Delegated zone format, select the concatenation format ([start]-
[end].c.b.a.in-addr.arpa, [start]-[size].c.b.a.in-addr.arpa, [start]-[prefix].c.b.a.in-addr.arpa) for
NS RR name.
578
9. Tick the box Add a specific suffix if you want the NS RR to be created in a domain different
from in-addr.arpa. The Specific suffix field appears.
10. In the field Specific suffix, type in the suffix of your choice. This suffix corresponds to the
domain in which you want to create the NS RR. This suffix is added at the end of each of
the CNAME RR you are creating.
11. Click on OK to commit the delegation configuration. The report opens and closes. The page
All RRs is visible again. There are as many CNAME RRs as delegated addresses and as
many a NS records as delegated servers. In the column Value, each address is listed accord-
ing to the format you chose, if you added a suffix, it is visible in that column as well.
Configuring DNS Forwarding at Zone Level

At zone level you can set forwarders and overwrite the configuration set at server or view level.
Unlike views, at zone level you can disable the forwarding.
You can edit the forwarding on master, slave, forward and stub zones.
Configuring a Forwarders List on a Zone

From the list All zones of a smart architecture you can edit the forward configuration of a zone.
This configuration edition applies to the zone on all the physical servers managed by the archi-
tecture. If the zone is managed on a server not managed via a smart architecture, it only applies
to that zone on the server.
Keep in mind that at zone level, unlike for the views, you can disable the forward.
To configure a forwarders list for a zone
3. Click on the name of the smart architecture of your choice. The page All zones opens.
5. Open the panel Forwarding using and click on EDIT . The wizard Edit a DNS zone opens.
6. Click on NEXT until the page Forwarding configuration appears.
7. In the field Add a forwarder, type in the address of a forwarder.
as needed.

Option Description
None Selecting this option disables the forwarding on the zone.
Default The zone uses the forward configuration set at server or view level.
First The server sends the queries to the forwarder(s) you just set and, if it does not receive any
answer, attempts to find an answer.
10. If you selected First or Only, set your forwarders list:
579

ers as needed.
Configuring Specific Forwarding for a Zone on a Physical Server Managed

Through a Smart
At zone level, you can set a specific forwarding configuration on physical servers managed
through a smart architecture already configured with forward options.
Just like for servers and views, the forwarding configuration set on a smart zone is automatically
replicated on the physical servers managed through that smart, but you can edit the type of forward
option for a zone directly on the physical server. This option applies in turn to the records of the
zone and allows you to customize the forwarding on your network.
Keep in mind that once the Forward option is set at server or view level, you can disable it on a
zone. To inherit the option from the server or view, you can set the Forward mode to Default.
To configure a specific forward mode on a physical server zone
4. Click on the name of the physical server of your choice. The page All zones of the physical
server opens.
6. Open the panel Forwarding using . The forward mode and forwarders list displayed are
inherited from the server or view.
7. Click on EDIT . The page Edit a DNS zone opens.
fields.
9. If you want to set the forwarding for the zone:

ers as needed.
c. In the field Forward mode, select the mode of your choice: First or Only. The page re-
freshes. For more details regarding these modes, refer to the table Forward mode options
above.
10. If you want to disable the forward for the zone: in the field Forward mode, select None. The
page refreshes.
580
11. Click on OK to commit the forwarders configuration of the physical server. The report opens
and closes. The properties page is visible again. In the panel Forwarding, the message
Smart configuration is overwritten is displayed above your mode and forwarders configuration.
At any time you can reverse you changes and use the configuration set at server or view level:
edit the panel Forwarding, untick the box Overwrite the smart settings and click on OK to commit
your changes.
Configuring DNS Notify Messages at Zone Level

Configuring the Notify at server level allows to set the changes notification once, for all the master
zones managed by the view. Once the notification is sent to slave zones, the administrator decides
if a zone transfer is relevant. For more details, refer to the sections Limiting Zone Transfers at
Server Level and Limiting Zone Transfer at View Level.
• The notification type configured for the server,

• The slave zones that should receive the notify messages through their managing server,
• The allow-notify directive configuration of the slave zones. For instance, you can allow all the
servers of a network to notify the slave zones of your server or only a few.
Note that there is an implicit allow-notify directive set when you add a slave zone: when you set
the Master IP address of the slave zone you are allowing the master zones of this server to send
notify messages to your slave zone.
Keep in mind that any configuration set at zone level overrides the configuration set at
server or view level.
To configure notify messages for a master zone
3. Click on the name of the server of your choice. The page All zones of the server opens.
4. At the end of the line of the master zone of your choice, click on . The properties page
opens.
6. If you or your administrator created classes, the DNS zone class list is visible. Select a class
7. In the drop-down list Notify, configure the zone notification behavior following the table below.

Field Description
Inherited The notify messages configuration is inherited from the lowest container for which it was
set (view or server). By default, Inherited is selected for each zone.
Yes The notify messages are sent to the target of the NS records of the master zone. It is also
sent to the IP address(es) specified in the field IP address below.
581
Field Description
below.
servers as needed.
is visible again. Your notify and also-notify settings are displayed in the panel Notify.
To configure notify messages for a slave zone
3. Click on the name of the server of your choice. The page All zones of the server opens.
4. At the end of the line of the slave zone of your choice, click on . The properties page opens.
7. In the drop-down list Notify, set the zone notification type following the table below.

Field Description
Inherited The notify messages configuration is inherited from the lowest container for which it was
set (view or server). By default, Inherited is selected for each zone.
Yes The notify messages are sent to the target of the NS records of the master zone. It is also
sent to the IP address(es) specified in the field IP address below.
below.
582
servers as needed.
9. Click on NEXT . The page Allow notify opens. It allows to specify if the slave zone can receive
master zones notification messages.

Type Description
a
For a Server.
a

is visible again. Your notify, also-notify and allow-notify settings are displayed in the panel
Notify.
Managing DNS Security

DNS Security can be configured at zone level through zone transfers configuration, DNS queries
restrictions configuration or dynamic update. All these methods set ACLs to allow or deny access
to your zones so keep in mind that the order of the elements listed in the ACL values field
is important as each restriction or permission is reviewed following the order you set in the list.
Dynamic update is detailed in the chapter Implementing Dynamic Update.
583
Restricting DNS Queries for a Zone

SOLIDserver allows to specify which hosts are allowed to issue DNS queries for a specific zone.
By default, queries are allowed from the local host and the local networks. This property can be
configured for an entire server including all zones it contains. For more details regarding restricting
DNS queries, refer to the sections Restricting DNS Queries at Server Level and Restricting DNS
Queries at View Level.
Keep in mind that once the allow query is configured at zone level, it overrides the config-
uration at server or view level.
To allow query access for a zone
4. In the panel Access Control, click on EDIT . The wizard Allow-query opens.
5. Using the drop-down lists Type and Restriction, you can configure as many restrictions as

Type Description
a
For a Server.
a

6. Click on NEXT . The page Allow-transfer appears.
7. Click on NEXT . The page Allow-update appears.
8. Click on OK to commit the configuration. The report opens and closes. The parameters are
visible in the panel Access control, in the list Allow-query.
584
Limiting Zone Transfers for a Zone

by default to all DNS server. SOLIDserver supports the allow-transfer zone property that allows
to specify which hosts, networks, or TSIG keys are granted or denied the right to do transfers for
a specified DNS zone.
Keep in mind that once the allow-transfer is configured at zone level, it overrides the con-
figuration set at server or view level.
To allow transfer access for a zone
4. In the panel Access Control, click on EDIT . The wizard opens: the page Allow-query appears.

Type Description
a
For a Server.
a

visible in the panel Access control, in the list Allow-transfer.
585
Configuring DNS Update Authorizations on a Zone

Once you authenticated dynamic update on a server, you can complete the configuration via the
statement allow-update of the master zones. This operation must be done one zone at a time.
Dynamic update replaces or deletes records in a master server by sending it a special form of
DNS messages. The format and meaning of these messages is specified in RFC 2136 and indic-
ates which servers or clients are authorized to dynamically update the DNS master zones. By
default, all DNS update queries are rejected. Note that:
• You can only complete the master zones configuration from the GUI on EfficientIP and
Nominum servers
• You cannot edit the zone update authorizations of Generic servers from the GUI, it has to be
done locally.
• You cannot configure dynamic update on Microsoft servers as they do not support TSIG keys.
However you can configure them with secure dynamic update using GSS-TSIG keys. For more
details, refer to the section Configuring Secure Dynamic Update.
To set up dynamic update, you must:
1. Secure the server with a unique TSIG key. For more details, refer to the section Securing the
Management of DNS Servers Using a TSIG Key.
2. Configure the server for dynamic update. For more details, refer to the section Authenticating
the Zones Dynamic Update from the Server.
3. Configure the statement allow-update with the TSIG key:
• If you edited the ACL admin of the server, the configuration is complete: by default the ACL
admin of the physical server is specified in the statement allow-update of the master zones.
• If you created an ACL, you must edit the statement allow-update and include the new ACL
in the permissions.
• If you do not want to rely on ACLs, you must edit the statement allow-update and include
the new ACL in the permissions.
Keep in mind that allowing updates based on the requestor IP address is insecure, we strongly
recommend using the TSIG key protocol filtering rather than an IP address based filtering.
To configure the statement allow-update of a zone
586

Type Description
a
For a Server.
a

visible in the panel Access control, in the list Allow-update.
To disable dynamic update, refer to the section Disabling Dynamic Update.
Configuring DNS Sources at Zone Level

The Sources configuration is only available for zones managed through an EfficientIP DNS
physical server using the SSL protocol. The notify configuration can only be set on master zones,
whereas the transfer configuration can only be set on slave zones.
At zone level, configuring DNS sources allows to set physical interfaces that should be system-
atically used for all notify operations and zone transfer. DNS sources can be inherited from the
server and views or set for a zone. The inheritance details are visible the zones properties page.
Keep in mind that once the sources are configured at zone level, they override the config-
uration set at server or view level.
Notify Configuration on Master Zones

interfaces that should be used for the notify options. When editing these panels, you can define
notify-source
587
notify-source-v6
To set IPv4 DNS sources on a master zone
2. Click on DNS zones. The corresponding list opens.
3. In the column Type, type in Master to only display master zones.
opens.
a. In the field Notify-source address, type in the IPv4 address to be used for the outgoing
used.
To set IPv6 DNS sources on a master zone
3. In the column Type, type in Master to only display master zones.
opens.
be used.
588
Transfer Configuration on Slave Zones

interfaces that should be used for the transfer options. When editing these panels, you can define
transfer-source
transfer-source-v6
view.
alt-transfer-source
the zones transfer on the server if the transfer-source-v6 failed and if the use-alt-transfer-
source is enabled.You can also specify a port for this statement. Its configuration is displayed
on the physical server, views and slave zones properties page.
To set IPv4 DNS sources on a slave zone
3. In the column Type, type in Slave to only display slave zones.
opens.
589
a. In the field Transfer-source address, type in the IPv4 address to be used for the zones
b. In the field Transfer-source port, you can specify which port on the interface should be
used.
c. In the drop-down list Use-alt-transfer-source, set the use of an alternate interface if
need be.

to yes.
fields.
The statement use-alt-transfer-source applies to the alternate interfaces declared through

dress-v6).
d. If you enabled the use of an alternate interface, in the field Alt-transfer-source address,
appliance.
e. If you enabled the use of an alternate interface, in the field Alt-transfer-source port,
To set IPv6 DNS sources on a slave zone
3. In the column Type, type in Slave to only display slave zones.
a. In the field Transfer-source-v6 address, type in the IPv6 address to be used for the
ance. If you defined the use-alt-transfer-source statement in the panel Sources, it applies
b. In the field Transfer-source-v6 port, you can specify which port on the interface should
be used.
590
c. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
d. If you enabled the use-alt-transfer-source in the Sources panel, in the field Alt-transfer-
591
Chapter 40. Managing DNS Resource
Records
The resource record (RR) is the lowest level of the DNS hierarchy.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 40.1. The resource record in the DNS hierarchy
Records are contained in master zones and can be replicated to slave zones if need be.
On the page All RRs, all records are listed and the column RR name indicates if you can edit a
record or not.
Figure 40.2. Resource records on the page All RRs
A record name not underlined indicates that you cannot edit it. In this case, you cannot edit
the four records listed because they belong to a physical server managed via a smart archi-
tecture.
An underlined record name indicates that you can edit the it. If you click on a name, you
open the wizard Edit a DNS RR.
In this case, the records underlined belong to a smart architecture, any changes you make
are pushed to the physical server managed via the smart.
The SOA record is never underlined because, unlike other records, you cannot its properties
from the page All RRs.
This lock indicates that the server records cannot be edited. In this case, the server listed
is a physical server managed via smart architecture.
This button, when white, indicates that the you are displaying the records of both the smart
architecture and the physical server(s) it manages.
SOLIDserver supports many types of resource records, most can be added to a zone, some are
automatically created when you add a zone.
592
Managing DNS Resource Records
All the supported records are listed in the table below.
Table 40.1. Supported DNS resource records

Type Full name Description
SOA Start of Authority Defines the zone name, an email contact and various
time and refresh values applicable to the zone. It is
automatically generated when you add a zone and can-
not be added manually.
NS Name Server Defines the name server(s) that has authority for the
domain (defined by the SOA record) or the subdomain.
When you add a zone, it is automatically generated once
the server has been synchronized
A IPv4 Address Maps a host name to an IPv4 address.
AAAA IPv6 Address Maps a host name to an IPv6 address.
AFSDB AFS Database Specifies the location of the AFS servers.
CAA Certificate Authority Authorization Defines the CAs authorized to issue a certificate for the
domain.
CERT Certificate record Stores certificates in the DNS.
CNAME Canonical Name Defines an alias name for a host.
DHCID DHCP identifier Stores DHCP client identifier in the DNS to resolve DNS
update conflicts.
DNAME Delegation of Reverse Names Sets delegation of reverse addresses primarily in IPv6.
(Deprecated, use the CNAME RR instead)
HINFO System Information Contains information about a host: hardware type and
operating system description.
MINFO Mailbox mail list Information Defines the mail administrator for a mail list and option-
ally a mailbox to receive error messages relating to the
mail list.
MX Mail Exchange Specifies the mail server/exchanger that services this
zone.
NAPTR Naming Authority Pointer Record Contains general purpose definition of rule set to be
used by applications e.g. VoIP.
NSAP Network Service Access Point Defines record (equivalent of an A record) maps a host
name to an endpoint address.
OPENPGPKEY OpenPGP public key record Publishes the OpenPGP public keys in the DNS.
PTR Pointer Record Maps a host name from an IPv4 or IPv6 address, used
in reverse mapping (address resolution).
SSHFP SSH Public Key Fingerprint Publishes the Secure Shell Fingerprint associated to a
specific hostname.
SRV Service locator Defines the services available in the zone: LDAP, HTTP,
etc...
TLSA TLSA certificate association Authenticates TLS client and server entities without a
certificate authority.
TXT Text Specifies the information associated with a name.
URI Uniform Resource Identifier Maps a domain to a URI.
WKS Well-Known Service Defines the services and protocols supported by a host.
(Deprecated, use the SRV RR instead)
DNSSEC records
65534 65534 A private type record automatically added to the zone
once it is signed with DNSSEC. It cannot be added
manually.
593
Type Full name Description

CDNSKEY Child DNSKEY Contains the public cryptographic key used to sign the
zone managing a subdomain with DNSSEC.
CDS Child DS Contains information used to verify the validity of the
ZSK of a zone managing a subdomain signed with
DNSSEC.
DNSKEY DNS Key Contains the public cryptographic key used to sign the
zone with DNSSEC.
DS Delegation Signer Contains information used to verify the validity of the
ZSK of a zone signed with DNSSEC.
When you create a master zone, it automatically contains an SOA record and an NS record. This
NS is not generated until the server is synchronized.
Browsing DNS Resource Records

If you created an RPZ zone, its RRs are listed on the all RPZ rules page and not the page All
RRs. For more details, refer to the chapter DNS Firewall (RPZ).
Browsing the DNS Resource Records Database

To display the list of DNS RRs
To display the list of DNS RRs of a specific zone
tains.
Resource records do not have a properties page, all their information is displayed in the list.
Customizing the Display on the Page All RRs

Understanding the DNS Resource Record Statuses

The column Status provides information regarding the resource records you manage.
Table 40.2. DNS resource record statuses

Status Description
OK The zone is operational.
Delayed create The zone creation is delayed due to a server load or a server unavailability. The creation
is automatically pushed when the server is available.
Delayed delete The zone deletion is delayed due to a server load or a server unavailability. The deletion
is automatically pushed when the server is available.
594
Adding Resource Records

From the page All RRs, you can add almost all the records listed in the table Supported DNS
resource records to a master zone, Name or Reverse.
When you add master zones, the SOA record and an NS record are created automatically.
This NS is only generated after the server is synchronized. You can create other NS records in
the zone.
Keep in mind that:
• All records can be named, if you do not name a record, it is named after the zone it belongs
to.
• The wizard Add a DNS RR provides a set of fields specific to each record type.
• The most common records are directly accessible in the menu Add > RR.
Name in the menu Corresponding record type

Address resolution PTR (only for reverse zones)
Host address v4 A
Host address v6 AAAA
Alias CNAME
Well Known Services WKS
NAPTR NAPTR
Service Localization SRV
Text TXT
Mail route MX
Name Server NS
All the other records are accessible in the sub-menu Add > RR > RR (record).
• All the records supported are not supported by all DNS servers:
Table 40.3. Supported record types per server

DNS Server type Supported records
BIND A, AAAA, AFSDB, CAA, CDS, CDNSKEY, CERT, CNAME, DHCID, DLV, DNAME,
DNSKEY, DS, HINFO, MINFO, MX, NAPTR, NS, NSAP, OPENPGPKEY, PTR,
SOA, SSHFP, SRV, TLSA, TXT, URI, WKS.
NSD A, AAAA, AFSDB, CAA, CNAME, DNAME, HINFO, MINFO, MX, NAPTR, NS,
NSAP, OPENPGPKEY, PTR, SOA, SRV, TLSA, TXT, WKS.
AWS Route-53 A, AAAA, CAA, CNAME, MX, NAPTR, NS, PTR, SOA, SPF, SRV, TXT.
Microsoft DNS servers A, AAAA, CNAME, MX, NS, PTR, SOA, SRV, TXT.
Adding an A Record
The IPv4 Address (A) record is used to forward map a host name to an IPv4 address. It can be
added to the page All RRs of any Master zone. A single host can be mapped toward several A
records, or IP addresses, that create an RRset. In this case, the DNS server responds to queries
with all the addresses defined but the order depends on the rrset-order statement of the server
configuration file.
595
To add an A record to a zone
3. In the column Zone, click on the name of the master zone of your choice to display the RRs
it contains.
4. In the menu Add > RR > Host address v4. The wizard Add a DNS RR opens.
5. In the field RR type, A is displayed.
6. In the field RR name, you can name your RR. The field Complete name auto-completes and
displays the RR full name as follows: RRname.zonename .
7. In the field TTL, specify an expiration time of the record in seconds. The default TTL for an
RR is 1 hour *. You can edit it if need be using the field on the left or one of the values listed
in the drop-down list on the right.
8. In the field IP address, type in the IPv4 Address of the host.
9. Click on OK to commit the creation. The report opens and closes. The record is now listed
and marked OK. The RR name column displays its Complete name, the Value column
displays the host IP address you specified.
If you do not name an A record, it takes the same name as the zone it belongs to, which allows
DNS clients to find the IPv4 address of your host using only its domain name. This way, querying
the zone name example.com would be resolved immediately and provide access to your host
through its IP address.
Adding a PTR Record

The Pointer (PTR) record is used to reverse map an IP address to a host name and can be used
both in IPv4 and IPv6. These record can only be added to reverse zones, they basically provide
the exact opposite information than the A and AAAA records.
The PTR name is always displayed in the RR name column in reverse with the syntax
B4.B3.B2.B1.in-addr.arpa but it is treated like a name. Which is why it is possible to set IP ad-
dresses final section (B4) with a value that does not respect the IP protocol: a value greater than
255 in IPv4 and greater than ffff in IPv6. This lack of limitation in the interface provides an addi-
tional tool for specific configurations.
The PTR being used for reverse host name look ups, it does not make sense to name multiple
PTR records with the same name, i.e. same IP address. However, to provide reverse round robin
configuration, you can set several IP addresses with different values. For more details, refer to
the section Load Balancing with Round Robin below.
To add a PTR record in a reverse zone
3. In the column Zone, click on the name of the master reverse zone of your choice to display
the RRs it contains.
4. In the menu Add > RR > Address resolution. The wizard Add a DNS RR opens.
5. In the field RR type, PTR is displayed.
596
6. Set the IP address in reverse via the field RR name or the field IP address. You must fill in
one of the two fields:
a. If you want to use the field RR name, you can type a number corresponding to the re-
maining section of the IP address of your choice. Filling in this field empties the field IP
address as only one of the two is required. The field Complete name auto-completes
and displays the RR full name as follows: RRname.reversezonename .
b. If you want to use the field IP address, the first sections of the IP address that you set
for the reverse zone is displayed, note that is not displayed in reverse. Type in the
missing dot and final section of the IP address. The field Complete name auto-completes
and displays the RR full name as follows: RRname.reversezonename .
8. In the field Hostname, type in the hostname that should be returned when the IP address
you stated above is queried.
and marked OK.
All the addresses used to name your PTR records provide as many entries toward the host names
of your choice in your reverse master zones.
Adding a CNAME Record

The Canonical Name (CNAME) record maps an alias to a real name, also called canonical name.
This name may lie inside or outside your zone but it generally exists elsewhere in your DNS. The
CNAME is mostly used if a host has several possible names, the alias provides a way of saving
all the possible names in your zone to resolve more easily IP or domain name queries. The
CNAME always points to another record, usually an A record. During a query, the CNAME returns
the canonical name and IP address embedded in the A record. That's why a CNAME should not
point to another CNAME record, the DNS answer would take longer and could overload the
server: the first CNAME would point to another CNAME that would point to another CNAME and
so forth until finally getting the IP address from the A record.
Keep in mind that each CNAME RR name is unique: you cannot have several records named
www in the same zone. Their complete name would be www.example.com and as the CNAME
is an alias, it should provide a link toward a canonical name that has not been declared in the
zone yet.
To add a CNAME record to a zone
it contains.
4. In the menu Add > RR > Alias. The wizard Add a DNS RR opens.
5. In the field RR type, CNAME is displayed.
6. In the field RR name, name your RR. The field Complete name auto-completes and displays
the RR full name as follows: RRname.zonename .
597
8. In the field Hostname, type in the host of your choice canonical name.
and marked OK.
There should be as many hostname aliases as there are CNAME records in your zone.
Adding an MX Record
The Mail Exchanger (MX) record allows to set the name and relative preference of your mail ex-
changers, in other words, mail servers for the zone. Keep in mind that:
• An MX record should not point to a CNAME record, as detailed in section 10.3 of RFC
2181. Therefore, if you have a CNAME called mail for the zone example.com (its complete
name would be mail.example.com) and if one of your mail exchangers name is mail.ex-
ample.com, you need to remove the alias from the zone to be able to declare the mail exchanger
name in the MX record. To make the answer for the MX more efficient, you should also add
an A or AAAA record pointing to the IP address of the mail server.
• If the mail server stated in one of the MX records lies in the zone, you should add an A
record. This A record name becomes the mail server and its value becomes its IP address.
To add an MX record to a zone
tains.
4. In the menu Add > RR > Mail route. The wizard Add a DNS RR opens.
5. In the field RR type, MX is displayed.
8. In the field Preference, type in a number between 0 and 65535, which defines which server
has priority if there are several MX records in the zone. The lowest the value has the priority
over the other server(s), it can be 0.
9. In the field Mail server, type in the mail server hostname.
and marked OK.
You can add as many MX records as you need in your master zones, it all depends on the
number of mail exchangers you want to declare.
598
Adding an NS Record
The Name Server (NS) record is used to list all the DNS name servers that have authority over
a zone. NS records must be declared both in the parent and the child zones. In the parent zone,
they indicate the zone authoritative server, in the child zone where they constitute the point of
delegation.
The requirement is that at least two name servers are defined for each public domain, so there
is at least two NS records in each zone. The first NS record, named after the zone is created
automatically when you create zones through the GUI to indicate the authoritative server; all
other NS records must be added manually following the procedure below.
We strongly recommend that you create an A record for each NS server to provide detailed in-
formation to the domain name query. This process is called creating a glue record, that way once
your domain is queried, it can return its authoritative servers name and IP address.
Keep in mind that RFC 2181 stipulates that the NS record can point to other records but
never to a CNAME record as the query answer does not return an address with the NS record
and in some cases might make the query fail altogether.
To add an NS record to a zone
tains.
4. In the menu Add > RR > Name Server. The wizard Add a DNS RR opens.
5. In the field RR type, NS is displayed.
8. In the field DNS server, type in the DNS server hostname.
and marked OK.
Adding a AAAA Record

The IPv6 Address (AAAA) record, also called Quad A record, is used to forward map a host name
to an IPv6 address. It can be added to the page All RRs of any Master zone. A single host can
be mapped toward several A records, or IP addresses, that create an RRset. In this case, the
DNS server responds to queries with all the addresses defined but the order depends on the
rrset-order statement of the server configuration file.
To add a AAAA record to a zone
599
it contains.
4. In the menu Add > RR > Host address v4. The wizard Add a DNS RR opens.
5. In the field RR type, AAAA is displayed.
8. In the field IPv6 address, type in the IPv6 Address of the host.
and marked OK. The RR name column displays its Complete name, the Value column
displays the host IP address you specified.
If you do not name a AAAA record, it takes the same name as the zone it belongs to, which allows
DNS clients to find the IPv6 address of your host using only its domain name. This way, querying
the zone name example.com would be resolved immediately and provide access to your host
through its IPv6 address.
Adding an AFSDB Record

The Andrew File System Database (AFSDB) record maps a domain name to an AFS database
server. Its purpose is to allows to discover the host that provide service AFS within a domain. It
is not widely used, an Adding an SRV Record record could provide the same kind of information.
To add an AFSDB record to a zone
tains.
4. In the menu Add > RR > RR (record). The wizard Add a DNS RR opens.
5. In the drop-down list RR type, select AFSDB.
8. In the field Sub-type, type in the version of service AFS used: 1 (AFS version 3.0) or 2 (OSF
DCE/NCA version).
9. In the field AFS server, type in the AFS hostname.
and marked OK.
600
Adding a CAA Record

The Certificate Authority Authorization (CAA) record allows the holder of a domain to specify
which certificate authoritie(s) are allowed to issue certificates for the domain.
To add an CAA record to a zone
tains.
5. In the drop-down list RR type, select CAA.
8. In the field Flags, type in the number, between 0 and 255, that influences the interpretation
of the record. 0 means that the record is not critical.
9. In the field Property identifier, type in the record tag that suits your needs: issue, issuewild,
iodef or any other value supported by your DNS engine. For more details, refer to the appendix
DNS Resource Records Related Fields.
10. In the field Value, type in the domain of the CA associated with the tag or a URL, depending
on the tag specified in the Property identifier.
and marked OK.
Adding a CERT Record

The Certificate (CERT) record allows to store certificates in the DNS.
To add an CERT record to a zone
tains.
5. In the drop-down list RR type, select CERT.
601
8. In the field Type type in the number, between 0 and 65535, that specifies the type of certific-
ate. For more details, refer to the appendix DNS Resource Records Related Fields.
9. In the field Key tag, type in the certificate's key tag, a 16-bit value computed for the key
embedded in the certificate.
10. In the field Algorithm, type in the public key's cryptographic algorithm.
11. In the field Certificate or CRL, type in the certificate, encoded in base-64 format.
and marked OK.
Adding a DHCID Record

The DHCP identifier (DHCID) record allows to store DHCP client identifier (DUID) in the DNS to
resolve DNS update conflict performed by DHCP clients.
To add an DHCID record to a zone
tains.
5. In the drop-down list RR type, select DHCID.
8. In the field Key, type in the encoded DUID in a binary format, encoded in base-64
and marked OK.
Adding a DNAME Record

The Delegation of Reverse Names (DNAME) record is used to map DNS subdomains with each
other. It does not redirects a query toward a subdomain: it rewrites the query. Technically, it re-
writes the subdomain query suffix and looks for a record within the zone matching this new name.
It is especially useful if a company has changed domain name or reorganizes its subdomains
management.
Keep in mind that a DNAME record rewrites the subdomain suffix and applies to all its subdomains.
A DNAME record rewriting a query for support.company.com to support.company.corp also applies
to queries for fr.support.company.com or es.support.company.com . The DNAME configuration
applies to any label located left of the specified domain name.
A zone configured with a DNAME has records that send back the proper information to DNS clients.
If the value of the DNAME is support.company.corp, there should be an A record, for instance,
named support.company.corp providing an IP address clients can reach.
602
Keep in mind that unlike a CNAME, the DNAME points a name and not to a record within the
zone.
To add a DNAME record to a zone
tains.
5. In the drop-down list RR type, select DNAME.
8. In the field Domain, type in the domain name of a subdomain of the zone.
and marked OK.
Adding a DNSKEY Record

The Domain Name System KEY (DNSKEY) record is used in zones signed with DNSSEC and
contain the public cryptographic key (KSK or ZSK) used to validate signatures. If you signed a
zone through the GUI, you do not need to add this record, SOLIDserver does it automatically.
If you manage through the GUI an external DNS server containing zone(s) already signed with
DNSSEC, you can add a DNSKEY record to the concerned zone(s). As the signature was not
performed using the appliance, SOLIDserver cannot push the DNSSEC keys to the server, so:
the DNSKEY record should merely be listed among the RRs; the zone keys is not listed in the
Key Ring and the zone is not displayed as DNSSEC compliant even though it is. The possibility
to add a DNSKEY record is therefore simply available to ease up the zones management. For
more details, refer to the chapter DNSSEC.
To be able to successfully add a DNSKEY record through the GUI, you need the DNSKEY flags,
protocol, algorithm and key; all of which are available in txt file generated after the zone signature.
To add a DNSKEY record to a zone
tains.
5. In the drop-down list RR type, select DNSKEY.
603
8. In the field Flags, type in or paste the zone key flag.
9. In the field Protocol, type in or paste the protocol value.
10. In the field Algorithm, type in or paste the public key's cryptographic algorithm.
11. In the field Key, type in or paste the public key material.
and marked OK.
Adding a DS Record
The Delegation Signer (DS) record is a DNSSEC that creates the chain of trust or authority from
a signed parent to a child zone. It can be used to verify the validity of the ZSK of a subdomain.
It is composed of the parent zone key tag, key algorithm, digest type and digest itself.
For more details, refer to the section DS Resource Record. For the DS addition procedure, refer
to the section Using the Delegation to Include Subdomains to the Chain of Trust.
Adding an HINFO Record

The System Information (HINFO) record allows to specify the server type of CPU and OS in use.
This record information can be used by some application protocols (like FTP). This record is
rarely used on public servers.
Keep in mind that if you name an HINFO record like an A or AAAA record, they are linked together
in the zone file and provide additional information when the domain name they share (an
identical Complete name in the GUI) is queried.
To add an HINFO record to a zone
tains.
5. In the drop-down list RR type, select HINFO.
8. Next to the field CPU, select a CPU in the drop-down list. It is displayed in the field. If your
CPU is not listed, select Other in the drop-down list and type in your CPU in the field.
9. Next to the field OS, select an OS in the drop-down list. If your OS is not listed, select Other
in the drop-down list and type in your OS in the field.
and marked OK.
604
The HINFO can also be used as a specific TXT record and contain other information.
Adding an MINFO Record

The Mailbox mail list Information (MINFO) record defines the mailbox administrator for a mail list
or even the mailbox that should receive error messages relating to the mail list.
To add an MINFO record to a zone
tains.
5. In the drop-down list RR type, select MINFO.
8. In the field Responsible email, type in the email address of the administrator of the mail list.
9. In the field Error email, type in the email address of the person that should receive the error
messages regarding the mail list.
and marked OK.
Adding an NAPTR Record

The Naming Authority Pointer (NAPTR) record is a Dynamic Delegation Discovery System (DDDS)
record used to define a rule that may be applied to private data owned by a client application, as
detailed in RFC 3403.
To add an NAPTR record to a zone
tains.
4. In the menu Add > RR > NAPTR. The wizard Add a DNS RR opens.
5. In the field RR type, NAPTR is displayed.
605
8. In the field Order, type in a number between 0 and 65535 to define which RR has priority if
there are several NAPTR records in the zone. The lowest value has the priority over the
other record(s).
9. In the field Preference, type in a number between 0 and 65535 to define which RR has pri-
ority if several NAPTR records have the same Order in the zone. The lowest value has the
priority over the other record(s).
10. In the field Flags, type in the string that corresponds to the action you want your client applic-
ation to perform.
11. In the field Service, type in the services parameters needed according to your client applic-
ation syntax.
12. In the field Regex, type in the string that contains a substitution expression to be applied to
the original string specified in the field Flags.
13. In the field Replace, type in the FQDN domain name to be queried when looking for the po-
tential data specified in the field Flags.
and marked OK.
Adding an NSAP Record

The Network Service Access Point (NSAP) record maps a hostname to an endpoint address for
the ISO's Open Systems Interconnect (OSI) system, in that sense it is the equivalent of an A re-
cord. The NSAP RR is described in the RFC 1706.
To add an NSAP record to a zone
tains.
5. In the drop-down list RR type, select NSAP.
8. In the field Name, type in the NSAP address of the end system. It should start with 0x and
not exceed 255 hexadecimal characters separated by dots.
and marked OK.
Adding an OPENPGPKEY Record

The OpenPGP public key record (OPENPGPKEY) record allows to publish OpenPGP public
keys in the DNS for a specific email address.
606
To add an OPENPGPKEY record to a zone
tains.
5. In the drop-down list RR type, select OPENPGPKEY.
8. In the field Key, type in the OpenPGP public key, without the last line.
and marked OK.
Adding an SSHFP Record

The SSH Public Key Fingerprint (SSHFP) record allows to publish the Secure Shell (key) Finger-
print associated to a specific host. That host is specified in the RR name.
To add an SSHFP record to a zone
tains.
5. In the drop-down list RR type, select SSHFP.
6. In the field RR name, specify the name of the host associated with the secure shell fingerprint
of the record. The field Complete name auto-completes and displays the RR full name as
follows: <host>.<domain> .
8. In the field Algorithm, type in the number matching the algorithm used by the Public Key: 1
(RSA), 2 (DSA), 3 (ECDSA) or 4 (Ed25519).
9. In the field Type, type in the number matching the type of fingerprint used: 1 (SHA-1) or 2
(SHA-256).
10. In the field Fingerprint, type in the hexadecimal string of the hash result.
and marked OK.
607
Adding an SRV Record

The Services (SRV) record allows to associate a service with a hostname. That way, users can
locate a service via the relevant SRV record. The answer to a successful SRV query should
provide the user with a hostname, the port providing the service and the hostname priority. If
there are several hosts in the zone, their weight defines which one should be used..
This record only allows one piece of information per field, so if for instance you want to configure
a set of ports for one service, you can create several SRV records each with the same information
in all fields except the port, priority and weight.
To add an SRV record to a zone
tains.
4. In the menu Add > RR > Service Localization. The wizard Add a DNS RR opens.
5. In the field RR type, SRV is displayed.
6. In the drop-down list RR type, select the RR type need be.
9. In the field Priority, type in a number, between 0 and 65535, to define which server has pri-
ority if there are several SRV RRs in the zone. The lowest the value has the priority over the
other server(s).
10. In the field Weight, type in a number, between 0 and 65535, to define the server weight. If
two SRV RRs have the same priority, the weight defines which server should be more used.
The greater the value is, the more the server is solicited. Basically, it gives priority to the
SRV RR with the greatest weight value. If you type in 0, there is no weighting.
11. In the field Port, type in the port number that delivers the service to the target.
12. In the field Target, type in the hostname of the server delivering the service.
and marked OK.
Adding a TLSA Record

The TLSA certificate association (TLSA) record allows to authenticate TLS client and server en-
tities without a certificate authority (CA). It is used to associate a TLS server certificate or public
key with the domain name where the record is found.
To add an TLSA record to a zone
608
tains.
5. In the drop-down list RR type, select TLSA.
8. In the field Certificate Usage, type in an number, between 0 and 255, that identifies the as-
sociation data provided to match the certificate presented in the TLS handshake. For more
details, refer to the appendix DNS Resource Records Related Fields.
9. In the field Selector, specify the part of the TLS certificate that the server presents to compare
with the association data: 0 (the Full certificate) or 1 (the SubjectPublicKeyInfo).
10. In the field Matching Type, specify the way the association data is presented, where 0 is the
Exact match on selected content, 1 is an SHA-256 hash of selected content and 2 is an
SHA-512 hash of selected content.
11. In the field Certificate Association Date, specify the certificate association data to be matched.
The expected value in the field is a string of hexadecimal characters, it can include spaces.
and marked OK.
Adding a TXT Record

The Text (TXT) record allows to associate text with a name in your zone. You can use the TXT
record value to describe a host, provide services contacts or even define the Sender Policy
Framework (SPF) information record.
To add a TXT record to a zone
tains.
4. In the menu Add > RR > Text. The wizard Add a DNS RR opens.
5. In the field RR type, TXT is displayed.
8. In the field Text, type in the text of your choice. This field text can contain a maximum of
2100 characters, including spaces.
and marked OK.
609
Adding a URI Record

The Uniform Resource Identifier (URI) record allows to map a domain to a URI.
To add an URI record to a zone
tains.
5. In the drop-down list RR type, select URI.
8. In the field Priority, type in a number, between 0 and 65535, to define which target URI has
priority if there are several URI records in the zone. The lowest value has the priority over
the other URI.
9. In the field Weight, type in a number, between 0 and 65535, to define the target URI weight.
If two URI records have the same priority, the weight defines which one is more used. The
field gives priority to the URI record with the greatest weight value: the greater the value is,
the more the URI is solicited. If you type in 0, there is no weighting.
10. In the field Target, type in targeted URI following the format described in RFC 3986.
and marked OK.
Adding a WKS Record

The Well-Known Services (WKS) record is used to define the services and protocols used by a
host.
Its use is DEPRECATED, the Adding an SRV Record record can provide the same information.
To add a WKS record to a zone
tains.
4. In the menu Add > RR > Well Known Services. The wizard Add a DNS RR opens.
5. In the field RR type, WKS is displayed.
610
8. In the field IP address, type in the IPv4 Address of the host that contains the services listed
in the field Services.
9. In the drop-down list Protocol, select the protocol that suits your needs.
10. In the drop-down list Service, select the service that suits your needs.
and marked OK.
Editing Resource Records

You can edit all the records contained in a master zone.
From the list All RRs, you can differentiate the ones you can or cannot edit, refer to the image A
list of resource records above. For instance, the records of a physical server manage via a smart
architecture cannot be edited.
Note that SOA records cannot be edited like the other records: you can tick them to change their
TTL or value, but you cannot edit them individually from the page. For more details, refer to the
sections Editing Several Records at Once and Editing the SOA from the Zone Properties Page.
Editing One record

From the page All RRs, you can edit most records by clicking on their Name. Note that:
• You cannot edit the records of a physical server managed by a smart architecture. You need
to edit the record of the smart, all your changes are then pushed on the physical server(s)
managed by the smart architecture
• The SOA records cannot be edited that way. To edit an SOA record, refer to the sections
Editing Several Records at Once and Editing the SOA from the Zone Properties Page.
To edit a resource record
3. In the column Zone, click on the name of the zone of your choice to display the records it
contains.
4. In the column RR name, click on the name of the RR of your choice. The wizard Edit a DNS
RR opens.
5. Edit, if need be, the values and TTL of the record following the table appropriate procedure
in the Adding Resource Records section above. The default TTL of a RR is 1 hour.
Keep in mind that if several records in a zone share the same name, editing the TTL on one
also edits the TTL on the records sharing that name.
6. Click on OK to commit your changes. The report opens and closes. The changes are visible
on the page.
611
Editing Several Records at Once

From the page All RRs, you can tick any record, SOA included, to edit its TTL or Value. These
changes can also be performed on several records at once.
To replace the TTL of one or several resource records
tains.
4. Tick the record(s) for which you want to replace the TTL.
5. In the menu, select Edit >Replace > The TTL of an RR. The wizard Replace the TTL of an
RR opens.
6. In the field TTL, specify the expiration time of the record in seconds or use one of the pre-
defined values in the drop-down list. The default TTL for an RR is 1 hour.
new TTL is visible.
You can tick several records and edit their Value. The wizard allows to replace existing values,
you can specify whole values or part of a value, for instance a domain name stated in all the re-
cords. Note that the wizard returns an error if you specify a value that does not exist.
To replace the value of one or several resource records
tains.
4. Tick the record(s) for which you want to replace a value.
5. In the menu, select Edit >Replace > The value of an RR. The wizard Replace the value of
an RR opens.
6. In the field Replace, type in the value you want to replace.
7. In the field By, type in the new value that should replace the content of the field Replace.
8. In the drop-down list Exact search, you can either select Yes or No, refer to the table below.
Table 40.4. DNS resource records replacement options

Type Description
Yes Select this option if the value specified in the field Replace must be replaced as a whole.
Keep in mind that it is then considered as unique, so if the RR contains the same value
several times, each of them has to be replaced individually. By default, Yes is selected.
No Select this option if every occurrence of the value specified in the field Replace must be
replaced every time it appears in the column Value of the RR.
changes as visible in the list.
612
Editing the SOA from the Zone Properties Page

As the SOA is automatically generated by SOLIDserver when you add a Master zone, you can
edit it from the properties page of the zone. Keep in mind that the SOA contains information
critical to the zone and editing it can have heavy consequences on a zone management.
The SOA contains the zone's serial number, administrator email and configuration information
(refresh, retry, expiration...) all of which you can edit. Note that:
• You cannot rename an SOA, it is automatically named like the zone when you create it.
• The SOA also contains the name of the primary server, the DNS server that has authority over
the zone, but you cannot edit it.
To edit the TTL or Value of one or several SOA records, refer to the section Editing Several Re-
cords at Once.
To edit an SOA record
4. In the panel Main properties, click on EDIT. The wizard Edit a DNS zone opens.
6. Edit the SOA parameters, according to your needs:

Field Description
7. Click on OK to commit your changes. The wizard closes. The page refreshes, the changes
are listed.
Configuring the Delegation at Record Level

At RR level, the delegation parameters are managed through the Start of Authority (SOA), the
Name Server (NS) and the Address (A or AAAA) records.The SOA and NS records are generated
upon creation of a zone.
613
Note that the primary NS record of a zone is generated once the server is synchronized and in-
dicates the authoritative server of the zone.
Delegating a sub-domain simply consists of adding both NS and an A (or AAAA) RR in the parent
zone pointing to the sub-domain:
• The NS record indicates which servers are authoritative for the zone. You can also create ad-
ditional NS records to delegate authority for the zone to other DNS servers.
• The A / AAAA record indicates the IP address of the server that has authority over the sub-
domain and therefore needs to be added in the RRs list of the parent zone.
Let's consider the zones efficientip.com and support.efficientip.com for the purpose of illustrating
the delegation configuration. The parent zone, efficientip.com, is managed through the server
ns1.efficientip.com and the child zone, support.efficientip.com, is managed through ns2.efficien-
tip.com . You need to add the relevant records in the parent zone. On the one hand, add the NS
record, name it support (it is then listed as support.efficientip.com as the RR name auto-completes
with the domain name at the end) and indicate the server that has authority over it in the adequate
field, in our case ns2.efficientip.com. On the other hand, add the A record named ns2 (once
again, its name auto-completes with the zone name and obtain the server actual name) and in-
dicate its IP address. That way, you should have two new records in the parent zone: an NS RR,
support.efficientip.com, pointing toward the delegated child zone and a glue A record, ns2.effi-
cientip.com.
To add an NS record to a zone
3. In the column Name, click on the name of the server containing the parent zone. The page
All zones of the server opens.
4. In the column Name, click on the name of the parent zone. The page All RRs of the zone
opens.
5. In the menu Add > RR > Name Server. The wizard Add a DNS RR opens.
6. In the field RR type, NS is displayed.
7. In the field RR name, name your RR after the sub-domain. Note that the Complete name
field auto-completes and displays the RR full name as follows: RRname.zonename .
8. In the field DNS server, type in the name of the server that has authority over the sub-domain.
and marked OK.
To add an A record to a zone
3. In the column Name, click on the name of the server containing the parent zone. The server
All zones list opens.
4. In the column Name, click on the name of the parent zone. The page All RRs of the zone
opens.
5. In the menu Add > RR > Host address (v4). The wizard Add a DNS RR opens.
614
6. In the field RR type, A is displayed.

7. In the field RR name, name your RR after the server that has authority over the sub-domain
(the same one as the DNS server specified when adding the NS record). Note that the field
Complete name auto-completes and displays the RR full name as follows: RRname.zonename
and should match the server name.
9. In the field IP address, type in the IP address of the authoritative server.
and marked OK.
Copying or Moving Records

At some point you can use the option Migrate to move or copy RR(s) from one DNS server or
view to the other.
Note that this option has nothing to do with the zones database replication of the DNS command
allow-transfer. Duplication and migration of a zone includes the records it manages.
To copy a record
3. Tick the record(s) you want to duplicate.
4. In the menu, select Edit > Migrate. The wizard Copying/Moving RRs opens.
6. In the drop-down list Target server, select the server of your choice. The Target zone drop-
down list appears.
7. In the drop-down list Target zone, select the zone of your choice. If you created views in
your server, the zone is named zone (view).
8. In the drop-down list Existing records, choose if you want to overwrite RRs with the same
name. The wizard refreshes.
9. Click on OK to commit the RR duplication. The report opens and closes. The page All RRs
is visible again and displays the migrated record. Note that the complete name of the RR(s)
in the column RR name is now RRname.newzonename.
To move a record
3. Tick the record(s) you want to move.
4. In the menu, select Edit > Migrate. The wizard Copying/Moving RRs opens.
6. In the drop-down list Target server, select the server of your choice. The Target zone drop-
down list appears.
615
7. In the drop-down list Target zone, select the zone of your choice. If you created views in
your server, the zone is named zone (view).
8. In the drop-down list Existing records, choose if you want to overwrite RRs with the same
name.
9. Click on OK to commit the RR migration. The report opens and closes. The page All RRs is
visible again and displays the migrated record. Note that the complete name of the RR(s)
in the column RR name is now RRname.newzonename.
Changing the Hostname Convention

At any time, you can change the RR naming convention to allow or prohibit the use of some
characters or patterns in the records full name. Before editing the record naming convention,
keep in mind that the hostname naming convention stated in the RFC 1034 only allows alphanu-
meric characters and hyphens. It does not include other special characters, such as underscore
("_"). Therefore, dynamic updates from Microsoft Active Directory controllers might not be accep-
ted.
The naming convention can be set through the GUI via one global regular expression (or regex)
that applies to the name of all the DNS zones resource records. SOLIDserver default naming
convention regular expression allows all characters including the hyphen ("-"), the dot (".") and
the underscore ("_"):
(^([*][.])?[-_a-z0-9\u00c0-\uffff]+([.][-_a-z0-9\u00c0-\uffff]+)*$)|(^[*]$)|(^$)
You can change this regular expression from the registry database following the procedure below.
To change the records naming convention
opens.
opens.
3. In the search engine of the column Name, type in the keyword rr_name. The list is filtered
and displays the item www.display.checktype.regex.js.rr_name.
4. In the column Value of the entry www.display.checktype.regex.js.rr_name, click on the
<regular_expression>. The wizard Registry database Edit a value opens.
5. In the field Value, edit the regex to match your needs. The regex default value is detailed
above.
6. Click on OK to commit your changes. The report opens and closes. The Registry database
is visible again.
Deleting Resource Records

Except for the basic SOA and NS records generated during the creation of a zone, all the resource
records that you created within a zone can be deleted.
To delete a resource record
616

tains.
4. Tick the record(s) you want to delete.
6. Click on OK to validate the deletion. The RR is marked Delayed delete and is then no
longer listed.
Load Balancing with Round Robin

The load balancing or Round Robin functionality is useful if you have a number of equivalent
network resources, like mirrored FTP servers, Web servers, and would like to spread the load
among them. You establish one domain name that refers to the group of resources, configure
clients to access that domain name, and the name server inverse-multiplexes the accesses
between the IP addresses you list.
For example, if you have three www servers with network addresses of 10.0.0.1, 10.0.0.2 and
10.0.0.3, a set of A resource records means that clients connect to each machine one third of
the time. When a resolver queries for these records, BIND rotates them and respond to the query
with the records in a different order. In the example above, clients randomly receive records in
the order 1, 2, 3; 2, 3, 1; and 3, 1, 2. Once the query is answered a first time with 1, the next client
querying the same name receives a different answer: 2; and so forth. There is no configuration
needed, the balancing is automatically activated if three different servers resolve to the same
domain name (to follow the example: www.yourdomain.com).
Note that if you configured the DNS advanced properties Create PTR, a PTR record is created
only for the first A record you add.
SPF Record
Sender Policy Framework (SPF) is an email validation system designed to prevent email spam
by detecting email spoofing using the senders' IP address. SPF allows administrators to specify
which hosts are authorized, or not, to send emails from a given domain. Mail exchangers use
the DNS to verify that the host sending the email from a given domain is sanctioned by that do-
main's administrators. The SPF record is actually a single string of text found in the value of a
single TXT record.
In 2003, when SPF was first being developed, the requirements for assignment of a new DNS
RR type were considerably more stringent than they are now. In its review of the RFC 4408, the
IETF SPFbis working group concluded that its dual RR type transition model was fundamentally
flawed since it contained no common RR type that implementers were required to serve and re-
quired to check.
The Simple Mail Transfer Protocol allows any computer to send email claiming to be from any
source address. This is exploited by spammers who often use forged email addresses, making
it more difficult to trace a message back to its sender, and easy for spammers to hide their
identity in order to avoid responsibility. It is also used in phishing techniques, where users can
be duped into disclosing private information in response to an email purportedly sent by an or-
ganization such as a bank. SPF allows the owner of an Internet domain to specify which computers
are authorized to send mail with sender addresses in that domain. Receivers verifying the SPF
records may reject messages from unauthorized sources before receiving the body of the message.
The sender address is transmitted at the beginning of the SMTP dialog. If the server rejects the
617
sender, the unauthorized client should receive a rejection message, and if that client was a relaying
message transfer agent (MTA), a bounce message to the original sending address may be gen-
erated. If the server accepts the sender, and subsequently also accepts the recipients and the
body of the message, it should insert a field Return-Path in the message header in order to save
the sender address.While the address in the Return-Path often matches other originator addresses
in the mail header such as From or Sender, this is not necessarily the case, and SPF does not
prevent forgery of these other addresses.
Examples of SPF records

example.com. IN TXT "v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all"
example.com. 21600 IN SPF "v=spf1 +all"

IN TXT "v=spf1 mx –all"
IN TXT "v=spf1 redirect=_spf.example.com"
IN TXT "v=spf1 ip4:192.0.2.0/24 ip4:198.51.100.123 a -all"
IN TXT "v=spf1 include:example.org -all"
618
Chapter 41. Implementing Dynamic
Update
Dynamic Domain Name Server (DDNS) is the system, detailed in RFC2136, through which IP
address assignment updates in the DHCP are immediately reflected in the DNS records for the
hosts. DDNS enables a DNS server to accept and receive an update every time a dynamic client
changes their IP address. Updating the DNS dynamically eliminates the need for an administrator
to manually set large numbers of records as authorized users can add, delete, and edit records
on the fly.
In the wrong hands, dynamic updates can open up your network to certain vulnerabilities as users
could update some or many of the records on a DNS server organization with incorrect information.
Which is why, within SOLIDserver, DDNS relies on the Transaction SIGnature (TSIG). Described
in RFC 2845, TSIG is based on the use of a symmetrical key, and we create one update key per
Efficient IP DNS server. That way, every transaction from DHCP servers to DNS servers is
automatically protected.
SOLIDserver supports both dynamic update via TSIG keys and secure dynamic update via
Generic Security Service Algorithm for Secret Key Transaction (GSS-TSIG) for DNS servers
serving Microsoft Active Directory clients.
You can configure your EfficientIP DNS server to authenticate your AD clients and grant or deny
them dynamic update rights on the master zone managing your AD server domain via the state-
ment update-policy. For more details, refer to the section Configuring Secure Dynamic Update.
Configuring Dynamic Update

To set dynamic update, you must configure your DNS server and then edit the statement allow-
update of master zones of your choice. The configuration requires to:
1. Secure the server. You must edit the server main properties and specify a TSIG key. For more
2. Configure the server for dynamic update.
• Either edit the default ACL admin to include the same TSIG key to its permissions.
• Or create a new ACL that includes the TSIG key to its permissions. For more details, refer
to the section Configuring Access Control Lists For a Server.
For more details, refer to the section Authenticating the Zones Dynamic Update from the
Server.
3. Configure the statement allow-update of your master zones with the same TSIG key. For more
details, refer to the section Configuring DNS Update Authorizations on a Zone.
Note that if you edited the ACL admin of the server, the configuration is complete because,
by default, the ACL admin of the physical server is specified in the statement allow-update of
the master zones.
You can configure dynamic update on all DNS servers except Amazon Route 53 DNS servers.
619
Implementing Dynamic Update
Configuring Secure Dynamic Update

Secure dynamic update for AD domains can be configured thanks to GSS-TSIG keys. You can
configure an EfficientIP DNS server managing your AD domain to authenticate AD users. Once
the server is set, you can configure the statement update-policy on the master zone managing
your AD domain to allow or deny dynamic update of your DNS server for AD users.
To properly set up secure dynamic update you must:
1. Meet the prerequisites.

2. Make sure the master zone managing your AD domain is properly configured.
3. Create and upload the GSS-TSIG key.
4. Configure your server with the GSS-TSIG key.
5. Configure the statement update-policy on the zone managing your AD domain.
Prerequisites
• SOLIDserver version 6.0.0.
• A Windows Active Directory server:
• Without DNS server, your DNS server is an EfficientIP DNS server.
• With at least one user with sufficient DNS rights, able to create GSS-TSIG keys. This user
must share the same name as your EfficientIP DNS server following the format my-ad-
user.my-ad-domain .
• With DES certificate enabled. For Windows Servers 2008 R2, it is disabled by default so you
must enable DES_CBC_MD5, AES128_HMAC_SHA1 and AES256_HMAC_SHA1 in the
Security Options of the Local Security Policy.
• At least one EfficientIP DNS server named after an AD user with sufficient DNS rights. The
server is named following the format my-ad-user.my-ad-domain .
The name of the DNS server can be set based on an existing user, or an AD user can be
named after the DNS server name. Either way, they must have the same name and that name
must include the full AD domain. To create a server, refer to the procedure To add an EfficientIP
DNS server.
• The EfficientIP DNS server must contain a master zone managing your AD domain, so it named
with a format similar to my-ad-domain.corp . This master zone must be configured with 9 key
records (1 SOA, 2 A and 6 SRV) linking your AD server, AD domain and DNS server. To create
the zone, refer to the procedure To add a master zone.
• SOLIDserver and your AD server must be set at the same time.You should configure the same
NTP server on SOLIDserver and your AD server.
Limitations
• Secure dynamic update can only configured for EfficientIP DNS and EfficientIP DNS Package
servers.
• For each physical DNS server there must be an AD user. Therefore, to configure secure dy-
namic update for a Multi-Master smart architecture, you need two AD users to generate the
GSS-TSIG key for the server named after them.
620
Making Sure your Master Zone is Properly Configured

As detailed in the Prerequisites, the master zone managing the AD domain has to be configured
with records linking the domain, the AD server and the DNS server. Without these records, you
cannot set up the AD authentication for AD clients' dynamic update.
The zone configuration must contain the 9 records configured as detailed in the example below.
ad-domain.corp SOA TTL dns-server.ad-domain.corp X X X X X X dns-server.ad-domain.corp A TTL IP
ad-server.ad-domain.corp A TTL IP _kerberos._udp.ad-domain.corp SRV TTL 0 100 464
ad-server.ad-domain.corp _kerberos._udp.ad-domain.corp SRV TTL 0 100 88 ad-server.ad-domain.corp
_kerberos._tcp.ad-domain.corp SRV TTL 0 100 464 ad-server.ad-domain.corp _kerberos._tcp.ad-domain.corp
SRV TTL 0 100 88 ad-server.ad-domain.corp _ldap._tcp.pdc._msdcs.ad-domain.corp SRV TTL 0 100 389
ad-server.ad-domain.corp _ldap._tcp.Default-First-Site-Name._sites.dc._msdcs.ad-domain.corp SRV TTL
0 100 389 ad-server.ad-domain.corp
These records can be added automatically following the procedure below.
To prepare the AD server and AD domain for dynamic updates
1. Configure the master zone managing your AD domain
a. Connect to SOLIDserver.
b. Go to the DNS tab. If the homepage is not displayed, click on . The homepage opens.
c. Click on DNS zones. The list All zones opens.
d. At the end of the line of the zone managing your AD domain, click on . The properties
page opens.
e. In the panel Access Control, click on EDIT . The wizard opens: the page Allow-query
appears.
f. Click on NEXT . The page Allow-transfer appears.
g. Click on NEXT . The page Allow-update appears.
h. In the drop-down list Type, select IP address.
i. In the drop-down list Restriction, select Allow.
j. In the field IP address, type in the IP address of your AD server.
k. Click on ADD , the IP address is visible in the list ACL values. Make sure that the IP ad-
dress of the AD server was not denied in the list, denied hosts are preceded by (!).
l. Click on OK to commit the configuration. The report opens and closes. The IP address
is visible in the panel Access control, in the list Allow-update.
2. Check the AD server configuration
a. Connect to your AD server.

b. Make sure the DNS resolver configured for the AD server is your EfficientIP DNS server.
If not, you must set your EfficientIP DNS server as the resolver of your AD server.
3. Complete the AD server configuration
a. Open a command prompt on the AD server.

b. Send the AD server details - an A record - to your EfficientIP DNS server using the fol-
lowing command.
621
ipconfig /registerdns
c. Add the missing key records to the DNS server using the command below.
nltest /server:<ad-server-name>.<full-ad-domain> /dsregdns
The missing records link your AD server, AD domain and DNS servers.
4. Make sure the configuration is complete
a. Connect to SOLIDserver.
b. Go to the DNS tab. If the homepage is not displayed, click on . The homepage opens.
c. Click on DNS zones. The list All zones opens.
d. Tick the zone managing your domain.
e. In the menu, select Edit > Status > Synchronize. The wizard Synchronization opens.
f. Click on OK to commit the synchronization. The report opens and closes, the page re-
loads.
g. Click on the zone name, the page All RRs opens. The key records - 1 SOA, 2 A and 6
SRV - are listed and configured as expected.
When the AD server, DNS server and master zone managing your AD domain are configured
properly, you can create a GSS-TSIG key and upload it to SOLIDserver.
Creating and Uploading the GSS-TSIG key

Once you prepared the AD server and AD domain for dynamic updates, you need to generate a
GSS-TSIG key and upload it to your DNS server. The key must respect the following:
• The AD user named after the DNS server must generate the key.
• The key has the extension .keytab and is used by the DNS server to authenticate AD users.
You need to generate the key from the AD server and then upload it to SOLIDserver.
To generate the GSS-TSIG key on the AD server
1. Connect to your AD server using the credentials of an AD administrator.

2. Open a command prompt.
3. Go to the directory of your choice.
4. Generate the GSS-TSIG key following the command below, on one line.
ktpass -princ DNS/<name>.<domain>@<domain> -pass <password> -mapuser <name>@<domain> -ptype
KRB5_NT_PRINCIPAL +DesOnly -mapOp set -out <name>.<domain>.keytab
# <name> is the AD user sharing the same name as the DNS server.
# <domain> is the full AD domain: domain.TLD .
# <password> is the password of the AD user specified.
5. Copy the file in the directory of your choice for the upload.
Once you generated the key and saved it where you want, you must upload it to SOLIDserver.
This upload is done on the page GSS-TSIG key ring.
622
On the page, the keys are listed using their Name, Encryption Type and Encryption number in
dedicated columns. You cannot edit the columns layout.
To upload the GSS-TSIG key to SOLIDserver
1. Connect to SOLIDserver.
opens.
3. In the section System, click on Key Ring. The page Key Ring opens.
4. In the menu, select Display > GSS-TSIG Keys. The page GSS-TSIG key ring opens.
5. In the menu, select Add > GSS-TSIG Key. The wizard Add a GSS-TSIG Key opens.
6. Click on BROWSE to find and upload your .keytab file.
7. Double-click on the name to select it.
9. Click on OK to commit the upload. The report opens and closes. The key is listed.
In the column Name, the uploaded key is displayed following the format declared during the
generation: DNS/<name>.<domain>@<domain> .
You can delete a GSS-TSIG key if you no longer use it on any server or zone. For more details,
refer to the section Disabling Secure Dynamic Update.
Configuring your DNS server for Secure Dynamic Update

When the GSS-TSIG key is uploaded, you must configure the physical server managing your
AD domain with it.
On the page All servers, the column Multi-Status indicates if the smart architecture has GSS-
TSIG enabled but there is no GSS-TSIG key configured on the physical server(s) it manages.
If you manage your physical server via a smart architecture, you must first enable GSS-TSIG on
the smart and then specify the .keytab file on the physical server.
To configure and specify the GSS-TSIG on a physical server managed via a smart
1. Enable GSS-TSIG on the smart server
c. At the end of the line of the smart server, click on . The properties page opens.
d. Open the panel GSS-TSIG using and click on EDIT . The wizard Edit GSS-TSIG prop-
erties opens.
e. Tick the box Use GSS-TSIG.
f. Click on OK to commit your choice. The report opens and closes. In the panel, the GSS-
TSIG status is now Enabled. Now you must specify the GSS-TSIG key on the physical
server.
623
2. Specify the GSS-TSIG key on the physical server
a. In the breadcrumb, click on Servers. The page All servers opens.

b. At the end of the line of the physical server managing your AD domain, click on . The
properties page opens.
c. Open the panel GSS-TSIG using and click on EDIT . The wizard Edit GSS-TSIG prop-
erties opens
d. The box Use GSS-TSIG is ticked.
e. In the drop-down list Select the key to use, select the .keytab file you uploaded.
f. Click on OK to commit your choice. The report opens and closes. In the panel, the key
details are displayed.
3. If you manage several physical servers via a Multi-Master architecture, you must repeat the
actions of the step 2 for each EfficientIP DNS server.
If you manage your physical server outside a smart server, you must enable GSS-TSIG and
specify the GSS-TSIG on the EfficientIP DNS server itself.
To configure a physical server with GSS-TSIG
3. At the end of the line of the physical server managing your AD domain, click on . The
4. Open the panel GSS-TSIG using and click on EDIT . The wizard Edit GSS-TSIG properties
opens.
5. Tick the box Use GSS-TSIG. A drop-down list appears.
6. In the drop-down list Select the key to use, select the .keytab file you uploaded. If there is
only one file on the page GSS-TSIG key ring, it is automatically selected.
7. Click on OK to commit your choice. The report opens and closes. In the panel, the key details
are displayed.
Once you selected a keytab file on a physical server, the AD users can be authenticated, when
they query the AD domain. Now you need to configure the AD users permissions and restrictions
on the zone managing the AD domain.
Configuring your Zone for Secure Dynamic Update

When the physical server managing your AD domain is configured to authenticate AD users, you
can configure the statement update-policy with permissions and restrictions that suit your needs
directly on the zone managing your AD domain.
On the page All zones, the column GSS-TSIG indicates if the zones are configured with a GSS-
TSIG key. The column has three possible values:
Table 41.1. Values of the column GSS-TSIG

Value Description
N/A The zone cannot be configured with GSS-TSIG.
624
Value Description
No The zone is not configured with GSS-TSIG: its update-policy statement has not been configured.
Yes The zone is configured with GSS-TSIG: its update-policy statement is activated and configured
with your entries and/or the default entries detailed below.
Before configuring the statement update-policy, keep in mind that:
• The first time you configure the statement, SOLIDserver automatically allows itself to edit the
zone. The panel contains the policy you configured in the wizard and the following policy:
grant "ipmadmin" wildcard "*" ANY;
If your zone is managed via a view, SOLIDserver automatically adds the following policy:
grant "<view-name>" wildcard "*" ANY;
• If they suit your needs, we recommend that you configure the following update-policy entries:
1. Allow the AD server to edit the master zone managing your domain. That way the AD server
can advertise any hostname or IP address changes directly to the DNS server without con-
figuring dynamic update again. The final policy should look as follows:
grant "<server-name>$@<full-domain>" wildcard "*" ANY;
# In the GUI, this configuration is set as follows:
# Permission=grant, Identity=<server-name>$@<full-domain>,
# Matchtype=wildcard, Tname=*, RR type=Any
2. Allow Windows computers registered in the AD domain to create their A and AAAA records
in the zone.
grant "<full-ad-domain>" ms-self "<full-ad-domain>" specific A AAAA;
# In the GUI, this configuration is set as follows:
# Permission=grant, Identity=<server-name>$@<full-domain>, Matchtype=ms-self,
# Tname=<full-domain>, RR type=Specific, Selected type(s)=A, AAAA
To configure secure dynamic update on the zone managing your AD domain
3. At the end of the line of the master zone managing your AD domain, click on .The properties
page opens.
7. Tick the box Use GSS-TSIG/update-policy. The page reloads and is now named Update
policy.
8. Configure the dynamic update permissions and restrictions for your zone:
Table 41.2. Update-policy configuration parameters

Option Description
Permission Specify if you grant or deny update-policy rights. This field applies to all the other fields
detailed below.
Identity Specify the GSS-TSIG key sent by the client when they try to update the zone. It may look
like <ad-server-name>$@<full-ad-domain> . Its use depends on the Matchtype you select,
it can therefore partially depend on the Tname.
625
Option Description
Matchtype Select the matchtype that suits your needs: subdomain, krb5-self, krb5-subdomain, ms-self
or ms-subdomain, described below.The matchtype only applies to the record type specified
in the list Any.
subdomain allows to define the subdomain being updated. You must specify the domain
in the field Tname following the format <domain>.<tld> , everything left of the specified
<domain> becomes a match.
wildcard allows to define the record being updated. You must specify the record's name
in the field Tname using at least one wildcard (*). It can contain only a wildcard, in which
case any record name can match.
krb5-self allows to define a rule based on Kerberos machine principal (host/QDN@REALM).
The record being updated matches the QDN part of the Principal. The matching REALM
must be specified exactly in the fields Identity and Tname.
krb5-subdomain allows to define a rule based on Kerberos machine principal
(host/QDN@REALM).The subdomain being updated matches the QDN part of the Principal.
The matching REALM is what is specified the field Identity, or any subdomain of the
specified Identity.
ms-self allows to define a rule based on AD format principal (machinename$@REALM)
to update machinename.realm in the DNS. The matching REALM must be specified exactly
in the fields Identity and Tname.
ms-subdomain allows to define a rule based on AD format principal (machine-
name$@REALM) to update machinename.realm in the DNS.The matching REALM is what
is specified the field Identity, or any subdomain of the specified Identity.
Tname Specify a value to which applies the Matchtype subdomain, krb5-self, krb5-subdomain, ms-
self or ms-subdomain. The expected format is detailed above, with each Matchtype.
RR type Select which record type(s) the configuration set in the previous fields applies to. It can be
Specific or Any.
Specific Configure permissions for the record types of your choice via the lists Available types
and Selected type(s). In the list Available types, select A, AAAA, CNAME, HINFO,
AFSDB, MX, PTR, NS, SRV, TXT, WKS, NSAP or DNAME and click on to move it to
the list Selected type(s). Repeat this action for as many record types as you need.
Any Allows to apply the configuration to all the update-policy record types: A, AAAA, CNAME,
HINFO, AFSDB, MX, PTR, NS, SRV, TXT, WKS, NSAP and DNAME.
Once you configured the fields, click on ADD .Your update-policy entry is moved to the Update-
policy list. The page refreshes. Configure as many entries as you want.
To organize the list, use the buttons and . Each restriction or permission is reviewed
and processed following the order set in the list.
9. Click on OK to commit the statement configuration. The report opens and closes. In the
panel Access control, the list Allow-update is now replaced by the list Update-policy.
Even if you do not configure any entry in the Update-policy list, once you click on OK ,
SOLIDserver automatically adds the entry grant "ipmadmin" wildcard "*" ANY; that allows it
to update your zone).
Each entry of the Update-policy list is listed on the page User tracking, in the column Description
as follows: DNS name: <name> Zone name: <name> Key: update-policy Value: <entry> .
Once you configured the update policy statement, all the AD users querying your DNS server
are authenticated by your AD server and only the allowed users can dynamically update the zone
managing your AD domain.
626
Troubleshooting Secure Dynamic Update

If your configuration is not running as expected, you should make sure that:
1. The AD server is running.

2. The DNS server and AD server are at the same time and date.
You should configure an NTP server on both SOLIDserver and the AD server. For more details
regarding NTP on SOLIDserver, refer to the section Configuring the NTP Server.
3. The .keytab file you are using is the correct one.
a. Go the page GSS-TSIG key ring to make sure you uploaded the proper .keytab file. If not,
upload it following the procedure in the section Creating and Uploading the GSS-TSIG key.
b. Go to the properties page of the physical server managing the zone dedicated to your AD
domain, in the panel GSS-TSIG the .keytab file is displayed. If the file is not the correct one,
edit it following the procedure To configure a physical server with GSS-TSIG.
4. The DNS server name is the same as the AD user declared in the .keytab file.
The AD user that generated it on the AD server and the physical DNS server managing your
AD domain have the same name. If not, you might need to generate the .keytab file again
following the section Creating and Uploading the GSS-TSIG key. Then complete the physical
server and zone configuration.
5. Your update-policy statement is properly configured. The order of the entries in the Update
policy list is important: each restriction or permission is reviewed following the order you set
in the list.
For more details, refer to the recommendations and procedure in the section Configuring your
Zone for Secure Dynamic Update.
Disabling Dynamic Update and Deleting Keys

If you no longer want users to dynamically update a zone you manage, you must:
• Edit the zone to empty the statement allow-update or update-policy.

• Make sure the server configuration suits your needs after your edited the zone.
Note that you cannot delete TSIG or GSS-TSIG keys if they are used. To delete them, you
must first disable dynamic update or secure dynamic update.
Disabling Dynamic Update

To disable dynamic update, you must edit the zone to remove the relevant key from the statement
allow-update and make sure that the ACL admin configuration of the DNS server suits your needs.
To disable dynamic update on a zone
2. Edit the zone:
a. Click on DNS zones. The list All zones opens.

b. At the end of the line of the zone of your choice, click on . The properties page opens.
627
c. In the panel Access Control, click on EDIT . The wizard opens: the page Allow-query
appears.
d. Click on NEXT . The page Allow-transfer appears.
e. Click on NEXT . The page Allow-update appears.
f. In the list ACL values, select an entry and click on DELETE . It is no longer listed.
g. Repeat these actions for each entry in the list.
Keep in mind that if you delete all entries, the entry admin is automatically recreated at
the top of the ACL list. It matches the configuration set on the server, which is why you
must make sure that the ACL admin at server level suits your needs.
h. Click on OK to commit the configuration. The report opens and closes. The parameters
are visible in the panel Access control, the list Allow-update is empty.
3. Check the server configuration:
a. In the breadcrumb, click on the zone's server name. The server properties page opens.
b. In the panel ACL, in the list DNS ACLs select admin.
c. Click on EDIT . The wizard ACL configuration Edit a DNS server opens.
d. Edit the ACL configuration according to your needs using the fields Type, Restriction
and ACL values.
Keep in mind that this ACL sets permissions and restrictions for all the zones of your
server. So you must make sure that its content matches your needs.
e. Click on OK to commit your changes. The report opens and closes. The properties page
is visible again.
Once you cleared the content of the statement allow-update and checked the ACL configuration
of the server, you can remove TSIG keys following the section Deleting TSIG and GSS-TSIG
Keys.
Disabling Secure Dynamic Update

To disable secure dynamic update you must:
1. Edit the zone managing your AD domain. Go to the zone's properties page, edit the panel
Access control, and on the page Update policy and untick the box Use GSS-TSIG/update-
policy.
2. Edit the server managing your zone, it can be either the smart architecture managing your
DNS physical server or the physical server itself if you manage it on its own.
• Go the properties page of the relevant server, in the panel GSS-TSIG click on EDIT and disable
GSS-TSIG: untick the box Use GSS-TSIG and click on OK .
• From the same properties page, in the panel ACL: select admin and click on EDIT . Make
sure the configuration suits your needs, if not make edit and click on OK .
Once you disabled dynamic update, you can delete the .keytab file following the procedure To
delete a GSS-TSIG key.
628
Deleting TSIG and GSS-TSIG Keys

You can delete DNS keys if:
• The TSIG key you want to delete from a server is no longer used by any of its zones. For more
details, refer to the section Disabling Dynamic Update.
• The GSS-TSIG key you want to delete from the Key Ring is no longer used by any zone and
GSS-TSIG is disabled on the server managing the zone. For more details, refer to the section
Disabling Secure Dynamic Update.
To delete a TSIG key
1. Make sure the key is no longer used in any statement of the server, view or zone.
5. Open the panel Keys using .
6. In the list DNS keys, select the key you want to delete in the list DNS keys.
7. Click on DELETE . The wizard Delete opens.
To delete a GSS-TSIG key
1. Make sure you disabled secure dynamic update following the section Disabling Secure Dy-
namic Update.
opens.
3. In the section Monitoring, click on Key Ring. The page Key Ring opens.
4. In the menu, select Display > GSS-TSIG Keys. The page GSS-TSIG key ring opens.
5. Tick the key(s) you want to delete.
629
Chapter 42. DNS Firewall (RPZ)
Recursive DNS server Response Policy Zone (RPZ) is based on domain data feeds provided by
an external service, manually created by network administrators,etc. Using this information,
SOLIDserver allows to set up a granular approach for RPZ zone management. Instead of
blocking an entire domain, you can set exceptions for subdomains and even configure individual
response policies for each subdomain. In this sense, the RPZ is basically a DNS firewall option
that you can configure on the server to set up a filter for recursive queries of domain names or
IP addresses through the resource records of a zone and provide an alternate response to this
query. This mechanism is similar to an email anti-spam blacklist. In other words, it allows you to
prevent DNS clients from accessing certain websites.
Malware Data Syslog

server
Feed
DNS Firewall
Multi-vendor
Dynamic policy
update
Alert Forbidden
request
Botnet attack
Malwares
Management Viruses
Appliance
Figure 42.1. The DNS firewall
At zone level, you can decide which requests are redirected and where, as well as set a NODATA
or even an NXDOMAIN response. The main benefit of this mechanism is that you can set up a
filter using either a domain name or an IP address using the CNAME, A and AAAA records of
the RPZ zone.
Within SOLIDserver, configuring the RPZ requires:
1. Managing an EfficientIP DNS server or a BIND DNS server.
For more details, refer to the sections Managing EfficientIP DNS Servers and Managing BIND
DNS Servers.
2. Adding at least one RPZ Zone.
For more details, refer to the section Adding RPZ Zones below.
3. Adding rules to the zone to implement specific policies.
For more details, refer to the section Managing RPZ Rules below.
630
DNS Firewall (RPZ)
Browsing RPZ Zones and Records

Within the GUI, the RPZ zones are listed with regular DNS zones. RPZ zones preceded by a
specific icon. These zones contain the records used as rules that define your policies, they are
all gathered and listed on the page All RPZ rules.
Figure 42.2. RPZ dedicated icons and page
The orange rectangle differentiates regular DNS zones and records from RPZ zones and
records. If you click on the Name of an RPZ zone name, you open the page All RPZ rules
that lists the records it contains.
The column DNS firewall (RPZ) allows to filter the list and only display your RPZ zones.
The page All RPZ rules lists all the records of RPZ zones. It even includes the SOA and NS
records of each RPZ zone.
The RPZ configuration of a zone relies on RPZ rules. Once you added your BIND server to the
page All servers, you need to add RPZ zones from the page All zones and configure RPZ rules
through the addition of CNAME, A and AAAA records on the page All RPZ rules.
Browsing the RPZ Zones Database

The RPZ zones are managed on the page All zones. Their statuses are identical to regular zones.
For more details, refer to the section Understanding the DNS Zone Statuses.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 42.3. The RPZ zone in the DNS hierarchy
To display the list of RPZ DNS zones
2. Click on DNS zones. The DNS page All zones opens. The RPZ zones are preceded by an
orange rectangle.
631
DNS Firewall (RPZ)
Browsing the RPZ Records Database

The RPZ zones contain records that set your policies.These policies are managed independently
on the page All RPZ rules.
DNS RECORD
ZONE
SERVER VIEW
RPZ RULE
ZONE
Figure 42.4. The RPZ rule in the DNS hierarchy
To display the list of RPZ resource records
2. In the breadcrumb, click on All RPZ rules. The page All RPZ rules opens.
To display the list of records of a specific RPZ zone
2. Click on DNS zones. The DNS page All zones opens, the RPZ zones are preceded by an
orange rectangle.
3. Click on the name of the RPZ zone of your choice. The page All RPZ rules opens. By default,
it lists at least the SOA and NS record of the zone. Any additional records is listed and pre-
ceded by the same orange rectangle as the zone.
Customizing the Display on the Page All RPZ Rules

Adding RPZ Zones

Once you added your a BIND server to the DNS page All servers, you can add RPZ zones from
the page All zones.
Keep in mind that:
• You can only configure RPZ on Name zones: it does not work on reverse zones.
• You can only configure RPZ on Master zones or Slave zones. Any other type of zone is ir-
relevant to the RPZ configuration.
• You cannot use the name of an existing zone when you create an RPZ zone, otherwise the
domain name that you use can no longer be resolved using DNS.
• You cannot add more than 32 RPZ zones in one view or in one server if the server does not
contain any views.
632
DNS Firewall (RPZ)
To add an RPZ master zone
3. In the menu, select Add > RPZ zone. The wizard Add a DNS zone opens.
4. In the field DNS server, select a BIND server and click on NEXT . The next page of the wizard
opens.
1
8. In the field Name, name your zone following the syntax given in RFC1034 .
9. In the drop-down list View, select a view if you created any. If there are no views in the se-
lected server, the list is empty.
10. The box DNS firewall (RPZ) is automatically ticked and displayed in gray.
11. In the drop-down list Overriding rule, Given is selected by default. For more details regarding
the Overriding rules, refer to the section Overriding RPZ Rules.
12. Click on OK to commit the creation. The report opens and closes. The RPZ zone is listed,
preceded by an orange rectangle and marked Delayed create before being marked
OK.
To add an RPZ slave zone
opens.
6. In the list DNS zone type, select Slave.
1
11. In the drop-down list Overriding rule, Given is selected by default. For more details regarding
the Overriding rules, refer to the section Overriding RPZ Rules.
1
633
DNS Firewall (RPZ)
Table 42.1. DNS slave zone parameters

Field Description
Master IP address Type in the master server IP address. This field is required.
Port You can type in the number of the port dedicated to communicating with the slave
zone. This field is optional.
TSIG key In the drop-down list, select a TSIG key set at server level. This field is optional. For
more details, refer to the section Securing the Management of DNS Servers Using a
TSIG Key.
14. Click on OK to commit the creation. The report opens and closes. The RPZ zone is listed,
preceded by an orange rectangle and marked Delayed create before being marked
OK.
Once you added the needed zones, you can configure their policies through records addition in
the page All RPZ rules.
Editing RPZ Zones

Once you created an RPZ zone:
• You cannot rename it.

• You cannot reset its configuration and use it as a regular zone.
An RPZ zone can be edited on some level:
• You can edit its content and add as many RPZ records as you please. For more details, refer
to the section Managing RPZ Rules.
• You can edit the class to the zone: add a new one, edit or remove it. For more details, refer to
the chapter Configuring Classes.
• You can configure an overriding rule or edit an existing one.
To edit an RPZ zone from the page All zones
3. Right-click over the Name of the RPZ zone you want to edit. The contextual menu opens.
4. Click on . The wizard Edit a DNS zone opens.
5. If you or your administrator configured classes at zone level, in the list DNS zone class you
can select the class of your choice or None.
7. You cannot edit the Name, View (if the server contains any) and DNS firewall (RPZ) fields.
8. In the drop-down list Overriding rule, select the value of your choice: Given, Disabled,
Passthru, Nxdomain, Nodata or CNAME. The page refreshes. For more details, refer to the
section Overriding RPZ Rules.
634
DNS Firewall (RPZ)
9. Click on OK to commit the changes. The report opens and closes. The page All zones is
visible again. The selected overriding rule is visible in the panel Main properties of the zone
properties page.
Keep in mind that you can also edit an RPZ zone from its properties page:
• From the panel Main properties, you can edit the class and overriding rule of the zone.
• From the panel Name servers, you can edit the Authoritative DNS servers. For more details,
refer to the section Configuring Delegation at Zone Level.
• From the panel Forwarding, you can edit the zone forwarding parameters. For more details
regarding the available parameters, refer to the section Configuring DNS Forwarding at Server
Level.
• From the panel Notify, you can edit IP addresses that should be notified of any changes on
the master zone.
• From the panel Access control, you can set or edit allow-query, allow-transfer and allow-update
options on your zones. For more details, refer to the section Managing DNS Security.
• From the panel Groups access, the members of the admin group, can set and edit which
groups should have or not the RPZ zone in their resources list.
Converting RPZ Zones

Like any master or slave zone, RPZ zones can be converted from slave to master and vice versa:
• During a conversion from slave to master, you can choose to delete the old NS records it
contains.
• Converting master zones to slave on servers that do not support slave zones (e.g. Route53
and Unbound) deletes all the records of the original master zone.
To convert slave zones to master
3. Tick the slave zone(s) you want to convert.
4. In the menu, select Edit > Convert > To master. The wizard Zone conversion from slave to
master opens.
5. In the drop-down list Remove old NS you can decide what to do with the zone's NS records:
a. Select Yes to delete the NS record of the former slave zone.

b. Select No to keep them in the master zone for future use.
To convert master zones to slave
3. Tick the master zone(s) you want to convert.
635
DNS Firewall (RPZ)
4. In the menu, select Edit > Convert > To slave. The wizard Zone conversion from master to
slave opens.
5. In the field IP of master server, specify the IP address of the master server that now has
authority over the zone(s).
Deleting RPZ Zones

Like any other zone, deleting an RPZ zone can be done from the page All zones.
To delete an RPZ zone
2. Click on DNS zones. The DNS page All zones opens.
4. Tick the RPZ zone(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The zone is marked
Keep in mind that if you delete a zone that was configured with a Passthru overriding rule, any
rule within the zone is deleted. Therefore, any record in the other zones of the server that matched
one of the rules of the deleted zone is no longer configured with a Passthru exception. For more
details, refer to the section Overriding RPZ Rules.
Managing RPZ Rules

Within an RPZ zone the RPZ rules set policies through the addition RPZ: <policy> records. In
fact, they create CNAME, A and AAAA records which syntax configures the filters of your choice.
SOLIDserver provides the configuration of four different policies that you can configure using
requested domain names (QNAME) or IP addresses:
• Redirection is set with a record RPZ: REDIRECT on the page All RPZ rules. It allows to define
which domain or IP address should be redirected toward which domain or IP address:
Domain name > domain name redirection
This redirection creates a CNAME record which name and value depend on the domain
names stated during the configuration.
Domain name > IP address redirection
This redirection creates an A record if you redirect the domain name toward an IPv4 address
or a AAAA record if you redirect the domain name toward an IPv6 address. This IP address
can be the IP address of any equipment or even an entire subnet start address. Its name
and value depend on the domain name and IP address stated during configuration.
IP address > domain name redirection
This redirection creates a CNAME record which name and value depend on the IP address
and domain name stated during configuration.
636
DNS Firewall (RPZ)
IP address > IP address redirection

This redirection creates a CNAME record which name and value depend on the IP address
stated during configuration.
• NODATA is set with a record RPZ: NODATA. It allows to set a NODATA response to any re-
quested domain name or IP address. It basically creates CNAME record named after the domain
name or IP address triggering this response.
Keep in mind that you can also set an NODATA policy using a Name Server Domain Name
(NSDNAME) or Name Server IP address (NSIP).
• NXDOMAIN is set with a record RPZ: NXDOMAIN. It allows to set an denial of existence re-
sponse to any requested domain name or IP address. It basically creates CNAME record
named after the domain name or IP address triggering this response.
Keep in mind that you can also set an NXDOMAIN policy using a Name Server Domain Name
(NSDNAME) or Name Server IP address (NSIP).
• PASSTHRU is set with a record RPZ: PASSTHRU. It allows to set an exception for the redir-
ection or NODATA or NXDOMAIN response you set. It creates a CNAME record that, for in-
stance, redirects *.domain.com toward your company website but still grant access to the page
www.domain.com.
Each policy is created with a TTL of 3600 seconds. Once applied, the policy TTL automatically
drops to 5 seconds, following BIND behavior.
At server level, adding a policy to a zone adds the response-policy option in the named.conf
file. SOLIDserver simply states in this option the RPZ zones managed by the server. In each of
the RPZ zone file, the records are listed as CNAME, A and AAAA records that respect the RPZ
syntax.
Understanding the RPZ Policies Order

The RPZ is considered as the DNS firewall as the policies are taken into account and implemented
like firewall rules: once a match is found in the list, the policy returns the configured alternate
responses and stop looking for other matches. Therefore, when a user queries an RPZ zone,
the data queried are compared to the RPZ policies list, the first match found is respected; any
other policy set on the very same requested data is ignored.
When adding RPZ policies, keep in mind that the triggers or records that encode the triggers (the
policies) of a given DNS query or DNS response follow a specific order that allows you to set
various RPZ rules for a single RPZ zone. The queries are compared to all RPZ policies in following
the order below:
1. The RPZ ordering matters
Policies encoded in the first response-policy defined zone in the server configuration are
matched first. In other words, the first policies created are the first used to provide alternate
responses to user queries.
2. Within a single RPZ zone, policies respect a specific precedence
QNAME policies (i.e. domain name based policies) are preferred over IP based policies; IP
policies are preferred over NSDNAME policies; NSDNAME policies are preferred over NSIP
policies.
3. Within a single RPZ zone, name based policies follow a specific order
637
DNS Firewall (RPZ)
Among applicable QNAME or NSDNAME policies, the policy with the smallest name is preferred.
4. Within a single RPZ zone, IP based policies follow a specific order
a. Among applicable IP or NSIP policies, the policy with the longest prefix length is preferred.
b. Among IP or NSIP policies with the same prefix, the smallest IP address is preferred.
Configuring Policies Using Domain Names

A domain name (QNAME) can be used to set up a redirect, nodata, nxdomain and/or passthru
response-policy through the addition of CNAME, A and AAAA records via the Add an RPZ Rule
wizard.
Configuring a Redirection Using a Domain Name
The RPZ redirection policy can be configured using domain names. There are as many domain
redirections as there are RPZ: REDIRECT records configured. You can either use a full domain
name or specify some parts as variable, to include all the subdomains of a particular domain for
instance.
To configure a redirection using a domain name
3. In the column Name, click on the name of the RPZ zone of your choice. The page All RPZ
rules opens.
4. In the menu Add > RPZ rule. The wizard Add an RPZ Rule opens.
5. In the drop-down list Source, select Domain.
6. In the field Domain, type in the domain name. It can be a full domain name or a partial one.
For more details, refer to the table below.
Table 42.2. Domain name possible syntax when configuring an RPZ policy
Value Description
domain.extension The DNS client requesting this domain is redirected toward a domain name
(refer to step 8) or toward an IP address (refer to step 9).
a
*.domain.extension The DNS client requesting any matching subdomain is redirected toward
a domain name (refer to step 8) or toward an IP address (refer to step 9).
<value>.domain.extension The DNS client requesting this specific name is redirected toward a domain
name (refer to step 8) or toward an IP address (refer to step 9).
a
The * (asterisk) is called the wildcard when used in front of a domain name.
7. In the drop-down list Policy, select Redirection. You can set a redirection toward a domain
8. Set the redirection toward the domain name of your choice:
a. In the drop-down list Redirection target, select Domain.

b. In the field Target domain, type in the target domain name of the redirection.
a. In the drop-down list Redirection target, select IPv4 or IPv6.
638
DNS Firewall (RPZ)
b. In the field Target address, type in the target IP address of the redirection, respecting
the selected protocol version syntax.
10. Click on OK to commit the creation. The report opens and closes. The record is now listed.
The column RR name displays an RPZ: REDIRECT named after the source domain name,
its Value is the target domain name or IP address depending on your configuration.
Configuring a NODATA Response Using a Domain Name
You can configure a NODATA response policy for clients requesting certain domain names.
There is a NODATA response for as many domains as there are RPZ: NO DATA records con-
figured.
To configure a NODATA response policy using a domain name
rules opens.
Value Description
domain.extension The DNS client requesting this domain gets a nodata response.
*.domain.extension The DNS client requesting any matching subdomain gets a nodata response.
<value>.domain.extension The DNS client requesting this specific name gets a nodata response.
7. In the drop-down list Policy, select Nodata.

The column RR name displays an RPZ: NODATA named after the source domain name, its
Value is * following the BIND RPZ syntax in the zone file.
Configuring an NXDOMAIN Response Using a Domain Name
You can configure an NXDOMAIN response policy for clients requesting certain domain names.
There is an NXDOMAIN response for as many domains as there are RPZ: NXDOMAIN records
configured.
To configure an NXDOMAIN response policy using a domain name
rules opens.
639
DNS Firewall (RPZ)
Value Description
domain.extension The DNS client requesting this domain gets an nxdomain response.
*.domain.extension The DNS client requesting any matching subdomain gets an nxdomain re-
sponse.
<value>.domain.extension The DNS client requesting this specific name gets an nxdomain response.
7. In the drop-down list Policy, select Nxdomain.

The column RR name displays an RPZ: NXDOMAIN named after the source domain name,
its Value is . following the BIND RPZ syntax in the zone file.
Configuring a PASSTHRU Exception Using a Domain Name
Once you configured redirection and specific request responses, you can always configure a
PASSTHRU exception for a particular domain name, subdomain, etc. There are as many domain
name exceptions as there are RPZ: PASSTHRU records configured.
To configure a PASSTHRU response policy using a domain name
rules opens.
You cannot use wildcard * when configuring a passthru from a domain name.
Value Description
domain.extension The DNS client requesting this domain gets a regular response.
<value>.domain.extension The DNS client requesting this specific name gets a regular response.
7. In the drop-down list Policy, select Passthru.

The column RR name displays an RPZ: PASSTHRU named after the source domain name,
its Value is rpz-passthru following the BIND RPZ syntax in the zone file.
Configuring Policies Using IP Addresses

An IP address can be used to set up a redirect, nodata, nxdomain and/or passthru response-
policy through the addition of CNAME records via the wizard Add an RPZ Rule.
640
DNS Firewall (RPZ)
The RPZ follows a specific syntax similar to the reverse mapping (in-addr.arpa) in the zone file:
IPv4 policies display

Once created, the RPZ policies from an IPv4 address display the source IP address in reverse:
<prefixlength.B4.B3.B2.B1>. In the zone file, the source IP address follows the RPZ syntax:
<prefixlength.B4.B3.B2.B1.rpz-ip>.
IPv6 policies display
Once created, the RPZ policies from an IPv6 address display the source IP address in reverse:
<prefixlength.W8.W7.W6.W5.W4.W3.W2.W1>. In the zone file, the source IP address follows
the RPZ syntax: <prefixlength.W8.W7.W6.W5.W4.W3.W2.W1.rpz-ip>.
On the page All RRs, the column Partial RR name of RPZ records might contain .zz. in . It
corresponds to :: and allows you not to type in full the omitted 0000: groups of the address.
Configuring a Redirection Using an IP Address
The RPZ redirection policy can configured using a specific IPv4 or IPv6 address or range of ad-
dresses. There are as many IP addresses redirections as there RPZ: REDIRECT records con-
figured.
Keep in mind that even though you can redirect a single address or a range of IP addresses (a
subnet address for instance), the redirection target can only be one IP address.
To configure a redirection using an IP address
rules opens.
5. In the drop-down list Source, select IPv4 or IPv6.
6. In the field Address, type in the IP address following the appropriate syntax.
7. In the drop-down list Prefix, select a prefix in the list. Your prefix might correspond to one
IP address or to a range of IP addresses.


The column RR name displays an RPZ: REDIRECT named after the source IP address and
641
DNS Firewall (RPZ)
prefix displayed in reverse, its Value is the target domain name or IP address depending on
your configuration.
Configuring a NODATA Response Using an IP Address
The RPZ NODATA policy can configured using a specific IPv4 or IPv6 address or range of ad-
dresses.There are as many IP addresses redirections as there RPZ: NODATA records configured.
To configure a NODATA response policy using an IP address
rules opens.
The column RR name displays an RPZ: NODATA named after the source IP address and
prefix displayed in reverse, its Value is * following the BIND RPZ syntax in the zone file.
Configuring an NXDOMAIN Response Using an IP Address
The RPZ NXDOMAIN policy can configured using a specific IPv4 or IPv6 address or range of
addresses. There are as many IP addresses redirections as there RPZ: NODATA records con-
figured.
To configure an NXDOMAIN response policy using an IP address
rules opens.
The column RR name displays an RPZ: NXDOMAIN named after the source IP address and
prefix displayed in reverse, its Value is . following the BIND RPZ syntax in the zone file.
642
DNS Firewall (RPZ)
Configuring a PASSTHRU Exception Using an IP Address
Once you configured the redirection and responses policies of your choice, the RPZ allows you
to configure PASSTHRU exceptions for the IPv4 and IPv6 addresses or ranges of addresses of
your choice. There are as many IP addresses exceptions as there are RPZ: PASSTHRU records.
To configure a PASSTHRU response policy using an IP address
rules opens.
The column RR name displays an RPZ: PASSTHRU named after the source IP address and
prefix displayed in reverse, its Value is rpz-passthru following the BIND RPZ syntax in the
zone file.
Configuring Policies Using Name Servers

In addition to filters through domain names and IP addresses, the RPZ filtering provides specific
policy syntax that allows to provide alternate responses to queries made to authoritative name
servers.You can set policies based on Name Server IP Address (NSIP) or Name Server Domain
Name (NSDNAME). These filters add a extra suffix to the RPZ syntax and look as follows in the
zone file: <source-value>.rpz-nsip or <source-value>.rpz-nsdname .
These records allow you to configure a redirection, an NXDOMAIN, a NODATA or a PASSTHRU

response-policy to any query made to any zone managed by a Name Server whether you identified
it through its IP address (NSIP) or through its domain name (NSDNAME).
Keep in mind that any of the zone managed by that authoritative Name Server are returned a
NODATA or NXDOMAIN response if queried EXCEPT if you set a passthru exception for a par-
ticular zone or IP address managed by said Name Server. Indeed, as the NSDNAME and NSIP
based policies are looked at last, if you set up a passthru based on a domain name (QNAME)
or IP address, the passthru match is found before the name server domain name or IP address
NODATA or NXDOMAIN policy. For more details, refer to the section Understanding the RPZ
Policies Order.
Configuring Policies using a Name Server Domain Name
A name server domain name can be used to set a NODATA or NXDOMAIN response to any
query made to the zones it manages. This server name is usually embedded in the NS value of
a domain name, once you retrieved it you simply need to add specify it as a Source Domain in
the Add an RPZ Rule wizard.
643
DNS Firewall (RPZ)
To configure a redirection using a name server domain name
rules opens.
5. In the drop-down list Source, select NSDNAME (domain name).
6. In the field Domain, type in the name server domain name.


The column RR name displays an RPZ: REDIRECT named after the name server domain
name followed by the suffix rpz-nsdname, its Value is the target domain name or IP address
depending on your configuration.
To configure a NODATA response policy using a name server domain name
rules opens.
The column RR name displays an RPZ: NODATA named after the name server domain
name followed by the suffix rpz-nsdname, its Value is * following the BIND RPZ syntax in
the zone file.
To configure an NXDOMAIN response policy using a name server domain name
644
DNS Firewall (RPZ)
rules opens.
The column RR name displays an RPZ: NXDOMAIN named after the name server domain
name followed by the suffix rpz-nsdname, its Value is . following the BIND RPZ syntax in
the zone file.
To configure a PASSTHRU response policy using a name server domain name
rules opens.
The column RR name displays an RPZ: NXDOMAIN named after the source domain name
followed by the suffix rpz-nsdname, its Value is rpz-passthru following the BIND RPZ syntax
in the zone file.
Configuring Policies using a Name Server IP Address
The IP address of a name server can also be used to set a NODATA or NXDOMAIN response
to any query made to the zones it manages. This server name IP address is usually embedded
in the A glue record of the domain name NS record, once you retrieved it you simply need to add
specify it as the Source Address with the prefix /32 in IPv4 and /128 in IPv6 in the Add an RPZ
Rule wizard.
To configure a redirection using a name server IP address
rules opens.
5. In the drop-down list Source, select NSIP (IPv4) or NSIP (IPv6).
7. In the drop-down list Prefix, select /32 for IPv4 or /128 for IPv6, if it was not automatically
selected.
645
DNS Firewall (RPZ)


The column RR name displays an RPZ: REDIRECT named after the source IPaddress and
prefix in reverse followed by the suffix rpz-ip, its Value is the target domain name or IP address
To configure a NODATA response policy using a name server IP address
rules opens.
selected.
The column RR name displays an RPZ: NODATA named after the source IP address and
prefix displayed in reverse followed by the suffix rpz-ip, its Value is * following the BIND RPZ
syntax in the zone file.
To configure an NXDOMAIN response policy using a name server IP address
rules opens.
selected.
646
DNS Firewall (RPZ)

The column RR name displays an RPZ: NXDOMAIN named after the source IP address and
prefix displayed in reverse followed by the suffix rpz-ip, its Value is . following the BIND RPZ
syntax in the zone file.
To configure a PASSTHRU response policy using a name server IP address
rules opens.
selected.
The column RR name displays an RPZ: PASSTHRU named after the source IP address and
prefix displayed in reverse followed by the suffix rpz-ip, its Value is rpz-passthru following
the BIND RPZ syntax in the zone file.
Configuring Other Policies

An administrator might need to configure policies that do not use a domain name, IP address,
name server domain name or IP address as a source; in which case, you need to specify yourself
the partial RR name, as the full name is automatically created as follows: <partial-rr-name>.<zone-
name>. Keep in mind that the procedure below is advanced configuration and therefore, the
consistency of the data in the field Value of the wizard is not checked. So if the syntax does not
comply with RPZ, the filter it sets should obviously not work.
For these sources, the available policies are the same: redirection, Nodata, Nxdomain or Passthru.
To configure an RPZ policy using a specific source
rules opens.
5. In the drop-down list Source, select Other.
6. In the field Value, type in the source identification following the RPZ syntax (with the appro-
priate values and suffixes).
7. In the drop-down list Policy, select the policy that suits your needs. If you select Redirection,
you need to specify a domain name or an IP address.
647
DNS Firewall (RPZ)
The column RR name displays an RPZ: <policy> named after the content of the Value field
in the wizard, its value depending on your configuration.
Deleting Policies
At any time, you can delete a policy. In other words, you can delete an RPZ record. In the pro-
cedure below, we delete record within a specific RPZ zone but you can also delete records from
the page All RPZ rules without filtering a specific zone.
To delete an RPZ policy
rules opens.
5. Tick the RPZ record(s) you want to delete.
7. Click on OK to commit the deletion. The report opens and closes. The record is marked
Overriding RPZ Rules

Once you created an RPZ zone, you can override all the rules it contains using the drop-down
list Overriding rule in the RPZ zone addition and edition wizards.
Overriding Rules Specificities
• There are six overriding rules that are named after the existing policies: Given, Disabled,
Nxdomain, Nodata, CNAME and Passthru.
• The overriding rules must be set a zone level.
• The overriding rules apply to all the rules of the zone except the Passthru that applies to the
server: once set on an RPZ zone, the Passthru applies to all the rules of the zone as well as
any matching RPZ rule name within the server.
To override the RPZ rules when creating an RPZ zone
opens.
6. In the list DNS zone type, select Master or Slave.
648
DNS Firewall (RPZ)
2
11. In the drop-down list Overriding rule, select the value of your choice according to the table
below.
Table 42.6. Overriding rules

Field Description
Given The rules set on the zone remain the same: all the policies specified for the zone are applied.
It is the default value.
Disabled Disables the RPZ policies of the zone, all the rules are ignored.
Nxdomain Applies an NXDOMAIN response to all the RPZ rules of the zone, no matter the policy
configured when creating them.
Nodata Applies an NODATA response to all the RPZ rules of the zone, no matter the policy con-
figured when creating them.
CNAME Applies a redirection to all the RPZ rules of the zone. Once selected, the field Domain ap-
pears: type in the FQDN of your choice. All the RPZ rules of the zone are ignored and re-
directed toward the specified domain.
Passthru Applies a PASSTHRU exception to all the RPZ rules of the zone. Keep in mind that if any
RPZ rule on the server matches the name of one or more of the RPZ rules of your zone,
setting the passthru policy on your zone applies to these rules as well. The passthru policy
applies to the RPZ rules of a server and not only of a specific zone.
The page refreshes.

properties page.
To override the RPZ rules when editing an RPZ zone
3. Right-click over the Name of the RPZ zone you want to edit. The contextual menu opens.
4. Click on . The wizard Edit a DNS zone opens.
5. The field Name displays the name of the zone. It is in gray: you cannot edit it.
6. The box DNS firewall (RPZ) is ticked and displayed in gray.
7. In the drop-down list Overriding rule, select the value of your choice. For more details, refer
to the table Overriding rules. The page refreshes.
properties page.
RPZ Limitations
• You can implement the RPZ only on BIND servers. Within the GUI this implies remotely
managing a BIND server or creating an EfficientIP DNS server.
2
For more details, refer to http://tools.ietf.org/html/rfc1034, on page 7.
649
DNS Firewall (RPZ)
For more details, refer to the section Managing EfficientIP DNS Servers or Managing BIND
DNS Servers.
• You cannot add more than 32 RPZ zones:
• In one view of a BIND server.
• On a BIND server that does not contain any views.
• You cannot set the order of the policies. Therefore the order of the zones is important.
The RPZ rules are applied one after the other respecting both the rule type and their order
within each zone, and views, of the server. Once a queried record is matched in one zone, it
is ignored in the following policies of the zone. For more details regarding the order of the rules
within a zone, refer to the section Understanding the RPZ Policies Order.
650
Chapter 43. Hybrid DNS Service
SOLIDserver provides a Hybrid DNS service that reduces corruption risks for BIND DNS engines.
Hybrid DNS incorporates an alternative DNS engine based on NLnet Labs Unbound and NSD
engines that can automatically switch servers from standard BIND service to Hybrid, if their
configuration is compatible.
Depending on your configuration, authoritative engines switch to BIND/NSD hybrid and re-
cursive engines switch to BIND/Unbound hybrid. Note that you cannot decide to switch to
NSD or Unbound, the switch is automatic and entirely dependent on the engine configuration.
Keep in mind that Hybrid engines have some limitations compared to BIND engines.
Once the switch is complete, the DNS engine footprint is more complex to analyze and less prone
to attacks as the DNS mechanism is different, it avoids BIND security flaws altogether. Therefore,
in the event of an attack or important security issue, the switch to Hybrid ensures data security
and avoids its potential corruption.
Checking the Compatibility with Hybrid

Checking the compatibility with Hybrid implies to:
1. Match the basic Hybrid requirements.

2. Check that no parameter set at server or zone level is incompatible with Hybrid.
3. Generate the incompatibility report, if need be.
4. Edit the server configuration to make sure that none of the parameters set are incompatible
with Hybrid.
Before switching, you need to understand that you cannot decide if your physical server switches
to BIND/NSD or BIND/Unbound. As a general rule, if your server is compatible with Hybrid, the
following switch occurs:
• If the smart server recursion is set to yes, a Hybrid compliant server can switch to
BIND/Unbound.
• If the smart server recursion is set to no, a Hybrid compliant server can switch to BIND/NSD.
Matching Hybrid Basic Requirements

The first step toward switching to Hybrid is to match the following Hybrid basic requirements:
• You can only convert servers to Hybrid from SOLIDserver hardware or software appliance.
• The servers you want to switch must be EfficientIP DNS servers.
• The servers you want to switch must be managed through a smart architecture. The changes
are pushed to the physical server.
• The smart architecture cannot be compatible with Hybrid if it does not manage only BIND
servers.
• The physical server status must be OK, you cannot switch a server in Timeout.
On the DNS All servers list, the Hybrid DNS compatibility and Forced Hybrid DNS compat-
ibility columns allow you to see if you can switch your BIND physical servers.
651
Hybrid DNS Service
In addition, the Multi-status column at server, view, zone and RR level provides you with all the
potential incompatibilities with Hybrid. For more details, refer to the section Understanding the
Column Multi-Status. For more details regarding how to change a page listing template, refer to
the section Customizing the List Layout.
This information is also provided on the smart architecture edition wizard: the Compatible with a
Hybrid DNS Engine field indicates the Hybrid compatibility of the physical servers managed.
Making Sure the Server Configuration is Compatible with Hybrid

If the smart architecture managing your physical server, is marked No in the Hybrid DNS compat-
ibility column, the physical server cannot be switched to Hybrid. If the server is set with one of
the following options and configurations, it cannot be switched to Hybrid:
• The DNS server type is different from a SOLIDserver Hardware or Virtual Appliance EfficientIP
DNS server (for instance a server using packages, an agentless server, a generic server, etc.).
• The server contains views.
• The server contains zones other than master, slave, forward or stub.
• The server contains master and/or slave zones as well as forward and/or stub zones. With
Hybrid, the server is either only authoritative or only recursive.
• One or more server zones are RPZ compliant.
• One or more server zones are signed with DNSSEC.
• The server configuration combines authoritative and recursive zones:
• If the DNS recursion set to yes and the server contains master and/or slave zones, the
server cannot switch to Hybrid.
• If the DNS recursion set to no and the server contains forward and stub zones, the server
cannot switch to Hybrid.
• If the DNS recursion set to yes with TSIG keys.
You must change your configuration to match Hybrid requirements if you want to switch to Hybrid.
During the switch, SOLIDserver checks once more all the parameters to make sure that your
server is compatible once more.
If you want to have a complete list of all the parameters and options that need to be edited, refer
to the section Generating the Hybrid Incompatibilities Report below.
Generating the Hybrid Incompatibilities Report

If the smart architecture managing your BIND servers is not compatible with Hybrid, you can
generate the List Hybrid DNS Engine incompatibilities report to have a detailed list of al the
parameters that do not comply with hybrid following the procedure below.
To generate the Hybrid DNS Engine incompatibilities report
3. Tick the smart server managing the physical server you intend to switch to Hybrid.
4. In the menu, select Report > Hybrid DNS Engine incompatibilities. The wizard Hybrid in-
compatibilities report opens.
652
Hybrid DNS Service
5. In the Report format list, select HTML or PDF.

6. Click on NEXT . The last page of the report opens.
7. In the drop-down list Action, select the kind of report to want to generate.
Table 43.1. Hybrid report available actions

Field Description
Generate new data This action generates a report that lists all to the incompatibilities with Hybrid at the
moment you create it. Once generated, this report is available in the list named as
follows: <date time>.
Schedule the report This action generates a graph as regularly as you need.
8. If you chose to Schedule the report, configure the reports using these fields.
Table 43.2. Scheduled report parameters

Field Description
Hour Select a specific time or one of the available schedules. By default, Every hour is se-
lected.
Minute Select a period of time, minutes-wise. By default, Every minute is selected.
Name A default name is already filled in, you can edit this scheduled export name if you
want.
Rights as Select a user. His/her rights and limitations are applied in the report: only the items
this user has access to are listed in the export.
9. Click on OK to generate the report. The page Report opens and works for a while.
10. You can click on DOWNLOAD to save the report immediately - this automatically closes the
wizard - or click on CANCEL to close the wizard.
When the report is generated, it is available on the page Reports. For more details, refer to
the procedure To list the reports.
Once you generated the report, all the parameters that are not compatible with Hybrid are listed
and you need to correct them all until your smart server is marked compatible. You can generate
as many reports as you want, every report is available on the Reports page of the Administration
module.
To find the Hybrid DNS Engine incompatibilities report
opens.
2. In the menu, select Monitoring > Reports. The page Reports opens.
3. In the list, the Hybrid DNS incompatibilities report are listed.
653
Hybrid DNS Service
Once the physical server is Hybrid compliant, on the page All servers, the column Hybrid DNS
compatibility is marked Yes and the smart architecture edition wizard field Compatible with a
Hybrid DNS Engine is also marked Yes.
Switching to Hybrid DNS

Once your smart architecture is compatible with Hybrid, you can switch it. If your server is not
compatible with Hybrid, you need to change its configuration as some parameters might prevent
the switch. For more details, refer to the section Checking the Compatibility with Hybrid.
The architecture can contain one or several BIND servers that you can all switch. Keep in mind
that, if you only switch one server, the other servers share the same limitations that the Hybrid
servers. So, before switching to Hybrid you should probably make sure that none of its limitations
prevent you from using your server with all the parameters you usually need. For more details,
refer to the section Hybrid DNS Engines Limitations.
The switch to Hybrid actually follows this order:
1. All the Hybrid incompatibilities checks are made again.

2. If the server is actually compatible, the relevant Hybrid configuration is pushed to the physical
server.
3. Once the whole configuration is successfully pushed, BIND service is disabled and stopped
and the relevant Hybrid service (NSD or Unbound) is enabled and started.
In some rare cases, you might have a Hybrid server listed among your servers outside a smart
architecture. As you cannot manage a Hybrid server outside a smart architecture, you need to
switch it to BIND, add it to your smart architecture and then switch it again to Hybrid. For more
details, refer to the procedures To switch a physical server from Hybrid to BIND DNS and To
switch a physical server from BIND to Hybrid DNS.
To switch a physical server from BIND to Hybrid DNS
3. Make sure the BIND physical server you want to switch to Hybrid belongs to a smart archi-
tecture compatible with Hybrid.
4. Make sure the server status is OK.
5. Tick the physical server you want to switch.
6. In the menu, select Tools > Expert > Switch DNS Engine > To NSD / Unbound. The
Switching the DNS Engine wizard opens.
7. Click on OK to commit the switch to Hybrid. The report opens and works until the relevant
DNS service restarts.The physical server Status is OK and its Version indicates the engine
name it switched to.
Your server configuration switches to Unbound or NSD on its own, based on its configuration.
Once the switch is complete, the compatibility with Hybrid is forced: this implies that a set of
configurations can no longer be set. For more details regarding NSD or Unbound specificities
and limitations, refer to the sections The Server Switched to NSD and The Server Switched to
Unbound below. As for the Hybrid limitations in general, refer to the section Hybrid DNS Engines
Limitations.
654
Hybrid DNS Service
To display the Hybrid engine the server switched to in the DNS module
3. In the column Version, the engine and version are displayed.
Like any other server, you can check on a Hybrid server from the columns Status and Sync. For
instance, make sure that the smart architecture can push your configuration on the physical
server, if not the smart is marked Locked synchronization. For more details regarding this status,
refer to the section The Status Locked Synchronization.
To display the Hybrid engine the server switched to in the Administration module
opens.
2. Click on Services. The page Services configuration opens.
3. Next to the DNS server, the engine that runs is indicated between brackets.
From the Services configuration page, you can enable, disable, stop and start the Hybrid DNS
server. For more details, refer to the section Handling Services.
In the same way, from this page you can download the NSD or Unbound configuration file de-
pending on which one is running. For more details refer to the section Downloading the
DNS/DHCP/DHCPv6 Configuration File.
The Server Switched to NSD

NSD Engines are designed to manage authoritative DNS configurations. Once the switch was
successfully performed, a set of BIND options and configurations is emulated to suit NSD require-
ments.
However, you should be aware of a set of NSD engines specificities and limitations that shape
the configuration that you can or cannot set through the GUI.
NSD engines specificities
• NSD servers are exclusively authoritative: only master and slave zones are supported.
• All records handled by BIND are handled by NSD but DNSSEC records are only supported if
you use the BIND/NSD server as slave server in a Stealth or Master/Slave smart architecture.
• Each change made to the server or zones creates a new NSD configuration or zone file, copies
the former files and pushes the new configurations on the physical server.
• Every change made to the records database rebuilds the NSD database and creates a new
zone to ensure that the changes are pushed to the physical server as soon as possible.
NSD engines limitations
• You cannot create forward, stub, hint or delegation-only zones on an NSD server.
• Not all ACLs are supported:
• none, any, localhost and all the access control lists based on IP or network addresses are
supported.
• The localnets ACL is ignored.
655
Hybrid DNS Service
• The allow-transfer and allow-notify clauses set on your BIND server are converted as follows
after a switch to NSD:
• If the allow-transfer clause is not specified at server or zone level, a default configuration is
pushed on the NSD server to allow any user to transfer master and slave zones via AXFR.
• If the allow-notify clause is not specified at server or zone level, the clause value on the NSD
server is set to respect BIND default behavior and allow proper synchronization of the master
and slave zones.
• NSD supports all the RRL settings except the Log only option. For more details, refer to the
section Limiting the Number of Responses of a Server.
The Server Switched to Unbound

Unbound Engines are designed to manage recursive DNS configurations. Once the switch was
successfully performed, a set of BIND options and configurations are emulated to suit Unbound
requirements. However, you should be aware of a set of Unbound engines specificities and lim-
itations that shape the configurations that you can or cannot set through the GUI.
Unbound engines specificities
• Unbound servers are exclusively recursive: only forward and stub zones are supported.
• BIND statements are interpreted as follows:
• If the allow-recursion is specified on BIND, its value is used to set the allow-query statement
on Unbound.
• If the allow-recursion is not specified on BIND, the localhost is set on Unbound.
• ACLs are only supported to configure the allow-recursion statement only at server level. For
more details regarding ACLs, refer to the section Unbound Engines Limitations below.
• On forward zones, the forward parameter can only be set to first.
• If the BIND server is configured with the forward parameter (set to any value but none) and
forwarders, the switch to Hybrid DNS creates a forward zone named "." that emulates all spe-
cified parameters. Keep in mind that if a "." forward zone already exists, the list of forwarders
of both zones are merged into one. Other parameters of the existing "." forward zone are ignored.
Unbound Engines Limitations
• You cannot create master, slaver, hint or delegation-only zones on an Unbound server. Con-
verting master zones to slave on Unbound servers deletes all the records of the original master
zone.
• Not all ACLs are supported:
• none, any, localhost and all the access control lists based on IP or network addresses are
supported.
• The localnets ACL and TSIG keys are not supported.
• Stub zones cannot be configured with:
• forward and parameter forwarders.
• stub-first and parameter stub-primes: they do not have any equivalent in BIND.
• Forward zones cannot be configured with the forward parameter set to only.
• Unbound handles the edns-udp-size option in a unique way:
656
Hybrid DNS Service
• If the option was set before switching, the specified value is set on the Unbound ipv4-edns-
size and ipv6-edns-size options. Keep in mind that in this case, ipv4-edns-size has precedence
over ipv6-edns-size.
• Unbound does not support RRL. For more details regarding RRL, refer to the section Limiting
the Number of Responses of a Server.
Hybrid DNS Engines Limitations

Once you switched your DNS service to Hybrid, you can configure and manage it through a smart
architecture. However, Hybrid has some limitations:
• It is impossible to import a Hybrid configuration.

• No statistics regarding Hybrid servers are retrieved, therefore the server properties page does
not contain any graph.
• You can only switch to Hybrid physical servers managed through a smart architecture
• After a fresh installation, the service default type is BIND. You need to manage the server
through a smart architecture and then switch it.
• Only the options compatible with BIND are supported: any hybrid vendor option that does not
have any counterpart in BIND cannot be set through SOLIDserver.
• The RNDC commands are not supported: you cannot perform the commands force-notify,
force-refresh, force-retransfer, querylog and flush cache on Hybrid compliant servers.
• The options inheritance is not supported per se. However, after switching to Hybrid, your
server configuration is directly set at zone level.
• SOLIDserver does not retrieve data from a Hybrid server. However, if you manage a Hybrid
server via a smart you can synchronize the architecture to push any changes made through
the GUI to the server (content or configuration file) from the smart to the physical server.
• Any change made to a Hybrid server restarts the service.
• Dynamic Update is not supported by Hybrid.
• ACL use is limited:
• All ACLs based on IP and network addresses are supported.
• The any, localhost and none ACL are supported in their IP address form.
• The localnet ACL is not supported.
• Views are not supported.
• RPZ zones are not supported.
• Signing zones with DNSSEC is only possible if the BIND/NSD Hybrid server is managed through
a smart architecture in which the BIND/NSD server is a slave which master is a BIND server.
Indeed, NSD servers cannot be signed in DNSSEC but as slave servers they can handle
DNSSEC records.
Forcing Compatibility with Hybrid

To provision a switch to Hybrid, you can force the compatibility with Hybrid on smart architectures.
This action allows you to make sure that all the parameters and configurations you set on your
server (at server and/or zone level) respect Hybrid requirements for BIND/NSD or BIND/Unbound.
That way, you wan switch your engine right away and do not need to perform any configuration
657
Hybrid DNS Service
changes, whether you were planning to on a particular day or because a CVE release impacts
your BIND servers security.
To force the compatibility with Hybrid
4. Right-click over the Name of the smart architecture that manages this server. The contextual
menu opens.
5. Click on . The Edit a DNS server wizard opens.
6. If you are editing a Master/Slave, Stealth, Multi-Master or Single-Server architecture follow
the steps below:
a. Click on NEXT until you get to the page DNS servers role configuration.
b. Tick the box Expert mode.
c. Click on NEXT . The page Advanced settings opens.
d. Tick the box Force Hybrid DNS compatibility.
7. If you are editing a Farm architecture follow the steps below:
a. Click on NEXT until you get to the page Advanced settings.

b. Tick the box Force Hybrid DNS compatibility.
8. Click on OK to commit your changes. The report opens and closes. The smart architecture
is marked Yes in the Forced Hybrid DNS compatibility.
Switching Back to BIND

As Hybrid engines imply a set of limitations that might prevent you from configuring your DNS
server according to your needs, mixing authoritative and recursive zone for instance, you can
switch back to BIND. As all the NSD and Unbound options that you can set through the GUI have
an equivalent in BIND, switching the engine back to BIND can be performed at any time.
To switch a physical server from Hybrid to BIND DNS
4. Make sure the server status is OK.
5. Tick the physical server you want to switch.
6. In the menu, select Tools > Expert > Switch DNS Engine > To BIND. The Switching the
DNS Engine wizard opens.
658
Hybrid DNS Service
7. Click on OK to commit the switch to BIND. The report opens and works until the relevant
DNS service restarts. The physical server Status is OK and its Version indicates it switched
to BIND.
Once you switched a Hybrid server engine to BIND, the option Force Hybrid DNS compatibility
is still enabled. To be able to configure the BIND server without the Hybrid limitations, you must
edit the smart architecture and untick the box.
To remove the forced compatibility with Hybrid
3. Make sure that the smart architecture you want edit does not manage any Hybrid server.
4. Right-click over the Name of the smart architecture. The contextual menu opens.
5. Click on . The Edit a DNS server wizard opens.
6. If you are editing a Master/Slave, Stealth, Multi-Master or Single-Server architecture follow
the steps below:
a. Click on NEXT until you get to the page DNS servers role configuration.
b. Tick the box Expert mode.
c. Click on NEXT . The page Advanced settings opens.
d. Untick the box Force Hybrid DNS compatibility.
7. If you are editing a Farm architecture follow the steps below:
a. Click on NEXT until you get to the page Advanced settings.

b. Untick the box Force Hybrid DNS compatibility.
8. Click on OK to commit your changes. The report opens and closes. The smart architecture
is marked No in the Forced Hybrid DNS compatibility.
Administrating the Backup and Restoration of Hybrid

Configurations
As Hybrid DNS engines differ from BIND named engine, there are a set of actions to perform
whenever you restore a backup or upgrade an appliance configured with Hybrid DNS.
Generating a Backup with Hybrid Servers

Whenever you generate an appliance backup, the Hybrid DNS configuration is automatically
retrieved. For more details regarding backups, refer to the sections Creating an Instant Backup
and Editing the Backup Settings.
Restoring a Backup Containing Hybrid Servers

When you restore the backup of an NSD or Unbound server, you must to tick the box "Restore
the system configuration". Otherwise, BIND service is started and the smart architecture might
push an outdated DNS configuration to your physical server instead of your Hybrid configuration.
659
Hybrid DNS Service
For more details regarding the restoration of a backup, refer to the section Restoring a Configur-
ation.
660
Chapter 44. DNS Guardian
DNS Guardian offers a direct response to Distributed Denial of Service. DDoS attacks overload
the network with malicious queries targeting a specific server, decreasing the available bandwidth
and preventing it from responding to real queries, to eventually collapse. However, it is recom-
mended to answer all the incoming queries to ensure that you are not missing or ignoring legitimate
traffic from your clients.
Operating in a secured framework, with the cache separated from the recursive DNS engines,
DNS Guardian performs a continuous real-time analysis of the inbound and outbound traffic.
This analysis is especially reliable if a large number of queries is cached. By default, DNS
Guardian caches all the answers to clients' queries. The answers not cached yet, are sent to the
DNS resolver and transmitted to Guardian, that caches them and sends them back to the client.
That way, DNS Guardian has an ever-growing number of queries to refine its analyses of the
network and avoid potential threats.
Internet
cached answers missing

answers from the cache
Figure 44.1. DNS Guardian default behavior
DNS Guardian is managed from the graphical user interface and via command-line interface:
1. From the GUI, you can enable and disable the service, configure its listening interface(s) and
monitor dedicated charts and analytics.
2. Via CLI, you can connect to DNS Guardian using SSH to configure DNS Guardian, its cache,
manage server and clients statistics, manage and configure triggers and configure the rescue
mode.
Keep in mind that the command help provides the full syntax to manage DNS Guardian
parameters. You can also press the Tabulation key after typing a command to display its
parameters.
Note that DNS Guardian is designed to express its full potential when combined with SDS-Blast
series appliances, whose recursive service can manage up to 17 million QPS.
Prerequisites
DNS Guardian requires:
• An appliance fully dedicated to DNS resolution: the services DNS Guardian and the DNS must
be the only ones running.
• A Blast-series hardware appliance, an SDS-550+ hardware or virtual appliance with a license
including the option Guardian. Virtual appliances must be configured with an intel network card
(em*, ix*).
• A license key on every appliance where the DNS Guardian is enabled.
661
DNS Guardian
• Configuring and managing the local Efficient IP DNS server to be recursive only, BIND or Un-
bound. To use the server both as recursive and authoritative, refer to the parameter set recursive
described in the section Managing DNS Guardian Configuration.
• The services DNS Guardian and DNS server (named) or DNS Guardian and DNS server (un-
bound) to be both running to ensure using Guardian at its full potential.
• Communication between the server and its clients to be over UDP.
• Sufficient rights, only members of the group admin can configure Guardian.
1
• A PCI Pass-through to a physical Intel X520 NIC in virtual environments .
Limitations
DNS Guardian:
• Can only be configured and managed through the CLI.

• Can only be configured on interfaces using igb or ix* network interface cards.
• Can only be configured on recursive servers.
• Does not allow managing more than 8 views.
• Only supports the following zone types: forward, stub and delegation-only.
• Does not support VLAN tagging on the network interfaces it uses.
• Does not allow capturing the network traffic answered by the service.
Enabling DNS Guardian

To enable DNS Guardian properly you need to:
1. Configure the listening interface, as detailed in the procedure below. Depending on the license
you purchased, you can configure one or several listening interfaces.
2. Enable the service DNS Guardian.
To configure listening interfaces and start DNS Guardian
1. Configuring DNS Guardian listening interface
a. Go to the Administration tab. If the homepage is not displayed, click on . In the

breadcrumb, click on Services configuration.
b. In the column Name, click on the link DNS Guardian. The wizard Edit DNS Guardian
configuration opens.
c. In the list Available interfaces, only interfaces relying on Intel drivers are listed, as follows:
<interface-name> (<MAC-address>). Select one and click on . The interface is moved
to the list Selected interfaces.
To remove an interface from the list Selected interfaces, select it and click on . The
interface is moved back to the list Available interfaces.
1
As in VMware environments: https://kb.vmware.com/s/article/1010789
662
DNS Guardian
d. Repeat this action for as many interfaces as needed. The number of interfaces in the
list Available interfaces depends on the license you purchased.
e. Click on OK to commit your configuration. The wizard closes. The page Services Con-
figuration is visible again.
f. Right now your configuration is pending. In the menu, select Tools > Apply configuration
to save your changes. The wizard Commit the system configuration changes opens,
click on OK to confirm your choice. The page refreshes.
g. Now that the listening interface is configured, you must start the service DNS Guardian.
2. Enabling the service DNS Guardian
a. In the column Name, look for DNS Guardian.

b. In the column Enabled, click on the link Disabled to enable the service. The wizard
opens.
c. Click on OK to commit your changes. The wizard closes. The page is visible again.
d. Right now your configuration is pending. In the menu, select Tools > Apply configuration
to save your changes. The wizard Commit the system configuration changes opens,
click on OK to confirm your choice. The page refreshes.
Once the service is enabled, on the page All servers your local EfficientIP DNS server is
marked Enabled in the column DNS Guardian.
When the configuration is set, all the cached queries are saved in the file /data1/dns-
blast_cache.dump which is used to answer clients' queries. This file matches the server config-
uration and contains:
• Each cached query.

• All the ACLs configured on the server; they are listed as a set of IP addresses/network addresses
that are granted or denied access.
• For BIND servers, the views match-clients and match-destinations configurations are saved
as well.
In addition, in the GUI:
• DNS Guardian statistics panels are available on the DNS server properties page. For more
details, refer to the section Monitoring DNS Guardian Statistics From the GUI.
• The analytics DNSTOP are no longer available on the page Analytics, instead the Guardian
data is available. For more details, refer to the section Monitoring DNS Guardian Analytics.
Every time you stop or restart the service DNS Guardian, the cache is automatically saved. When
you start the service again, the latest version of the cache is restored. For more details, refer to
the section Disabling DNS Guardian.
Managing DNS Guardian Configuration

You can configure DNS Guardian as long as you:
• Meet the Prerequisites and take into account the Limitations.

• Configure and enable the service DNS Guardian. For more details, refer to the section Enabling
DNS Guardian.
663
DNS Guardian
Once the SSH connection is established, you can connect to DNS Guardian to edit, display and
save the DNS Guardian configuration. By default, the Rescue mode is enabled and configured.
To set your own values, refer to the section Configuring Rescue Mode in this chapter.
Displaying DNS Guardian Configuration

You can display all the parameters configured for DNS Guardian as well as the views you might
have configured on the server. The command result contains the name of all the parameters that
you can edit. Here below is an example of a DNS Guardian configuration.
DNS Blast> show config
set additional_time_keep_in_cache=1 // Additional time (sec) before records expiration
set answerlog=0 // Enable answerlog
set blast=1 // Enable DNS Blast cache
set clean_cache0.cmd=lastused>86400 // Clean cache command #0
set clean_cache1.cmd=lastused>60 used<10 // Clean cache command #1
set clean_cache2.cmd=error!=NOERROR // Clean cache command #2
set clean_cache3.cmd= // Clean cache command #3
set clean_client0.cmd=lastused>86400 // Clean client command #0
set clean_client1.cmd=lastused>3600 // Clean client command #1
set clean_client2.cmd= // Clean client command #2
set client_stats=1 // Enable Source IP statistics
set debug_search=0 // Enable debug on search
set debug=0 // Enable debug
set display_query_time=1 // Display "search time" for show cache/clients
set ipv4_udp_checksum=0 // Enable IPv4 UDP checksum
set max_cache_entries=1000000 // Maximum cache entries triggering the commands
clean_cache#.cmd
set max_client_entries=1000000 // Maximum clients entries triggering the commands
clean_client#.cmd
set max_ipv4_fragment=100000 // Maximum IPv4 fragment entries
set min_clean_cache_percent=5 // Minimum cache entries to keep in the cache
(% of max_cache_entries)
set min_clean_client_percent=5 // Minimum clients entries to keep in the cache
(% of max_clients_entries)
set min_ttl_cache=0 // Minimum TTL to store in cache
set process_ipv4_fragments=1 // Enable IPv4 fragment processing
set quarantine_redirect_aaaa= // IPv6 address for quarantine redirection
set quarantine_redirect_a= // IPv4 address for quarantine redirection
set quarantine_redirect_ttl=30 // TTL for the "quarantine_redirect_*" records
set querylog=0 // Enable querylog (0=no,1=yes,2=only-tagged-clients)
set recursive=1 // Enable recursion (0=no,1=yes,2=both)
set rescue_detection=1 // Enable rescue mode detection (0=disabled,1=auto,2=forced)
set rescue_high_rec_packet=200000 // Maximum number of received queries
set rescue_min_rec_packet=5000 // Minimum number of received queries, configure with
rescue_unanswered_rate
set rescue_time=5 // Rescue mode checks period (value*10s). Number of checks
on traffic/packets every 10 seconds before potential
switch
set rescue_ttl=300 // Rescue mode TTL set for the expired records returned
set rescue_unanswered_rate=10 // % of rescue_min_rec_packet unanswered queries
set rpz_log=0 // Log RPZ matches
set rpz_policy=nodata // RPZ policy
set rpz_redirect_aaaa= // IPv6 address for RPZ redirect policy
set rpz_redirect_a= // IPv4 address for RPZ redirect policy
set rpz_ttl=300 // TTL for the "rpz_redirect_*" records
set rpz=0 // Enable RPZ
set server_stats=0 // Enable recursive DNS IP statistics
set servfail_diff=1 // Enable SERVFAIL diff
set shared_cache_key= // Shared cache signing key
664
DNS Guardian
set shared_cache_mcast_addr= // Shared cache destination multicast IP address

set shared_cache_mcast_port=1234 // Shared cache destination multicast port
set shared_cache_mcast_source_addr= // Shared cache source IP address (optional)
set shared_cache_mcast_source_port=0 // Shared cache source port (optional)
set shared_cache_mcast_ttl=1 // Shared cache multicast TTL
set shared_cache=0 // Enable shared cache
set tuning_add_slot=20 // Additional slot buffer to main thread
set tuning_max_query_use_single_thread=20// Use single thread when nb. of queries is lower than this
value
set tx_max_retry=10 // TX max retry
set view0.enabled=1 // Enable view #0 (0=disabled,1=enabled)
set view0.match_clients=any; // Match-clients on view #0
set view0.match_destinations=any; // Match-destinations on view #0
set view0.name=view0 // View name for view #0
set view1.match_clients=none; // Match-clients on view #1
set view1.match_destinations=none; // Match-destinations on view #1
update trigger "Trigger-A" enabled block@3600 query@10 100 >=
update trigger "Trigger-B" enabled block@3600 query@10 push_param 100 >= cache_miss@30 push_param 50
>= |
update trigger "Trigger-M" enabled none@3600 query@10 100 >=
update trigger "Trigger-L" enabled ratelimit@3600 query@10 100 >=
update trigger "Trigger-Q" enabled quarantine@3600 query@10 100 >=
update trigger "Trigger-R" enabled quarantine_redirect@3600 query@10 100 >=
update trigger "Trigger-X" enabled block@3600 query@10 100 >=
update trigger "Trigger-Z" enabled none+querylog+answerlog@60 answer_servfail@10 100 >=
update trigger "T1 - Volumetric DDoS" enabled none@60 query@10 10000 >=
update trigger "T2 - nxdomain 100 in 10 seconds - received %0" enabled none@60 answer_nxdomain@10
push_param 100 >
update trigger "T3 - servfail 50 in 10 seconds - received %0" enabled none@60 answer_servfail@10
push_param 50 >
update trigger "T4 - Data leak prevention" enabled none@60 miss_query_size@5 push_param 100000 >=
update trigger "T5 - Tunneling" enabled none@60 cache_miss@10 push_param 200 >=
update trigger "T6 - Recursive attacks" enabled none@60 recurs_time@40 push_param 31 >
update trigger "T7 - NXDomain attack" enabled none@60 miss_answer_nxdomain@10 push_param 100 >=
update trigger "T8 - Syntax error protection" enabled none@60 answer_formerr@10 push_param 100 >=
update trigger "T9 - Servfail" enabled none@60 miss_answer_servfail@60 push_param 200 >=
The results of the command are described in the following table:
Table 44.1. DNS Guardian configuration parameters

Configuration parameter Description
set additional_time_keep_in_cache=<number- An additional period of time, in seconds, added to the cached re-
of-seconds> cords before letting a record expire.
set answerlog=(0|1|2) The answerlog activation status, either disabled (0), enabled (1)
or enabled only for client log (2). It is disabled by default. For more
665
DNS Guardian

details, refer to the section Enabling Querylog and Answerlog for
Suspicious Clients.
set blast=(0|1) DNS Guardian cache activation status, enabled (1) or disabled (0).
Depending on your license, it can be enabled by default. For more
details, refer to the section Disabling DNS Guardian Protection.
set clean_cache<number>.cmd=<filter> A command to clean Guardian cache according to the filter you
set, where <number> is the number of the command from 0 to 9.
These ten cache cleaning commands are automatically executed
in order, when max_cache_entries is reached. First,
clean_cache0 is executed, when the cleaning is completed DNS
Guardian checks the value of min_clean_cache_percent: if
the percentage set for min_clean_cache_percent is not
reached, clean_cache1 is executed. And so forth until the last
cleaning command is executed or the value of
min_clean_cache_percent is reached. For more details, refer
to the section Clearing DNS Guardian Cache Automatically.
set clean_client<number>.cmd=<filter> A command to clean Guardian clients data according to the filter
you set, where <number> is the number of the command from 0
to 9. These ten client cleaning commands are automatically ex-
ecuted in order, when max_client_entries is reached. First,
clean_client0 is executed, when the cleaning is completed DNS
Guardian checks the value of min_clean_client_percent: if
the percentage set for min_clean_client_percent is not
reached, clean_client1 is executed. And so forth until the last
cleaning command is executed or the value of min_clean_cli-
ent_percent is reached. For more details, refer to the section
Clearing DNS Guardian Clients Statistics Automatically.
set client_stats=(0|1) The client statistics retrieval status, disabled (0) or enabled (1).
These statistics are based on the IP address of the clients, for
more details refer to the section Managing DNS Guardian Clients
Statistics.
set max_cache_entries=<number> The maximum number of cache entries stored. Depending on the
appliance memory, setting a large number might prevent it from
running smoothly. When the value of this parameter is met, the
cleaning commands clean_cache<number>.cmd are executed
in order. For more details, refer to the section Clearing DNS
Guardian Cache Automatically.
set max_client_entries=<number> The maximum number of client entries stored. Depending on the
appliance memory, setting a large number might prevent it from
running smoothly. When the value of this parameter is met, the
cleaning commands clean_client<number>.cmd are executed
in order. For more details, refer to the section Clearing DNS
Guardian Clients Statistics Automatically.
set min_clean_cache_percent=<percent> The percentage of the cache entries that you want to keep if the
number of entries set for max_cache_entries is reached and
the cleaning commands are executed. Keep in mind that the more
cached data you have, the more efficient are your responses and
reliable are your statistics and analytics. For more details, refer to
the section Clearing DNS Guardian Cache Automatically.
set min_clean_client_percent=<percent> The percentage of the client entries that you want to keep if the
number of entries set for max_client_entries is reached and
the cleaning commands are executed. Keep in mind that the more
cached data you have, the more efficient are your responses and
reliable are your statistics and analytics. For more details, refer to
the section Clearing DNS Guardian Clients Statistics Automatically.
set min_ttl_cache=<seconds> A way to enforce a minimum TTL for all the records that DNS
Guardian receives from the local recursive server before sending
666
DNS Guardian

them to the DNS clients. The minimum only applies to records that
have a TTL lower than the one you set for the parameter. By de-
fault, the parameter is disabled (0). The maximum value accepted
is 4 294 967 295 seconds.
set quarantine_redirect_aaaa=<IPv6-address> The IPv6 address where clients in quarantine are redirected. For
more details, refer to the section Putting Suspicious Clients in
Quarantine.
set quarantine_redirect_a=<IPv4-address> The IPv4 address where clients in quarantine are redirected. For
more details, refer to the section Putting Suspicious Clients in
Quarantine.
set quarantine_redirect_ttl=<seconds> The TTL of quarantine_redirect_aaaa and quarantine_re-
direct_a. For more details, refer to the section Putting Suspicious
Clients in Quarantine.
set querylog=(0|1|2) The querylog activation status, either disabled (0), enabled (1) or
enabled only for client log (2). It is disabled by default. For more
details, refer to the section Enabling Querylog and Answerlog for
Suspicious Clients.
set recursive=(0|1|2) DNS Guardian server recursion configuration, disabled (0), enabled
(1) or both recursive and authoritative (2). It is enabled (1) by de-
fault. When set to (2), authoritative RRs are only answered by the
resolver and are not cached, i.e. they are not compatible with DNS
Guardian mechanisms.
set rescue_detection=(0|1|2) The DNS Guardian rescue mode detection configuration, disabled
(0), enabled (1) or forced (2). It is enabled (1) by default. For more
details, refer to the section Managing DNS Guardian Rescue Mode.
set rescue_high_rec_packet=<number> The rescue mode configuration parameters of DNS Guardian. For
more details, refer to the section Managing DNS Guardian Rescue
set rescue_min_rec_packet=<number>
Mode.
set rescue_time=<seconds>
set rescue_ttl=<seconds>
set rescue_unanswered_rate=<number>
rescue_servfail_qps=<number>
rescue_ratio_servfail=<number>
set rpz_log=(0|1) The RPZ logs activation status, disabled (0) or enabled (1). It is
disabled (0) by default. For more details, refer to the section Man-
aging DNS Guardian Response Policy Zones.
set rpz_policy=<policy-name> The RPZ policy applied to the RPZ entries: disabled, drop, nodata,
nxdomain or redirect. For more details, refer to the section Man-
aging DNS Guardian Response Policy Zones.
set rpz_redirect_aaaa= The IPv6 address where clients querying RPZ entries are redirec-
ted. For more details, refer to the section Managing DNS Guardian
Response Policy Zones.
set rpz_redirect_a= The IPv4 address where clients querying RPZ entries are redirec-
ted. For more details, refer to the section Managing DNS Guardian
Response Policy Zones.
set rpz_ttl=<seconds> The TTL of rpz_redirect_aaaa and rpz_redirect_a. For
more details, refer to the section Managing DNS Guardian Re-
sponse Policy Zones.
set rpz=(0|1) The RPZ activation status, enabled (1) or disabled (0). If disabled
(0), none of the rpz_ parameters listed above are taken into ac-
count. It is disabled by default. For more details, refer to the section
Managing DNS Guardian Response Policy Zones.
set servfail_diff=(0|1) A way to identify and differentiate cached records based on the
rcode they return the first time they are queried. If enabled, this
667
DNS Guardian

parameter force DNS Guardian to answer clients querying cached
records even if the local recursive server sent out a SERVFAIL. In
this case, the records are returned with a TTL 30 seconds. This
parameter only applies to records that previously sent out any
other rcode than a SERVFAIL, and is enabled (1) by default. You
can disable this parameter, for more details refer to the section
Ignoring the SERVFAIL Error Message Differences.
set shared_cache_key=<key> The cache sharing configuration parameters. For more details,
refer to the section Sharing the Cache of Several DNS Guardian
set shared_cache_mcast_addr=<IP-address>
Servers.
set shared_cache_mcast_port=<port-number>
set shared_cache_mcast_source_addr=<IP-
address>
set shared_cache_mcast_source_port=<port-
number>
set shared_cache_mcast_ttl=(0|1)
set shared_cache=(0|1)
set view<number>.enabled=(0|1) Indicates if the view is enabled (1) or not (0), where <number> is
the view number from view0 to view7. If the view is enabled, it
must have a match-clients, match destinations and name. Keep
in mind that you cannot configure more than 8 views if you use
DNS Guardian and a local BIND recursive server. View0 is always
enabled.
set view<number>.match_clients=any; The view match-clients configuration, whether it was set using CLI
or from the GUI, where <number> is the view number from view0
to view7. Keep in mind that you cannot configure more than 8
views if you use DNS Guardian and a local BIND recursive server.
set view<number>.match_destinations=any; The views match-destinations configuration, whether it was set
using CLI or from the GUI, where <number> is the view number
from view0 to view7. Keep in mind that you cannot configure
more than 8 views if you use DNS Guardian and a local BIND re-
cursive server.
set view<number>.name=<view-name> The view name, whether it was set using CLI or from the GUI,
where <number> is the view number from view0 to view7. Keep
in mind that you cannot configure more than 8 views if you use
DNS Guardian and a local BIND recursive server.
update trigger "<trigger-name>" <enabled|dis- The triggers configured on DNS Guardian are all listed at the end
abled> <policy>@<number-of-seconds> of the configuration results. For more details, refer to the section
<threshold(s)> Managing DNS Guardian Triggers.
Each line begins with the keyword set.They can be copied and executed as individual commands.
To display DNS Guardian configuration
1. Open a shell session on your appliance using root credentials.

2. Connect to your local DNS Guardian using the command:
/usr/local/nessy2/bin/blastcli
3. To display the current configuration of DNS Guardian, use the following command:
show config
668
DNS Guardian
Configuring DNS Guardian

You can edit DNS Guardian configuration at any time by manually editing the file
/data1/etc/dnsblast.conf or from the CLI. Once that you made the changes, you must load the
configuration manually to apply it on DNS Guardian.
To configure DNS Guardian

3. With the information described in the table DNS Guardian configuration parameters:
a. To edit the configuration automatically, use the following syntax for each parameter you
want to set:
<configuration-parameter>=<value>
b. To edit the configuration manually, open and edit the file /data1/etc/dnsblast.conf . Then,
save it and close it.
4. Save the current version of DNS Guardian configuration, using the following command:
save config
5. Apply your changes using the following command:

load config
Managing DNS Guardian Cache

You can manage DNS Guardian cache as long as you:

DNS Guardian.
Via SSH, you can connect to DNS Guardian to display the cache content, reset it, save it, restore
it, clear it and share it with other DNS Guardian servers - incrementally or as a whole.
The cache data is then used to generate statistics, at server and client levels, which you can
manage via CLI and visualize from the GUI. For more details, refer to the section Managing DNS
Guardian Statistics.
Displaying DNS Guardian Cache Content

You can display, filter and sort as many entries in the cache as needed. Here below is an example
of the command result limited to the 10 most queried entries:
DNS Blast> show cache limit=10
Used | Query | RCODE | Type | TTL | EOL | Last-used |
C-miss | R-time | AVG R-time | View | Origin | OPT
213201 | license.intranet | NOERROR | A | 3600 | 1167 | 0 |
35 | 20 | 0 | 0 | L | -
180971 | apidata.googleusercontent.com | NOERROR | A | 267 | 57 | 210 |
281 | 1438 | 5 | 0 | L | -
669
DNS Guardian
180088 | apidata.googleusercontent.com | NOERROR | AAAA | 300 | -827 | 1125 |

145 | 1487 | 10 | 0 | L | -
80249 | vbox.validation.intranet | NOERROR | A | 600 | 143 | 457 |
266 | 160 | 0 | 0 | L | -
67366 | debian1.intranet | NOERROR | A | 3600 | 1684 | 24 |
46 | 0 | 0 | 0 | L | -
57276 | core.intranet | NOERROR | A | 600 | 56 | 0 |
265 | 180 | 0 | 0 | L | -
54283 | clients4.google.com | NOERROR | A | 176 | 169 | 5 |
982 | 14704 | 14 | 0 | L | -
52764 | clients6.google.com | NOERROR | A | 144 | 139 | 3 |
988 | 10563 | 10 | 0 | L | -
49970 | mail.google.com | NOERROR | A | 299 | 61 | 31 |
560 | 7561 | 13 | 0 | L | -
47958 | play.google.com | NOERROR | A | 300 | 32 | 14 |
527 | 16102 | 30 | 0 | L | -
RCODE RETURNED:
RCODE | Total | Percent
NOERROR | 62362 | ( 81.61%)
SERVFAIL | 1481 | ( 1.94%)
NXDOMAIN | 12576 | ( 16.46%)
RR TYPE:
Type | Total | Percent
A | 67047 | ( 87.74%)
NS | 34 | ( 0.04%)
CNAME | 10 | ( 0.01%)
SOA | 76 | ( 0.10%)
PTR | 1815 | ( 2.38%)
MX | 26 | ( 0.03%)
TXT | 555 | ( 0.73%)
AAAA | 6739 | ( 8.82%)
SRV | 80 | ( 0.10%)
NAPTR | 3 | ( 0.00%)
DS | 2 | ( 0.00%)
SSHFP | 12 | ( 0.02%)
DNSKEY | 3 | ( 0.00%)
ANY | 16 | ( 0.02%)
ORIGIN:
Origin | Total | Percent
L | 76419 | (100.00%)
76419 entries found (5115k total utilization avg_pkt_size: 91)
search time: 20ms
Table 44.2. DNS Guardian cache statistics

Data returned Description
Used The number of times the query was made, or used. The result are listed from most queried
to least queried.
Query The name of the queried domain.
RCODE The query response status, it indicates possible errors.
Type The type of records queried.
TTL The record time to live in seconds.
EOL The record expiration time in seconds, or end of life. A negative eol means that the record
has expired.
Last-used The period in seconds since the record was queried for the last time.
R-time The cumulated time in recursion in milliseconds.
AVG R-time The average time in recursion in milliseconds.
C-miss The number of queries for which the TTL had expired.
View The view the record belongs to. If there are no views on the server, the view 0 is the only
one displayed.
670
DNS Guardian

Origin The record origin, either L for Local or S for Sent. For more details, refer to the sections
Sharing the Cache of Several DNS Guardian Servers and Sending the Cache Content to
Another DNS Guardian Server.
OPT The option set in the query, None, DNSSEC or EDNS.
RCODE RETURNED The number and percentage of RCODEs returned, by type: NOERROR, SERVFAIL,
NXDOMAIN...
RR TYPE The number and percentage of resource records returned, by type: A, AAAA, NS, CNAME...
ORIGIN The number and percentage of queries, by origin: either L for Local or S for Sent. For more
details, refer to the sections Sharing the Cache of Several DNS Guardian Servers and
Sending the Cache Content to Another DNS Guardian Server.
<n> entries found The total number of different results matching the command filter(s).
<n> total utilization The total number of queries received matching the command filter(s).
avg_pkt_size: <num- The average size of the packets returned matching the command filter(s).
ber-of-bytes>
To display DNS Guardian cache statistics

3. To display DNS Guardian cache statistics, use the following command:

show cache
4. By default, the command displays 50 entries, in particular, the 50 most queried domains.
You can limit the entries to be displayed using the following command:
show cache limit=<number>
5. You can also sort the entries by the type of data returned, described in the table DNS
Guardian cache statistics, using the following command:
show cache order=<data-type>
6. To display specific cache entries, use the following command with one or several of the filters
from the table below:
show cache <filter>
Table 44.3. Available filters for DNS Guardian cache statistics

Filter Description
view=<number> Filter the results using views, where <number> is the view number. Considering
that you cannot have more than 8 views with DNS Guardian, the views number
is an integer between 0 and 7 that corresponds to the order you set for the local
recursive server views. For more details, refer to the section Editing the Order
of the Views. If you did not configure any view, all the results returned belong to
view=0.
expired=(0|1) Filter the results using records TTL expiration status. expired=0 returns the
cached records with a valid TTL, expired=1 displays the expired records in
the cache. If you do not specify this filter, all the records are returned no matter
their TTL.
eol(>|<)<number> Filter the results using the record expiration time. Use > or < to narrow down
your search. To exclude expired values, use the expired filter.
671
DNS Guardian
Filter Description
<error(=|!=)ERROR> Filter the results using the errors returned. Use the format error=<ERRORTYPE>
or error!=<ERRORTYPE> to narrow down your search. Accepted accepted error
types are: NOERROR, FORMERR, SERVFAIL, NXDOMAIN, NOTIMP or REFUSED.
type=<RRTYPE> Filter the results using the record types. All record types are accepted.
<origin=L|S> Filter the results using the record origin: cached by the local DNS Guardian
server, origin=L, or shared/sent by another DNS Guardian server, origin=S.
opt=(-|DNSSEC|EDNS) Filter the results using the option the records are configured with. The accepted
options are: - (no option was set), DNSSEC and EDNS.
used(>|<|=|!=)<number> Filter the results using the number of times the records were queried, i.e. the
number of hits. Use >, <, = or != to narrow down your search.
lastused(>|<|=|!=)<num- Filter the results using the last time the entries were queried in seconds. Use >,
ber> <, = or != to narrow down your search.
ttl(>|<|=|!=)<number> Filter the results using the record TTL value, in seconds. Use >, <, = or != to
narrow down your search.
<regex filter> Filter the results using regular expressions.
<domain> Filter the results using a full or partial domain name. For instance, in the command
show cache view=0 mit.edu that only returns hits for queries of the domain mit.edu
within the first - or only - view of the local recursive server. The domain name is
always the last parameter of the command. You can also exclude the domain
name of your choice following the syntax !<domain>.
You can use, at the same time, the order and limit parameters with one or several filters.
Resetting DNS Guardian Cache

You can reset the number of hits for some or all of the listed used entries in the cache.
To reset Guardian cache entries

3. To completely reset the current version of DNS Guardian cache, use the following command:
reset cache
4. To reset only a part of DNS Guardian cache, use the filters detailed in the table Available
filters for DNS Guardian cache statistics and the following command:
reset cache <filter>
Saving DNS Guardian Cache

You can save DNS Guardian cache at any time. The last cache version can be used as a point
of restoration.
Keep in mind that every time you stop or restart DNS Guardian, the cache is automatically saved.
To save DNS Guardian cache
672
DNS Guardian

3. To save DNS Guardian cache, use the following command:

save cache
The cache is saved in the file /data1/dnsblast_cache.dump . Note that you cannot browse the
content of this file, it can only be used for restoration purposes.
Restoring DNS Guardian Cache

Whether the cache was saved automatically or at a specific time you can use a command to restore
the latest saved version.
The file /data1/dnsblast_cache.dump contains the latest version of the cache and is automatically
used when you restore the DNS Guardian server cache.
To restore DNS Guardian cache

3. To restore the last saved version of DNS Guardian cache, use the following command:
load cache
Forcing Cache Entries as Expired

You can set all or part of the cache entries as expired. This operation is useful if you want to
configure or force the Rescue mode. For more details regarding this mode, refer to the section
Managing DNS Guardian Rescue Mode.
To set DNS Guardian cache entries as expired

3. To set the DNS Guardian cache entries as expired, use the following command:
expire cache
4. To set only a part of DNS Guardian cache as expired, use the filters detailed in the table
Available filters for DNS Guardian cache statistics and the following command:
expire cache <filter>
Clearing DNS Guardian Cache Manually

At any time, you can clear records from your DNS Guardian cache, that is to say delete some or
all the entries it contains.
673
DNS Guardian
The command indicates the number of entries it deleted. Here below is an example using a regex
filter.
DNS Blast> clear cache (mit.edu|ietf)
32 entries flushed
done
Note that you can also set parameters to automatically clear the cache to keep DNS Guardian
performances at best. For more details, refer to the section Clearing DNS Guardian Cache
Automatically.
To clear DNS Guardian cache

3. To clear the cache records content, entirely or partly, use the following command:
clear cache
4. To clear only a part of the cache records content, use the filters detailed in the table Available
filters for DNS Guardian cache statistics and the following command:
clear cache <filter>
Clearing DNS Guardian Cache Automatically

You can use a set of parameters in DNS Guardian configuration to automate the cache entries
clearing process.
Two parameters allow to set a maximum number of entries to keep and a minimum percentage
of entries to clear. When the maximum number of values is reached, the cleaning commands
are automatically executed in order until they meet or exceed the minimum percentage of clients
statistics to clear. You can configure up to 10 clearing commands matching the filters of your
choice.
The automated clearing is configured using the commands below:
• max_cache_entries sets the maximum of entries that you want to store in the cache. Its
default value depends on the memory of each appliance:
Table 44.4. max_cache_entries default values

SOLIDserver model Default value
SDS-550 set max_cache_entries=500000
SDS-3300 & Blast series set max_cache_entries=1000000
• min_clean_cache_percent sets the percentage of max_cache_entries to keep in the cache

after executing the clearing commands clean_cache<number>.cmd .
Once max_cache_entries is reached, the cleaning command clean_cache0.cmd is executed.

If the cache still contains more entries than the value of min_clean_cache_percent, the command
clean_cache1.cmd is executed. All the commands clean_cache#.cmd are executed in
674
DNS Guardian
order until the percentage of entries remaining in the cache matches or is lower than the value
of min_clean_cache_percent.
• clean_cache<number>.cmd parameters set 10 different clearing commands, numbered
from 0 to 9, that respect the clearing filters of your choice.
The clearing commands are only executed if:

• The parameter clean_cache<number>.cmd has a value.
• The percentage of entries cleared is higher than the value set for min_clean_cache_percent.
By default, only the first three clearing commands are configured.
Note that you can also clear some or all the cache entries manually. For more details, refer to
the section Clearing DNS Guardian Cache Manually.
To automate DNS Guardian cache clearing

3. To configure the maximum number of entries in DNS Guardian cache, use the following
command:
set max_cache_entries=<maximum-number-of-entries>
4. To set the percentage of cache entries that you want to keep in DNS Guardian cache, use
the following command:
set min_clean_cache_percent=<percentage-of-max_cache_entries>
5. To configure the clearing commands, use the filters detailed in the table Available filters for
DNS Guardian cache statistics and the following command:
set clean_cache<number>.cmd=<filter>
// The 10 existing commands are numbered from clean_cache0.cmd to clean_cache9.cmd
Sharing the Cache of Several DNS Guardian Servers

If you purchased several DNS Guardian licenses, you can make them share their latest entries
with an incremental cache sharing service. Any new record in cache is automatically added to
the cache of the other servers configured:
Once the sharing is set on all servers:
1. They can automatically update their cache content using a common multicast configuration.
2. You can send the entire content of your cache to a specific DNS Guardian server using a
unicast IP address. For more details, refer to the section Sending the Cache Content to Another
DNS Guardian Server.
To set the cache sharing between DNS Guardian servers, on each of them you must:
• Specify a common multicast IP address.

• Specify a common multicast port.
675
DNS Guardian
• Specify a common sharing key.

• Enable the sharing service.
• Set the TTL of the IP packets sent. By default, it set to 1.
To incrementally update the cache of other DNS Guardian servers

3. Set the multicast IP address for the sharing using the following command:
set shared_cache_mcast_addr=<multicast-IP-address>
4. Set the multicast port used for the cache sharing using the following command:
set shared_cache_mcast_port=<multicast-port>
5. Set the sharing key using the following command:

set shared_cache_key=<key>
6. Enable the sharing using the following command:

set shared_cache=1
7. Set the shared IP packets TTL using the following command:

shared_cache_mcast_ttl=<TTL>
// Its default value is 1
Follow this procedure using the exact same IP address, port and key on all the DNS Guardian
servers that should send and receive the new entries in their cache .
The entries on the local DNS Guardian are marked origin: L while they are marked origin: S on
the receiving one.
Sending the Cache Content to Another DNS Guardian Server

If you enabled DNS Guardian on several appliances, once your cache has all the entries you
need, you can send its entire content to another DNS Guardian server. Using a dedicated com-
mand, you can send all the cache entries from the source server to a receiving server, which
then adds the missing entries to its cache and/or updates the existing ones.
To send the content of your cache you must:
• Configure the cache sharing parameters: the multicast IP address, port and sharing key. It is
impossible to send the content of the cache from one DNS Guardian server to the other without
these parameters. Once properly configured, the sharing must be enabled (shared_cache=1).
For more details, refer to the section Sharing the Cache of Several DNS Guardian Servers.
• Use the IP address of the target DNS Guardian server. This command, unlike cache sharing,
is a one-time operation that uses a unicast IP address. Any IP address configured on the target
server can be used.
676
DNS Guardian
Keep in mind that if you do not want to incrementally update the cache of both servers with the
new records, you need to disable the cache sharing parameters once the target DNS Guardian
received the cache entries.
To share the cache with another DNS Guardian server

3. Make sure that cache sharing is configured and enabled. For more details, refer to the section
Sharing the Cache of Several DNS Guardian Servers.
4. To send the entire content of your cache, use the following command:
share cache <target-DNS-Guardian-server-IP-address>
The entries are marked origin: L on the local DNS Guardian and origin: S on the receiving one.
Managing DNS Guardian Statistics

DNS Guardian statistics gather all the metrics related to the client-server interactions and can
be fully managed via CLI. However, SOLIDserver also provides a selection of graphs as well as
detailed analytics to help you monitor suspicious traffic through the GUI. For more details, refer
to the section Monitoring DNS Guardian From the GUI.
Note that you can also monitor DNS Guardian data yourself via SNMP, for more details regarding
DNS Guardian monitoring refer to the section Monitoring Using SNMP.
Managing DNS Guardian Server Statistics

You can manage DNS Guardian server statistics as long as you:

DNS Guardian.
DNS Guardian server statistics allow you to have a detailed overview of the traffic processed by
the server. They are based on the analysis of DNS Guardian cache and clients data to display
the type, number, size and recursion time of all queries and answers. For more details, refer to
the sections Managing DNS Guardian Cache and Managing DNS Guardian Clients Statistics.
Server statistics can be reset at any time. For more details, refer to the section Resetting DNS
Guardian Server Statistics.
Displaying DNS Guardian Server Statistics
At any time you can have an overview of your DNS Guardian server statistics as in the example
below:
DNS Blast> show stats
2010M Cache hit
17311k Cache missed
17311k Cache missed but exists (expired)
0 Cache missed, never queried
0 Cache hit in quarantine mode
0 Cache missed in quarantine mode
677
DNS Guardian
0 Cache missed but exists (expired) in quarantine mode

0 Cache missed, never queried in quarantine mode
0 Cache missed in quarantine_redirect mode
0 Cache hit in rescue mode
0 Cache missed in rescue mode
0 Cache missed but exists (expired) in rescue mode
0 Cache missed, never queried in rescue mode
0 Blocked queries
0 Ratelimited queries
63021 Cache size
0 Client size
0 Server size
2027M Sent DNS answers
172GB Sent DNS answers (bytes)
2027M Received DNS queries
141GB Received DNS queries (bytes)
17311k Queries sent to the local recursive server
1172MB Queries sent to the local recursive server (bytes)
17072k Answers sent by the local recursive server
1405MB Answers sent by the local recursive server (bytes)
0 Sent DNS answers in quarantine mode
0B Sent DNS answers in quarantine mode (bytes)
0 Sent DNS answers in quarantine_redirect mode
0B Sent DNS answers in quarantine_redirect mode (bytes)
0 Sent DNS answers in rescue mode
0B Sent DNS answers in rescue mode (bytes)
0 Received Invalid DNS queries
0B Received Invalid DNS queries (bytes)
743661 Received SERVFAIL from local recursive server (rcode changed)
0 RPZ matched queries
0 Discarded outgoing DNS packets
0 Discarded outgoing DNS packets (received by local recursive server)
0 Discarded incoming packets
0 Discarded DNS queries (sent to local recursive server)
15782k Recursive queries with latency < 10ms
1026k Recursive queries with latency >= 10ms and < 100ms
67408 Recursive queries with latency >= 100ms and < 500ms
180065 Recursive queries with latency >= 1600ms
2026M Sent NOERROR rcode
0 Sent FORMERR rcode
743661 Sent SERVFAIL rcode
0 Sent NXDOMAIN rcode
0 Sent NOTIMP rcode
0 Sent REFUSED rcode
0 Sent YXDOMAIN rcode
0 Sent YXRRSET rcode
0 Sent NXRRSET rcode
0 Sent NOTAUTH rcode
0 Sent NOTZONE rcode
0 Received NOERROR rcode from local recursive server
0 Received FORMERR rcode from local recursive server
0 Received SERVFAIL rcode from local recursive server
0 Received NXDOMAIN rcode from local recursive server
0 Received NOTIMP rcode from local recursive server
0 Received REFUSED rcode from local recursive server
0 Received YXDOMAIN rcode from local recursive server
0 Received YXRRSET rcode from local recursive server
0 Received NXRRSET rcode from local recursive server
0 Received NOTAUTH rcode from local recursive server
0 Received NOTZONE rcode from local recursive server
Table 44.5. DNS Guardian server statistics

Metrics Description
Cache hit Number of queries answered by the cache.
Cache missed Number of that cannot be answered by the cache.
Cache missed but exists (expired) Number of queries that cannot be answered by the cache because
the cache entry expired.
678
DNS Guardian
Metrics Description
Cache missed, never queried Number of queries that cannot be answered by the cache because
the entry queried does not exist.
Cache hit in quarantine mode Number of queries answered by the cache to clients in quarantine
mode.
Cache missed in quarantine mode Number of that cannot be answered by the cache to clients in
quarantine mode.
Cache missed but exists (expired) in quarant- Number of queries that cannot be answered by the cache to clients
ine mode in quarantine mode because the cache entry expired.
Cache missed, never queried in quarantine Number of queries that cannot be answered by the cache to clients
mode in quarantine mode because the entry queried does not exist.
Cache missed in quarantine_redirect mode Number of queries that cannot be answered by the cache and are
redirected to the IP address configured in the quarantine_redirect
mode.
Cache hit in rescue mode Number of queries answered by the cache in rescue mode.
Cache missed in rescue mode Number of queries that cannot be answered by the cache in rescue
mode.
Cache missed but exists (expired) in rescue Number of queries that cannot be answered by the cache in rescue
mode mode because the records expired.
Cache missed, never queried in rescue mode Number of queries that cannot be answered by the cache in rescue
mode because the entry queried does not exist.
Blocked queries Number of queries that are blocked, once the policy BLOCK has
been configured and triggered for specific clients.
Ratelimited queries Number of queries that dropped because source clients reached
the configured query limit rate of 100 queries per second.
Cache size Total number of entries in the cache.
Client size Total number of clients (unique IP addresses) for which statistics
are maintained. For more details, refer to the section Managing
DNS Guardian Clients Statistics.
Sent DNS answers Number of answers sent out by DNS Guardian.
Sent DNS answers (bytes) Total size of the packets sent out by DNS Guardian.
Received DNS queries Number of queries received by DNS Guardian.
Received DNS queries (bytes) Total size of the packets received by DNS Guardian.
Queries sent to the local recursive server Number of queries not already cached by DNS Guardian that were
sent to the local DNS recursive server.
Queries sent to the local recursive server Total size of the packets not already cached by DNS Guardian that
(bytes) were sent to the local DNS recursive server.
Answers sent by the local recursive server Number of queries not already cached by DNS Guardian that were
answered by the local DNS recursive server.
Answers sent by the local recursive server Total size of the packets not already cached by DNS Guardian that
(bytes) were answered by the local DNS recursive server.
Sent DNS answers in quarantine mode Number of answers sent out to clients in quarantine mode.
Sent DNS answers in quarantine mode Total size of the packets sent out to clients in quarantine mode.
(bytes)
Sent DNS answers in quarantine_redirect Number of answers redirected to the IP address configured in the
mode quarantine_redirect mode.
Sent DNS answers in quarantine_redirect Total size of the packets redirected to the IP address configured in
mode (bytes) the quarantine_redirect mode.
Sent DNS answers in rescue mode Number of queries received by DNS Guardian once it switched to
rescue mode.
679
DNS Guardian
Metrics Description
Sent DNS answers in rescue mode (bytes) Total size of the packets received by DNS Guardian once it switched
to rescue mode.
Received Invalid DNS queries Number of invalid queries received by DNS Guardian.
Received Invalid DNS queries (bytes) Total size of the invalid queries packets received by DNS Guardian.
Received SERVFAIL from local recursive Number of SERVFAIL error messages received by DNS Guardian
server (rcode changed) from the local recursive server that previously returned a different
rcode for the same query. To stop taking into account these results,
refer to the section Ignoring the SERVFAIL Error Message Differ-
ences.
RPZ matched queries Number of queries that matched an RPZ entry.
Discarded outgoing DNS packets Number of DNS packets received and discarded by DNS Guardian.
Discarded outgoing DNS packets from local Number of DNS packets sent to the local DNS recursive server and
recursive server transmitted to the client.
Discarded incoming packets Number of incoming packets that were discarded.
Discarded DNS queries (sent to local recurs- Number of packets sent to the local DNS recursive server that were
ive server) discarded.
Recursive queries with latency < 10ms Number of recursive queries which answering time is lower than 10
milliseconds.
Recursive queries with latency >= 10ms and Number of recursive queries which answering time is equal to 10
< 100ms or lower than 100 milliseconds.
Recursive queries with latency >= 100ms Number of recursive queries which answering time is equal to 100
and < 500ms or lower than 500 milliseconds.
Recursive queries with latency >= 1600ms Number of recursive queries which answering time is equal to or
higher than 1600 milliseconds.
Sent NOERROR rcode Number of NOERROR error messages sent by DNS Guardian.
Sent FORMERR rcode Number of FORMERR error messages sent by DNS Guardian.
Sent SERVFAIL rcode Number of SERVFAIL error messages sent by DNS Guardian.
Sent NXDOMAIN rcode Number of NXDOMAIN error messages sent by DNS Guardian.
Sent NOTIMP rcode Number of NOTIMP error messages sent by DNS Guardian.
Sent REFUSED rcode Number of REFUSED error messages sent by DNS Guardian.
Sent YXDOMAIN rcode Number of YXDOMAIN error messages sent by DNS Guardian.
Sent YXRRSET rcode Number of YXRRSET error messages sent by DNS Guardian.
Sent NXRRSET rcode Number of NXRRSET error messages sent by DNS Guardian.
Sent NOTAUTH rcode Number of NOTAUTH error messages sent by DNS Guardian.
Sent NOTZONE rcode Number of NOTZONE error messages sent by DNS Guardian.
Received NOERROR rcode from local recurs- Number of NOERROR error messages received by DNS Guardian
ive server from the local recursive server.
Received FORMERR rcode from local recurs- Number of FORMERR error messages received by DNS Guardian
Received SERVFAIL rcode from local recurs- Number of SERVFAIL error messages received by DNS Guardian
Received NXDOMAIN rcode from local re- Number of NXDOMAIN error messages received by DNS Guardian
cursive server from the local recursive server.
Received NOTIMP rcode from local recursive Number of NOTIMP error messages received by DNS Guardian
server from the local recursive server.
680
DNS Guardian
Metrics Description
Received REFUSED rcode from local recurs- Number of REFUSED error messages received by DNS Guardian
Received YXDOMAIN rcode from local re- Number of YXDOMAIN error messages received by DNS Guardian
cursive server from the local recursive server.
Received YXRRSET rcode from local recurs- Number of YXRRSET error messages received by DNS Guardian
Received NXRRSET rcode from local recurs- Number of NXRRSET error messages received by DNS Guardian
Received NOTAUTH rcode from local recurs- Number of NOTAUTH error messages received by DNS Guardian
Received NOTZONE rcode from local recurs- Number of NOTZONE error messages received by DNS Guardian
Note that some of the server statistics are used to generate charts available in the GUI, for more
details refer to the section Monitoring DNS Guardian Statistics From the GUI.
To display DNS Guardian server statistics

3. To display DNS Guardian server statistics, use the following command:

show stats
You can also monitor the server statistics to display more information, refreshed every
second. For more details, refer to the section Monitoring DNS Guardian Server Statistics in
Real-Time.
Monitoring DNS Guardian Server Statistics in Real-Time
You can monitor, in real-time, all the server statistics of DNS Guardian or only some information.
The statistics are updated every second in the Last sec column while the Cumulative column
displays the values collected since the last reset. For more details, refer to the section Resetting
DNS Guardian Server Statistics. Monitoring DNS Guardian data returns information as follows:
DNS Blast> monitor
DNS BLAST monitoring:

-----------------------------------------------------------------------------
Cumulative ( Avg /s ) Name
-----------------------------------------------------------------------------
99.99% ( 100.00% ) Cache hit rate
0.00% ( 0.00% ) Cache miss rate
0.00% ( 0.00% ) Block query rate
15690M ( 17080k ) Cache hit
2 ( 0 ) Cache missed
2 ( 0 ) Cache missed but exists (expired)
0 ( 0 ) Cache missed, never queried
0 ( 0 ) Cache hit in quarantine mode
0 ( 0 ) Cache missed in quarantine mode
0 ( 0 ) Cache missed but exists (expired) in quarantine mode
0 ( 0 ) Cache missed, never queried in quarantine mode
0 ( 0 ) Cache hit in rescue mode
0 ( 0 ) Cache missed in rescue mode
0 ( 0 ) Cache missed but exists (expired) in rescue mode
0 ( 0 ) Cache missed, never queried in rescue mode
0 ( 0 ) Blocked queries
0 ( 0 ) Ratelimited queries
681
DNS Guardian
1003 ( 0 ) Cache size

0 ( 0 ) Client size
0 ( 0 ) Server size
15690M ( 17080k ) Sent DNS answers
1403GB ( 1564MB ) Sent DNS answers (bytes)
15690M ( 17080k ) Received DNS queries
1169GB ( 1303MB ) Received DNS queries (bytes)
2 ( 0 ) Queries sent to the local recursive server
166B ( 0B ) Queries sent to the local recursive server (bytes)
2 ( 0 ) Answers sent by the local recursive server
284B ( 0B ) Answers sent by the local recursive server (bytes)
0 ( 0 ) Sent DNS answers in quarantine mode
0B ( 0B ) Sent DNS answers in quarantine mode (bytes)
0 ( 0 ) Sent DNS answers in rescue mode
0B ( 0B ) Sent DNS answers in rescue mode (bytes)
0 ( 0 ) Received Invalid DNS queries
0B ( 0B ) Received Invalid DNS queries (bytes)
0 ( 0 ) Received SERVFAIL from local recursive server (rcode changed)
0 ( 0 ) RPZ matched queries
0 ( 0 ) Discarded outgoing DNS packets
0 ( 0 ) Discarded outgoing DNS packets (received by local recursive server)
0 ( 0 ) Discarded incoming packets
0 ( 0 ) Discarded DNS queries (sent to local recursive server)
2 ( 0 ) Recursive queries with latency < 10ms
0 ( 0 ) Recursive queries with latency >= 10ms and < 100ms
0 ( 0 ) Recursive queries with latency >= 1600ms
15690M ( 17080k ) Sent NOERROR rcode
0 ( 0 ) Sent FORMERR rcode
0 ( 0 ) Sent SERVFAIL rcode
4 ( 0 ) Sent NXDOMAIN rcode
0 ( 0 ) Sent NOTIMP rcode
0 ( 0 ) Sent REFUSED rcode
0 ( 0 ) Sent YXDOMAIN rcode
0 ( 0 ) Sent YXRRSET rcode
0 ( 0 ) Sent NXRRSET rcode
0 ( 0 ) Sent NOTAUTH rcode
0 ( 0 ) Sent NOTZONE rcode
The result of the command starts with statistics on the current measurement rates, as described
in the table below:
Table 44.6. DNS Guardian monitoring rate statistics

Metrics Description
Cache hit rate Percentage of queries answered by the cache, all modes taken to-
gether (normal, quarantine and rescue mode). This line is only re-
turned if you monitor the statistics. For more details refer to the
section Monitoring DNS Guardian Server Statistics in Real-Time.
Cache miss rate Percentage of queries that cannot be answered the cache, all modes
taken together. This line is only returned if you monitor the statist-
ics, for more details refer to the section Monitoring DNS Guardian
Server Statistics in Real-Time.
Block query rate Percentage of queries that are blocked. This line is only returned if
you monitor the statistics, for more details refer to the section
Monitoring DNS Guardian Server Statistics in Real-Time.
All the others statistics are described in the table DNS Guardian server statistics.
To monitor DNS Guardian server statistics in real-time

682
DNS Guardian
3. To monitor all the statistics at once, use the following command:

monitor
4. To focus the monitoring on specific statistics, described in the table DNS Guardian server
statistics, use the following command with one or several of the filters from the table below:
monitor <filter>
Table 44.7. Available filters for DNS server real-time monitoring

Filter Description
view=<view-number> Filter the results using the statistics of a specific view
show-qps Filter the results using the queries per second statistics, number
or size in bytes.
show-rtt Filter the results using the round-trip or recursion time statistics.
These statistics are named Recursive queries with latency
<range>.
show-rcode Filter the results using the RCODEs statistics. These statistics
are named Sent <VALUE> rcode.
5. Hit enter to stop monitoring.
Monitoring DNS Guardian Triggers Statistics in Real-Time
You can monitor, in real-time, all the server statistics of DNS Guardian triggers. Monitoring DNS
Guardian data returns information as follows.
DNS Blast> monitor show-trigger

-----------------------------------------------------------------------------
-----------------------------------------------------------------------------
54001 ( 121 ) Restricted IPv4 entries
2660 ( 23 ) Restricted IPv6 entries
0 ( 0 ) Number of time trigger #0 was armed
...
The result of the command is described in the following table:
Table 44.8. DNS Guardian server real-time triggers statistics

Restricted IPv4 entries Number of IPv4 addresses for which a trigger was armed.
Restricted IPv6 entries Number of IPv6 addresses for which a trigger was armed.
Number of time trigger #0 was armed Number of times the first trigger, #0, has been armed.
Number of time trigger #... was armed Number of times one of the triggers, all identified with a number
between #0 and #63, has been armed.
Number of time trigger #63 was armed Number of times the last trigger, #63, has been armed.
683
DNS Guardian
To monitor DNS Guardian server triggers statistics in real-time

3. To monitor all the triggers statistics at once, use the following command:
monitor show-trigger
Monitoring DNS Guardian Cache Sharing Statistics in Real-Time
You can monitor, in real-time, all the server statistics of cache data shared among several DNS
Guardian appliances. Monitoring DNS Guardian data returns information as follows.
DNS Blast> monitor show-cache-sharing

-----------------------------------------------------------------------------
-----------------------------------------------------------------------------
0 ( 0 ) DNS entries received via shared cache
0B ( 0B ) DNS entries received via shared cache (bytes)
0 ( 0 ) DNS entries sent via shared cache
0B ( 0B ) DNS entries sent via shared cache (bytes)
The result of the command is described in the following table:
Table 44.9. DNS Guardian server real-time cache-sharing statistics

DNS entries received via shared cache Number of queries received by the local DNS Guardian via shared
cache.
DNS entries received via shared cache Total size of the packets received by the local DNS Guardian via
(bytes) shared cache.
DNS entries sent via shared cache Number of queries sent to another DNS Guardian via shared cache.
DNS entries sent via shared cache (bytes) Total size of the packets sent to another DNS Guardian via shared
vcache.
To monitor DNS Guardian server cache sharing statistics in real-time

3. To monitor the cache sharing statistics of the server, use the following command:
monitor show-cache-sharing
Resetting DNS Guardian Server Statistics
At any time you can reset the statistics of your DNS Guardian server to make sure that the data
displayed is up to date, especially if you want to Monitoring DNS Guardian Server Statistics in
Real-Time.
684
DNS Guardian
To reset DNS Guardian server statistics

3. To reset the statistics results, use the following command:

reset stats
Ignoring the SERVFAIL Error Message Differences
By default, DNS Guardian monitors the SERVFAIL message differences: a record queried sev-
eral times can have any rcode at first and then a SERVFAIL message. A command allows to
force DNS Guardian to ignore this difference.
This information is listed on the line Received SERVFAIL from local recursive server (rcode
changed) of the monitoring screen.
To disable the detection of SERVFAIL message differences

3. To disable the detection of SERVFAIL message differences, use the following command:
set servfail_diff=0
Note that DNS Guardian provides you with two DNS Guardian tops dedicated to queries and
clients returning SERVFAIL error message. For more details, refer to the section Monitoring DNS
Guardian Analytics.
Also, note that you can configure DNS Guardian switch to Rescue Mode based on the number
of SERVFAIL error messages received by local recursive servers. For more details, refer to the
section Configuring Rescue Mode.
Managing DNS Guardian Clients Statistics

You can manage DNS Guardian client statistics as long as you:

DNS Guardian.
DNS Guardian client statistics allow you to have a specific view of the server usage focused on
the IP address making the queries. They are based on the analysis of DNS Guardian cache and
the servers statistics in general. For more details, refer to the sections Managing DNS Guardian
Cache and Managing DNS Guardian Server Statistics.
Enabling DNS Guardian Clients Statistics
Accessing the DNS Guardian client statistics requires to enable the feature.
685
DNS Guardian
To enable DNS Guardian clients statistics

3. To enable the DNS Guardian clients statistics, use the following command:
set clients_stats=1
4. To make sure the clients statistics have been enabled, you can display the server configur-
ation using the command:
show config
Displaying DNS Guardian Clients Statistics
DNS Guardian allows to display detailed statistics on the different clients that have queried the
server. Here below is an example of the command result limited to 10 entries:
DNS Blast> show clients limit=10
Query | Client IP | View | Last-used | C-hit | C-miss | hit-Q-sz | miss-Q-sz | hit-A-sz
| miss-A-sz | recurs-time | invalid-Q | restricted | block-Q | NOERROR | NXDOMAIN |
SERVFAIL | rpz-hit | trigger-hit
235213 | 10.0.200.1 | 0 | 238 | 12891 | 222322 | 567KB | 9571KB | 1109KB
| 20229KB | 16536k | 0/0/0/0/0/0/0/0/0 | | 0 | 8684 | 218595 |
6502 | 0 | 98
54364 | 10.10.13.37 | 0 | 2 | 51384 | 2980 | 1736KB | 106KB | 2763KB
| 278KB | 181434 | 0/0/0/0/0/0/0/0/0 | | 0 | 54249 | 111 |
4 | 0 | 0
38674 | 10.10.13.39 | 0 | 2 | 17684 | 20990 | 650KB | 796KB | 1512KB
| 2002KB | 753664 | 0/0/0/0/0/0/0/0/0 | | 0 | 37082 | 1548 |
16 | 0 | 0
28925 | 10.0.0.10 | 0 | 32 | 25077 | 3848 | 843KB | 164KB | 1923KB
| 361KB | 44819 | 0/0/0/0/0/0/0/0/0 | | 0 | 28280 | 645 |
0 | 0 | 0
27557 | 10.0.253.252 | 0 | 22 | 17584 | 9973 | 781KB | 404KB | 1893KB
| 1256KB | 214175 | 0/0/0/0/0/0/0/0/0 | | 0 | 27413 | 120 |
24 | 0 | 10
21213 | 10.0.0.17 | 0 | 15 | 17116 | 4097 | 648KB | 167KB | 1197KB
| 362KB | 4199 | 0/0/0/0/0/0/0/0/0 | | 0 | 11099 | 10113 |
0 | 0 | 0
17185 | 10.10.17.8 | 0 | 4 | 12531 | 4654 | 457KB | 180KB | 910KB
| 338KB | 115822 | 0/0/0/0/0/0/0/0/0 | | 0 | 16353 | 16 |
0 | 0 | 0
17064 | 10.10.13.41 | 0 | 63606 | 15624 | 1440 | 694KB | 55577B | 1446KB
| 143KB | 66730 | 0/0/0/0/0/0/0/0/0 | | 0 | 17058 | 2 |
3 | 0 | 0
16751 | 10.0.50.99 | 0 | 31 | 6799 | 9952 | 272KB | 400KB | 558KB
| 972KB | 91521 | 0/0/0/0/0/0/0/0/0 | | 0 | 6149 | 10602 |
0 | 0 | 9
13596 | 10.0.30.254 | 0 | 1 | 3227 | 10369 | 129KB | 422KB | 253KB
| 1011KB | 2999 | 0/0/0/0/0/0/0/0/0 | | 0 | 3758 | 9838 |
0 | 0 | 0
RCODE RETURNED:
RCODE | Total | Percent
NOERROR | 569609 | ( 63.87%)
SERVFAIL | 6673 | ( 0.75%)
NXDOMAIN | 308101 | ( 34.55%)
245 entries found (891816 total utilization)
search time: 0ms
686
DNS Guardian
Table 44.10. DNS Guardian clients statistics

Query Number of queries received from the client.
Client IP IP address of the client.
View Number of the view that answered the client query, from 0 to 7.
Last-used Number of seconds since the client did query DNS Guardian for the last time.
C-hit Number of queries for which the answer was in the cache.
C-miss Number of queries for which the answer was not in the cache.
hit-Q-sz Total size (in bytes) of the queries which answer was in the cache.
miss-Q-sz Total size (in bytes) of the queries which answer was not in the cache.
hit-A-sz Total size (in bytes) of the queried answers that were in the cache.
miss-A-sz Total size (in bytes) of the queried answers that were not in the cache.
recurs-time Time needed to get the answer from the local recursive server, in milliseconds.
invalid-Q Number of invalid queries received from the client. This information follows the
format n/n/n/n/n/n/n/n/n where n is the number. Each / separates a specific
case:
N/n/n/n/n/n/n/n/n is the Total sum of invalid queries received.
n/N/n/n/n/n/n/n/n is an Invalid class (IN).
n/n/N/n/n/n/n/n/n is an Overflow (wrong size).
n/n/n/N/n/n/n/n/n is a Discrepancy on the number of questions.
n/n/n/n/N/n/n/n/n is a Wrong opcode (use of reserved code).
n/n/n/n/n/N/n/n/n is an Invalid UDP source.
n/n/n/n/n/n/N/n/n is an IP SRC and IP DST are the same.
n/n/n/n/n/n/n/N/n is an IP SRC address is a broadcast address.
n/n/n/n/n/n/n/n/N is the number of packets of invalid size received.
restricted Policy applied on the client: any, none, quarantine or block.
blocked-Q Number of queries received and blocked by the server.
NOERROR Number of queries returning a NOERROR error code.
NXDOMAIN Number of queries returning a NXDOMAIN error code.
SERVFAIL Number of queries returning a SERVFAIL error code.
rpz-hit Number of times the client matched an RPZ entry.
trigger-hit Number of hits triggered by the client.
Note that some of the clients data is used to generate analytics available in the GUI, for more
details refer to the section Displaying DNS Guardian Analytics Tops.
To display DNS Guardian clients statistics

3. Make sure the clients data retrieval is enabled. For more details, refer to the section Enabling
DNS Guardian Clients Statistics.
4. To display DNS Guardian clients statistics, use the following command:
show clients
687
DNS Guardian
5. By default, the command displays 50 clients, in particular, the ones with the highest number
of queries.
You can limit the number of clients to be displayed using the following command:
show clients limit=<number>
6. You can also sort the entries by the type of data returned, described in the table DNS
Guardian clients statistics, using the following command:
show clients order=<data-type>
7. To display specific clients statistics, as described in the table DNS Guardian clients statistics,
use the following command with one or several of the filters from the table below:
show clients <filter>
Table 44.11. Available filters for DNS Guardian clients statistics

Filter Description
used (>|<|=|!=) <number-of- Filter the results using the number of queries received from the client.
queries>
view (>|<|=|!=) <view-number> Filter the results using the number of a DNS view .
lastused (>|<|=|!=) <duration> Filter the results using the last time the client queried the DNS server, in
seconds.
C-miss (>|<|=|!=) <number-of- Filter the results using the number of queries which answer was not in the
queries> cache.
C-hit (>|<|=|!=) <number-of- Filter the results using the number of queries which answer was in the
queries> cache.
(<IP-address>|/<prefix>) Filter the results using the client IP address. For a range of addresses, fol-
lowing the format <ip-address>/<prefix>.
restricted (=|!=) <policy> Filter the results that triggered the policy none: Display all the clients with
no restriction at all.
Filter the results that triggered the policy ratelimit: Display all the clients
whose query rate is limited. For more details, refer to the section Limiting
Suspicious Clients' Query Rate.
Filter the results that triggered the policy quarantine: Display all the clients
put in quarantine. For more details, refer to the section Putting Suspicious
Clients in Quarantine.
Filter the results that triggered the policy quarantine_redirect: Display
all the clients redirected to a specific IP address. For more details, refer to
the section Redirecting Suspicious Clients.
Filter the results that triggered the policy block: Display all the clients
blocked. For more details, refer to the section Blocking Suspicious Clients.
Filter the results that triggered the policy any: Display all the clients with
any of the described restrictions.
You can use, at the same time, the order and limit parameters with one or several filters.
Resetting DNS Guardian Clients Statistics
You can reset clients statistics at any time, thus bringing the counters of your choice to 0. This
can prove useful for a real-time analysis of the traffic.
You can select the statistics to be reset using specific search parameters. For more details, refer
to the table Available filters for DNS Guardian clients statistics.
688
DNS Guardian
To reset DNS Guardian clients statistics

3. To reset DNS Guardian clients statistics, use the following command:

reset clients
Clearing DNS Guardian Clients Statistics Manually
You can delete clients statistics at any time. Keep in mind that cleared statistics cannot be
retrieved.
You can select the statistics to be cleared using specific search parameters. For more details,
refer to the table Available filters for DNS Guardian clients statistics.
To clear DNS Guardian clients statistics

3. To clear DNS Guardian clients statistics, use the following command:

clear clients
Clearing DNS Guardian Clients Statistics Automatically
You can use a set of parameters in DNS Guardian configuration to automate the clients statistics
clearing process. Keep in mind that cleared statistics cannot be retrieved.
Two parameters allow to set a maximum number of entries to keep and a minimum percentage
of entries to clear. When the maximum number of values is reached, the cleaning commands
are automatically executed in order until they meet or exceed the minimum percentage of clients
statistics to clear. You can configure up to 10 clearing commands matching the filters of your
choice.
The automated clearing is configured using the commands below:
• max_client_entries sets the maximum of entries that you want to store in the cache. Its
default value depends on the memory of each appliance:
Table 44.12. max_client_entries default values

SOLIDserver model Default value
SDS-550 set max_client_entries=20000
SDS-3300 & Blast series set max_client_entries=1000000
689
DNS Guardian
• min_clean_client_percent sets the percentage of max_client_entries to keep in the

cache after executing the clearing commands clean_client<number>.cmd .
Once max_client_entries is reached, the cleaning command clean_client0.cmd is executed.

If the cache still contains more entries than the value of min_clean_client_percent, the command
clean_client1.cmd is executed. All the commands clean_client#.cmd are executed
in order until the percentage of entries remaining in the cache matches or is lower than the
value of min_clean_client_percent.
• clean_client<number>.cmd parameters set 10 different clearing commands, where
<number> is a number from 0 to 9, that respect the clearing filters of your choice.
The clearing commands are executed in order, but only if:

• The parameter clean_client<number>.cmd has a value.
• The percentage of entries cleared is higher than the value set for min_clean_client_percent.
By default, only the first two clearing command are configured.
To automate DNS Guardian client statistics clearing

3. To configure the maximum number of entries in DNS Guardian cache, use the following
command:
set max_client_entries=<maximum-number-of-entries>
4. To set the percentage of client statistics entries that you want to keep in DNS Guardian
cache, use the following command:
set min_clean_client_percent=<percentage-of-max_client_entries>
5. To configure the client statistics clearing commands, use the following command:
set clean_client<number>.cmd=<filter-of-your-choice>
// The 10 existing commands are numbered from clean_cache0.cmd to clean_cache9.cmd
Monitoring DNS Guardian From the GUI

In addition to CLI management, the GUI also provides a selection of graphs on the server prop-
erties page as well as detailed analytics on clients queries.
Note that clients statistics must be enabled. For more details, refer to the section Enabling DNS
Guardian Clients Statistics.
Monitoring DNS Guardian Statistics From the GUI
From the GUI, you can monitor DNS Guardian cache statistics from the server properties page.
Displaying DNS Guardian Statistics Panels
From the GUI, when DNS Guardian is configured and enabled, the properties page of the local
EfficientIP DNS server provides extra panels containing charts dedicated to DNS Guardian.
690
DNS Guardian
More detailed statistics and options are available via CLI. For more details, refer to the sections
Managing DNS Guardian Server Statistics and Managing DNS Guardian Clients Statistics.
To display DNS Guardian statistics panels

3. In the column DNS Guardian, the server is marked Enabled
4. At the end of the line of the server of your choice, click on . The server properties pages
opens.
Available DNS Guardian Statistics Panels
The properties page of DNS Guardian servers provides you with dedicated panels that can be
managed like a gadget and displayed on any dashboard. For more details, refer to the section
Assigning a Gadget from a Resource Properties Page.
Each of these panels is named Guardian - <data> and described below. Note that:
• All the information returned in these panels is based on some of the server statistics available
in CLI, the data used is indicated after each description. For more details, refer to the table
DNS Guardian server statistics.
• All the panels contain at least one chart. The y-axis of these charts indicates the unit, the axis
scale and unit prefix depend on the period selected and maximum value displayed. Following
the standard ISO 80000-1, all the y-axis units can have no prefix or any SI prefix such as: m
(milli), k (kilo) or M (mega).
Guardian - Cache Size (Bytes)

A chart displaying DNS Guardian cache size evolution over time, in bytes. For more details
refer to the section Managing DNS Guardian Cache.
Based on: Cache size.

Guardian - Cache Hits/Misses
A chart displaying the ratio of DNS Guardian answered and unanswered queries, in percent.
For more details refer to the section Managing DNS Guardian Cache.
Based on: Cache hit rate and Cache miss rate.

Guardian - Hits in Quarantine
A chart displaying the number of DNS queries that DNS Guardian answered to clients in
quarantine mode. For more details regarding the quarantine mode, refer to the section Putting
Suspicious Clients in Quarantine.
Based on: Cache hit in quarantine mode.

Guardian - Cache Statistics
A chart displaying DNS Guardian cache statistics for all DNS traffic, in queries per second.
The results include traffic in quarantine and rescue mode. For more details refer to the section
Managing DNS Guardian Cache.
691
DNS Guardian
Based on: Cache hit, Cache missed, Cache missed but exists (expired) and Cache missed,
never queried.
Guardian - Quarantine statistics
A chart displaying DNS Guardian cache statistics for clients in quarantine mode, in queries
per second. For more details regarding the quarantine mode, refer to the section Putting
Suspicious Clients in Quarantine.
Based on: Cache hit in quarantine mode, Cache missed in quarantine mode, Cache missed
but exists (expired) in quarantine mode and Cache missed, never queried in quarantine
mode.
Guardian - Rescue mode statistics
A chart displaying DNS Guardian cache hit statistics for clients in rescue mode, in queries
per second. For more details regarding the rescue mode, refer to the section Managing DNS
Guardian Rescue Mode.
Based on: Cache hit in rescue mode, Cache missed in rescue mode, Cache missed but exists
(expired) in rescue mode and Cache missed, never queried in rescue mode.
Guardian - Blocked traffic (Queries)
A chart displaying the number of queries per second that have been blocked by DNS
Guardian, once the mode BLOCK has been and triggered for specific clients. For more details
regarding triggers, refer to the section Blocking Suspicious Clients.
Based on: Blocked queries.

Guardian - Tracked clients
A chart displaying the number of client IP addresses that DNS Guardian is tracking. For more
details, refer to the section Putting Suspicious Clients in Quarantine.
Based on: Client size.

Guardian - Sent/Received traffic (Queries)
A chart displaying the number of queries sent and received by DNS Guardian, in queries per
second. For more details, refer to the section Sending the Cache Content to Another DNS
Guardian Server.
Based on: Sent DNS answers and Received DNS queries.

Guardian - Sent/Received traffic (Bytes)
A chart displaying the overall traffic generated by the queries sent and received by DNS
Guardian, in bytes per second. For more details, refer to the section Sending the Cache
Content to Another DNS Guardian Server.
Based on: Sent DNS answers (bytes) and Received DNS queries (bytes).
Guardian - Answers in Quarantine/Rescue Mode (Queries)
A chart displaying the number of queries answered by DNS Guardian in quarantine mode
and in rescue mode, in queries per second. For more details, refer to the sections Putting
Suspicious Clients in Quarantine and Managing DNS Guardian Rescue Mode.
Based on: Sent DNS answers in quarantine mode and Sent DNS answers in rescue mode.
Guardian - Answers in Quarantine/Rescue Mode (Bytes)
A chart displaying the overall traffic generated by the queries answered by DNS Guardian
in quarantine mode and in rescue mode, in bytes per second. For more details, refer to the
sections Putting Suspicious Clients in Quarantine and Managing DNS Guardian Rescue
Mode.
692
DNS Guardian
Based on: Sent DNS answers in quarantine mode (bytes) and Sent DNS answers in rescue
mode (bytes).
Guardian - Invalid traffic (Queries)
A chart displaying the total number of invalid queries that were dropped by DNS Guardian.
Based on: Received Invalid DNS queries.

Guardian - Invalid traffic (Bytes)
A chart displaying the traffic generated by all the invalid queries that were dropped by DNS
Guardian, in bytes. For more details refer to the section Managing DNS Guardian Cache.
Based on: Received Invalid DNS queries (bytes).

Guardian - Cache sharing statistics
A chart displaying the number of entries sent and received via shared cache DNS Guardian,
in queries per second. For more details, refer to the section Sharing the Cache of Several
DNS Guardian Servers.
Based on: DNS entries received via shared cache and DNS entries sent via shared cache.
Guardian - Cache sharing statistics (Bytes)
A chart displaying the traffic generated by all the entries sent and received via shared cache
DNS Guardian, in bytes. For more details, refer to the section Sharing the Cache of Several
DNS Guardian Servers.
Based on: DNS entries received via shared cache (bytes) and DNS entries sent via shared
cache (bytes)
Guardian - Return codes statistics
A chart displaying the number of return codes sent by DNS Guardian, in queries per second.
Based on: Sent NOERROR rcode, Sent FORMERR rcode, Sent SERVFAIL rcode, Sent
NXDOMAIN rcode, Sent NOTIMP rcode, Sent REFUSED rcode, Sent YXDOMAIN rcode,
Sent YXRRSET rcode, Sent NXRRSET rcode, Sent NOTAUTH rcode and Sent NOTZONE
rcode.
Guardian - Triggers
A chart displaying the number of times each of the first 8 available triggers were armed. The
chart is generated using the ID of each trigger, therefore even if you edit the trigger name,
action, period and/or threshold, the graph keeps evolving but might not always have the same
meaning. For more details, refer to the section Managing DNS Guardian Triggers.
Based on: Number of time trigger #0 was armed, Number of time trigger #1 was armed,
Number of time trigger #2 was armed, Number of time trigger #3 was armed, Number of time
trigger #4 was armed, Number of time trigger #5 was armed, Number of time trigger #6 was
armed and Number of time trigger #7 was armed.
Guardian - Recursive queries latency
A chart displaying the recursive query latency distribution of DNS Guardian, in queries per
second. The latency is divided into 6 periods and ranges from less than 10 milliseconds to
more than 1600 milliseconds. For more details, refer to the section Limiting Suspicious Clients'
Query Rate.
Based on: Recursive queries with latency < 10ms, Recursive queries with latency >= 10ms
and < 100ms, Recursive queries with latency >= 100ms and < 500ms, Recursive queries
693
DNS Guardian
with latency >= 500ms and < 800ms, Recursive queries with latency >= 800ms and < 1600ms
and Recursive queries with latency >= 1600ms.
Guardian - Rate limited traffic (Queries)
A chart displaying the number of queries dropped by DNS Guardian because source clients
reached the configured query limit rate (of 100 QPS), in queries per second. For more details,
refer to the section Limiting Suspicious Clients' Query Rate.
Based on: Ratelimited queries.
Monitoring DNS Guardian Analytics From the GUI
From the GUI, you can monitor DNS Guardian clients data via detailed analytics, for one or
several servers, as long as the related analytics collection is enabled.
Note that when DNS Guardian is enabled and configured:
• Classical DNS Top Analytics are no longer available. For more details, refer to the section
Displaying the DNS Analytics.
• The sampling Periodicity (min.), in the panel Analytics and the related wizard, is no longer
visible as it is not configurable.
Making Sure DNS Guardian Analytics are Collected
To display DNS Guardian analytics, you must make sure that DNS Analytics collection is enabled.
To make sure DNS Guardian Analytics are collected

3. In the column Name, right-click over the server for which DNS Guardian is Enabled and click
on . The server properties pages opens.
4. In the panel Analytics, click on EDIT . The wizard Configure DNS Analytics opens.
5. Make sure the box Enable analytics collection is ticked. If it is not, tick it.
6. Click on OK to commit your choice. The report opens and closes. The server properties
pages is visible again. In the panel Analytics, the option Enable analytics collection is set
to yes.
Displaying DNS Guardian Analytics Tops
When DNS Guardian is configured and enabled, the local DNS EfficientIP server provides dedic-
ated tops analyzing Guardian data on the page Analytics.
DNS Guardian tops allows to display, for a time window that can range from 5 minutes to 1
week, every 5-minute samples of the traffic in which a metric has been measured.
Each top provides:
• A set of dedicated filters that allow to display a precise view of the traffic, all detailed in the
image below.
• Specific columns.
• Three different views of the data returned.
694
DNS Guardian
For instance, as in the figure below, you can use the Overview to display the total number of
queries received by DNS Guardian during the 3 hours that precede a certain time and date:
Figure 44.2. Guardian Analytics filters
The drop-down list Display allows to select the analytics of your choice. If you are displaying
the page Analytics of a DNS Guardian server, only Guardian - Top <data> are listed.
There are three displays available: Overview, Detailed view and Consolidated view. No
matter the selected display, the number of entries listed depend on the time window you set
using the next three fields. For more details, refer to the section Using the Views to Analyse
a Specific Guardian Top.
The drop-down list For allows to choose a time window for the analytics, ranging from 5
minutes to a week. The available durations depend on the view you chose.
This drop-down list allows to set the bounds of your search: either Since, to display the Top
data for the selected duration from the date and time; or Until, to display the Top data for
the selected duration until the date and time.
This field allows to specify the date and date of your choice. It is surrounded by and
that allow to edit the field content based on the duration selected in the list For.
The icon allows to open the time and date constructor and browse the calendar to select
a date and set a specific time using the drops-down lists. Once you selected both date and
time, click on OK to refresh the field and display Guardian analytics.
From the page Analytics, you can display all the available tops.
To display DNS Guardian Analytics data

a. If you want to launch an analysis on a specific server, in the column Name, right-click
over the server for which DNS Guardian is Enabled and click on . The server properties
pages opens.
b. Otherwise, to launch a cross-servers analysis, go straight to the next step.
3. In the breadcrumb, click on Analytics. The page Analytics opens.
695
DNS Guardian
4. In the drop-down list Display, only DNS Guardian data is available and named as follows:
Guardian - Top <data>.
All the columns can be used to filter and sort the data, except for the Start date and Period,
where filtering is not possible. Also, depending on the top and view selected, some columns
may be empty or not displayed at all.
Table 44.13. DNS Guardian analytics columns

Column Description
Server The name of the DNS Guardian server(s) if you launched a cross-servers analysis.
This column may not appear if the server is already selected and displayed in the
breadcrumb.
Start date In the Overview and Detailed view: the start date and time of the 5-minute sample
Period.
In the Consolidated view: the start date and time of the first sample Period, within the
analytics time window, during which the metric has been measured.
Period The sample period, either detailed (5 minutes) or consolidated (multiple of 5 minutes),
during which metrics have been measured.
Client's IP address The IP address of the client querying DNS Guardian. Depending on the top and view
selected, this column may be empty or not displayed at all.
Domain The name of the domain queried. Depending on the top and view selected, this column
may be empty or not displayed at all.
RR type The record returned when the domain was queried: A, AAAA, PTR... Depending on
the top and view selected, this column may be empty or not displayed at all.
<metric> Queries: the number of queries received by the server on the sample period, either
from a Client's IP address or for a specific Domain and RR Type.
Time (ms): the recursion time, in milliseconds, of the queries received by the server
on the sample period, either from a Client's IP address or for a specific Domain and
RR Type.
Size (bytes): the size, in bytes, of the queries received by the server on the sample
period, either from a Client's IP address or for a specific Domain and RR Type.
Trigger hits: the number of times, in the sample period, a Client's IP address armed
a DNS Guardian trigger.
Total The value of all the metrics measured during the same sample period, regardless of
the Client's IP address, Domain or RR Type.
Ratio The proportion of the metric value compared to the total value within the same period,
in percents.
Available DNS Guardian Analytics Tops
DNS Guardian allow you to display detailed measurements of the server traffic, in number of
queries, size or recursion time. These metrics either return information based on the IP address
of a client or domain/record queried.
Each of these analytics is named Guardian - Top <data> and described below.
All the information returned in these tops is based on some of the server statistics available in
CLI, the data used is indicated after each description. For more details, refer to the tables DNS
Guardian clients statistics and DNS Guardian analytics columns.
Guardian - Top clients generating dropped queries (BLOCK)

The blocked clients whose query was received and dropped. For more details, refer to the
section Blocking Suspicious Clients.
696
DNS Guardian
Metrics: Queries by Client's IP address.
Based on: blocked-Q.

Guardian - Top clients querying records missing from the cache
The clients querying records not in the cache. For more details, refer to the sections Managing
DNS Guardian Clients Statistics and Managing DNS Guardian Server Statistics.
Based on: C-miss.

Guardian - Top clients querying records present in the cache
The clients querying records in the cache. For more details, refer to the sections Managing
DNS Guardian Clients Statistics and Managing DNS Guardian Server Statistics.
Based on: C-hit.

Guardian - Top clients generating recursive incoming traffic
The total size of the answers queried by clients that were not in the cache and were received
from the local recursive server. For more details, refer to the section Managing DNS Guard-
ian Clients Statistics.
Metrics: Size (bytes) by Client's IP address.
Based on: miss-A-sz.

Guardian - Top clients generating recursive outgoing traffic
The total size of the queries which answer was not in the cache and were sent to the local
recursive server. For more details, refer to the section Managing DNS Guardian Clients
Statistics.
Metrics: Size (bytes) by Client's IP address.
Based on: miss-Q-sz.

Guardian - Top clients
The clients querying DNS Guardian. For more details, refer to the section Managing DNS
Based on: Query.

Guardian - Top clients receiving NOERROR rcodes
The clients whose queries were answered with the rcode NOERROR. For more details, refer
to the section Managing DNS Guardian Clients Statistics.
Based on: NOERROR.

Guardian - Top clients receiving NXDOMAIN rcodes
The clients whose queries were answered with the rcode NXDOMAIN. For more details, refer
to the section Managing DNS Guardian Clients Statistics.
697
DNS Guardian
Based on: NXDOMAIN.

Guardian - Top recursion time by client
The clients for whom the cumulative queries took the longest time to be answered by the
local recursive server, in milliseconds. For more details, refer to the section Managing DNS
Metrics: Time (ms) by Client's IP address.
Based on: recurs-time.

Guardian - Top clients receiving SERVFAIL rcodes
The clients whose queries were answered with the rcode SERVFAIL. For more details, refer
to the sections Managing DNS Guardian Clients Statistics and Ignoring the SERVFAIL Error
Message Differences.
Based on: SERVFAIL.

Guardian - Top clients triggering policies
The number of times a client query armed a trigger and, therefore, triggered a policy. For
more details, refer to the sections Managing DNS Guardian Clients Statistics and Managing
DNS Guardian Triggers.
Metrics: Trigger Hits by Client's IP address.

Guardian - Top queries of records missing from the cache
The queries sent to DNS Guardian for records not in the cache. For more details, refer to
the section Managing DNS Guardian Server Statistics.
Metrics: Queries.
Based on: C-miss.

Guardian - Top queries
The queries sent to DNS Guardian. For more details, refer to the section Managing DNS
Guardian Server Statistics.
Metrics: Queries.
Based on: Used.

Guardian - Top SLD creating new cache entries
The queries for a sub-level domain name that has not been queried before. For more details,
refer to the section Managing DNS Guardian Server Statistics.
Metrics: Queries by Domain and RR Type.
Based on: Query and first-used.

Guardian - Top queries returning NXDOMAIN rcodes
The queries returned with the rcode NXDOMAIN. For more details, refer to the section
Managing DNS Guardian Server Statistics.
Metrics: Queries.
Based on: RCODE.
698
DNS Guardian
Guardian - Top recursion time by FQDN

The recursion of all queries, one fully qualified domain name at a time. For more details, refer
to the section Managing DNS Guardian Server Statistics.
Metrics: Time (ms) by Domain and RR Type.
Based on: R-time.

Guardian - Top queries returning SERVFAIL rcodes
The queries returned with the rcode SERVFAIL.For more details, refer to the sections Man-
aging DNS Guardian Server Statistics and Ignoring the SERVFAIL Error Message Differences.
Metrics: Queries.
Based on: RCODE.
They all provide three different ways to display the analytics within the time window set in the
drop-down list For.
Note that the analytics time window can range from 5 minutes to 6 hours for Detailed view and
Consolidated view or 1 hour to 1 week for the Overview. For more details, refer to the section
Using the Views to Analyse a Specific Guardian Top.
Using the Views to Analyze a Specific DNS Guardian Top
As described in the section Displaying DNS Guardian Analytics Tops, each DNS Guardian Top
offers three different views of the data for the same time window:
1. Overview returns a simplified display of the data for each 5-minute sample matching the time
window set in your filters. With the column Total, you can identify peaks in the traffic and get
more information with the consolidated or detailed view.
Figure 44.3. Overview of DNS Guardian Analytics
2. Consolidated view focuses on the client's IP address or on the domain and RR type, depending
on the selected Top. When a client IP address or queried domain/record is repeatedly identified
over the different 5-minute samples matching the time window set in your filters, these sampling
periods add up in the column Period.
699
DNS Guardian
Figure 44.4. Consolidated view of DNS Guardian Analytics
3. Detailed view focuses on a sampling period. For each 5-minute sampling period, this view
lists the number of times one IP address or a domain and RR type matching your filters have
been identified.
Figure 44.5. Consolidated view of DNS Guardian Analytics
You can select the Overview on the Guardian - Top queries returning NXDOMAIN rcodes to
display a 6-hour window around a specific time and date. Sorting the data with the column Total
allows to pinpoint the 5-minute samples during which DNS Guardian handled an unusual peak
of potentially suspicious queries.
To display a DNS Guardian Top Overview
1. Go to the page Analytics of the server of your choice.

2. In the drop-down list Display, select Guardian - Top <data> of your choice.
3. In the next drop-down list, select Overview.
4. In the drop-down list For, select 1 h, 3 h, 6 h, 1 day or 1 week.
5. In the next drop-down list, select Until to use the time and date and duration you set as an
end point for the search results or Since to set them as a starting point for the search.
Note that if you select Until and specify a time such as xx:00 or xx:05, this particular time is
excluded from the result because it is the starting point of a 5-minute sampling going from
xx:00 to xx:05 or xx:05 to xx:10. To include xx:05 to the result, specify xx:06.
6. In the last field, specify the date and time that suit your needs. You can either type in the
date and time following the format dd/mm/yyyy hh:mm, or use the time and date constructor:
a. Click on or double-click in the field to open the time and date constructor.
b. To set the date, click on and to browse the months and select the date of your
choice. The date selected is highlighted in white.
c. To set the Time, select the hour in the first drop-down list and the minutes in the second.
700
DNS Guardian
d. When you selected both date and time, click on OK . The constructor closes and the
date and time you set are displayed in the field.
Note that the arrows and surrounding the date and time field allow to edit the field
content based on the duration set in the list For. Click on either to add or subtract 5 minutes,
an hour, six hours or even a day to the date and time displayed.
7. Click on OK at the end of the line to display the entries matching the selected Top and filters.
Only the columns first Start date, Period and Total contain data.
You can also select the Consolidated view on the Guardian - Top clients triggering policies to
display a 6-hour window around a specific time and date. Sorting the data with the column Period
allows to highlight the clients that repeatedly triggered policies over time.
To display a DNS Guardian Top Consolidated view

3. In the next drop-down list, select Consolidated view.
4. In the drop-down list For, select 5 min, 30 min, 1 h, 3 h or 6 h.
All the columns contain data.
Finally, you can select the Detailed view on the Guardian - Top clients to display a 6-hour window
around a specific time and date. Sorting the data with the column Client's IP address allows to
display every 5-minute period during which a certain client queried DNS Guardian.
To display a DNS Guardian Top Detailed view

701
DNS Guardian
3. In the next drop-down list, select Detailed view.

4. In the drop-down list For, select 5 min, 30 min, 1 h, 3 h or 6 h.
All the columns contain data.
Managing DNS Guardian Protection

Malicious operations on the DNS infrastructure, such as DDoS, DNS tunneling or data exfiltration
attacks, usually result in overloaded servers and service loss for legitimate clients. You can use
the information provided by DNS Guardian clients statistics to identify the different types of threats.
For instance, a high C-miss value might indicate that a client keeps querying names that are not
cached, thus increasing the load on the recursive server. You can also correlate an important
miss-A-sz to an encapsulated data transfer, taking advantage of the number of characters allowed
in the packets. As for the miss-Q-sz counter, a large size of sent queries might be due to data
exfiltration on the same principle. Other counters like recurs_time or invalid-Q are also good in-
dicators in the case of a sloth or invalid queries attack. For more details regarding the statistics,
refer to the table DNS Guardian clients statistics.
These statistics are then used to protect the server by targeting suspicious clients to either
monitor them, put them in quarantine, redirect them, limit their query rate or block them
completely.
If your recursive server is under DDoS attack, DNS Guardian also offers a feature called
Rescue mode to temporarily provide best-effort delivery and prevent it from being overloaded
or victim of cache-poisoning.
Enabling DNS Guardian Protection

By default, DNS Guardian Protection is enabled when the service is started. For more details,
refer to the section Enabling DNS Guardian. However it can be disabled to stop using DNS
702
DNS Guardian
Guardian cache to answer client queries directly but still update its content. For more details,
refer to the section Disabling DNS Guardian Protection.
To enable DNS Guardian protection

3. To enable DNS Guardian protection, use the following command:

set blast=1
Monitoring Suspicious Clients

DNS Guardian allows to log the activity of suspicious clients when they reach a traffic threshold.
You can set these detection conditions by creating a trigger using the policy none. For more details
on triggers, refer to the section Managing DNS Guardian Triggers.
For instance, the following command creates a trigger that is armed during 3600 seconds, for
any client from which the server receives more than 100 queries during 10 consecutive
seconds:
create trigger "Trigger-M" enabled none@3600 query@10 100 >=
The arming and disarming of the trigger is logged in named.log with the tag Trigger-M:
01/03/2018 19:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:NONE) (Trigger-M)
01/03/2018 18:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:NONE) (Trigger-M)
Note that you can enable the querylog and answerlog when a suspicious client arms a trigger.
For more details, refer to the sections Enabling Querylog and Answerlog for Suspicious Clients.
For more details on how to display the logs, refer to the section Logs Visualization.
To monitor suspicious clients

3. Create the trigger using any policy and the querylog and/or answerlog parameter:
create trigger "<trigger-name>" <enabled|disabled> none@<number-of-seconds>
<metric>@<number-of-seconds> <threshold(s)>
DNS Guardian also provides you with charts to visualize different triggers statistics on the prop-
erties page of the server as well as a DNS Guardian Analytics top dedicated to suspicious clients.
For more details, refer to the section Monitoring DNS Guardian From the GUI.
Limiting Suspicious Clients' Query Rate

DNS Guardian allows to limit the rate of suspicious clients to 100 queries per seconds. The
value is set by default and cannot be changed.
703
DNS Guardian
Suspicious clients cannot be rate limited manually using DNS Guardian, they must reach a traffic
threshold. You can set these detection conditions by creating a trigger using the policy ratelimit.
For more details on triggers, refer to the section Managing DNS Guardian Triggers.
For instance, the following command creates a trigger that limits, for 3600 seconds, the query
rate of any client from which the server receives more than 100 queries during 10 consecutive
seconds:
create trigger "Trigger-L" enabled ratelimit@3600 query@10 100 >=
The arming and disarming of the trigger is logged in named.log with the tag Trigger-L:
01/03/2018 19:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:RATELIMIT)
(Trigger-L)
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:RATELIMIT)
(Trigger-L)
To limit the query rate of suspicious clients

3. Create the trigger using the ratelimit policy:

create trigger "<trigger-name>" <enabled|disabled> ratelimit@<number-of-seconds>
Putting Suspicious Clients in Quarantine

Using DNS Guardian cache, you can put suspicious clients in quarantine to protect the local re-
cursive servers. For clients in quarantine, recursion is forbidden but their queries are answered
using the entries present in DNS Guardian cache.
Internet
only cached any answer not in

answers are sent the cache is ignored
quarantined
client
Figure 44.6. DNS Guardian's behavior toward quarantined clients
Suspicious clients cannot be put in quarantine manually using DNS Guardian, they must reach
a traffic threshold. You can set these detection conditions by creating a trigger using the policy
quarantine. For more details on triggers, refer to the section Managing DNS Guardian Triggers.
704
DNS Guardian
For instance, the following command creates a trigger that puts in quarantine for 3600 seconds
any client from which the server receives more than 100 queries during 10 consecutive
seconds:
create trigger "Trigger-Q" enabled quarantine@3600 query@10 100 >=
The arming and disarming of the trigger is logged with the tag Trigger-Q:
01/03/2018 19:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:QUARANTINE)
(Trigger-Q)
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:QUARANTINE)
(Trigger-Q)
To put suspicious clients in quarantine

3. Create the trigger using the quarantine policy:

create trigger "<trigger-name>" <enabled|disabled> quarantine@<number-of-seconds>
Redirecting Suspicious Clients

DNS Guardian allows you to redirect any IPv4 or IPv6 query coming from suspicious clients to
a specific address for which you can configure the TTL.
Internet
sends one answer any answer not in

no matter the query the cache is ignored
quarantined client
redirected
Figure 44.7. DNS Guardian's behavior toward redirected clients
Suspicious clients cannot be redirected manually using DNS Guardian, they must reach a traffic
threshold. You can set these detection conditions by creating a trigger using the policy quarant-
ine_redirect. For more details on triggers, refer to the section Managing DNS Guardian Triggers.
For instance, the following command creates a trigger that redirects for 3600 seconds any client
from which the server receives more than 100 queries during 10 consecutive seconds:
create trigger "Trigger-R" enabled quarantine_redirect@3600 query@10 100 >=
705
DNS Guardian
The arming and disarming of the trigger is logged in named.log with the tag Trigger-R:
01/03/2018 19:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101
(action:QUARANTINE_REDIRECT) (Trigger-R)
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:QUARANTINE_REDIRECT)
(Trigger-R)
To redirect suspicious clients

3. To set or remove a redirection for clients in Quarantine mode querying an IPv4 address, use
set quarantine_redirect_a=<IPv4-address>
4. To set or remove a redirection for clients in Quarantine mode querying an IPv6 address, use
set quarantine_redirect_aaaa=<IPv6-address>
5. To set or remove the TTL - in seconds - for the address resource record, use the following
command:
set quarantine_redirect_ttl=<number-of-seconds>
6. Create the trigger using the quarantine_redirect policy:

create trigger "<trigger-name>" <enabled|disabled> quarantine_redirect@<number-of-seconds>
Blocking Suspicious Clients

DNS Guardian allows to completely deny access to suspicious clients.
Internet
no answer is sent any answer not in

blocked to the client the cache is ignored
client
Figure 44.8. DNS Guardian's behavior toward quarantined clients
706
DNS Guardian
Suspicious clients cannot be blocked manually using DNS Guardian, they must reach a traffic
threshold. You can set these detection conditions by creating a trigger using the policy block. For
more details on triggers, refer to the section Managing DNS Guardian Triggers.
For instance, the following command creates a trigger that blocks, for 3600 seconds, any client
from which the server receives more than 100 queries during 10 consecutive seconds:
create trigger "Trigger-X" enabled block@3600 query@10 100 >=
The arming and disarming of the trigger is logged in named.log with the tag Trigger-X:
01/03/2018 19:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:BLOCK) (Trigger-X)
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:BLOCK) (Trigger-X)
Keep in mind that blocking a client's address might ensue in blocking all other clients using
it to connect the network, for instance, in the case of private hosts on the same NAT device or
router. Therefore, you should be careful when you use the block policy as the consequences
might be quite important.
To block suspicious clients

3. Create the trigger using the block policy:

create trigger "<trigger-name>" <enabled|disabled> block@<number-of-seconds>
Enabling Querylog and Answerlog for Suspicious Clients

DNS Guardian allows several ways to handle clients generating suspicious traffic by:
• Monitoring Suspicious Clients

• Limiting Suspicious Clients' Query Rate
• Putting Suspicious Clients in Quarantine
• Redirecting Suspicious Clients
• Blocking Suspicious Clients
In each case, you must create a trigger and set its policy, either none, ratelimit, quarantine,
quarantine-redirect or block, as well as its arming conditions and duration. For more details, refer
to the section Managing DNS Guardian Triggers.
In addition to these policies, DNS Guardian allows to log the queries and/or answers of a client
that arms a trigger. To do so:
707
DNS Guardian
• You must set the DNS Guardian parameters set querylog and/or set answerlog to 2. For more
details, refer to the section Managing DNS Guardian Configuration.
• You must add the parameters querylog and/or answerlog to the trigger itself.
For instance, you can decide to enable the querylog and answerlog along with the policy none
during 60 seconds, for any client that receives more than 10 SERVFAIL rcode answers during
100 consecutive seconds from the server:
create trigger "Trigger-Z" enabled none+querylog+answerlog@60 answer_servfail@10 100 >=
The arming and disarming of the trigger as well as the client's queries and/or answers are logged
in named.log with the tag Trigger-Z:
01/03/2018 15:17:37 solid named[12962]: DISARMING trigger on 10.0.252.11 (action:NONE) (Trigger-Z)
01/03/2018 15:17:32 solid named[12962]: client 10.0.252.11#38824 (wikipedia.com): answer:
wikipedia.com IN A (10.0.81.4) -> SERVFAIL
01/03/2018 15:17:32 solid named[12962]: client 10.0.252.11#38824: query: wikipedia.com IN A
(10.0.81.4)
01/03/2018 15:16:46 solid named[12962]: client 10.0.252.11#26822 (reddit.com): answer: reddit.com
IN A (10.0.81.4) -> SERVFAIL
01/03/2018 15:16:46 solid named[12962]: client 10.0.252.11#26822: query: reddit.com IN A (10.0.81.4)
IN A (10.0.81.4) -> SERVFAIL
IN A (10.0.81.4) -> SERVFAIL
IN A (10.0.81.4) -> SERVFAIL
IN A (10.0.81.4) -> SERVFAIL
01/03/2018 15:16:37 solid named[12962]: ARMING trigger on 10.0.252.11 (action:NONE) (Trigger-Z)
To enable querylog and answerlog for suspicious clients

3. Create the trigger using any policy and the parameter(s) querylog and/or answerlog:
create trigger "<trigger-name>" <enabled|disabled>
<policy>+<querylog>+<answerlog>@<number-of-seconds> <metric>@<number-of-seconds> <threshold(s)>
Managing DNS Guardian Triggers

DNS Guardian allows you to log suspicious traffic and switch the clients that caused it into different
modes using triggers, a mechanism that launches specific actions upon threat detection.
These actions are of different types, called policies and can be applied on a client for a definite
period in seconds. The available policies are described in the table below
Table 44.14. DNS Guardian trigger policies

Policy Description
none The arming and disarming of the trigger is logged in the file named.log.
708
DNS Guardian
Policy Description
ratelimit The arming and disarming of the trigger is logged and the client the client is switched to
Ratelimit Mode. For more details, refer to the section Limiting Suspicious Clients' Query
Rate.
quarantine The arming and disarming of the trigger is logged and the client the client is switched to
Quarantine Mode. For more details, refer to the section Putting Suspicious Clients in
Quarantine.
quarantine_redirect The arming and disarming of the trigger is logged and the client redirected to a specific
IPv4 or IPv6 address. For more details, refer to the section Redirecting Suspicious Clients.
block The arming and disarming of the trigger is logged and the client the client is switched to
Block Mode. For more details, refer to the section Blocking Suspicious Clients.
Once a client metric reaches a threshold, the trigger is armed for the whole specified period even
if the client traffic drops down below said threshold. If the client reaches the traffic threshold again
when the trigger is already armed, the policy period is renewed but there is no mention of the
rearming in the named.log. For more details on how to display the logs, refer to the section Logs
Visualization.
Threshold
Trigger armed
Policy
applied over the
defined period
Figure 44.9. DNS Guardian triggers
The metrics that can be used to create triggers are described in the table below:
Table 44.15. DNS Guardian trigger metrics

Metric Description
<0-999999> A number between 0 and 999999.
query Number of queries received.
invalid_query Number of invalid queries received.
cache_hit Number of cache hits.
cache_miss Number of cache misses.
cache_hit_quarantine Number of cache hits in quarantine mode.
cache_miss_quarantine Number of cache misses in quarantine mode.
recurs_time Total time in recursion in milliseconds.
hit_query_size Size, in bytes, of hit queries.
hit_answer_size Size, in bytes, of hit answers.
709
DNS Guardian
Metric Description
miss_query_size Size, in bytes, of missed queries.
miss_query_size_not_exist Size, in bytes, of missed queries that have never been cached.
miss_answer_size Size, in bytes, of answers to missed queries.
miss_answer_size_not_ex- Size, in bytes, of answers to missed queries that have never been cached.
ist
answer_noerror Number of answers returning a NOERROR rcode.
answer_formerr Number of answers returning a FORMERR rcode.
answer_servfail Number of answers returning a SERVFAIL rcode.
answer_nxdomain Number of answers returning a NXDOMAIN rcode.
answer_notimp Number of answers returning a NOTIMP rcode.
answer_refused Number of answers returning a REFUSED rcode.
hit_answer_noerror Number of answers (hits) returning a NOERROR rcode.
hit_answer_formerr Number of answers (hits) returning a FORMERR rcode.
hit_answer_servfail Number of answers (hits) returning a SERVFAIL rcode.
hit_answer_nxdomain Number of answers (hits) returning a NXDOMAIN rcode.
hit_answer_notimp Number of answers (hits) returning a NOTIMP rcode.
hit_answer_refused Number of answers (hits) returning a REFUSED rcode.
miss_answer_noerror Number of answers (misses) returning a NOERROR rcode.
miss_answer_formerr Number of answers (misses) returning a FORMERR rcode.
miss_answer_servfail Number of answers (misses) returning a SERVFAIL rcode.
miss_answer_nxdomain Number of answers (misses) returning a NXDOMAIN rcode.
miss_answer_notimp Number of answers (misses) returning a NOTIMP rcode.
miss_answer_refused Number of answers (misses) returning a REFUSED rcode.
rpz_hit Number of RPZ hits.
Note that DNS Guardian provides you with charts to visualize different triggers statistics on the
properties page of the server, as well as DNS Guardian Analytics dedicated to triggers and
policies. For more details, refer to the section Monitoring DNS Guardian From the GUI.
Also, note that you can temporarily enable the querylog and/or answerlog when a client arms a
trigger, regardless of the policy. For more details, refer to the section Monitoring Suspicious Clients.
Creating a DNS Guardian Trigger
The trigger and threshold syntax is based on the Reverse Polish Notation which is parenthesis-
free and where each operator follows all of its operands. You can create as many trigger as
needed, using:
• The name of a policy from the table DNS Guardian trigger policies.
• The operators +, -, *, /, =, !=, >=, <=, <, > to set the value of the threshold(s).
• The operator & and | to set different metrics for the same trigger.
• The operators % and push_param to update, in the file named.log, the trigger tag with the
threshold that has been reached.
• One or more metrics from the DNS Guardian clients metrics described in the table DNS
Guardian trigger metrics.
710
DNS Guardian
All the events that caused the ARMING or DISARMING of the trigger are detailed in the file
named.log, along with the client's IP address and the related action policy. For more details on
how to display the logs, refer to the section Logs Visualization.
For instance, the following command creates Trigger-A, which is enabled and configured to
launch a block policy on a client for 3600 seconds.
create trigger "Trigger-A" enabled block@3600 query@10 100 >=
The threshold is met if, from said client, the server receives more than 100 queries during 10
consecutive seconds. The arming and disarming of the trigger is logged in named.log with the
tag Trigger-A:
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:NONE) (Trigger-A)
01/03/2018 18:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:NONE) (Trigger-A)
Triggers can be armed by one of several metrics, as in Trigger-B below:

create trigger "Trigger-B" enabled block@3600 query@10 push_param 100 >= cache_miss@30 push_param 50
>= |
Here, the threshold is met if the server receives more than 100 queries during 10 consecutive
seconds OR more than 50 queries missing the cache during 30 consecutive seconds from
the client. The arming and disarming of the trigger is logged in named.log with the tag Trigger-
B.
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:NONE) (Trigger-B)
01/03/2018 18:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:NONE) (Trigger-B)
The result above does not indicate which threshold was met. You can however add a tag next
to the trigger name when creating or updating a trigger. For more details, refer to the section
Tagging a Trigger.
The triggers T1 to T9, below, provide you with an overview of the different configurations you
can set, with or without trigger tags:
create trigger "T1 - Volumetric DDoS" enabled none@60 query@10 10000 >=
create trigger "T2 - nxdomain 100 in 10s - rcvd %0" enabled none@60 answer_nxdomain@10 push_param 100
>
create trigger "T3 - servfail 50 in 10s - rcvd %0" enabled none@60 answer_servfail@10 push_param 50
>
create trigger "T4 - Data leak prevention" enabled none@60 miss_query_size@5 push_param 100000 >=
create trigger "T5 - Tunneling" enabled none@60 cache_miss@10 push_param 200 >=
create trigger "T6 - Recursive attacks" enabled none@60 recurs_time@40 push_param 31 >
create trigger "T7 - NXDomain attack" enabled none@60 miss_answer_nxdomain@10 push_param 100 >=
create trigger "T8 - Syntax error protection" enabled none@60 answer_formerr@10 push_param 100 >=
create trigger "T9 - Servfail" enabled none@60 miss_answer_servfail@60 push_param 200 >=
To create a DNS Guardian trigger

3. Create the trigger using of one of the policies described in the table DNS Guardian trigger
policies and one or several metrics described in the table DNS Guardian trigger metrics:
a. If the trigger has only one metric, use the following command:
create trigger "<trigger-name>" <enabled|disabled> <policy>@<number-of-seconds>
<metric>@<number-of-seconds> <threshold>
711
DNS Guardian
b. If the trigger has several metrics, you can add the structure <metric>@<number-of-
seconds> <threshold> as many times as needed, by placing the operator | after all the
operands, as in the following command:
create trigger "<trigger-name>" <enabled|disabled> <policy>@<number-of-seconds>
<first-metric>@<number-of-seconds> <first-threshold> <second-metric>@<number-of-seconds>
<second-threshold> |
Tagging a DNS Guardian Trigger
You can tag a trigger in order to display, in the file named.log, the metric that armed it as well as
the threshold that has been reached.
Each metric you want to display in the tag is given a numerical position, from left to right, starting
from 0. To add a tag to trigger:
• Next to the trigger name, between the inverted commas, add each <metric name> followed by
%<position-number>.
• Before each metric threshold, add the push_param.
For instance, the following command creates Trigger-C which is enabled and configured to
launch a block policy on a client for 3600 seconds:
create trigger "Trigger-C Queries %0" enabled block@3600 query@10 push_param 100 >=
The threshold is met if, from said client, the server receives more than 100 queries during 10
consecutive seconds. The arming and disarming of the trigger is logged in named.log with the
tag Trigger-C Queries <value>:
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:NONE) (Trigger-C
Queries 100)
01/03/2018 18:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:NONE) (Trigger-C
Queries 0)
Tags are the most useful when the triggers has several metrics, as in Trigger-D below:
create trigger "Trigger-D Queries %0 Cache-Miss %1" enabled block@3600 query@10 push_param 100 >=
cache_miss@30 push_param 50 >= |
Here, the threshold is met if the server receives more than 100 queries during 10 consecutive
seconds OR more than 50 queries missing the cache during 30 consecutive seconds from
the client. The arming and disarming of the trigger is logged in named.log with the tag Trigger-
D Queries <value> Cache-Miss <value>.
The result below indicates that the threshold of the second metric, tagged as Cache-Miss, was
met:
01/03/2018 18:13:18 solid named[12962]: ARMING trigger on 142.12.0.101 (action:NONE) (Trigger-D
Queries 0 Cache-Miss 50)
01/03/2018 18:13:18 solid named[12962]: DISARMING trigger on 142.12.0.101 (action:NONE) (Trigger-D
Queries 0 Cache-Miss 0)
To define a DNS Guardian trigger tag

712
DNS Guardian
3. Define the tag of an existing trigger:
update trigger "<trigger-name> <metric-name> %0" <enabled|disabled>
<policy>@<number-of-seconds> <metric>@<number-of-seconds> push_param <threshold>
b. If the trigger has several metrics, use the following command:

update trigger "<trigger-name> <first-metric-name> %0 <second-metric-name> %1"
<enabled|disabled> <policy>@<number-of-seconds> <metric>@<number-of-seconds> push_param
<first-threshold> push_param <second-threshold> |
You can use the same structure when creating a trigger using the command create instead
of update. For more details, refer to the section Creating a Trigger.
Displaying DNS Guardian Triggers
You can display the list of triggers configured in DNS Guardian, with details regarding their IDs
and parameters, as in the example below:
ID | Enabled | Description | Action | Period | Thresholds
0 | YES | Trigger-A | BLOCK | 3600 | query@10 100 >=

1 | YES | Trigger-B | BLOCK | 3600 | query@10 100 >=
query@10 100 >= cache_miss@30 100 >= |
2 | YES | Trigger-C Queries %0 | BLOCK | 3600 | query@10 push_param
100 >=
3 | YES | Trigger-D Queries %0 cache-miss %1| BLOCK | 3600 | query@10 push_param
100 >= cache_miss@30 push_param 100 >= |
4 | YES | Trigger-M | NONE | 3600 | query@10 100 >=
5 | YES | Trigger-L | RATELIMIT | 3600 | query@10 100 >=
6 | YES | Trigger-Q | QUARANTINE | 3600 | query@10 100 >=
7 | YES | Trigger-R | QUARANTINE-REDIRECT | 3600 | query@10 100 >=
8 | YES | Trigger-X | BLOCK | 3600 | query@10 100 >=
9 | YES | Trigger-Z | NONE | 60 | answer_servfail@10
100 >=
10 | YES | T1 - Volumetric DDoS | NONE | 3600 | query@10 10000 >=
11 | YES | T2 - nxdomain 100 in 10s - rcvd %0| NONE | 3600 | answer_nxdomain@10
push_param 100 >
12 | YES | T3 - servfail 50 in 10s - rcvd %0 | NONE | 3600 | answer_servfail@10
push_param 50 >
13 | YES | T4 - Data leak prevention | NONE | 3600 | miss_query_size@5
push_param 100000 >=
14 | YES | T5 - Tunneling | NONE | 3600 | cache_miss@10
push_param 200 >=
15 | YES | T6 - Recursive attacks | NONE | 3600 | recurs_time@40
push_param 31 >
16 | YES | T7 - NXDomain attack | NONE | 3600 |
miss_answer_nxdomain@10 push_param 100 >=
17 | YES | T8 - Syntax error protection | NONE | 3600 | answer_formerr@10
push_param 100 >=
18 | YES | T9 - Servfail | NONE | 3600 |
miss_answer_servfail@60 push_param 200 >=
Keep in mind that in addition to CLI management of the triggers, SOLIDserver GUI allows you
to monitor the analytics of all trigger armings as well the graph statistics of 8 triggers. For more
details, refer to the section Monitoring DNS Guardian From the GUI.
To display DNS Guardian triggers

3. To display the list of triggers, use the following command:
713
DNS Guardian
show trigger
Note that once a trigger has been created, it is also listed at the bottom of the DNS Guardian
configuration results listing. For more details, refer to the section Displaying DNS Guardian
Configuration. This listing allows you to see if a trigger is set with the parameters querylog
and/or answerlog, not available using the command above. For more details, refer to the
section Enabling Querylog and Answerlog for Suspicious Clients.
Updating a DNS Guardian Trigger
You can update a trigger to enable or disable it, but also to modify its policy, time, querylog, an-
swerlog and/or threshold(s) parameters. For more details on the metrics available for the
thresholds, refer to the section Creating a Trigger.
To update a DNS Guardian trigger

3. Update the trigger using of one of the policies described in the table DNS Guardian trigger
policies and one or several metrics described in the table DNS Guardian trigger metrics:
update trigger "<trigger-name>" <enabled|disabled> <policy>@<number-of-seconds>
<metric>@<number-of-seconds> <threshold>
b. If the trigger has several metrics, you can add the structure <metric>@<number-of-
seconds> <threshold> as many times as needed, by placing the operator | after all the
operands, as in the following command:
update trigger "<trigger-name>" <enabled|disabled> <policy>@<number-of-seconds>
<first-metric>@<number-of-seconds> <first-threshold> <second-metric>@<number-of-seconds>
<second-threshold> |
Deleting a Trigger
You can delete triggers, one by one, using the trigger ID. For more details, refer to the section
Displaying Triggers in this chapter.
To delete a DNS Guardian trigger

3. To delete a trigger, use the following command:

delete trigger <trigger-ID>
Managing DNS Guardian Response Policy Zones

With DNS Guardian, you can globally manage Response Policy Zones which allow you to restrict
access to domains and subdomains. The RPZ mechanism of DNS Guardian is completely
714
DNS Guardian
independent from the management of RPZ zones and provides a more upstream layer of
protection. For more details, refer to the chapter DNS Firewall (RPZ).
Once you enabled the DNS Guardian RPZ management, you can add RPZ entries and an RPZ
policy for all the matching IPv4 or IPv6 queries or redirect them altogether toward a specific
address. When you configured the mechanism, you can start logging RPZ matches and display
them at will.
Note that DNS Guardian only supports forward, stub and delegation-only zones as described in
the Prerequisites and Limitations.
Enabling DNS Guardian RPZ Management
By default, DNS Guardian RPZ management is disabled. It must be enabled to log the RPZ
matches, apply a global response policy and/or redirect the clients toward an IPv4 or IPv6 address.
To enable DNS Guardian RPZ management

3. To enable DNS Guardian RPZ management, use the following command:

set rpz=1
4. The protection may be up but you may not see the queries processed. To start logging DNS
Guardian RPZ matches, use the following command:
set rpz_log=1
Configuring DNS Guardian RPZ Entries
You can create, list and delete RPZ entries to restrict access to the domains and subdomains
that suit your needs. For more details on restriction policies, refer to the section Configuring DNS
Guardian RPZ Policy below.
To configure DNS Guardian RPZ Entries

3. To add a domain to the RPZ, use the following command:

create rpz_entry <FQDN>
4. To display all or some of the RPZ entries, use the following command:
show rpz <regex>
If you enabled the log, the entries are sorted by the number of times they have been queried.
DNS Blast> show rpz
Used | * | = | EOL | RPZ name
323 | | = | 0 | www.somedomain.com
252 | | = | 0 | www.anotherdomain.us
152 | | = | 0 | www.thisdomain.net
715
DNS Guardian
145 | | = | 0 | www.thatdomain.org
99 | | = | 0 | www.notmydomain.com
5. To reset the counter of all or some of the RPZ entries, use the following command:
reset rpz <regex>
6. To delete all or some of the RPZ entries, use the following command:
clear rpz <regex>
7. Save the current version of DNS Guardian RPZ configuration, using the following command:
save rpz

load rpz
Configuring DNS Guardian RPZ Policy
DNS Guardian allows you to configure a global response policy for all the Response Policy Zones
entries you configured. Depending on your configuration, all matching queries are answered the
same way or redirected to the same IP address. For more details, refer to the section Configuring
DNS Guardian RPZ Entries above.
To configure a DNS Guardian RPZ Policy

3. You can set one of the global policies described in the table below on all the Response Policy
Zones managed by DNS Guardian:
Table 44.16. DNS Guardian RPZ policies

RPZ policy Description
disabled No global policy is applied and the individual rules of each Response Policy Zone remain
the same. It is the value by default.
drop The server drops all the queries on any Response Policy Zone.
nodata The server sends a NODATA response to all the queries on Response Policy Zones, no
matter the policy configured when creating them.
nxdomain The server sends an NXDOMAIN response to all the queries on Response Policy Zones,
no matter the policy configured when creating them.
redirect The server redirects all the clients querying Response Policy Zones.
To set a global policy for all the Response Policy Zones, use the following command:
set rpz_policy=<rpz-policy>
4. If you choose to redirect the clients, you can:
a. Set or remove a redirection address for clients querying Response Policy Zones in IPv4,
using the following command:
set rpz_redirect_a=<IPv4-address>
716
DNS Guardian
b. Set or remove a redirection address for clients querying Response Policy Zones in IPv6,
using the following command:
set rpz_redirect_aaaa=<IPv6-address>
c. Set or remove the TTL - in seconds - for the address resource record, using the following
command:
set rpz_ttl=<number-of-seconds>
5. Save the current version of DNS Guardian RPZ configuration, using the following command:
save rpz

load rpz
Disabling DNS Guardian RPZ Management
You can chose to disable only the log or the whole DNS Guardian RPZ management which will
stop the the log and any other policy you configured altogether.
To disable DNS Guardian RPZ management

3. To stop logging DNS Guardian RPZ matches, use the following command:
set rpz_log=0
4. To disable DNS Guardian RPZ management, use the following command:

set rpz=0
Managing DNS Guardian Rescue Mode

DNS Guardian provides SOLIDserver with a Rescue mode that allows to answer as many queries
as possible if the local DNS server is unable to do so due to high traffic, as during DDOS attacks.
Rescue
Mode
Internet
best effort
cached
answers for queries
answers
not in the cache
Figure 44.10. DNS Guardian's behavior in Rescue mode
In Rescue mode, DNS Guardian buffers all the queries and behaves as follows:
• If the queried record is in the cache, the response is immediate.
717
DNS Guardian
• Usually, if the queried record is not cached yet, DNS Guardian relays it to your local DNS
server. In Rescue mode, the local DNS server offers a best-effort service to deliver answers
to the clients. If the query is answered, it is cached by DNS Guardian.
• If the queried record has expired, DNS Guardian sends it to the client with the TTL that you
have set beforehand (300 seconds by default) to preserve the local DNS server and potentially
avoid querying it altogether. Keep in mind that you can manually expire all or part of your cache
entries. For more details, refer to the section Forcing Cache Entries as Expired.
For the Rescue mode to be available, DNS Guardian Protection must be enabled. For more details,
refer to the section Enabling DNS Guardian.
Note that DNS Guardian provides you with charts to visualize different Rescue Mode statistics
on the properties page of the server. For more details, refer to the section Monitoring DNS
Guardian Statistics From the GUI.
Enabling Rescue Detection
Rescue detection is enabled by default but can be disabled. For more details, refer to the section
Configuring Rescue Mode.
To enable Rescue mode

3. To enable the Rescue mode detection, use the following command:

set rescue_detection=1
Configuring Rescue Mode
Rescue mode can be triggered for one of the three following reasons:
1. The server reaches a maximum number of queries per second sent from DNS Guardian to
the local DNS server: above the value set, DNS Guardian switches to Rescue mode. Refer
to rescue_high_rec_packet in the table below.
2. The server reaches both:
• A minimum number of queries per second sent from DNS Guardian to the local DNS server,
set by the parameter rescue_min_rec_packet.
• A percentage of these queries that are unanswered. This value acts as a threshold. Refer
to rescue_unanswered_rate in the table below.
3. The server receives a maximum number or percentage of SERVFAIL error messages per
second from the local resolver. This threshold can be set using either the rescue_servfail_qps
or rescue_ratio_servfail parameter.
Table 44.17. Rescue mode parameters

Parameter Default Description
value
rescue_time 5 Sets a check period (<value>*10s) during which the inbound traffic, out-
bound traffic and packet traffic between DNS Guardian and the local DNS
server are monitored to determine if a switch to Rescue mode is needed.
718
DNS Guardian
Parameter Default Description

value
Over this period, a check is performed every 10 seconds and the <value>
sets the number of check performed. By default, it is set to 5, meaning
that over the last 50 seconds (5*10s), DNS Guardian checked 5 times
every 10 seconds if the traffic met the triggering conditions that determine
if a switch to Rescue mode is necessary.
rescue_ttl 300 Defines the TTL values of the cached records queried by clients that
already expired once DNS Guardian is in Rescue mode. It overwrites the
actual record TTL, so we suggest that you set a low value to prevent cli-
ents from keeping an outdated value once DNS Guardian turns off the
Rescue mode.
rescue_min_rec_packet 5000 Sets the minimum number of queries per second received by the local
DNS server that call for an extra check. If the number of queries set is
met, DNS Guardian checks the condition of the parameter rescue_un-
answered_rate to decide if it is necessary to switch to Rescue mode.
rescue_unanswered_rate 10 Sets a percentage of unanswered queries by the local DNS server, based
on the number of queries of rescue_min_rec_packet. If the percentage
of unanswered queries is exceeded, DNS Guardian switches to Rescue
mode.
rescue_high_rec_packet 200000 Sets the maximum number of queries per second sent from DNS
Guardian to the local DNS server, above the value set DNS Guardian
switches to Rescue mode.
rescue_servfail_qps 50000 Sets the maximum number of queries per second answered by the local
resolver with SERVFAIL error messages.
rescue_ratio_servfail 90 Sets the maximum percentage of queries per second answered by the
local resolver with SERVFAIL error messages.
Rescue mode parameters can be set to match your network needs. At any time, you can display
the configuration using the show config command to see if it suits your needs. For more details,
refer to the section Displaying DNS Guardian Configuration.
To configure the Rescue mode parameters

3. To set a rescue mode monitoring period - <number of checks> * 10 seconds - use the follow-
ing command:
set rescue_time=<number-of-checks>
4. To edit the expired records TTL once in Rescue mode - in seconds -, use the following
command:
set rescue_ttl=<number-of-seconds>
5. To trigger the Rescue mode based on a minimum number of received queries per second
and a percentage of unanswered queries, use the following commands:
set rescue_min_rec_packet=<number-of-queries-per-second-received>
set rescue_unanswered_rate=<percentage-of-unanswered-queries-once-the-number-of-queries-is-matched>
6. To trigger the Rescue mode above a number of received queries per second, use the following
command:
719
DNS Guardian
set rescue_high_rec_packet=<number-of-queries-per-second-received>
7. To trigger the Rescue mode based on a maximum number or percentage of queries per
second answered with SERVFAIL error messages, use one of the following commands:
set rescue_servfail_qps=<number-of-queries-per-second-answered-with-SERVFAIL-error-messages>
set rescue_ratio_servfail=<percentage-of-queries-per-second-answered-with-SERVFAIL-error-messages>
Forcing Rescue Mode
When Rescue detection is enabled, you can manually force DNS Guardian to switch into Rescue
Mode, regardless of the threshold(s) you set in the parameters.
To switch into Rescue mode manually

3. To manually switch DNS Guardian into Rescue mode, use the following command:
4. To switch back into normal Rescue mode detection, which uses the threshold(s) you set in
the parameters, use the following command:
Disabling Rescue Detection
Rescue detection is enabled by default but but can be manually disabled, in which case, DNS
Guardian does not switch into Rescue mode if the traffic reaches the threshold(s) you set in the
parameters.
To disable Rescue mode

3. To disable the Rescue mode detection, use the following command:

Disabling DNS Guardian Protection

Disabling DNS Guardian protection allows to stop using the cache to answer client queries but
still update its content:
• DNS Guardian still caches the local recursive server queries/answers but does not send any
information to DNS clients. This can be useful to fill in the cache.
• The server receives and sends new entries to the other DNS Guardian servers if you configured
cache sharing. For more details, refer to the section Sharing the Cache of Several DNS
Guardian Servers.
720
DNS Guardian
• DNS Guardian server ignores the Rescue mode configuration and can never switch to that
mode. For more details, refer to the section Managing DNS Guardian Rescue Mode.
• DNS Guardian server ignores the triggers configured. For more details, refer to the section
Managing DNS Guardian Triggers.
To disable DNS Guardian protection

3. To disable DNS Guardian protection, use the following command:

set blast=0
Disabling DNS Guardian

You can disable DNS Guardian protection to keep filling the cache without arming any trigger or
switching to Rescue mode. For more details, refer to the section Disabling DNS Guardian Protec-
tion. You can also fully disable DNS Guardian from the GUI like any other service.
Keep in mind that when you disable the service:
• DNS Guardian cache is saved automatically, as disabling a service also stops it. Enabling the
service again will starts it as well, which will restore the latest version of the cache.
• In the GUI:
• The Guardian statistics panels on the properties page are no longer displayed.
• The analytics Guardian are no longer available on the page Analytics, instead the DNSTOP
data is available.
Note that if you stop the service, but do not disable it, all the analytics and statistics dedicated
panels and list are still available but the information is outdated and therefore no longer reliable.
To disable the service DNS Guardian
2. In the column Name, look for DNS Guardian.
3. In the column Enabled, click on the link Disabled to enable the service. The wizard opens.
4. Click on OK to commit your changes. The wizard closes. The page is visible again.
to save your changes. The wizard Commit the system configuration changes opens, click
on OK to confirm your choice. The page refreshes.
721
Chapter 45. DNSSEC
Domain Name System Security Extensions (DNSSEC) is used to strengthen DNS protocol security.
It is compatible with the existing DNS system and protects it against spoofing attacks among
other threats. DNSSEC provides origin authentication and integrity protection of DNS information
exchanged between DNS name servers if they both use DNSSEC. Keep in mind that within
SOLIDserver, DNSSEC can be configured on EfficientIP DNS servers and smart architectures
managed via SSL, it is not possible to manage DNSSEC on other DNS vendors.
DNSSEC protects the data from one signed zone to the other and not whole servers. It allows
the recipient to validate the integrity of a DNS answer, whether it is successful or not.
Three concepts emerge from the DNSSEC protocol:
1. DNS data in each zone is cryptographically signed with a couple of public and private Zone
Signing Keys (ZSK) that validate the integrity of the data of each zone. As a result, every RRset
of the zone is assigned a new RRSIG record that includes its own signature. The public key
is then provided to the resolver or application that validates the integrity of the received RR.
The integrity is provided by a chain of trust starting with the public key of a trust anchor.
2. NSEC3 records are generated for each RRset, thus creating an organized chain of all the RRs
of the zone that provides an authenticated denial of existence: if the data is supposed to be
located in an area of the zone where another RR is located, it means that it does not exist.
3. Delegated zones are part of a chain of trust that ensures that every zone is recognized as le-
gitimate by its parent zone. To implement the security of that relation, each delegated zone
ZSK is signed at the parent zone level thanks to a couple of cryptographic Key Signing Keys
(KSK) and a Delegation Signer (DS).
Once DNSSEC is configured, the DNS packages sent and received often exceed 512 bytes, so
we recommend configuring EDNS to extend the size of your DNS messages. For more details
refer to the section Configuring EDNS Options at Server Level.
DNSSEC Records and Chain of Trust

DNSSEC introduces 5 new records, all part of the DNSSEC chain of trust:
• DNSKEY: the public cryptographic key (KSK or ZSK) used to validate signatures.
• RRSIG: the cryptographic signature associated with each set of RR of a zone.
• NSEC3: the Next SECure is located behind each RR and points to the next valid host name
in the zone. If the requested name is not returned, it does not exist.
• NSEC3PARAM: the Next Secure 3 Parameter is an implementation record that determines
the information needed by authoritative servers in DNSSEC requests.
• DS: the Delegation Signer used to verify the validity of the ZSK of a delegated subdomain.
These records are automatically generated once the zone is signed and DNSSEC-compliant,
the zone orders the records automatically.
In addition, you can manually add to a DNSSEC zone CDS and CDNSKEY records. For more
details, refer to the appendix DNS Resource Records Related Fields.
722
DNSSEC
DNSKEY Resource Record

The Domain Name System KEY record uses public key cryptography to sign and authenticate
RRsets. It contains the public key data for the zone, used by the DNSSEC clients during the au-
thentication process.
The DNSKEY record is used to generate the zone public cryptographic keys, a pair of Zone
Signing Key (ZSK) used to sign all the records of the zone, and a Key Signing Key (KSK) used
to sign the ZSKs.
Therefore, three DNSKEY records are generated every time a zone is signed.
Note that in case of unexpected KSK change, you might want to manually add CDNSKEY records
to inform the parent zone of these changes. For more details, refer to the DNSSEC records
configuration fields in appendix.
RRSIG Resource Record

The Resource Record SIGnature records store the digital private signatures of every set of RRs
for each zone (CNAME RRs, DNSKEY records, NSEC, etc.). Therefore, each answer to a DNS
lookup significantly extends the zone file adding RRSIG records after each RRset but also
guarantees secure DNS operations
Each operation is verified as follows: the private key is used to encrypt a hash of an RRset and
stored in an RRSIG record; the public key, stored in the DNSKEY record, allows a resolver to
decrypt the RRSIG. Comparing both the hash of both keys allows to make sure that the RRset
has not been changed.
It is important to understand that RRSIG records sign a set of RRs and not individual records.
Indeed, signing an RRSIG RR would add no value and would create an infinite loop in the signing
process. It is, however, possible to associate several RRSIG with one RRset.
There must be an RRSIG for each RRset using at least one DNSKEY of each algorithm in the
zone apex DNSKEY RRset. The apex DNSKEY RRset itself must be signed by each algorithm
appearing in the DS RRset located at the delegating parent (if any). The RRSIG and the RRset
it covers share the same name and the same class (the RRSIG being class independent). The
RRSIG RR type is 46.
Authoritative RRsets signing involves at least one RRSIG meeting the requirement listed below:
• The RRSIG Type Covered field is equal to the RRset type.

• The RRSIG Original TTL field is equal to the TTL of the RRset.
• The RRSIG RR's TTL is equal to the TTL of the RRset.
• The RRSIG Labels field is equal to the number of labels in the RRset owner name, not counting
the null root label or the leftmost label if it is a wildcard.
• The RRSIG Signer's Name field is equal to the name of the zone containing the RRset.
• The RRSIG Algorithm, Signer's Name, and Key Tag fields identify a zone key DNSKEY record
at the zone apex.
RRSIG records can also be created to verify the NSEC data.
723
DNSSEC
NSEC/NSEC3 Resource Record

The Next SECure resource records provide authenticated denial of existence for DNS RRsets.
They map out the content of a zone by pointing to the next valid label thus creating a chain at
the end of which the last NSEC record points back to the zone root. That way, if a requested RR
is not listed in the response, it does not exist. On the contrary, when a resolver gets a positive
answer and the requested RR name and type are listed in the response, there is no doubt that
the record exists.
However, the main side-effect of NSEC RRs is that they can help enumerate the content of a
zone. That's why the NSEC3 record was designed, it is officially called DNSSEC Hashed Authen-
ticated Denial of Existence record. It is used as a proof of non-existence and uses a specific salt
to cryptographically hash each label to prevent enumeration. The NSEC3 record lists the RR
types present at the original owner name (before they were hashed) and includes the next hashed
owner name in the hash order of the zone.
The owner name for the NSEC3 RR is the base32 encoding of the hashed owner name prepended
as a single label to the name of the zone. The type value for the NSEC3 RR is 50. And like the
RRSIG, it is class independent so its class must be the same as the class of the original owner
name. The TTL of this record should be equal to or higher than the value of the field Minimum
set for the SOA TTL. Only NSEC3RSASHA1, RSASHA256 and RSASHA512 algorithms are
NSEC3 capable.
To assist the requests, NSEC3PARAM was introduced. It contains the NSEC3 parameters needed
by authoritative servers to calculate hashed owner names. These parameters help the authorit-
ative servers choose which set of NSEC3 records are included in the negative responses.
Thus, the zone file of a signed zone is significantly extended by the NSEC3 and the NSEC3PARAM
records. Note that the NSEC3 is automatically generated and located behind the RRs and the
RRSIG to point to the next record and signature of that record.
DS Resource Record
The Delegation Signer resource record is used to secure delegations. Indeed, a DS record points
to a DNSKEY record as it stores the key tag, algorithm number, and a digest of the DNSKEY
RR. With all this information, a resolver can authenticate the DNSKEY record to which the DS
record points.
The DS record and its corresponding DNSKEY RR have the same owner name, but they are
stored in different locations. The DS record appears only on the parental side of a delegation
and is authoritative data in the parent zone, whereas the DNSKEY record is stored in the child
zone. Without a DS in the parent zone, there is no delegation between a zone and its parent.
Keep in mind that you cannot add a DS to a zone if it does not already contain an NS record with
the same name.
The type number for the DS record is 43. As the RRSIG and the NSEC records it is class inde-
pendent. Note that the DS record has no special TTL requirements.
Note that in case of unexpected KSK change, you might want to manually add CDS records to
inform the parent zone of these changes. For more details, refer to the DNSSEC records config-
uration fields in appendix.
724
DNSSEC
DNSSEC Chain of Trust

The DNSSEC chain of trust is the verified electronic signature at each DNS lookup node that
ensures that no rogue can be included into the lookup path and redirect the lookup to a bogus
IP address. In other words, it is a chain of lookups validated by the domain name digital signature
that secures the request through all lookup nodes by providing a validating resolver the correct
path to secured zones.
The starting point of this chain is the trust anchor configured with the validating resolver. The
trust anchor is a DNSKEY or DS record and should be securely retrieved from a trusted source
(not using DNS). This way, any single island of security can be joined to another secure domain
(i.e. signed) through its delegation point and can be authenticated using the final RR in the
DNSSEC set (remember that all the names in the zone have corresponding NSEC records listed
in order and that they create a chain of all the signed record sets).
To set up a proper chain of trust, a sub domain has to be secured and linked to the secured zone
it is a delegated from, this child zone is then linked to its secure parent zone. The trusted anchor
of the parent zone then covers the secured zones and domains that are delegated from it. This
process is sometimes set up all the way up to the TLD.
KSK
"." root zone
com IN DNSKEY sv0LR4loi...4rew89ctb (KSK)

com IN DNSKEY du4tf3...4ss32DDS (ZSK)
com IN RRSIG DNSKEY KSK com ...
com IN RRSIG DNSKEY ZSK com ...
domain.com IN DS KSK sd6zf8q...8ze5d
domain.com IN RRSIG DS .... ZSK com ...
.com zone
security point of entry
domain.com IN DNSKEY r5e4d...7785dd5 (KSK)

domain.com IN DNSKEY t457uc7...4ss362552 (ZSK)
domain.com IN RRSIG DNSKEY KSK eip.com ...
domain.com IN RRSIG DNSKEY ZSK eip.com ...
support.domain.com IN DS KSK sd6zf8q...8ze5d
support.domain.com IN RRSIG DS .... ZSK eip.com ...
domain.com zone
support.domain.com IN DNSKEY 841qe...1d2edd5 (KSK)

support.domain.com IN DNSKEY 8c5dx...d45shc78 (ZSK)
support.domain.com IN RRSIG DNSKEY KSK support.eip.com ...
support.domain.com IN RRSIG DNSKEY ZSK support.eip.com ...
www.support.domain.com IN A 187.65.3.71
www.support.domain.com IN RRSIG A .... ZSK eip.com ...
support.domain.com zone
Figure 45.1. The DNSSEC chain of trust from root to subdomains
Maintaining a valid chain of trust is paramount because broken chains of trust would result in
data being marked as Bogus, which may cause entire (sub)domains to become invisible to veri-
fying clients. The administrators of secured zones have to realize that their zone is, to verifying
clients, part of a chain of trust.
Managing a DNSSEC Resolver

DNSSEC resolvers validate the integrity of the records sent by DNS clients, they ensure the
DNSSEC chain of trust.
725
DNSSEC
Only EfficientIP DNS servers using SSL protocol can be used as DNSSEC resolvers. You can
only manage them on SOLIDserver version 4.0.1 or higher.
Enabling DNSSEC resolution generates a trust anchor that allows to set up a chain of
trust. Once the resolution is set:
• When a DNSSEC resolver receives a response from an unsigned zone that has a signed
parent, it confirms with the parent that the zone was intentionally left unsigned. This operation
is done by verifying, via signed and validated NSEC/NSEC3 records, that the parent zone
contains no DS records for the child. If the DNSSEC resolver can prove that the zone is secure,
then the response is accepted. Otherwise, it assumes that the response is insecure and
probably a forgery, rejects the response and logs an error.
• The trust anchor is accessible on a dedicated page of the GUI. You can display it, associate
it for several servers and delete it.
Enabling a DNSSEC Resolver

You can activate DNSSEC resolution, and validation, on Efficient DNS servers and smart archi-
tectures. In this case, once you set the DNSSEC parameters, all the physical servers it contains
are DNSSEC compliant.
Enabling DNSSEC resolution requires ticking a box when you add or edit a server. Once enabled,
DNSSEC resolution generates a trust anchor that you can manage from the GUI, as detailed in
the sections below.
Besides, on the page All servers DNSSEC resolvers are marked Yes in the column DNSSEC.
To enable DNSSEC resolution on an existing server
4. In the panel DNSSEC, click on EDIT . The wizard Edit DNSSEC properties opens.
5. Tick the box Use DNS as DNSSEC resolver.
6. Make sure a trust anchor is listed among the list Configured Trust Anchor.
If not, or if you want to add a different trust anchor, select one among the Available Trust
Anchor and click on . The selected trust anchor is moved to the list Configured Trust An-
chors.
To remove a trust anchor, select it in the list Configured Trust Anchors and click on .
7. Click on OK to commit the configuration. The wizard closes. In the panel DNSSEC, the
DNSSEC resolution is now Enabled and the list Trust Anchors contains the chosen trust
anchor(s).
On the page All servers, the server is now marked Yes in the column DNSSEC.
726
DNSSEC
Displaying the Trust Anchor

The trust anchor is managed from the Administration tab, on the page Key ring.
From this page, you can access its properties page where you can find all its details in the panels
DNSSEC Keys, Trust Anchor and DNS servers using this Trust Anchor.
To display a trust anchor properties
opens.
2. In the section System, click on Key Ring. The page Key Ring opens, it contains the trust
anchor(s) and ZSKs and KSKs.
3. At the end of the line of the trust anchor of your choice, click on . The properties page
opens.
Applying One Trust Anchor On Several Servers

You can use one trust anchor with several servers, provided that they support it.
To apply a trust anchor to several servers
opens.
2. In the section System, click on Key Ring. The page Key Ring opens. The trust anchor is
listed.
3. At the end of the line of the trust anchor, click on . The properties page opens.
4. In the panel DNS servers using this Trust Anchor, click on EDIT . The wizard DNSSEC chain
of trust configuration opens.
5. In the DNS server list, select a server and click on . The server is moved in the list Selected.
6. Repeat this action for as many servers as needed.
7. Click on OK to commit your changes. The servers are now listed in the panel DNS servers
using this Trust Anchor.
Deleting a Trust Anchor

A trust anchor can only be deleted if it is no longer associated with any server.
To delete a DNSSEC trust anchor
opens.
2. In the section System, click on Key Ring. The page Key Ring opens. The trust anchor is
listed.
3. At the end of the line of the trust anchor, click on . The properties page opens.
4. In the panel DNS servers using this Trust Anchor, make sure no server is listed. If there is
any, click on EDIT and remove them from the list Selected using the button .
5. In the breadcrumb, click on Key Ring. The page Key ring opens.
727
DNSSEC
6. Tick the trust anchor you want to delete.

8. Click on OK to commit the deletion. The trust anchor is no longer listed on the key ring page.
Managing an Authoritative DNSSEC Server

A smart architecture or EfficientIP DNS server becomes an authoritative DNSSEC server once
you signed at least one of the zones it contains.
When you sign a zone, SOLIDserver generates a KSK and two ZSKs that you can configure
yourself.
Signing a Zone
From the page All zones you can sign your zones. During the operation, you can set up notifica-
tions to help you with the key rollover of the signing keys. We strongly recommend setting at
least one notification as any problem within a zone can invalidate an entire server. Keep in mind
that:
• Only Master zones can be signed.

• Signing a zone automatically generates one KSK, it is active right away.
• Signing a zone automatically generates two ZSKs: one is active right away; the other activates
when the first one expires.
To sign a zone
3. Tick the zone(s) you want to sign.
4. In the menu, select Tools > Sign zones. The wizard DNSSEC - Sign Zones opens.
5. Configure the signing keys:
a. Select your ZSK and KSK options. By default, the RSASHA1 algorithm encryption is
selected and we recommend that you keep it selected. However, your KSK value is
probably set by your parent zone.
b. Click on NEXT . The last page of the wizard opens.
6. Configure the alert notifications. You must tick and configure at least one box: Send Mail or
Trap SNMP, you can tick both. The SNMP service must be configured properly. For more
details, refer to the section Managing the SNMP Service.
a. To set up email alert configuration, make sure the box Send mail is ticked. The related
fields are displayed.
728
DNSSEC
Table 45.1. Send mail alert configuration parameters

Mailing lists Select the group of users notified via email. Make sure that you configured an
email address for the users of the group you choose to send the alert to.
Additional Mail Type in the email address that should receive the alert and click on ADD . You
can add as many addresses as you want, the address is moved to the field Addi-
tional Mail List.
Additional Mail List All the addresses listed should receive the alert at the same time no matter their
order in the list.You can edit the content of the list. Click on an entry, it is displayed
again in the field, edit it and click on UPDATE or click on DELETE to remove it from
the list. If you made changes that you do not want to save, click on CANCEL .You
can edit the list:
b. To set up an SNMP Trap, tick the box. The SNMP related fields appear. All the fields
are compulsory.
Table 45.2. SNMP alert configuration parameters

SNMP version Select the version of SNMP, either v2c or v3
SNMP Destination Type in the IP address of the network management platform.
SNMP Community Type in the community string that would act as a password to access the SNMP
agent.
Raised alert SNMP Type in a custom OID to be sent when the alert is raised.
OID
Released alert SN- Type in a custom OID to be sent when the alert is released.
MP OID
7. Click on OK to commit the signature configuration for the zone(s). The report wizard opens
and closes. The zone(s) is marked yes in the column DNSSEC.
Managing the Signing Keys

Even if signing a zone automatically generates the relevant signing keys, you must ensure their
validity. Regenerating your keys is compulsory to ensure the security of your DNSSEC system,
it is part of what is called the key rollover.
Within SOLIDserver, in order to properly secure a zone:
• The ZSK is automatically regenerated. You can also force an earlier check if you suspect their
are compromised.
• The KSK needs to be regenerated manually, ideally once a year.
Managing the Zone Signing Keys
The Zone Signing Keys (ZSK) are automatically generated and regenerated. When you sign
a zone, two ZSKs are generated: the first one is published in the zone and immediately active;
the second one is published but inactive until the active ZSK expires. Both keys are configured
with the same parameters.
The whole set of active keys is checked daily. When the active ZSK expires, the second one is
activated and a third key is published and inactive until the second ZSK expires, etc. Every ZSK
created matches the parameters you set when you signed the zone.
729
DNSSEC
Both the active ZSK and the published ZSK are visible on the page Key Ring.
Zone signing
ZSK 0
published and active inactive key deletion
It is deleted The inactive ZSK is deleted from the
from the GUI DNS after one third of its lifespan
but remains
in the DNS
Future ZSK 1 ZSK 1

published key deletion
It is inactive until the
current ZSK expires
Future ZSK 2 ZSK 2
key deletion
Future ZSK 3 ZSK 3

key deletion
t0 t1 t2 t3 t4
Figure 45.2. ZSK rollover
Inactive ZSKs are automatically deleted from the GUI, and remain in the DNS for one third of
their lifespan before being deleted from the DNS as well. These inactive keys are kept in the
DNS because that information has been cached by other servers. Therefore, the information of
the inactive ZSK is still used to secure the records, unless you edited them after the activation
of the new ZSK. Once the ZSK is deleted from the DNS, all the records are automatically signed
again using the currently active ZSK.
In addition to the automated ZSK rollover, you can force a refresh of the keys or revoke a ZSK.
Forcing a refresh of the ZSKs
From the Key ring, you can check your keys and make sure that they are not compromised or
soon to expire. If they are, new ones are automatically generated to replace them. For more details
regarding the replacement mechanism, refer to the images in the section Revoking a ZSK.
To refresh the ZSKs manually
opens.
3. In the menu, select Expert > Force ZSK refresh. The wizard Forcing the refresh of all the
ZSKs opens.
4. Click on OK to refresh the ZSKs. The report opens and closes. The refresh triggers a new
key generation only if necessary.
Revoking a ZSK
You can select a specific ZSK and delete it from the Key Ring. This operation can be done at
any time, but is particularly useful if you suspect or know that one of your ZSK is compromised.
As there should always be two ZSKs for each signed zone, SOLIDserver automatically replaces
the selected ZSK following the logic below.
730
DNSSEC
• If the active ZSK is revoked

1. The revoked ZSK is deleted from the GUI and the DNS database.
2. The published ZSK is activated to replace it. The new ZSK lasts longer that the initial time
configured when you signed the zone: it lasts for the remaining time of the revoked key plus
it own lifespan.
3. Another ZSK is generated and published. It lasts as long as the active ZSK. When the active
ZSK expires, it replaces it, this time it lasts for the initial period configured when you signed
the zone.
ZSK revocation
ZSK n
published Immediate deletion
and active The ZSK is deleted from
the GUI and the DNS
ZSK n+1
published active key deletion
The published ZSK is activated. It stays
active for the remaining lifetime of
the revoked ZSK and its own lifespan.
ZSK n+2 ZSK n+2

Another ZSK is published Once active, its lifespan
and remains inactive until matches the one configured
the active ZSK expires. when the zone was signed
Figure 45.3. The mechanism when you revoke the active ZSK
• If the published ZSK is revoked

1. The revoked ZSK is deleted from the GUI and the DNS database.
2. Another ZSK is generated and published, matches the active ZSK configuration. It is activated
when the active ZSK expires.
731
DNSSEC
ZSK n
published and active key deletion
ZSK revocation
ZSK n+1
published Immediate deletion
The ZSK is deleted from
the GUI and the DNS
ZSK n+1 ZSK n+1

Another ZSK is published
and remains inactive until
the active ZSK expires.
Figure 45.4. The mechanism when you revoke the published ZSK
To revoke Zone Signing Keys
opens.
3. Tick the ZSK(s) you want to revoke.
4. In the menu, select Expert > Revoke ZSKs. The wizard Revoking ZSKs opens.
5. Click on OK to revoke the selected key(s). The report opens and works for a while. The page
refreshes.
In you revoked an active key, you can see in the column Validity that one of the keys now
has a higher value than the other.
Managing the Key Signing Keys
The Key Signing Key (KSK) has to be managed manually. Indeed, the KSK is generated auto-
matically when you sign the zone but, as you configure it with parameters that can depend on
what was assigned by the Registrar or your parent zone, its regeneration is not automated.
Once you generated the new KSK, you should send the new information to your Registrar or
parent zone.
732
DNSSEC
KSK
KSK t+1
1 2 3 4 5 6 7 8 9 10 11 12 13 14
months
Figure 45.5. KSK rollover
Some time before the KSK expires, you receive an email alert and/or an SNMP trap. When you
get that notification, you should generate a new KSK.
To generate a new KSK
3. Click on the name of the server you want to generate a new KSK for. The page All zones
of the server opens.
4. Tick the zone for which you have to generate a new KSK.
5. In the menu, select Tools > Generate new KSK. The wizard DNSSEC - Generate a new KSK
opens.
6. Edit the Algorithm, Encryption and Validity parameters according to your needs. Usually,
to avoid any conflict, the same algorithm than the previous KSK is used.
7. Click on OK to commit the generation. The report wizard opens and closes.
After the KSK regeneration, you must transmit the new key-related information to your parent
zone to make sure the validation chain is still efficient. To get this information you have to access
the key properties.
To display the new KSK related information
1. Retrieve the new KSK details:

homepage opens.
b. In the section System, click on Key Ring. The page Key Ring opens. In the list, the
columns Start Date and End date display of the two KSK has changed. The rest of the
key configuration is identical, in order to ensure the replacement.
2. Retrieve the new DS information:
b. Click on DNS zones. The page All zones opens.
c. At the end of the line of the zone you just signed, click on . The properties page opens.
d. Open the panel DS Keys, in the DS list a new DS has been generated along with the
new KSK.
733
DNSSEC
3. Send both the KSK and DS information to the parent zone.
Managing the Delegation Signer

Without the Delegation Signer (DS) pointing to the right zone, DNSSEC resolvers cannot
authenticate the zone and clients cannot access it.
To be part of the zone's Chain of Trust, the DS has to be provided to your parent zone. For more
details, refer to the section Retrieving the Delegation Signer Information.
If you are delegating zones to manage your subdomains, you can use the DS record to include
them to the Chain of Trust. For more details, refer to the section Using the Delegation to Include
Subdomains to the Chain of Trust.
KSK
"." root zone
com IN DNSKEY sv0LR4loi...4rew89ctb (KSK)

com IN DNSKEY du4tf3...4ss32DDS (ZSK)
com IN RRSIG DNSKEY KSK com ...
com IN RRSIG DNSKEY ZSK com ...
domain.com IN DS KSK sd6zf8q...8ze5d
domain.com IN RRSIG DS .... ZSK com ...
.com zone
security point of entry
domain.com IN DNSKEY r5e4d...7785dd5 (KSK)

domain.com IN DNSKEY t457uc7...4ss362552 (ZSK)
domain.com IN RRSIG DNSKEY KSK eip.com ...
domain.com IN RRSIG DNSKEY ZSK eip.com ...
support.domain.com IN DS KSK sd6zf8q...8ze5d
support.domain.com IN RRSIG DS .... ZSK eip.com ...
domain.com zone
support.domain.com IN DNSKEY 841qe...1d2edd5 (KSK)

support.domain.com IN DNSKEY 8c5dx...d45shc78 (ZSK)
support.domain.com IN RRSIG DNSKEY KSK support.eip.com ...
support.domain.com IN RRSIG DNSKEY ZSK support.eip.com ...
www.support.domain.com IN A 187.65.3.71
www.support.domain.com IN RRSIG A .... ZSK eip.com ...
support.domain.com zone
Figure 45.6. The Delegation Signer (DS) within authoritative zones
Retrieving the Delegation Signer Information
The Delegation Signer information is essential to set up a valid Chain of Trust, it must be retrieved
and transmitted to the parent zone and it can also be used to include your delegated subdomains
to the Chain of Trust.
The DS information of each zone is available on the zone properties page, in the panel DS keys.
From there, you can copy/paste it and then send it. Note that this panel is also available on the
properties page of the KSK of the zone.
To retrieve the DS information
734
DNSSEC
4. In the panel DS Keys, all the DS record(s) information is displayed.
For each DS record, there are two lines, both share the same key tag, but have a different
digest type. Each line contains the zone name and RR type followed by a key tag, algorithm
key, digest type and digest for the DS record.
Figure 45.7. Example of a panel DS Keys
In the image, the underlined section right of DS, contains the key tag, algorithm key, digest
type and digest, separated by a space, of the DS record for the zone mycompany.com. In
the DS record addition wizard, they each have a dedicated field. From this example, we can
extract the following values:
Key Tag 50934

Key Algorithm 7
Digest Type 2
Digest 5CC525FF1972741B3B4668982E27174113838187F740F0BA16C9D1E119E3BDF4
When you identified the DS record of your choice, you only need one of the two lines.
Preferably, you should retrieve the second line, encrypted with the digest type 2.
5. Retrieve the information that suits your needs:
a. To transmit the DS information to a parent zone, copy the entire line of DS record that
suits your needs, paste it in the document of your choice and send it.
Note that you can also tick a zone and export the column DS to a CSV file. For more
details, refer to the chapter Exporting Data.
b. To include a delegated subdomain to the Chain of Trust, retrieve the Key tag, Algorithm
Key, Digest Type and Digest of the child zone. You will use them to create a DS record
in the parent zone following the procedure in the section Using the Delegation to Include
Subdomains to the Chain of Trust. The image below details them.
Note that, if your parent zone supports it, you can also add a CDS record to let the parent zone
retrieve information and be informed of any changes. For more details, refer to the DNSSEC re-
cords configuration fields in appendix.
Using the Delegation to Include Subdomains to the Chain of Trust
If you are managing a domain and its subdomains in separate zones, you might want to include
the child zones to the Chain of Trust. Instead of creating a Trust anchor for each delegated sub-
domain, you can declare the delegation signer information of each child zone in the parent zone.
To include your delegated subdomains to the Chain of Trust, you must:
735
DNSSEC
1. Retrieve the DS keys details of the child zone (its Key Tag, Key Algorithm, Digest Type and
Digest), as detailed in the section Retrieving the Delegation Signer Information.
2. Add a DS record and configure it with the child zone DS keys details in the parent zone, as
detailed below.
Once the parent zone contains a DS record for each child zone, the Chain of Trust includes both
the domain and all its delegated subdomains.
Keep in mind that you cannot add a DS to a zone if it does not already contain an NS record
with the same name. For more details, refer to the section Adding an NS Record.
To add a DS to a parent zone
3. Click on the name of the parent zone where you want to add a DS. The page All RRs of the
zone appears.
4. In the menu, select Add > RR > RR (record). The wizard Add a DNS RR opens.
5. In the drop-down list RR type, select DS.
6. In the field RR name, name the record as follows: dsname.zonename .
7. In the field TTL and drop-down list, you can edit the default value. Changing one field auto-
matically edits the other. By default, the TTL is of 3600 seconds (1 hour).
8. In the field Key Tag, paste the child zone key tag.
9. In the field Key Algorithm, paste the child zone algorithm key.
10. In the field Digest Type, paste the child zone digest type.
11. In the field Digest, paste the child zone digest.
12. Click on OK to commit the DS RR creation. The report opens and closes. The RR is listed
on the page All RRs, its value corresponds to the content of the fields Key Tag, Algorithm
Key, Digest Type and Digest separated by a comma.
Disabling DNSSEC
When you no longer want to use DNSSEC, you can disable it:
• You can unsign zones and then purge them to ensure they no longer manage DNSSEC records.
• You can enable and disable DNSSEC keys (KSKs and ZSKs), unused DNSSEC keys are
automatically deleted after a while. You can also invalidate inactive or compromised keys.
Enabling and Disabling Keys

Within SOLIDserver, enabling or disabling a key means deleting or regenerating the DNSKEY
RR of the corresponding DNS zone.
If not handled properly, disabling a key can be a very risky operation: disabling the wrong key
could affect the zone and all it subdomains and could for instance make it a dark zone.
Disabling a key does not delete it, however, disabling an active key:
• Changes its Status to Delayed Delete on the page All RRs.
736
DNSSEC
• Changes its Status to Disabled on the page Key Ring.

• Deletes the corresponding DNSKEY RR and could make the validation impossible as the zone
would be unavailable for query: the corresponding zone appears Broken on the page All zones.
To enable/disable a key
opens.
3. Tick the disabled ZSK or KSK you want to enable.
4. In the menu, select Expert > Enable or Disable. The opens.
5. Click on OK to commit your changes. The selected keys is marked as Enabled or Disabled
in the column Status.
Unsigning DNSSEC Zones

Unsigning a DNSSEC zone means disabling every key of a zone. Keep in mind that:
• Unsigning a zone also unsigns all the children zones it was associated with, thus breaking any
previously created chain of trust.
• Zones signed using HSM must be unsigned using the HSM as well: the server managing these
zones must have the box Enable HSM ticked when you unsign the zones. That way you ensure
that both SOLIDserver and the HSM module are notified that one zone is no longer part of the
DNSSEC delegation. For more details, refer to the chapter HSM.
To unsign DNSSEC zones
opens.
3. Tick all the keys you wish to unsign.
4. Make sure that the trust anchor is not selected as you cannot disable or unsign a trust anchor.
5. In the menu, select Expert > Disable. The wizard Enable / Disable DNSSEC keys opens.
6. Click on OK to commit your changes. The keys are marked Disabled in the column Status
on the page Key Ring and, as it is no longer DNSSEC-compliant, the zone is marked No in
the column DNSSEC of the page All zones.
Purging DNSSEC Zones

This functionality allows you to verify that DNSSEC records have been removed from the server
and that the keys have been deleted from the key ring. It only applies to unsign zones. Purging
DNSSEC zones ensures that both the key ring and the DNS server store the same data. Indeed,
it allows you to delete the keys stored in the key ring from the DNS tab.
To purge DNSSEC zones
737
DNSSEC
3. Tick the zone you wish to purge.

4. In the menu, select Tools > Expert > Purge DNSSEC Records. The wizard Purge zones
from DNSSEC records opens.
5. Click on OK to commit the purge. The key ring is now key-less and the DNSSEC keys have
also been removed from the list All RRs.
Invalidating a Compromised KSK

The invalidation functionality should only be used to get rid of a compromised KSK. You should
never invalidate a KSK considering that is has heavy consequences and cannot be undone. At
a technical level, invalidating a KSK means modifying its DNSKEY RR: by changing the bit mask
of that record, you invalidate the key. In SOLIDserver, you have to invalidate a KSK before dis-
abling it.
Note that invalidating the KSK protects your zone from attacks and allows you to replace this key
safely.
Once you invalidated a KSK, do not forget to transmit the DS or Public Key of the old KSK
and new KSK. There are four main steps to follow to properly invalidate a compromised KSK of
your zone:
1. Generating a new KSK to make sure that you do not invalidate the whole zone once you inval-
idated the compromised one.
2. Invalidating the compromised KSK to replace it with the new one.
3. Disabling the compromised KSK to update its RRs. This changes its value in the zone list.
Then you have to enable it again to ensure that the compromised key cannot be used again
by anyone.
4. Notifying the changes. Once you invalidated your KSK, you have to transmit a copy of the in-
validated DS set to your parent zone or a copy of the Public Key to your Registrar.
To safely protect a zone while getting rid of a compromised KSK
1. Generate a KSK
c. Click on the name of the server you want to generate a new KSK for. The page of its
zones opens.
d. Tick the zone for which you have to generate the KSK.
e. In the menu, select Tools > Generate new KSK. The wizard DNSSEC - Regenerate key
opens.
f. Edit the Algorithm, Encryption and Validity options according to your needs. Usually,
to avoid any conflict, the same algorithm than the previous KSK is used.
g. Click on OK to commit the generation. The report wizard opens and closes.
The new KSK is automatically Enabled and visible in the key ring (Administration tab >
Key Ring).
738
DNSSEC
2. Invalidate the compromised KSK

homepage opens.
b. In the section System, click on Key Ring. The page Key Ring opens.
c. Tick the KSK you wish to invalidate.
d. In the menu, select Expert > Invalidate Keys. The wizard Invalidate Keys opens.
e. Click on OK to commit the key invalidation. The invalidated KSK is now marked as (in-
validated) in the list but is still marked as Enabled in the column Status.
3. Disable the compromised KSK
a. Tick the invalidated KSK.

b. In the menu, select Expert > Disable. The wizard Enable/Disable keys opens.
c. Tick the same invalidated KSK again.
d. In the menu, select Expert > Enable. The wizard Enable/Disable keys opens. In the list
All RRs of the invalidated zone, the value of the DNSKEY RR has been modified.
4. Notify the DS and Public Key changes
a. At the end of the line of the invalidated key, click on . The properties page opens.
b. Copy the content of the fields DS and Public Key.
c. Paste it in the file of your choice and send it.
Deleting Unused DNSSEC Keys

To enhance the keys management EfficientIP provides an automatic check of their validity. Every
night at midnight, the rule checks that each and every KSK or ZSK listed in the Key Ring is actually
being used. This check involves finding DNSKEY RRs in the relevant zone RRs list. If none is
found, the corresponding key is deleted and therefore removed from the page Key Ring.
However, you might want to remove the unused keys to clean up the system. That's why,
SOLIDserver provides you with an option that allows to manually executes the automatic check
rule.
To manually remove unused DNSSEC keys
Before following this procedure, make sure you unsigned the zones properly.
opens.
3. In the menu, select Expert > Remove unused DNSSEC keys. The wizard Remove unused
DNSSEC keys opens.
4. Click on OK to commit the unused keys deletion. The report opens and closes. The relevant
keys are deleted.
739
Chapter 46. HSM
The goal of this chapter is to detail the procedures to sign Master zones with DNSSEC using a
Hardware Security Module (HSM). This operation is only possible with an EfficientIP DNS server,
either managed by a smart architecture or not.
A Hardware Security Module (HSM) is a physical crypto processor dedicated to generating,

storing and managing encryption keys. It provides strong authentication, through accelerated
cryptographic operations, and multiple levels of security. With SOLIDserver, you can sign Efficien-
tIP DNS servers' zones with DNSSEC using HSM encryption.
DNSSEC is an extension to DNS that provides a way to authenticate DNS responses, thus pre-
venting DNS traffic interference such as man in the middle attacks. For DNSSEC to function
1
properly, it is essential for the private keys, ZSK and KSK, to be protected . With HSM, the private
keys never leave the module thus preventing any exposition to potential attacks, on the network
or host computer. SOLIDserver is compatible with the Thales nShield 500 HSM.
To ensure a secure communication with a DNS server, the HSM relies on:
• The Security World (SW), a closed architecture that describes the global cryptographic
environment
The SW is used to encrypt recovery data and authorize the creation of Operator Card Sets
(OCS) that can be required for the module to function. For redundancy, it can manage several
HSM servers, i.e. modules, but is supervised using a unique Administrator Card Set (ACS).
You can create your own SW or integrate your SOLIDserver appliance to an existing one.
• The Remote File System (RFS) that contains the keys and configuration data
Every key is generated on the RFS, sent to the module for encryption and sent back to the
RFS for storage. Any time the server needs a key, the encrypted key is transmitted by the RFS
to the module(s) for decryption and sent straight to the server.
There should be one RFS by Security World stored either locally on your SOLIDserver appliance
or, if you want to integrate your SOLIDserver appliance to an existing SW, on an external
2
server .
Prerequisites
• Only users of the group admin can perform the operations detailed in this chapter.
• Only the Thales nShield Connect 500 HSM is supported.
• Your license must be valid and include the DNS module.
• Your SOLIDserver appliance should be added to the HSM authorized client list using the
proper ACS. For more details, refer to the documentation of your HSM.
• Master zones to be signed with the HSM must be managed by an EfficientIP DNS server,
whether in a smart architecture or not. This feature is not compatible with other types of DNS
servers.
1
For more details, refer to the chapter DNSSEC.
2
The RFS storage being remote in essence, you need to choose a server that offers enough data security to store the RFS outside of
the HSM.
740
HSM
• To properly secure appliances in High Availability, it is strongly advised to set up the HSM on
each of them before enrolling the Hot Standby.
Limitations
• The HSM slot is common to all the HSM queries. You cannot set it per DNS server.
• Deleting private keys from SOLIDserver does not trigger automatic deletion on the RFS. For
more details regarding how to delete them from the RFS, refer to the documentation of your
HSM.
• A card from the OCS needs to be inserted in the HSM for encryption to work. Softcards, i.e.
virtual security tokens, are not supported.
• K/N quorum is not supported, only 1/N is. This means you cannot require more than one card
to use a module.
• When the HSM feature is enabled on an EfficientIP DNS server, all the zones you sign with it
are signed using the HSM, i.e. you cannot sign some zones with the module and others without
it.
• All the Master zones signed using the HSM must also be unsigned using the HSM.
Browsing HSM Servers

When the HSM has been fully configured, the page Services configuration provides you with
the properties you have set for the HSM module(s). Once enrolled and enabled, the status of the
service DNS server (HSM) should be OK . The service DNS server (Named) should be
Disabled.
To display the HSM servers list
opens.
2. In the section System, click on Services. The page Services configuration opens.
3. In the column Name, the different properties of the HSM are listed below the service nFast
Hardserver.
741
HSM
Figure 46.1. HSM service configuration
HSM Protection
On the page Services configuration, in the column Name, the service HSM Protection is followed
either by OCS, if the module is configured to function only when a physical smart card is inserted,
or Module if no card is required.
If a PIN code has been specified for the OCS, the column Configuration displays the mention
PIN code:****.
RFS Server
On the page Services configuration, the column Configuration of the service RFS server indic-
ates the IP address of the server on which the RFS is stored. If the RFS is stored locally on the
SOLIDserver appliance, the column displays the mention Local instead.
HSM Servers
For redundancy, you can manage several modules, also referred as HSM servers in SOLIDserver,
within the same Security World. They are listed under the service HSM servers on the page
Services configuration:
• The column Name indicates the name and IP address of the module(s) enrolled by SOLIDserver.
• The column Configuration displays the electronic serial number (ESN) and hash of the KNETI
key (KNETI HASH) in use for each module.
• The column Status provides information regarding the modules - or HSM servers - you manage.
Table 46.1. HSM server statuses

Status Description
OK The HSM module or service is operational.
Missing RFS The RFS is missing and the HSM server is not operational.
Not identified The HSM module is not identified and therefore not operational.
Not enrolled The HSM module is not enrolled and therefore not operational.
742
HSM
In case a module fails, whether you are managing only one or several modules, there is
no visual indication on the GUI.
However, the logs in the file named.log indicate that SOLIDserver has switched back from the
service DNS server (HSM) to DNS server (named) to sign zones with DNSSEC. For more details
regarding how to display logs, refer to the section Logs Visualization.
Figure 46.2. HSM error log
In both cases, it is necessary to stop the service DNS server (HSM) and restart it before you can
use it again to sign zones. For more details regarding how to restart a service, refer to the section
Starting or Stopping a Service.
Setting Up the HSM

Setting up the HSM for DNSSEC zone signature requires to:
1. Set up the service nFast Hardserver that represents the Security World.This implies configuring
the HSM protection, the RFS server and the IP address of each physical module, called HSM
servers in the GUI. For more details, refer to the section Setting Up the Service nFast Hard-
server.
2. Switch from the classic service DNS Server (named) to DNS Server (HSM) . For more details,
refer to the section Switching from DNS Server (named) to DNS Server (HSM).
3. If you plan on using HSM with High Availability, set up the service nFast Hardserver and switch
to the proper DNS service as detailed in the the two previous steps on both appliances before
you enroll the Hot Standby. For more details, refer to the chapter High Availability Management.
You can however set up your HSM on appliances already in HA and force the synchronization
within a minute. For more details, refer to the section Enable HSM on Appliances Already in
High Availability.
4. Enable HSM on the servers managing zones that you want to sign using HSM. For more details,
refer to the section Signing Zones Using HSM and DNSSEC.
Setting Up the Service nFast Hardserver

To enroll an HSM with SOLIDserver, you need to enable and configure the service nFast Hard-
server from the Administration module.
If you want to specify a communication slot different from the default ones, follow the procedure
in the section Adding a Custom Communication Slot below. Otherwise, go straight to the section
Enabling the Service nFast Hardserver.
Adding a Custom Communication Slot
To communicate with the Thales nShield Connect 500 HSM, SOLIDserver uses the preconfigured
slots 492971158 for OCS protection and 492971157 for Module protection.
If you want to specify a different slot than the default ones, you need to add a new item in the
Registry database. Otherwise, go straight to the section Enabling the Service nFast Hardserver.
743
HSM
To add a custom slot ID
opens.
opens.
4. In the field Name, type in module.dns.hsm_slot .
5. In the field Value, type in the number of your slot.
6. Click on OK to commit the addition.The report opens and closes.The page Registry database
is visible again.
opens.
8. In the section System, click on Services. The page Services configuration is visible again.
Enabling the Service nFast Hardserver
To properly enroll a module with SOLIDserver, you need to enable the service nFast Hardserver
before configuring it.
If you plan on using HSM with High Availability, make sure to set up and enable the service nFast
Hardserver on both the future Master and the Hot Standby before configuring the association.
To enable the service nFast Hardserver
opens.
3. In the column Name, find the service nFast Hardserver.
4. In the column Enabled, click on Disabled to enable the service. The wizard Enable a service
opens.
5. Click on OK to commit your choice. The report opens and closes. The service starts automat-
ically but is listed in red because the configuration is still pending.
6. In the menu, select Tools > Apply configuration. The wizard Commit the system configur-
ation changes opens.
nFast Hardserver is marked OK.
Configuring the Service nFast Hardserver
The service nFast Hardserver allows to enroll one or several modules. To configure the service,
you can:
• Either specify an existing Security World by declaring the IP address of its Remote File System,
744
HSM
• Or use your SOLIDserver as the local RFS, in which case, it would contain the Security World
needed to authenticate your data exchanges.
To configure the service nFast Hardserver
1. On the HSM, add your SOLIDserver to the authorized clients list. For more details, refer to
the documentation of your HSM.
opens.
4. In the column Name, click on the service nFast Hardserver. The wizard HSM server config-
uration opens.
5. In the drop-down list Protection method, set the configuration that suits your needs:
Table 46.2. HSM protection configuration

Field Description
Module The module doesn't need a physical smart card from the Operator Card Set (OCS) to
function. By default, this option is selected.
OCS The module functions only when a card from the OCS is inserted. If selected, the page re-
freshes and displays the field OCS PIN code.
OCS PIN code Type in a password for the OCS, it should be the same for every card of a given set. If you
want to integrate SOLIDserver to an existing Security World, use the related PIN code.

7. Set the configuration that suits your needs for the module you are enrolling:
Table 46.3. HSM protection configuration

Field Description
Name Type in a name for the module.
IP address Type in the IP address of the module.
Description Type in a description for the module.
Override default parameters Tick this box to set additional parameters. If selected, the page refreshes
and displays the boxes Force enrollment and Privilege.
Force enrollment Tick this box to force the reconfiguration of the module if it has once been
enrolled by SOLIDserver.
Privilege Tick this box if you want SOLIDserver to request a connection with privileges
to the module.
8. Click on ADD to commit your addition. The page refreshes and the server is moved to the
list HSM servers.
• To update an entry, select the module of your choice, edit the data and click on UPDATE .
• To delete an entry, select the module of your choice and click on DELETE .
• To add another module to the Security World, repeat steps 7 and 8.
745
HSM

10. In the drop-down list RFS, set the configuration that suits your needs:
Table 46.4. RFS storage configuration

Field Description
Local The HSM uses SOLIDserver as the Remote File System to store the Security World for
authentication and data exchanges. By default, this option is selected.
Remote The HSM uses an external server to store the RFS, which can be the one of an existing
Security World. The page refreshes and displays the field IP.
IP Set the IP address of the external server used to store the RFS.
11. Tick the box Expert mode to set additional parameters:
Table 46.5. RFS expert mode configuration

Field Description
Force setup Tick this box to overwrite the previous RFS server configuration.
Address Type in the IP address of a client you want to grant write access to the RFS.
Name Type in a name for the client.
Description Type in a description for the client.
12. If you specified a client with write access, click on ADD to commit your addition. The page
refreshes and the client is moved to the list Allowed clients.
• To update an entry, select the client of your choice, edit the data and click on UPDATE .
• To delete an entry, select the client of your choice and click on DELETE .
• To grant another client write access to the RFS, repeat steps 11 and 12.
13. Click on OK to commit your addition. The report opens and closes. The page Services con-
figuration is visible again. The enrolled modules are listed under the line HSM servers along
with their ESN and KNETI-HASH. The statuses of the nFast Hardserver and module(s)
should be OK . For more details, refer to the section Browsing HSM Servers.
Switching from DNS Server (named) to DNS Server (HSM)

To enable the DNS service dedicated to HSM, once the service nFast Hardserver is configured,
you must:
1. Disable the service DNS server (named).

2. Enable the service DNS server (HSM).
These instances cannot be running at the same time. To stop using the HSM, refer to the section
Best Practices to Stop Using the HSM.
Note that, if you enable the service DNS server (HSM) before adding any HSM server, the service
Status should be ! No HSM found. In this case, you need to add the HSM server and restart
the service DNS server (HSM).
746
HSM
To switch from DNS Server (named) to DNS Server (HSM)
opens.
3. In the column Name, find the service DNS server (named).
4. Disable the service DNS server (named).:
a. In the column Enabled, click on Enabled to disable the service. The wizard Disable a
service opens.
b. Click on OK to commit your choice. The report opens and closes. The service starts
automatically but is listed in red because the configuration is still pending.
c. In the menu, select Tools > Apply configuration. The wizard Commit the system con-
figuration changes opens.
d. Click on OK to commit your choice. The report opens and closes. The page Services
configuration is visible again and the service is marked Disabled.
5. In the column Name, find the service DNS server (HSM).

6. Enable the service DNS server (HSM):
a. In the column Enabled, click on Disabled to enable the service. The wizard Enable a
service opens.
configuration is visible again and the service is marked Enabled.
When the service DNS server (HSM) is enabled, you can start signing zones through EfficientIP
DNS servers.
Enable HSM on Appliances Already in High Availability

It is strongly advised to set up the HSM before configuring High Availability. However,you can
still force HSM synchronization by Setting Up the Service nFast Hardserver and Switching from
DNS Server (named) to DNS Server (HSM) on both Master and Hot Standby appliances and
then following the procedure below.
To force HSM synchronization with the Hot Standby
1. Connect to the Master appliance.

opens.
747
HSM
opens.
4. In the column Name, type in module.system.file_sync_period and hit Enter. The key is the
only one listed.
5. In the column Value, click on the value. The wizard Registry database edit a value opens.
6. In the field Value, type in 60 to force the replication on the Hot Standby within the minute.
The default value is 3600.
is visible again.
8. Wait for more than 60 seconds, in order for the Hot Standby to synchronize.
9. Connect to the Hot Standby.
10. Restart the DNS and HSM services:
a. Disable the Service nFast Hardserver. For more details, refer to the section Disabling
the Service nFast Hardserver.
b. Switch from DNS Server (HSM) to DNS Server (named). For more details, refer to the
section Switching from DNS Server (HSM) to DNS Server (named).
c. Enable the Service nFast Hardserver. For more details, refer to the section Enabling
the Service nFast Hardserver.
d. Switch from DNS Server (named) to DNS Server (HSM). For more details, refer to the
section Switching from DNS Server (named) to DNS Server (HSM).
11. Repeat steps 1 to 5.

12. In the field Value, type in the value 3600.
is visible again.
Signing Zones using DNSSEC and HSM

To sign zones with DNSSEC and your HSM, you need to tick the box Enable HSM on an EfficientIP
DNS server and, if need be, the smart architecture that manages it. This feature is not compatible
with other types of DNS servers. Once the feature is enabled, signing zones follows the same
procedure as detailed in the chapter DNSSEC, but the zone data is encrypted and stored in the
HSM.
Keep in mind that:
• From a server with the HSM feature enabled, all the Master zones are signed using the
HSM.
You cannot sign some zones with the HSM and others without it.
• All the Master zones signed using the HSM must also be unsigned using the HSM.
When you unsign the zones, you must make sure that the box Enable HSM is still ticked.
To enable HSM on an EfficientIP server or a smart architecture
748
HSM
3. At the end of the line of the server or smart architecture of your choice, click on . The
6. Tick the box Enable HSM to use HSM when you sign the server's zones with DNSSEC.
7. Click on OK to commit your configuration. The report opens and closes. The server or smart
architecture is listed and uses HSM to authenticate DNSSEC keys.
8. Repeat steps 3 to 8 for as many servers or smart architectures as needed.
Best Practices to Stop Using the HSM

At any time, you can completely stop using encrypted data communication via the module. To
do so, you need to connect to SOLIDserver GUI using the credentials of a user belonging to the
group admin and follow the steps below:
1. Delete all the HSM servers from the list as detailed in the section Deleting an HSM Server.
2. Disable the service nFast Hardserver as detailed in the section Disabling the Service nFast
Hardserver.
3. Switch back from the service DNS server (HSM) to DNS server (named) as detailed in the
section Switching from DNS Server (HSM) to DNS Server (named).
4. Disable HSM on the EfficientIP DNS servers and smart architectures on which it is enabled
as detailed in the section Disabling HSM on DNS Servers and Smart Architectures.
Deleting an HSM Server

At any time you can delete an HSM server from the list. This action purges all the configuration
files of the module thus preventing any communication with SOLIDserver. It also forces a cleanup
of all the related files. The HSM server should no longer be listed on the page Services configur-
ation.
To delete an HSM server
opens.
3. In the column Name, click on the service nFast Hardserver. The wizard HSM server config-
uration opens.
5. In the list HSM servers, click on the module you want to delete. The page refreshes and the
fields display the module's details.
6. Click on the button DELETE . The page refreshes, the fields are emptied and the server is re-
moved from the list.
7. Repeat steps 5 and 6 for as many servers as needed.
749
HSM

9. Click on OK to commit your addition. The report opens and closes. The page Services con-
figuration is visible again and the HSM server is no longer listed.
Disabling the Service nFast Hardserver

Once the HSM servers are deleted, you must disable the service nFast Hardserver.
To disable the service nFast Hardserver
opens.
3. In the column Name, locate the service nFast Hardserver.
4. In the column Enabled, click on Enabled to disable the service. The wizard Disable a service
opens.
5. Click on OK to commit your choice. The report opens and closes. The service starts automat-
ically but is listed in red because the configuration is still pending.
6. In the menu, select Tools > Apply configuration. The wizard Commit the system configur-
ation changes opens.
7. Click on OK to commit your choice. The report opens and closes. The page refreshes, the
service nFast Hardserver is marked as Disabled.
Switching from DNS Server (HSM) to DNS Server (named)

As the service DNS server (HSM) is not fully functional at this point, it is necessary to enable
back the service DNS server (named) to handle the requests resolution.
To switch from DNS Server (HSM) to DNS Server (named)
opens.
3. In the column Name, find the service DNS server (HSM).
4. Disable the service DNS server (HSM).:
a. In the column Enabled, click on Enabled to disable the service. The wizard Disable a
service opens.
configuration is visible again and the service is marked Disabled.
750
HSM
5. In the column Name, find the service DNS server (named).

6. Enable the service DNS server (named):
a. In the column Enabled, click on Disabled to enable the service. The wizard Enable a
service opens.
configuration is visible again and the service is marked Enabled.
Disabling HSM on DNS Servers and Smart Architectures

To remove the remaining link between the HSM and the DNS server(s) you used to sign zones,
you need to untick the box Enable HSM.
To disable HSM on an EfficientIP server or a smart architecture
3. At the end of the line of the server or smart architecture of your choice, click on . The
6. Untick the box Enable HSM to stop using HSM when you sign the server's zones with
DNSSEC.
7. Click on OK to commit your configuration. The report opens and closes. The server or smart
architecture is listed and does not use HSM anymore to authenticate DNSSEC keys.
8. Repeat steps 3 to 9 for as many servers or smart architectures as needed.
751
Chapter 47. Monitoring and Reporting
DNS Data
SOLIDserver provides a set of tools to monitor DNS servers and generate reports.
• The alerts that you can set on the DNS pages allow to customize your monitoring. For more
details, refer to the chapter Managing Alerts.
• A set of statistics are available in dedicated panels of the properties page of DHCP servers,
as detailed in the section Monitoring DNS Servers From their Properties Page.
• A set of data sampling analytics are available on the page Analytics, as detailed in the section
Monitoring DNS Servers From the Page Statistics.
• A couple of tools allow to monitor a DNS server querylog and answerlog, as detailed in the
section Monitoring DNS Queries and Answers.
• A number of reports on servers, views and zones are available, as detailed in the section
Generating DNS Reports.
Monitoring DNS Servers From their Properties Page

On the properties page of a physical or smart DNS server, some panels are dedicated to monit-
oring queries and changes. The monitoring panels are the following:
• DNS server statistics <server-name> displays query dedicated charts for the physical servers,
except DNS Hybrid servers. This data is retrieved using SNMP, therefore, the graphs are empty
if the SNMP is not configured properly. To edit the SNMP parameters of an EfficientIP DNS
server, refer to the section Editing the SNMP Monitoring Parameters of an EfficientIP DNS
Server.
• State log displays the server logs.
• Audit displays all the latest changes performed on the server by the user logged in.
Note that you might have additional panels called Guardian - <data> on the properties page, if
you have enabled DNS Guardian on your appliance. For more details, refer to the chapter DNS
Guardian.
To display a DNS physical server query statistics
open.
4. Open the panel DNS server analytics <physical-server-name> using .
752
Monitoring and Reporting DNS Data
Note that this panel can be displayed on any dashboard, like the other gadgets. For more details,
refer to the section Assigning a Gadget from a Resource Properties Page.
To display a DNS server state log
open.
4. Open the panel State log using . The panel content retrieves the server state in the logs:
OK , KO, Invalid settings... and the time and date for each.
To display a DNS server audit
open.
4. Open the panel Audit using . The panel displays the latest changes in the database.
The Date and time it occurred, the Service used, the user and the User performing the oper-
ation and the server basic information: DNS name, DNS type and Architecture if relevant.
By default, it lists the changes carried out by the user logged in, but if they belong to a group
with access to the changes from all users, the panel displays all the operations ever per-
formed. For more details, refer to the section Allowing Users to Display All the Operations
Performed.
Monitoring DNS Servers From the Page Analytics

The page Analytics provides data sampling via DNS query dedicated Top 50 lists for the EfficientIP
DNS physical servers and the Hybrid DNS servers you manage. There are some limitations de-
tailed in the section DNS Analytics Limitations.
The analytics functionality is enabled by default and samples the DNS traffic over specific periods
of time. By default, it offers 5-minute samples. If you want to set a shorter or bigger periodicity,
refer to the section Configuring the Analytics Retrieval.
You can set up an alert on the entries displayed. For more details, refer to the chapter Managing
Alerts.
Accessing the Page Analytics

The page Analytics offers dedicated Top 50 data samples based on the DNS queries of the
physical servers.
753
The Top 50 information compares data retrieved over a specific periodicity, a limited period of
time, that is set by default to a sample time of 5 minutes.You can edit the sampling period following
the procedure in the section Configuring the Periodicity.
Note that the page might contain Top 50 samples and DNS Guardian data. If you display the
Analytics of a specific server, either DNS data or DNS Guardian data is displayed. For more details
regarding DNS Guardian data, refer to the section Monitoring DNS Guardian Statistics From the
GUI.
To display the page Analytics
2. Click on Analytics. The page Analytics opens and offers data for all the DNS servers you
manage.
To display the page Analytics of a specific physical server
opens.
4. In the breadcrumb, click on Analytics. The page Analytics of the server opens.
Each column provides and compares message information over the specified sample time:
Table 47.1. The columns on the page Analytics

Column Description
Server The name of the physical server, it is display the page for all the servers. Click on a server
name to display only the analytics of that server.
Start date The time and date when the data retrieval started.
End date The time and date when the data retrieval stopped. The end date respects the number of
minutes set in the periodicity.
Period The periodicity set for the sample of queries. It is set on a physical server properties page.
For more details, refer to the section Configuring the Periodicity.
Domain The name of the domain queried by the client <example.com>.
TLD The TLD of the domain queried by the client, <com>. This column is only displayed for
Top 50 TLDs / Source IP and Top 50 Source IPs.
Source IP The IP address of the client querying the information. This column is only displayed for
Top 50 TLDs / Source IP, Top 50 Destination IPs and Top 50 TLDs / Source IPs.
Destination IP The IP address of the client receiving the information. This column is only displayed for
Top 50 Destination IPs.
OpCode The operation codes returned for each query during the selected period: Query, Status,
Notify, Update... This column is only displayed for Opcodes.
RCode The return code sent with each query response during the selected period: Noerror, Servfail,
Nxdomain... This column is only displayed for Rcodes.
Query type The DNS resource record returned to provide the answer to the client: SOA, NS, A, AAAA,
PTR, MX... This column is only displayed for Query types.
Total queries The total number of messages on the DNS traffic during the selected period, it includes
the queries and the codes returned.
Number of hits The exact number of times the domain/TLD/record/code was queried or returned for the
selected period. For instance, the number of times <example.com> was queried by the IP
754
Column Description
address <1.2.3.4> during a 5-minute period. For the Top 50 Domains / source IP and the
Top 50 TLDs / source IP, the number of hits is based on the value of the columns Source
IP and End date; e.g., the number of times an A record was queried by the IP address
<1.2.3.4> during a 5-minute period.
Ratio The percentage of Number of hits compared with the Total queries for the selected period.
For instance, the percentage that represents the A records queried to find the IP address
of <example.com> compared with all the messages on the traffic for a period of 5 minutes.
Note that the columns Start date and End date can be filter using the keyword last to display the
data retrieved in the last X minutes, X being the periodicity set for the server. If no data is retrieved
in that period, the list is empty.
Displaying the DNS Analytics

From the page Analytics, you can display the physical server data samples retrieved from the
messages. It focuses by default on a sample period of 5 minutes to draw Top 50 comparisons.
To display specific DNS analytics data
1. Go to the page Analytics of the DNS physical server of your choice.

2. Under the menu, in the drop-down list Display, select the data of your choice. The page re-
freshes, the selected data is displayed.
All available analytics are detailed in the table below. If the drop-down list only contains data
named Guardian - <sample>, refer to the section Displaying DNS Guardian Analytics Tops.
3. Under the drop-down list, you can tick the box Automatic refresh to automatically refresh
the data listed every minute. To edit the page refresh frequency, refer to the section Editing
the Automatic Refresh Frequency.
You can edit the sample time following the procedure in the section Configuring the Periodicity.
Table 47.2. DNS analytics

Statistic Description
Top 50 Domains The top 50 queried domains on the DNS traffic during the configured Period,
identified using their name and TLD.
Top 50 Domains / source IP The top 50 domains queried by specific IP addresses on the DNS traffic during
the configured Period, identified using the domain name and TLD and the
querying client IP address.
Top 50 Destination IPs The top 50 answered clients on the DNS traffic during the configured Period,
Top 50 Source IPs The top 50 querying clients on the DNS traffic during the configured Period,
Top 50 TLDs The top 50 TLDs queried on the DNS traffic during the configured Period,
identified using the domain TLD.
Top 50 TLDs / source IP The top 50 TLDs queried by specific IP addresses on the DNS traffic during
the configured Period, identified using the domain TLD and the querying client
IP address.
Opcodes All the operation codes on the DNS traffic during the configured Period, identified
using their name.
Rcodes All the return codes on the DNS traffic during the configured Period, identified
using their name.
Query types All the queries answered on the DNS traffic, identified using the RR type.
755
Configuring the Analytics Retrieval

You can configure the analytics retrieval according to your needs. You can edit the sampling
period, or periodicity, the page automatic refresh frequency, the data retrieval frequency and
even its purge frequency.
Editing the Automatic Refresh Frequency
On the page Analytics, the box Automatic refresh allows to automatically refresh the page display
every 60 seconds. You can edit this frequency via a registry database key.
To edit the analytics automatic refresh frequency

opens.
3. In the column Name, type in www.dns.stat.refresh and hit Enter. The key is the only one listed.
4. In the column Value, click on the value. The wizard registry database edit a value opens.
5. In the field Value, type in the number of seconds of your choice. By default, it is set to 60.
the new key value is visible.
Configuring the Periodicity
By default, the data sampling compare the DNS traffic over a sample periodicity of 5 minutes.
The sample time specified in the column Period on the page Analytics.
You can configure a shorter or larger periodicity on each physical server individually.
Note that no matter the periodicity, the data is available on the page at a frequency specified
through the rule 380. To edit that rule, refer to the next section.
To edit the DNS analytics periodicity of a physical server
opens.
4. Open the panel DNS analytics. It indicates if the retrieval is enabled and the periodicity.
5. Click on EDIT . The wizard Configure DNS analytics opens.
6. In the drop-down list Periodicity (min.), select the period of your choice: 1, 5, 10 or 15
minutes. By default, 5 is selected.
7. Click on OK to commit your changes. The page refreshes, the properties is visible again.
756
Configuring the DNS Analytics Retrieval Frequency
The frequency to which the analytics are displayed in the GUI is set by the rule 380, Retrieval of
the DNS server analytics data. By default, every 5 minutes it displays the data comparison results
for messages sampled during 1, 5, 10 or 15 minutes, depending on the configured periodicity.
No matter the periodicity you set on the physical server, the data is available in the GUI depending
on the rule configuration.
To edit the rule 380 that sets the DNS analytics data retrieval
opens.
7. Edit the drop-down lists Day(s) of the week, Date of the month, Month, Hour and/or Minute
according to your needs. By default, only the drop-down list Minute is set to Every 5 minutes.
Configuring the DNS Analytics Purge Frequency
You can configure the purge mechanism of the analytics retrieval. By default, it is based on:
• The data age. The rule 382, Configuration of the DNS analytics purge, deletes data older than
30 days. You can set it to delete data earlier or later.
• A lines count. A registry key deletes data if the analytics database exceeds 100,000 lines -
each Top 50, Opcodes, Rcodes and Query types can reach that many lines. You can set a
lower or higher threshold.
Both thresholds work together: once the number of days or the number of lines is met, the un-
wanted data the deleted.
No matter the way you want to purge your database, keep in mind that if you set very high
thresholds, you may slow down your appliance because the database contains too much
information.
To edit the rule 382 that purges the DNS analytics
opens.
757
7. Edit the drop-down lists according to your needs. By default the rule is executed daily at
23:30.
Table 47.3. Filters of the rule 382

Column Default value

9. In the field Number of days, type in the number of days above which you want the logs
database to be purged. By default, it is set to 30: logs older than thirty days are automatically
deleted.
To create a threshold to purge DNS analytics

opens.
4. In the field Name, type in dns.stats.limit.
5. In the field Value, type in the number of lines above which the data is purged. The default
value is 100,000.
the key is listed.
Exporting the Analytics

From the page Analytics, you can export the data listed in a CSV, HTML, XML, XLS or PDF file.
Like any other export, you can retrieve the data immediately or schedule it. For more details,
refer to the section Configuring Exports.
Disabling the Analytics

At any time, you can stop retrieving the analytics for any physical server.
To disable the DNS analytics retrieval on a physical server
4. Open the panel DNS analytics. It indicates if the retrieval is enabled and the periodicity.
758
5. Click on EDIT . The wizard Configure DNS analytics opens.

6. Untick the box Enable analytics collection. The page refreshes, the drop-down list Periodicity
(min.) is no longer visible.
7. Click on OK to commit your changes. The page refreshes, the properties is visible again. In
the panel, the field Enable analytics collection is marked no.
DNS Analytics Limitations

• The analytics are only available for EfficientIP and Hybrid DNS servers.
• The analytics data is only retrieved based on UDP traffic.
• Only the first 50 entries matching the selected statistic are listed. Therefore, if on the selected
period of time, 100 pieces of information are identical, the GUI only displays the first 50.
• You might slow your appliance down if you edit the purge mechanism to include more lines or
keep data longer than the default 30 days.
Monitoring DNS Queries and Answers

SOLIDserver allows to toggle the logs and monitor DNS physical servers queries and answers.
Monitoring DNS Queries

At any time you have the possibility to display all the DNS queries of an EfficientIP or a BIND
DNS server. You can execute the command querylog from the page All servers and then display
the whole list of logs on the page Syslog in the Administration module.
Querylog is a toggle command that provides an overview of all the DNS queries in IPv4 and IPv6.
The logs structure is as follows:
a. The requesting client IP address and port number, the query name, class and type.
b. The recursion detailed, + or -. The Recursion Desired flag: + is set (the query was recursive),
- is not set (the query was iterative).
c. DNS options details if relevant: whether the query is signed (S), whether EDNS was used (E),
whether TCP was used (T), whether DO - DNSSEC OK - was set (D), whether CD - Checking
Disabled - was used (C).
d. The IP address the information was sent to.
Keep in mind that all the logs can be displayed in the page Syslog in real time. They can slow
this page down consistently as the querylog command can generate a substantial volume of data
very quickly.
To toggle on the DNS querylog command
1. Enabling the querylog
c. Tick the server of your choice.
d. In the menu, select Edit > Command > Querylog. The wizard Toggle the querylog
command opens.
759
e. Click on OK to send the command. The report opens and closes. The page All servers
is visible again and the server is marked Enabled in the column Querylog.
2. Displaying the DNS query and answer logs

homepage opens.
b. In the section Monitoring, click on Logs Visualization. The page Syslog opens.
c. Under the menu, in the drop-down list SOLIDserver, make sure the hostname of the
appliance managing the DNS server for which you toggled on the querylog is selected.
d. In the drop-down list Services, select named.
e. You can tick the box Automatic refresh if you want the page Syslog to refresh the log
display every 10 seconds.
f. Filter the list via the column Time with the current date, and the time if you want.
g. In the column Log, all the query and answer logs of your server are displayed.
The first logs are received control channel command 'querylog' and query logging is
now on; all the logs are listed below.
To toggle off the DNS querylog command
1. Disabling the querylog
c. Tick the server of your choice. It is marked Enabled in the column Querylog.
d. In the menu, select Edit > Command > Querylog. The wizard Toggle the querylog
command opens.
e. Click on OK to send the command. The report opens and closes. The page All servers
is visible again and the server is marked Disabled in the column Querylog.
2. Making sure the querylog is off

homepage opens.
b. In the section Monitoring, click on Logs Visualization. The page Syslog opens.
c. Under the menu, in the drop-down list SOLIDserver, make sure the hostname of the
appliance managing the DNS server for which you toggled on the querylog is selected.
d. In the drop-down list Services, select named.
e. You can tick the box Automatic refresh if you want the page Syslog to refresh the log
display every 10 seconds.
f. Filter the list via the column Time with the current date, and the time if you want.
g. In the column Log, two lines indicate the querylog is toggled off: received control channel
command 'querylog' and query logging is now off.
760
Monitoring DNS Answers

At any time you have the possibility to display all the DNS answers of an EfficientIP or a BIND
DNS server from the CLI.
Answerlog is a toggle command that provides an overview of all the DNS answers in IPv4 and
IPv6. It uses the same information structure as querylog, each log contains: client information,
recursion details, DNS options when relevant... For more details, refer to the log structure in the
section Monitoring DNS Queries.
When answerlog is on, it displays two lines: first the initial query, second the answer received by
the client followed by the return code of the answer: NOERROR, SERVFAIL, NXDOMAIN...
To toggle on the DNS answerlog command
1. Connect to your appliance via a shell session.

2. Use the following command:
/usr/local/nessy2/bin/rndc answerlog
The logs look as follows:

# Line 1: the initial client query.
# Line 2: the answer sent to the client followed by the return code of the answer.
Nov 18 18:05:08 my-appliance-hostname named[1552]: client 127.0.0.1#31070 (www.google.com): view

vue3: query: www.google.com IN A +E (127.0.0.1)
Nov 18 18:05:08 my-appliance-hostname named[1552]: client 127.0.0.1#31070 (www.google.com): view
vue3: answer: www.google.com IN A +E (127.0.0.1) -> NOERROR www.google.com. 95 A 74.125.71.99
A 74.125.71.103 A 74.125.71.104 A 74.125.71.105 A 74.125.71.106 A 74.125.71.147
To toggle off the DNS answerlog command
1. Connect to your appliance via a shell session.

/usr/local/nessy2/bin/rndc answerlog
Generating DNS Reports

EfficientIP provides dedicated DNS reports at server and zone level.The reports on inconsistencies
or misconfiguration details might be empty if the server or zone configuration is correct.
Table 47.4. Available DNS reports

Page Report
All servers A records without an IPv4 address or alias
AAAA records without an IPv6 address or alias
CNAME records without an alias
PTR records without an IPv4 address
Route 53 Incompatibilities
Zones NS and IP addresses
Servers Configuration
Hybrid DNS Engine Incompatibilities
761
Page Report
Server Peak Hour
Servers Configuration Comparison
Query Rate per Server
Server Reply to Queries Charts
Server Usage Charts
All views View Statistics
All zones Zones NS and IP addresses
Zones Missing RRs
Zone Statistics
Zones Configuration Comparison
762
Part VII. Global Policies
Global policies are options that allow to set specific behaviors within a module or between modules. They
are available in the modules IPAM, DHCP, DNS and Device Manager.
• Inheritance and Propagation allows to can use meta-data, advanced properties and class parameters
across the IPAM, DNS and Device Manager hierarchy.You can set, inherit, propagate or restrict an object's
property from one level to the other.
• Managing Advanced Properties allows to configure advanced properties that define interactions between
and/or within the IPAM, DHCP and DNS modules.
Chapter 48. Inheritance and Propagation
Two mechanisms allow to inherit and propagate meta-data, advanced properties and class
parameters within all modules. Both mechanisms are available by default in the addition/edition
wizard of the resources that can be configured with it.
For each meta-data, advanced property and class parameter, you can configure the Inheritance
property to Set or Inherited and/or the Propagation property to Propagate or Restrict via a
dedicated icon and layer in the wizard.
Keep in mind that the default configuration of both properties does automatically Propagate the
parameter value you specify on an object to all its child objects if their inheritance property is In-
herited. Like in the example below, a DNS server was Set on a space, and Inherited by all the
objects it contains down to its IP addresses.
SPACE DNS server = ns1.mycorp.com
NETWORK
BLOCK Domain name = lab.mycorp.com
NETWORK Gateway = 10.6.22.255

SUBNET
POOL
ADDRESS
DNS server = ns1.mycorp.com

Domain name = lab.mycorp.com
Gateway = 10.6.22.255
Figure 48.1. Example of the inheritance and propagation of some advanced properties in the IPAM
In the wizard, the dedicated configuration icon is located next to all the fields for which you can
configure either the inheritance or the propagation property. It indicates the current configuration
of the meta-data, advanced property or class parameter. Here below are the possible combinations.
Table 48.1. Inheritance and Propagation property possible configurations

Icon Current Inheritance and Propagation configuration
Inheritance: Set. Propagation: Propagate. The default value for both properties.
Inheritance: Set. Propagation: Restrict.
Inheritance: Inherited. Propagation: Propagate.
Inheritance: Inherited. Propagation: Restrict.
You can use the internal hierarchy of a module to inherit and propagate a parameter with the
values that suit your needs. In the example below, the advanced property DNS server has one
value from space to block-type network and different one from subnet-type network down to IP
address level.
764
Inheritance and Propagation
SPACE DNS server = ns1.mycorp.com
NETWORK DNS server = ns1.mycorp.com

BLOCK
NETWORK DNS server = ns8.mycorp.com

SUBNET
POOL
ADDRESS
DNS server = ns8.mycorp.com
Figure 48.2. Example of an advanced property set and propagated at network level
Prerequisites
Before configuring the inheritance property and/or the propagation property on advanced proper-
ties, meta-data and class parameters, keep in mind that:
• Advanced Properties can be configured for the IPAM, DNS and/or DHCP. At all levels of
these modules, you can define the Inheritance property and/or the Propagation property of
your advanced properties. For more details regarding advanced properties, refer to the chapter
• Meta-data is by default configured for class global of all resources within SOLIDserver. Note
that a few resources of the modules IPAM, DNS and Device Manager provide meta-data for
which you can define inheritance and propagation, without editing the class.
Table 48.2. Resources that have meta-data available by default

Module Resource Parameter
IPAM (IPv4 and IPv6) Network (block-type) Description
Network (subnet-type)
Pool
DNS Zone (regular) AD replication (Expert mode)
Device Manager Device Description
For more details regarding meta-data, refer to the chapter Configuring Classes.
• Class Parameters belong to the customized classes you create from the page Class Studio.
Once enabled, you can define the Inheritance property and the Propagation property of all the
class objects that define your classes. Once displayed in the addition/edition wizard of the re-
source it applies to, the class objects are considered as class parameters. For more details
regarding customized classes, refer to the chapter Configuring Classes.
765
Limitations
• Configuring the Inheritance and/or Propagation property does not trigger any creation.
Configuring the inheritance and propagation properties on objects managing other objects
propagates the parameter and its value to the objects it contains but does not trigger any creation
behavior. So if you configure the advanced property Create DHCP static on a terminal network,
the property value is propagated down to its assigned IP addresses but these addresses are
not created in the DHCP.
To trigger the creation behavior on existing objects at lower level, you must tick them and in
the menu select Tools > Expert > Initialize rules.
• The Inheritance property cannot be configured at some levels:
• At the highest level of any module, you cannot switch the property to Inherited, it is forced
to Set.
1
• You cannot inherit a parameter on: IPAM spaces , DHCP servers, DNS servers, NetChange
devices, Workflow requests, Device Manager devices, VLAN domains and groups of users.
• The Propagation property cannot be configured at some levels:
• At the lowest level of any module, you cannot set the property to Propagate, it is forced to
Restrict.
• You cannot propagate parameters on: IP addresses (IPv4 and IPv6), DHCP groups (IPv4
and IPv6), DHCP ranges (IPv4 and IPv6), DHCP statics (IPv4 and IPv6), DNS zones, Device
Manager interfaces and ports, NetChange ports and VLAN ranges. All these objects can
however inherit parameters.
• Some operations are impossible. You cannot:
• Configure the Inheritance property and Propagation property to Inherited/Restrict in template
mode in the IPAM. An inherited parameter value must be propagated.
• Delete a class parameter that was Inherited from a parent object.
• Restrict the propagation of a parameter that has already been propagated.
• Reconciling class parameter must follow a specific order.
If you plan on reconciling the meta-data, advanced properties and/or class parameters of all
the objects of a module, you must start from the lowest level of the hierarchy up to the highest
one.
Configuring the Inheritance of a Parameter Value

The inheritance property can be configured as follows:
• This property has two possible values: Inherited and Set.

• The default value of the property is Inherited if on the parent object the propagation property
is Propagate.
• This property is forced to Set if the parameter is not configured on the parent object.
• This property is forced to Set if the parameter is configured on the parent object but its
propagation property is Restrict.
1
If you have a space-based VLSM organization, you cannot inherit parameters on the top level space. You can inherit parameters from
the first level down.
766
SPACE Domain name = lab.mycorp.com
NETWORK Domain name = lab.mycorp.com

BLOCK
NETWORK Domain name = lab.mycorp.com

SUBNET
POOL Domain name = priv.mycorp.com
ADDRESS
No Domain name
Figure 48.3. Example of an advanced property set and restricted at pool level
Once configured on a parent object, the value is used on all the objects it contains if their
inheritance property is set to inherited. In the example above, the value of the advanced
property Domain name follows this logic: it is configured to Set/Propagate from the space down
to the pool, every level in between is configured to Inherited/Propagate. At pool level the para-
meter is configured to Set/Restrict with a different value, so the IP addresses are not configured
with the property.
In the following procedure the icon is used to provide an example of configuration, it matches
the default value of the inheritance and propagation properties. Depending on your configuration,
it could be any of the icons detailed in the previous paragraph.
The inheritance property has to be configured directly in the addition/edition wizard of an object.
In this section, configuring includes defining the inheritance property for the first time or editing
its value.
To configure the inheritance of an advanced property or class parameter
1. Take into account the inheritance Limitations.

2. Go to the tab and page of your choice.
3. Add or edit a resource. The wizard opens.
4. If you or your administrator created classes, in the list <object> class select a class or None.
5. Right of the field of your choice, click on . The configuration layer opens.
6. In the drop-down list Inheritance property, click on Set or Inherited depending on your needs.
Keep in mind that you cannot configure the inheritance property on the highest level of a
module.
7. Click on OK to commit your configuration. The report opens and closes. The page is visible
again.
The inheritance/propagation property icon details the object configuration on its properties
page.
767
Note that deleting some objects of the IPAM and DNS hierarchy triggers the automatic
inheritance:
• When you delete a non-terminal subnet-type network, an IPAM pool or a DNS view that contains
other objects at lower levels, the child objects are automatically moved higher in the hierarchy.
• If the child objects inherited class parameters from the deleted container, for each class para-
meter:
• The Inheritance property is forced to Inherited or Set to match the configuration of the deleted
parent object. This way, the value and the source of the value remain the same.
• The Propagation property remains the same.
Configuring the Propagation of a Parameter Value

The propagation property can be configured as follows:
• This property has two possible values: Propagate and Restrict.

• The default value of the property is Propagate. So the parameter value is propagated to the
child objects:
• If the parameter is not configured on the child objects.
• If the parameter is not already configured with a different value.
• If the parameter is not already configured with an Inheritance property Inherited.
• This property is forced to Restrict if it is impossible to propagate parameters on the child objects.
SPACE DHCP cluster = dhcp-clust1.mycorp.com
NETWORK DHCP cluster = dhcp-clust1.mycorp.com

BLOCK
NETWORK DHCP cluster = dhcp-clust1.mycorp.com

SUBNET
POOL
ADDRESS
No DHCP cluster

Figure 48.4. Example of an advanced property inherited and restricted at network level
Once configured on a parent object, the value is used on all the objects it contains if their
propagation property is set to inherited. In the example above, the value of the advanced
property DHCP cluster follows this logic: it is configured to Set/Propagate from the space down
to the subnet-type network, every level in between is configured to Inherited/Propagate. At network
level the parameter is configured to Inherited/Restrict, so the pools and IP addresses are not
configured with the property.
768
In the following procedure the icon is used to provide an example of configuration, it matches
the default value of the inheritance and propagation properties. Depending on your configuration,
it could be any of the icons detailed in the previous paragraph.
The propagation property has to be configured directly in the addition/edition wizard of an object.
In this section, configuring includes defining the propagation property for the first time or editing
its value.
To configure the propagation of an advanced property or class parameter
1. Take into account the propagation Limitations.

4. If you or your administrator created classes, in the list <object> class select a class or None.
5. At the right of the field of your choice, click on . The configuration layer opens.
6. In the drop-down list Propagation property, click on Propagate or Restrict depending on
your needs.
Keep in mind that you cannot configure the propagation property on the lowest level of a
module.
again.
The inheritance/propagation property icon details the object configuration on its properties
page.
Setting Class Parameters

You can set class parameters for several objects at once using the option Set class parameters.
This option also allows to edit or define the inheritance and propagation configuration of the
parameters of an object. This operation is quite advanced and should not be delegated lightly to
users that do not belong the group admin.
If you only want to set advanced properties on several objects at once, we recommend that you
use the option Set advanced properties because the wizard already contains all the available
values and allows to choose them in dedicated drop-down lists rather than specifying them in
fields. For more details, refer to the section Setting Advanced Properties.
Using the option Set class parameters allows, as long as you are aware of the Limitations, to:
• Set any parameter on an object: either a class parameter or meta-data.

• Overwrite any parameter configured or not.
• Overwrite the value of the Inheritance property and/or Propagation property of a parameter.
• Propagate a configured parameter to child objects if their Inheritance property is Inherited.
• Restrict a parameter at the level of your choice.
Note that, in the wizard, the drop-down lists Inheritance property and Propagation property are
only displayed if they are relevant to the object you selected.
769
To set parameters' inheritance and/or propagation property on several objects

2. Tick the object(s) for which you want to set the inheritance and/or propagation property of
a parameter.
3. In the menu, select Tools > Expert > Set class parameters. The wizard Set class parameters
opens.
4. In the drop-down list Parameter, select the class parameter or meta-data of your choice.
The page refreshes and the drop-down list Value appears.
5. In the drop-down list Inheritance property, configure the inheritance behavior:
a. Select Set to set the parameter the value or overwrite the current value on the object.
This value is selected by default.
b. Select Inherited to inherit the advanced property from a parent object. Selecting this
value hides the field Value.
6. If you selected Set, in the field Value, type in the parameter value.
7. In the drop-down list Propagation property, configure the propagation behavior:
a. Select Propagate to propagate the parameter value on the child objects.The propagation
is only possible if the child objects' Inheritance property is Inherited.This value is selected
by default.
b. Select Restrict to only configure the parameter on the object(s) selected and prevent
its propagation to the child objects.
8. Click on ADD to move your parameter configuration to the Parameters list.
• To update an entry, select a configuration in the list, it is loaded again in the fields. Edit
the needed data and click on UPDATE .
• To delete an entry, select a configuration and click on DELETE .
9. Repeat the steps 5 to 8 for as many parameters as you need.

10. Click on OK to commit the changes. The report opens and closes. Any parameter value and
configuration previously set for the selected object(s) is overwritten.
Reconciling Class Parameters

The option Reconcile class parameters allows to adjust the inheritance property of your meta-
data, advanced properties and class parameters on several objects at once.
For instance, after a migration of your database, from a version prior to 6.0.0, with parameters
configured that are all Set with the same value at all levels, you can use the option to make sure
they respect the internal module hierarchy and make the lower levels Inherit the top level para-
meter value. If you configured or edited classes, your objects are configured at each level but
the inheritance between each level is not implemented yet. Running this option allows comparing
all the properties and parameters set on the parent, for the selected child objects. If they are
configured on both levels and their values match, the inheritance property of the child objects is
forced to Inherit to set up the inheritance.
770
The option allows to force the Inheritance property of a parameter based on the value of the
parameter in the parent object. Therefore:
• The parameter value is forced to Set if it is not configured on the parent object.
• The parameter value is forced to Set if it is configured on the parent object with the Propagation
property set to Restrict.
• The parameter value is forced to Set if it has a different value on the parent object.
• The parameter value is forced to Inherited if on the parent object: the parameter is configured,
has the same value and has the Propagation property set to Propagate.
Keep in mind that the option is only available on pages managing objects that can inherit data.
Some class parameters might not be reconciled, for more details refer to the section Limitations.
To reconcile a parameter inheritance property
If you plan on reconciling meta-data, advanced properties and class parameters on all the
objects of a module, you must start from the lowest level and execute the option on all levels
up to the highest one.
2. Tick the object(s) for which you want to reconcile the class parameters inheritance property
with their parent object.
3. In the menu, select Tools > Expert > Reconcile the class parameters. The wizard Reconcile
the class parameters opens.
4. Click on OK to commit the reconciliation. The report opens and works for a while. The report
opens.
771
Chapter 49. Managing Advanced
Properties
Advanced properties are specific class parameters that allow administrators to configure replication
behaviors between the modules IPAM, DHCP and DNS.
DNS server: ns1.mycorp.com

SPACE
Update DNS: yes
America
NETWORK Default domain:

BLOCK lab.mycorp.com
USA
10.6.0.0/15
NETWORK
SUBNET
New York
10.6.0.0/24
POOL
Manhattan
10.6.0.1-10.6.0.50
NEW NEW IP NEW

LEASE ADDRESS RECORD
DHCP IPAM DNS

IP Address: 10.6.0.42 IP Address: 10.6.0.42 Type: A
MAC address: be:ef:12:34:be:ef MAC address: be:ef:12:34:be:ef RR name: client.mycorp.com
Name: client.mycorp.com Name: client.mycorp.com IP address: 10.6.0.42
Advanced properties
Update DNS: yes
Default domain: lab.mycorp.com
Figure 49.1. Replication from the DHCP to the DNS via the IPAM
These properties can edit the interaction between these three modules and/or provide extra options
within a module:
• From the IPAM module, you can update the DNS and/or DHCP when creating networks or
adding IP addresses, within this module you can also define the gateway creation behavior or
decide to create pools when you create terminal networks.
The module also provides extra advanced options that are detailed in separate chapters:
• The IPv4 to IPv6 transition properties are detailed in the chapter Setting Up a Transition
From IPv4 to IPv6.
• The IPAM/Device Manager interaction properties are detailed in the chapter Managing the
Interaction with the IPAM.
• The IPAM/VLAN interaction properties are detailed in the chapter Managing the IPAM/VLAN
Interaction.
• From the DHCP module, you can update the IPAM and DNS when allocating leases.
• From the DNS module, you can update the IPAM when updating the records database of a
smart architecture.
Keep in mind that once configured at high level, the value of advanced properties is inherited by
all the objects at lower level, unless you configure them otherwise. Which is why, you can configure
772
Managing Advanced Properties
on a space properties that apply to IP addresses and you can configure on a server properties
that apply to leases or records.
The advanced properties configuration involves two operations:
1. Selecting at each level the advanced properties fields to display or enable, by default, in the
addition and edition wizards.
2. In the addition or edition wizard, configuring the property. The configuration of the properties
implies that the end user has sufficient rights and resources.
All the advanced properties are represented in the appendix Advanced Properties.
You can edit the advanced properties inheritance and propagation of several objects at a time.
For more details, refer to the section Setting Advanced Properties.
Note that users belonging to a group that do have the right Advanced properties Customize:
wizard can view but cannot edit the advanced properties parameters applied to an object. They
appear in gray in the addition and edition wizards.
Prerequisites
To use advanced properties you must select all the modules in the Internal module setup.
To configure the internal module setup before using advanced properties
1. From any page of SOLIDserver, in the menu select Settings > Expert > Internal module
setup. The wizard Internal module setup opens.
2. If you want to activate all the behaviors:

3. Click on OK to commit your configuration. The wizard closes.
Once the internal module setup is complete, administrators must select the properties they want
to display in the addition/edition wizard of the resources. For more details, refer to the section
Selecting the Advanced Properties Displayed by Default.
Browsing Advanced Properties

There is no page dedicated to advanced properties, but the objects that can be configured with
them contain the panel Advanced properties.
That panel displays the advanced properties configuration of the object. After the property value,
you may find between brackets the level the property was inherited from.
773
Figure 49.2. The panel Advanced properties
To display the panel Advanced properties
1. Go to the properties page of the object of your choice using .

2. Open the panel Advanced properties, using . The panel displays the advanced properties
configuration of the object.
Selecting the Advanced Properties Displayed by Default

End users with limited rights can only configure advanced properties on IPAM, DNS and/or DHCP
resources if their administrator chose to display them.
That display configuration can only be set via the wizard Advanced properties customization.
Once the wizard is configured:
• The selected properties are displayed and/or enabled by default in the resource addition/edition
wizard.
• At the bottom of the addition/edition wizard, the drop-down list Advanced properties possible
values are:
• Default: all the properties that were ticked/enabled by the administrator in the wizard Advanced
properties customization are displayed. This is the drop-down list default value.
• All: all the properties available for display in the wizard Advanced properties customization
are loaded. That option value excludes the properties that must be enabled in the customiz-
ation wizard. Only administrators or users with sufficient rights can select All in the list.
To select the advanced properties to display in the addition/edition wizard
1. Go to the IPAM, DNS or DHCP module.

2. Display the page of your choice.
4. Tick the boxes of the properties you want to display or enable in the addition/edition wizard.
Each object has its own properties, refer to the module and object that suits your needs.
again.
774
In the addition/edition wizard, all the ticked and enabled properties are now part of the Default
display.
Configuring IPAM Advanced Properties

To configure advanced properties:
1. Your administrator must have configured the internal module setup as detailed in the Prerequis-
ites and chose the fields available for configuration as detailed in the section Selecting the
Advanced Properties Displayed by Default.
2. You must configure the properties in the addition/edition wizard of the object.
You can configure IPAM spaces, networks, pools and IP addresses managing IPv4 and IPv6
addresses with IPAM properties, DNS properties and/or DHCP properties.
Note that within the IPAM, two options use the same principles than the advanced properties but
are not considered as such because they only apply to IPAM objects. For more details refer to
the chapters Setting Up a Transition From IPv4 to IPv6, Managing the Interaction with the IPAM,
and Managing the IPAM/VLAN Interaction.
Space Advanced Properties

At space level, the wizard Advanced properties customization only contains advanced properties
that can be displayed. All properties are enabled.
The table below details the properties in the customization wizard and the corresponding field in
the addition/edition wizard.
Table 49.1. Space advanced properties fields

In the wizard Advanced properties customization In the addition/edition wizard
Display the IPv4 to IPv6 transition fields Activate the IPv4 to IPv6 transition
Select the DNS server where the IP addresses should be updated DNS server
Select the DNS view where the IP addresses should be updated DNS view
Select the DNS domain where the IP addresses should be updated Default Domain
Select a restricted list of the allowed domains Domains list / Selected Domains list
Create a DNS reverse zone Tick the box to display more fields
Select the DNS server where the reverse zone of a network should be DNS server for reverse zones
created
Select the DNS view where the reverse zone of a network should be DNS view for reverse zones
created
a
Select the DHCP failover cluster where the configuration should be applied DHCP cluster
Display the box "Update DNS" Update DNS
Display the box "Create DHCP static" Create DHCP Static
a
Setting a DHCP cluster at space level is only propagated to its IPV4 objects.
Once the advanced properties are displayed, they can be configured when adding or editing
spaces. Each one can be inherited at lower levels to automate the replication from the IPAM.
775
IPAM DHCP
DHCP cluster: DHCP
SPACE SERVER
failover-dhcp1.mycorp.com
America dhcp1.mycorp.com
NETWORK Use Address and Prefix

BLOCK as shared network: yes
USA
10.6.0.0/15
NEW NEW
NETWORK SCOPE
SUBNET
Name: New York Name: New York

Start address: 10.6.0.0 Start address: 10.6.0.0
End address: 10.6.0.255 End address: 10.6.0.255
Advanced properties
DHCP cluster: failover-dhcp1.mycorp.com
Use Address and Prefix as shared network: yes
Figure 49.3. IPAM to DHCP replication at network level inherited from the space
To configure advanced properties at space level
3. Add or edit a space. The wizard opens. For more details refer to the chapter Managing
Spaces.
4. On the last page of the wizard, configure the advanced properties of your choice according
to the table below:
If not all the fields are part of the wizard Default display, users with sufficient rights can select
All in the drop-down list Advanced properties to display all the fields that do not require to
be enabled in the customization wizard. All the fields appear but their order does not respect
the table.
Next to each advanced property, you can click on to define its Propagation property. For
more details, refer to the chapter Inheritance and Propagation.
Table 49.2. Space advanced properties configuration fields

Field Default value Description
Activate the IPv4 to IPv6 Unticked Tick this box to configure the IPv4 to IPv6 transition. For more
transition details, refer to the chapter Setting Up a Transition From IPv4
to IPv6.
DNS server None Select the DNS server managing the zone you want to update
when you assign IP addresses. Once you selected a server, the
fields DNS view, Domains list, Selected domains list and Default
domain appear if they were ticked in the customization wizard.
If you select All, all the views and zones are available in the re-
lated fields. You must tick the box Update DNS to take this
parameter into account.
DNS view All Select the DNS view managing the zone you want to update
when you assign IP addresses. You must tick the box Update
DNS to take this parameter into account.
776

Domains list / Select the DNS domain, i.e. zone, you want to update when you
assign IP addresses. You might have the possibility to add sev-
eral zones, use to move them to the field Selected domains
list. You must tick the box Update DNS to take this parameter
into account.
Default domain None Select a default domain. The listed zones are all part of the list
Selected domains. You must tick the box Update DNS to take
this parameter into account.
DNS server for reverse All Select the DNS server where reverse zones are created upon
zones addition/edition of terminal networks. Keep in mind that deleting
a network configured with this option also deletes the cor-
responding reverse zone from the DNS, if it only contains the
default records (SOA and NS). You must tick the box Update
DNS view for reverse All Select the DNS view where the reverse zones are created upon
Update DNS Unticked Tick this box to update the zone configured as default domain
with A, AAAA, PTR and/or CNAME records when you assign IP
a
addresses in the relevant terminal network . Keep in mind that
these records, created from the IPAM, are deleted when you
untick the box.
DHCP cluster None Select a DHCP failover cluster to create a scope matching every
terminal network you create (name and addresses), on the DHCP
servers of the selected cluster. The terminal network you create
contains the panel DHCP options displaying the options config-
uration of the scope. In IPv4, the DHCP servers are automatically
set with the option routers, its value is the network gateway ad-
dress.
Create DHCP static Unticked Tick this box to reserve a DHCP static for every assigned IP
address. The static creation is only possible if you selected a
DHCP cluster.
Use IPAM name instead Unticked Tick this box to name the static created in the DHCP like the IP
of DHCP client name address you assign in the IPAM. If you do not tick it, the IP ad-
dress you create does not have a name and it is named after
the next DHCP client that connects to the network.
a
Note that since version 6.0.2, the gateway address no longer creates an A or AAAA record in the DNS.
5. Click on OK to commit your configuration. The report opens and closes. The page All spaces
is visible again.
Network Advanced Properties

At network level, the wizard Advanced properties customization contains advanced properties
that can appear in the subnet-type and/or block-type network wizards.
Enabling the advanced properties can allow to automatically create a DNS zone when you add
a network.
777
IPAM DNS
SPACE Update DNS: yes DNS
SERVER
America ns1.mycorp.com
DNS server for reverse zone:
NETWORK ns1.mycorp.com VIEW
BLOCK DNS view for reverse zone:
USA intranet intranet
10.6.0.0/15
NEW NEW
NETWORK REVERSE
SUBNET ZONE
Name: New York Name: 0.6.10.in-addr.arpa

Start address: 10.6.0.0
End address: 10.6.0.255
Advanced properties
Update DNS: yes
DNS server for reverse zone: ns1.mycorp.com
DNS view for reverse zone: intranet
Figure 49.4. IPAM to the DNS replication at network level
The existing networks are not impacted, to configure them like their container refer to the section
Setting Advanced Properties.
Table 49.3. Network advanced properties fields

IPAM properties
Gateway offset Gateway
Display the field "Gateway" Gateway
Display the IPv4 to IPv6 transition fields Activate the IPv4 to IPv6 transition
DNS properties
Select the DNS domain where the IP addresses should be updated Default Domain
Select a restricted list of the allowed domains Domains list / Selected Domains list
Create a DNS reverse zone Tick the box to display more fields
Select the DNS server where the reverse zone of a network should be DNS server for reverse zones
created
Select the DNS view where the reverse zone of a network should be DNS view for reverse zones
created
DHCP properties
a
Select the DHCP failover cluster where the configuration should be applied DHCP cluster
b
Ask if this network must be configured as a DHCP shared network Use Address and Prefix as shared
network
Pools creation
Ask the number of pools to create Number of pools / Size / Type / Name
IPAM/VLAN interaction
778

Display the VLAN association fields VLAN domain
VLAN range
VLAN ID
a
In IPv6 this property cannot be inherited from the server. You must set it to propagate it down to the IP addresses.
b
Tick the box Select the DHCP failover cluster where the configuration should be applied to display this field.
Note that from the customization wizard, you can enable or disable two properties:
Gateway offset
This field allows to automatically calculate and create a gateway when you add terminal
networks:
• You can specify positive and negative values in the field. A positive value calculates the
gateway from the start address of the network; a negative value calculates it from the end
address of the network.
By default, the offset value is -1: the penultimate address of the network is used as gateway.
• You cannot specify 0 in the field. To disable the automatic gateway creation and create
terminal networks without a gateway, you must leave the field empty. Once the gateway
creation is disabled, the field Gateway is not displayed in the addition/edition wizard even
if the box Display the field "Gateway" is ticked.
Ask the number of pools to create
This box allows to create pools during the creation of a terminal network. Note that:
• This option does not apply when you edit a terminal networks.
• This option can only be used if pool classes are enabled.
• The field Number of pools cannot be displayed in the addition wizard if you do not tick this
option.
As the properties are inherited, the advanced properties configuration at network level influence
the IP address behaviors. That way, the automatic creation of the Gateway address, configures
the DHCP option Routers on the scope automatically created when you add a terminal network.
779
IPAM DHCP
DHCP cluster: DHCP
SPACE SERVER

USA
10.6.0.0/15
NETWORK Gateway offset: -1
SUBNET
New York
10.6.0.0/24
NEW IP SCOPE
ADDRESS
IP address name: Gateway New York

Address: 10.6.0.254 10.6.0.0/24
Advanced properties DHCP option
DHCP cluster: failover-dhcp1.mycorp.com Routers: 10.6.0.254
Gateway offset: -1
Figure 49.5. Replication from the IPAM to the DHCP at IP address level
All the properties detailed in the procedure below are based on a configuration that was not in-
herited. Most fields are already filled with the value in the container of the resource you create.
For more details, refer to the chapter Inheritance and Propagation.
To configure advanced properties at network level
3. On the right-end side of the menu, click on V4 or V6 according to your needs.
4. Add or edit a network. The wizard opens. For more details refer to the chapter Managing
Networks.
to the table below:
the table.
Next to each advanced property, you can click on to define its Inheritance property and/or
Propagation property. For more details, refer to the chapter Inheritance and Propagation.
Table 49.4. Network advanced properties configuration fields

For all networks
Activate the IPv4 to IPv6 Unticked Tick this box to configure the IPv4 to IPv6 transition. For more
transition details, refer to the chapter Setting Up a Transition From IPv4
to IPv6.
780

Domains list / Select the DNS domain, i.e. zone, you want to update when you
assign IP addresses. You might have the possibility to add sev-
eral zones, use to move them to the field Selected domains
list. You must tick the box Update DNS to take this parameter
into account.
Default domain None Select a default domain. The listed zones are all part of the list
Selected domains. You must tick the box Update DNS to take
this parameter into account.
DNS server for reverse All Select the DNS server where reverse zones are created upon
DNS view for reverse All Select the DNS view where the reverse zones are created upon
a
untick the box.
DHCP cluster None Select a DHCP failover cluster to create a scope matching every
terminal network you create (name and addresses), on the DHCP
servers of the selected cluster. The terminal network you create
contains the panel DHCP options displaying the options config-
uration of the scope. In IPv4, the DHCP servers are automatically
set with the option routers, its value is the network gateway ad-
dress.
DHCP cluster.
Only for subnet-type networks
Gateway Matches the Specify a different gateway if need be. Its value is calculated
offset based on the Gateway offset configuration. If the gateway offset
calculation is disabled, the field is not displayed.
Use Address and Prefix Ticked Tick this box to use the Address and Prefix of the network you
as shared network are adding as a shared network. This action creates a new scope
781

in the DHCP servers of the selected cluster. This box is only
visible when the DHCP cluster is Set and a value is specified.
Number of pools 0 Select between 1 and 5 pool(s) to create within the terminal
network you are creating. For each pool, you need to specify a
Size and Type. If you select 0, no pool is created.
Size None Type in the number of IP addresses of each pool. This option is
only available in IPv4.
Type Select a value Select a class for the pool. The pool is named after the class
you select.
Name None If you selected Other, type in a name for the pool.
VLAN domain None Select a domain to associate a terminal network with a VLAN.
For more details, refer to the chapter Managing the IPAM/VLAN
Interaction.
a
6. Click on OK to commit your configuration.The report opens and closes.The page All networks
is visible again.
Pool Advanced Properties

At pool level, the wizard Advanced properties customization only contains advanced properties
that can be displayed. All properties are enabled.
Enabling the advanced properties allows to automatically create a DHCP range when you add
a pool.
IPAM DHCP
DHCP cluster: DHCP
SPACE SERVER

USA
10.6.0.0/15 SCOPE
NETWORK New York

SUBNET 10.6.0.0/24
New York
10.6.0.0/24
NEW NEW
POOL Create DHCP range: yes RANGE
Name: Manhattan Name: 10.6.0.1-10.6.0.50

Start address: 10.6.0.1
End address: 10.6.0.50
Advanced properties
Create DHCP range:yes
Figure 49.6. Replication from the IPAM to the DNS at pool level
782
Table 49.5. Pool advanced properties fields

Display the field "Create a DHCP range" Create a DHCP range
Display the field "Create DHCP static" Create DHCP static
To configure advanced properties at pool level
4. Add or edit a pool. The corresponding wizard opens. For more details, refer to the chapter
Managing Pools.
to the table below:
the table.
Table 49.6. Pool advanced properties configuration fields

Create a DHCP range Unticked Tick this box to create a range in the DHCP matching the start
and end address of the pool you are creating. The range is cre-
ated in the scope matching the terminal network the pool belongs
to.
address in the pool. The static creation is only possible if you
selected a DHCP cluster.
6. Click on OK to commit your configuration. The report opens and closes. The page All pools
is visible again.
IP Address Advanced Properties

At IP address level, the wizard Advanced properties customization only contains advanced
properties that can be displayed. All properties are enabled.
Table 49.7. IP address advanced properties fields

IPv4 addresses transition to IPv6 Corresponding IPV6 address
783

Enable the automatic construction of the IP address hostname: short- Shortname / Domain
name.domain
Make the Domain selection mandatory for the hostname construction of Domain (required)
a
the IP address and its aliases
Select the DNS domain where the IP addresses should be updated Domain
b
IPAM / Device Manager interaction
Enable to create devices from the IPAM Create a device
Enable to link IP address with existing devices Interface name
Enable to edit the devices topology from the IPAM Link with device / Link with port
a
That box is only displayed if the box Enable the automatic construction is ticked.
b
For more details, refer to the chapter Managing the Interaction with the IPAM.
Enabling the advanced properties allows to automatically create a DHCP static or a DNS record
when you add an IP address.
IPAM DHCP
DHCP cluster: DHCP
SPACE SERVER

USA
10.6.0.0/15 SCOPE
NETWORK New York

SUBNET 10.6.0.0/24
New York
10.6.0.0/24
NEW IP NEW
ADDRESS Create DHCP static STATIC
IP Address: 10.6.0.100 IP Address: 10.6.0.100

MAC address: ba:ba:00:00:ba:ba MAC address: ba:ba:00:00:ba:ba
Advanced properties
Create DHCP static:yes
Figure 49.7. Replication from the IPAM to the DHCP at IP address level
784
IPAM DNS
DNS server: ns1.mycorp.com DNS
SPACE SERVER
Update DNS: yes
America ns1.mycorp.com
NETWORK Default domain: lab.mycorp.com

BLOCK
USA
10.6.0.0/15 ZONE
NETWORK
SUBNET lab.mycorp.com
New York
10.6.0.0/24
Enable the automatic
NEW IP construction of the IP address NEW
ADDRESS RECORD
hostname: shortname.domain
Shortname: pc1 Type: A
IP address name: pc1.lab.mycorp.com RR name: pc1.lab.mycorp.com
Address: 10.6.0.1 IP address: 10.6.0.1
Advanced properties
Update DNS: yes
Default domain: lab.mycorp.com
Enable the automatic construction: yes
Figure 49.8. Replication from the IPAM to the DNS at IP address level
To configure advanced properties at IP address level
2. Click on Addresses. The page All Addresses opens.
4. Add or edit an IP address. For more details, refer to the chapter Managing IP Addresses.
The corresponding wizard opens.
to the table below:
the table.
Next to each advanced property, you can click on to define its Inheritance property. For
more details, refer to the chapter Inheritance and Propagation.
Table 49.8. IP address advanced properties configuration fields

Corresponding IPV6 ad- IP address The field is read-only and matches the transition configuration.
dress For more details, refer to the chapter Setting Up a Transition
From IPv4 to IPv6.
785

Shortname / Type in a name for the IP address. The complete IP address
name is constructed as follows: <shortname>.<domain_name>.
Selecting this option creates an A record for the address in the
DNS zone specified in the field Domain.
Domain None Select a domain to complete the IP address name. Selecting
this option creates A, AAAA and/or CNAME records for the IP
address and its aliases in the DNS zone specified in the field
Domain. This field is mandatory if the box Make the Domain
selection mandatory in the hostname of the IP address and its
aliases is ticked in the customization wizard.
a
untick the box.
DHCP cluster.
a
6. Click on OK to commit your configuration. The report opens and closes. The page All ad-
dresses is visible again.
Configuring DHCP Advanced Properties

You can configure DHCP servers, scopes and ranges managing IPv4 with IPAM properties
and DNS properties. For instance, you could create an IP address every time you add a DHCP
static.
786
DHCP IPAM
DHCP Push leases to IPAM: yes SPACE
SERVER
dhcp1.mycorp.com America
NETWORK
BLOCK
SCOPE Use client name (FQDN): yes USA
10.6.0.0/15
New York
10.6.0.0/24 NETWORK
SUBNET
New York
RANGE 10.6.0.0/24
10.6.0.1 POOL
-10.6.0.50
Manhattan
10.6.0.1-10.6.0.50
NEW NEW IP
LEASE ADDRESS
IP Address: 10.6.0.42 IP Address: 10.6.0.42

MAC address: be:ef:12:34:be:ef MAC address: be:ef:12:34:be:ef
Name: client.mycorp.com Name: client.mycorp.com
Advanced properties
Push leases to IPAM: yes
Use client name (FQDN): yes
Figure 49.9. Replication from the DHCP to the IPAM at lease level
Table 49.9. DHCP advanced properties fields

Display the box "Push leases to IPAM" Push leases to IPAM
Display the drop-down list "Lease name" Lease name
Display the box "Use client name (FQDN)" Use client name (FQDN)
To configure advanced properties on DHCP resources
2. Go to the page All servers, All scopes or All ranges depending on your needs.
4. Add or edit the DHCP object of your choice. The wizard opens. For more details, refer to the
part DHCP Management.
to the table below:
787
the table.
Table 49.10. DHCP advanced properties configuration fields

Push leases to IPAM Unticked Tick this box to assign an IP address in the IPAM for each alloc-
ated lease, using the client name and MAC address. If you set
a space for the scope, the IP address is assigned or edited in
that space. If you did not set any space for the scope, the IPAM
update applies to any matching IP address in the smallest ter-
minal network possible. Once you ticked this box, the fields Lease
name, Use client name (FQDN) and Update DNS appear.
Lease name Only one client Select the behavior of your choice in case of hostname conflict
can update the in the IPAM and DHCP. Such a conflict could affect the DNS,
IPAM so you must decide what you want to send to the IPAM.
Only the first client up- / If multiple clients that have the same name obtain a lease, only
dates the IPAM the client getting the first lease updates the IPAM and DNS.
Until the first client's lease has not expired, their name cannot
be replaced in the DNS. Basically, the first client getting a lease
push their information in the IPAM (name, MAC address and IP
address). The second client with the same name, has their IP
and MAC addresses pushed to the IPAM without a name and
therefore do not update the DNS.
Only one client can up- / This option is dedicated to mobile clients, on a network configur-
date the IPAM ation composed of several scopes. It allows the client connecting
from two different parts of the network with the same name and
MAC address to be listed twice in the DHCP. The lease name,
MAC address and IP address are pushed to the IPAM: the name
and MAC address are identical but the IP address differs. Once
saved in the IPAM, only the latest lease information updates the
DNS.
Clients always update the / All the DHCP clients update the IPAM no matter their name, IP
IPAM or MAC address. In other words, every client getting a lease has
their information pushed to the IPAM (name, MAC address and
IP address) even if their name has already been pushed to the
IPAM. This is the most permissive mode. Keep in mind that only
the latest lease information updates the DNS.
Use client name (FQDN) Unticked Tick this box to make sure the leases' "client name" value (the
FQDN) is pushed in the IPAM and used as IP address name. If
you tick the box Update DNS as well, the zone matching the
FQDN is updated.
Update DNS Unticked Tick this box to update the DNS records database with the lease
information.
again.
Configuring DNS Advanced Properties

788
You can configure DNS servers, views and zones with IPAM properties and DNS properties.
Enabling the advanced properties allows to automatically create an IP address when you add a
DNS record.
DNS IPAM
DNS Update IPAM: yes
SERVER SPACE
ns1.mycorp.com America
NETWORK
BLOCK
USA
ZONE 10.6.0.0/15
lab.mycorp.com NETWORK
SUBNET
New York
10.6.0.0/24
NEW NEW IP
RECORD ADDRESS
Type: A Name: pc2.lab.mycorp.com

RR name: pc2 IP address: 10.6.0.142
Complete name: pc2.lab.mycorp.com
IP address: 10.6.0.142
Advanced properties
Update IPAM: yes
Figure 49.10. Replication from the DNS to the IPAM at record level
Table 49.11. DNS advanced properties configuration fields

Display the box "Update IPAM" Update IPAM
Display the box "Create PTR" (not available for DNS views) Create PTR
To configure advanced properties on DNS resources
2. Go to the page All servers, All views or All zones depending on what you just configured.
3. Add or edit the DNS object of your choice. For more details, refer to the part DNS Manage-
ment. The corresponding wizard opens.
789
to the table below:
the table.
Table 49.12. DNS advanced properties configuration fields

Update IPAM Unticked Tick this box to update the IPAM when you create A, AAAA or
PTR resource records. If you set a space for the zone, the IP
address(es) is assigned or edited in that space. If you did not
set any space for the zone, the IPAM update applies to any
matching IP address in the smallest terminal network possible.
Create PTR Unticked Tick this box to create a PTR record for each A or AAAA resource
record created in the DNS physical servers managed via a smart
architecture. This option can be applied on DNS servers and
zones. Note that if you create several A records with one name
pointing to the several IP addresses, only the first PTR record
is created.
again.
Setting Advanced Properties

Advanced properties can be set individually or several objects at a time regardless of any
preexisting configuration. This operation is quite advanced and should not be delegated lightly
to users that do not belong the group admin. Standard users can view but not modify the advanced
properties parameters applied to an object.They appear in gray in the addition and edition wizards.
You cannot use this option on VLAN and Device Manager advanced properties.
Using the option Set advanced properties allows to:
• Set a property on an object.

• Overwrite any advanced property already configured.
• Overwrite the value of the Inheritance property and/or Propagation property of an advanced
property.
• Propagate a configured advanced property to child objects if their Inheritance property is set
to Inherit.
• Restrict an advanced property at the level of your choice.
Note that, in the wizard, the drop-down lists Inheritance property and Propagation property are
only displayed if they are relevant to the object you selected.
To set advanced properties on several objects
This operation should only be performed by users of the group admin.
790
1. Go to the IPAM, DHCP or DNS tab. If the homepage is not displayed, click on . The
homepage opens.
2. Go to the page of the object of your choice.
3. Tick the object(s) for which you want to set advanced properties.
4. In the menu, select Tools > Expert > Set advanced properties. The wizard Set advanced
properties opens.
5. In the drop-down list Property, select the advanced property of your choice. The page re-
freshes and the drop-down list Value appears.
6. In the drop-down list Inheritance property, configure the advanced property inheritance be-
havior:
a. Select Set to set the advanced property or overwrite the value of the advanced property
if it is already set on the object. This value is selected by default.
b. Select Inherited to inherit the advanced property from a parent object. Selecting this
value hides the drop-down list Value.
7. If you selected Set, in the drop-down list Value select the parameter value.
8. In the drop-down list Propagation property, configure the advanced property propagation
behavior:
a. Select Propagate to propagate the advanced property value on the child objects. The
propagation is only possible if the child objects' Inheritance property is Inherited. This
value is selected by default.
b. Select Restrict to only configure the advanced property on the object(s) selected and
prevent its propagation to the child objects.
9. Click on ADD to move your advanced property configuration to the Advanced properties list.
• To update an entry, select a configuration in the list, it is loaded again in the drop-down
lists. Edit the needed data and click on UPDATE .
• To delete an entry, select a configuration and click on DELETE .
10. Repeat the steps 5 to 9 for as many advanced properties as you need.
11. Click on OK to commit the changes. The report opens and closes. Any property value and
configuration previously set for the selected object(s) is overwritten.
791
Part VIII. NetChange
NetChange allows to locate and monitor your network devices. You can import them using their IP address
and the CDP, NDP and LLDP layer 2 discovery protocols to find more devices on the network.
Once imported, NetChange relies on the SNMP protocol to retrieve information in the MIB of each device
and provide monitoring for the routes, VLANs and ports they contain as well as the devices connected to
them. In addition, it allows to monitor the configuration file versioning on the devices that support it.
IP address connection tracking

- Switch number
- Port number
- MAC address
- VLAN ID
- DNS name
Local
discoveries
Remote
discoveries
Local
Data Center discoveries Small Office
Head Quarter
Figure 196. Example of a NetChange architecture

1
We recommend importing all possible devices to have a clear overview of your network.
Within SOLIDserver, NetChange has a dedicated module. From its dashboard, or homepage, you can access
Figure 197. The NetChange dashboard
NetChange can include up to 3 levels of organization:
• Network devices: the highest level of hierarchy where you import all the devices you want to manage.
They contain routes, VLANs, ports and/or configurations files. For more details, refer to the chapter
Managing Network Devices.
1
All supported devices are listed on the Knowledge Base in the category NetChange/IPLocator at https://kb.efficientip.com/in-
dex.php/Main_Page.
• Routes: one of the second levels of hierarchy where you can view and partially manage the routing tables
of your layer 3 devices. For more details, refer to the chapter Managing Routes.
• VLANs: one of the second levels of the hierarchy where you can manage the VLANs of your network
devices. For more details, refer to the chapter Managing VLANs.
• Ports: one of the second levels of the hierarchy where you can manage the ports of your network devices.
For more details, refer to the chapter Managing Ports.
• Configurations: one of the second levels of the hierarchy where you can manage the configuration file
versioning of the network devices that support it. For more details, refer to the chapter Managing Routes.
• Discovered items: the lowest level of the hierarchy where you can manage the devices connected to
your network devices.The devices are identified through their MAC address and are connected to a network
device via VLANs or ports. For more details, refer to the chapter Managing Discovered Items.
The module also provides:
• Statistics. You can use gadgets to display device and/or port statistics. For more details, refer to the
chapter Managing Statistics.
• Monitoring and Tuning. You generate reports on devices, refresh them using CSV files, keep them up-
to-date or customize their type. For more details, refer to the chapter Monitoring and Tuning.
Note that the depending on the license you chose, you can either retrieve network devices information
or partially configure your network devices and their content. There are two NetChange licenses available:
1. NetChange-IPL, a light version that provides basic management options of your network devices.
2. NetChange, the full license that allows advanced management of your network devices as it provides
configuration options for VLANs and ports, 802.1X authentication, versioning...
Table 295. NetChange licenses differences

Option NetChange-IPL NetChange
Adding and listing Network devices YES YES
Discovering and listing routes YES YES
Listing VLANs YES YES
Listing ports YES YES
Listing discovered items YES YES
Adding and deleting VLANs NO YES
Configuring the speed of a port NO YES
Configuring the duplex of a port NO YES
Configuring the VLAN of a port NO YES
Configuring access VLANs NO YES
Enabling or disabling 802.1X authentication NO YES
Configuring the protocol Port-security on a port NO YES
Managing network devices' configuration file versioning NO YES
Limiting port edition rights to specific groups of users NO YES
Chapter 50. Managing Network Devices
NetChange uses the SNMP protocol to query network devices and centralize all collected inform-
ation in its database. You can add, import and delete network devices from the page All network
devices. There are several ways to integrate new network devices in NetChange database:
• Adding one or several network devices using their IP address.

• Importing network devices through discovery protocols (like CDP, DP or LLDP) once you added
a device.
• Importing network devices using a CSV file. For more details, refer to the section Importing
Data to NetChange of the chapter Importing Data.
To use NetChange at the maximum of its potential, we strongly suggest that you add at least
one device using its IP address and then use the discovery protocols to add all your network
devices to the page All network devices.
Browsing Network Devices

The network device is the highest level of organization in NetChange. All the devices that you
want to manage and work with on your network are gathered on one page.You can define, check
or discover how all these devices are related to each other through their VLANs, ports, routes
and discovered items. If they support it, you can even monitor their configuration file versioning.
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 50.1. The network device in NetChange hierarchy
Browsing the Network Devices Database

To display the list of network devices
opens.
To display a network device properties page
opens.
794
Managing Network Devices
3. At the end of the line of the network device of your choice, click on . The properties page
opens.
Browsing a Network Device Properties Page
The properties page of a network device describes its configuration and details in a set of panels.
Table 50.1. The panels on a network device properties page

Panel Description
Main properties Sums up the main information regarding the device. For more details, refer to the
table The panel Main properties of a network device.
Refresh properties Displays the device refresh configuration, for both data and configuration file refresh.
For more details, refer to the chapter Managing Configuration Versioning.
Additional information Lists all the gathered data that is not displayed in the other panels: stack identifier,
serial number, Uptime, MAC address, number of ports, etc.
SNMP properties Displays the supported MIBs and all the SNMP related data of the device: profile,
version, port, number of retries, etc.
Configuration versioning Displays the versioning configuration status: unsupported, enabled, disabled. Once
enabled and configured, the connection profile is also displayed in the panel. For
more details, refer to the chapter Managing Configuration Versioning.
IP addresses list Displays the IP address(es) of the device.
Network device ports status Displays a graph representing the active, inactive and disabled ports of the device.
The panel Main properties can contain specific information, depending on the device supported
MIBs, in the table below the specific properties are in italic.
Table 50.2. The panel Main properties of a network device

Property Description
Name The network device name.
IP address The IP address of the network device management interface.
Type The network device type and model.
Analysis The network device current analysis status: Being analyzed (in progress) or time
necessary to collect information during last refresh.
Description The network device description and operating system.
CPU Load The network device CPU Load.
Last updated The network device last refresh date and time.
Serial Number The network device serial number.
Uptime The network device uptime.
sysLocation The network device sysLocation.
Product type The network device type (level 2 switch, level 3 router...).
Status The network device status:
OK: The network device is up and running.
Timeout: The network device is not responding.
Misconfigured: The connection with the network device is not properly set.
System ID The network device internal system ID (its MAC address generally).
Temperature The network device temperature.
Class The network device class.
795
Customizing the Display on the Page All Network Devices

Some columns provide more specific information regarding network devices:
Table 50.3. Available columns on the page All network devices

Column Description
Complete description All the available vendor information, the SysDescr of the device.
Version The device OS version, only for Cisco equipment.
Last config. check Device configuration file versioning information for the devices that support it. You
Revision can also display more versioning dedicated columns. For more details, refer to the
chapter Browsing the Configuration Files.
Versioning
Serial number Displays the network device serial number.
Slot serial number Displays the slot number and slot serial number (identifier) of used slots as follows:
<slot-number>:<slot-serial-number>.That column only retrieves information for used
slots, empty slots are not listed.
Adding Network Devices

The menu Add allows to import network devices via SNMP based on their IP address, you can
specify a range of IP addresses to import several devices at once.
Note that you can also import network devices from a CSV file. For more details, refer to the
section Importing Data to NetChange.
To add a network device
opens.
3. In the menu, select Add > Network device. The wizard Add network devices opens.
4. If you or your administrator created classes at the network device level, in the list Network
device class select a class or None. Click on NEXT . The next page of the wizard appears.
5. In the field IP address, type in either the IP address of the device of your choice or the start
address of a range of addresses that contains several or all of your network devices.
6. In the field Ending IP address, you can type in the last address of the range containing net-
work devices.
7. You can select the SNMP profile(s) to use in order to access the SNMP agent on the devices.
Table 50.4. SNMP profile information parameters

SNMP profiles configuration The SNMP profiles available. By default there are 3 profiles, standard v1,
standard v2c and standard v3, but you can create as many profiles as
needed to display them in this list. For more details, refer to the section
796
Managing SNMP Profiles. Select a profile and click on to move it to the
list Selected profiles.
Selected profiles This field lists the SNMP profiles to use in order to retrieve the device(s)
information. SOLIDserver tries all the profiles on the device(s), following
the list order. To remove a profile from the list, select it and click on .
If you do not select any, NetChange uses the profile standard v2c.
8. Tick the box Expert mode to specify more details regarding the device(s) information retrieval.
Edit the parameters according to your needs following the table below:

Field Description
SNMP port The port used to discover the devices and retrieve their data via SNMP. By de-
fault, the port 161 is selected.
SNMP transfer timeout The number of minutes above which the SNMP transfer is aborted when you
to 0.
9. In the drop-down list Target space, select the IPAM space associated with the network
device(s).
10. Click on OK to add the network device(s). The report opens and works for a while before
closing. The list is updated.
Once you added one device, you can retrieve all the devices it is directly connected (plugged)
to thanks to the discovery protocols option detailed in the section Importing Network Devices
Using Discovery Protocols below.
Importing Network Devices Using Discovery Protocols

Once you manage at least one network device, you can use the discovery protocols to retrieve
and the import the network devices connected to each other. For more details regarding network
device addition, refer to the section Adding Network Devices.
Note that you can also import network devices from a CSV file before using the discovery protocols.
For more details, refer to the section Importing Data to NetChange.
The discovery protocol import option retrieves all the information via three layer 2 protocols: the
Cisco Discovery Protocol (CDP), the Nortel Discovery Protocol (NDP) and the Link Layer Discovery
Protocol (LLDP). The information gathered through these protocols is then retrieved using SNMP,
among which, the devices neighbors i.e. the devices connected to the devices listed on the page
All network devices.
797
The Cisco Discovery Protocol (CDP)

The CDP is a proprietary Data Link Layer network protocol developed by Cisco Systems to
share information between devices, from their topology to their OS version, IP address or
interfaces' status. NetChange uses CDP to discover Cisco network devices.
The Nortel Discovery Protocol (DP)
The DP is a Data Link Layer (OSI Layer 2) network protocol for discovery of Nortel devices
and their topology. NetChange uses it to automatically discover Nortel, Avaya and Ciena
network devices.
The Link Layer Discovery Protocol (LLDP)
The LLDP is a vendor-neutral Link Layer protocol in the Internet Protocol Suite used by net-
work devices for advertising their identity, capabilities, and neighbors on a IEEE 802 local
area network, principally wired Ethernet. LLDP is supported by the following switch vendors:
HP, H3C, Nortel, Extreme Networks, Cisco and Juniper, Dell and Entreats.
To import network devices using the discovery protocols
opens.
3. Tick the device(s) for which you want to discover neighbors.
4. In the menu, select Add > Import > Using CDP/NDP/LLDP. The wizard Add network devices
opens.
5. In the drop-down list Target space, select the IPAM space that should list the IP addresses
of the discovered device(s).
6. Click on OK to execute the discovery. The report opens and works for a while before closing.
The devices found are listed.
The LLDP being the only vendor-neutral protocol, you might need to enable it on your devices,
especially if the devices connected are from different vendors or if you connected a Nortel or
Cisco device with a device from a different vendor.
Enabling LLDP on HP Devices

LLDP is enabled by default on HP Procure switches and routers. There is nothing to do. If you
want to see LLDP neighbors from your HP switch, use the following command.
show lldp info remote-device
Enabling LLDP on Nortel Devices

Nortel switch 425 and 55x0 series support LLDP with a 5.x firmware.This is not enabled by default.
Here is the set of command to enable LLDP:
5510-24T(config)#interface FastEthernet ALL
5510-24T(config-if)#lldp tx-tlv port ALL port-desc
5510-24T(config-if)#lldp tx-tlv port ALL sys-name
5510-24T(config-if)#lldp tx-tlv port ALL sys-desc
5510-24T(config-if)#lldp tx-tlv port ALL local-mgmt-addr
5510-24T(config-if)#lldp tx-tlv port ALL dot1 vlan-name ALL
5510-24T(config-if)#lldp tx-tlv port ALL dot3 link-aggregation
5510-24T(config-if)#lldp tx-tlv port ALL dot3 mac-phy
Depending on your firmware version, some options may be unrecognized. For VLAN, unfortunately,
you need to issue the command each time you add a VLAN. When using MT, EAST or SMELT,
you may want to disable ingress filtering:
798
vlan ports ALL filter-unregistered-frames disable
For Nortel RES 8600, there is no support for LLDP. For Nortel Switch for IBM Blade canter (Nortel
Layer 2-3 and 2-7), you need version 5.1 or more recent.
Enabling LLDP on Extreme Networks Devices

ExtremeOS and ExtremeWare supports LLDP with recent firmware's. You need to enable it with:
enable lldp ports all
configure lldp ports all avertise management-address
configure lldp ports all avertise port-description
configure lldp ports all avertise system-capabilities
configure lldp ports all avertise system-description
configure lldp ports all avertise system-name
configure lldp ports all avertise vendor-specific dot1 vlan-name
configure lldp ports all avertise vendor-specific dot3 link-aggregation
configure lldp ports all avertise vendor-specific dot3 mac-phy
Enabling LLDP on Cisco Devices

Starting from IS 12.2(33)SCH, LLDP is supported. Use the following command to enable it:
lldp run
On each interface, you may need to accept LLDP:

interface GigabitEthernet1/7
lldp enable
Enabling LLDP on Juniper Devices

Numerous platforms from Juniper support LLDP and LLDP-MED.The Juniper supported platforms
are: EX, MX, M, J and SEX. Use the following command to enable it:
set protocols lldp
On capable and configured devices, you can see LLDP information with:
show lldp <detail>
Enabling or Disabling the 802.1X Authentication Protocol

As long as a device supports the 802.1X authentication, you can enable or disable it from the
GUI. We recommend that you display the column 802.1X, it allows to see if the authentication is
supported on a device and its status, enabled or disabled.
Keep in mind that even if the authentication is enabled for the device, you can choose to disable
it on the ports individually. For more details, refer to the section the section called “Managing the
802.1X Authentication on a Port”.
To enable/disable the 802.1X authentication on a device
opens.
4. Right-click over the Name of the device you want to edit. The contextual menu opens.
5. Click on . The wizard Edit a network device opens.
799
6. In the drop-down list 802.1x authentication, select Enable or Disable.

7. Click on OK to commit your changes. The report opens and closes. The device is marked
Enabled or Disabled in the column 802.1X .
Editing the SNMP Properties of a Network Device

For each device, you can set specific SNMP parameters (version, profile, port, number of retries,
transfer timeout...) via the panel SNMP properties on its properties page. Keep in mind that the
SNMP service and profiles must be configured beforehand. For more details, refer to the sections
Managing the SNMP Service and Managing SNMP Profiles.
This panel also provides an overview of the MIBs supported by the device.
To edit the SNMP properties of a device
opens.
opens.
4. In the panel SNMP properties, click on EDIT . The wizard SNMP parameters opens.
5. Edit the parameters according to your needs following the table below:

Field Description
SNMP version The version of the SNMP protocol you want to use. It can be either v1, v2c or
v3. By default, v2c is selected.
SNMP port The port that the SNMP service must use. By default, the port 161 is selected.
SNMP retries Select the number of connection attempts when the server is in timeout. You
can set it between 0 and 5. By default, it is set to 2 attempts.
SNMP timeout Select the number of seconds between each connection attempt. You can set
it between 1s and 5s or set it to 10s. By default, it is set to 5s.
SNMP transfer timeout Set the number of minutes above which the SNMP transfer is aborted when you
to 0.
6. Click on NEXT. The last page of the wizard opens.

page.
800
are currently working with.
8. Click on OK to commit your changes. The wizard closes. The changes are listed in the panel.
Refreshing the Network Devices Database

After each network device import, a discovery is automatically carried out to fill NetChange
database. It includes ports, VLANs, routes, IP addresses and MAC addresses information. Fol-
lowing this initial discovery, it is necessary to periodically refresh the database to keep it up to
date. Two methods are available: a manual refresh or a scheduled refresh of network devices.
Refreshing a Device Manually

The manual refresh allows to get the latest information available regarding a network device. For
instance, you should use it if its configuration or architecture have been modified.
Keep in mind that the device parameter SNMP transfer timeout can impact the success of the
refresh. For more details, refer to the section Editing the SNMP Properties of a Network Device.
To manually refresh a device
opens.
3. Tick the network device(s) you want to refresh.
4. In the menu, select Edit > Refresh. The wizard Refresh a network device opens.
5. Tick the box Device data to refresh the database of the selected network device(s).
6. If you enabled versioning on the selected device(s), you can tick the box Configuration
versioning. For more details, refer to the section Refreshing a Configuration File.
7. Click on OK to refresh the device(s). The report opens and works for a while.
When the refresh is over, a report might appear and list the created IP addresses (Notice)
and existing ones (Error). This list only regards the device addition or import in the selected
Target space. You can download this report in the format of your choice: TEXT , HTML or
EXCEL .
8. Click on CLOSE to go back to the page All network devices. The page refreshes.
Scheduling a Refresh
The scheduled refresh allows to plan ahead the update of the NetChange database. You can
specify different schedules depending on the devices. Typically, edge switches are queried more
often than backbone routers.
Setting Up a Scheduled Refresh
The device refresh frequency can be common to several devices or specific to a device. Do not
hesitate to tick one or several devices before setting up a refresh schedule.
801
To set up a network device scheduled refresh
opens.
3. Tick the network device(s) for which you want to schedule the refresh.
4. In the menu, select Edit > Scheduling > Configure refresh.The wizard Set refresh parameters
opens.
5. Configure the refresh frequency using the table below.
Table 50.7. Scheduled refresh parameters

Field Description
Minute Select the moment (o'clock, quarter past, half past or quarter to) or the frequency (in
minutes) of the refresh.
Hour Select a frequency (over the whole day or for a limited period of time each day), a set
of hours or a specific hour per day for the refresh.
Date of the month Select a specific day of the month or a frequency (every day) for the refresh.
Month Select a specific month or a frequency (every month) for the refresh.
Day(s) of the week Select a frequency (over the whole week or for a specific set of days) or a specific
day of the week.
6. Tick the Device data to refresh the database of the selected network device(s) at the
scheduled time.
7. If you enabled versioning on the selected device(s), you can tick the box Configuration
versioning. For more details, refer to the section Refreshing a Configuration File.
8. Click on OK to commit the refresh configuration. The report opens and closes. The page is
visible again. The refresh frequency that you set is displayed in the panel Refresh properties
on the properties page of your network device.
Disabling a Scheduled Refresh
Any scheduled refresh can be disabled for one or several devices at once.
To disable a network device scheduled refresh
opens.
3. Tick the network device(s) for which you want to disable the scheduled refresh.
4. In the menu, select Edit > Scheduling > Disable. The wizard Disable Schedule opens.
visible again.
Connecting to a Network Device Via a Console

From the properties page you can connect to a network device via an SSH, telnet or web console.
802
To connect to a network device via SSH
opens.
opens.
4. In the menu, select Tools > Connect > Via SSH.
5. The SSH console connected to your device opens.
To connect to a network device via a telnet console
opens.
opens.
4. In the menu, select Tools > Connect > Via telnet.
5. The telnet console connected to your device opens.
To connect to a network device via a web console
opens.
opens.
4. In the menu, select Tools > Connect > Via web.
5. A new tab connecting to your device opens.
Making a Network Device Snapshot

SOLIDserver allows you to retrieve information regarding a specific network device, whether it
is already managed by NetChange or not, through its IP address.
EfficientIP support team might ask for a device snapshot in case of missing or distorted information
on the equipment you want to add to NetChange. The snapshot is generated in .pcap format and
stored in the Local files listing. Keep in mind that the SNMP service and profiles must be configured
beforehand. For more details, refer to the sections Managing the SNMP Service and Managing
SNMP Profiles.
To make a network device snapshot
opens.
803
3. In the menu, select Tools > Make a snapshot. The wizard Make a network device snapshot
opens.
4. In the drop-down list Interface, select the network interface through which you want to make
the snapshot.
5. In the drop-down list SNMP profile, select the SNMP protocol version of the snapshot gen-
eration. By default, standard v1 is selected. For more details, refer to the section Managing
SNMP Profiles.
6. If you are generating a Cisco device snapshot, tick the box Cisco device.
7. In the field IP address, type in the device IP address.
8. Click on OK to commit the creation. The report opens and works for a while before closing.
The page All network devices is visible again. The snapshot (<chosen_inter-
face>_<chosen_SNMP_profile>_snapshot.pcap file) is available on the page Local files
listing. To download this file, refer to the procedure below.
To download a network device snapshot through the GUI
opens.
2. In the menu, select Maintenance > Local files listing. The page Local files listing opens
filtered through the bullet Local, under the menu.
3. In the column Name, the snapshot is listed and named following the following format:
<chosen_interface>_<chosen_SNMP_profile>_snapshot.pcac.
4. Filter the list if need be. Once you found the snapshot, click on its name to download it.
Creating Network Devices in Device Manager

SOLIDserver allows you to manage your network devices through NetChange and Device Man-
ager. With a simple automated manipulation you can create, within Device Manager module, the
network devices of your choice as well as the ports and interfaces they contain.
For more details, refer to the section Automatically Adding Network Devices in Device Manager.
Deleting Network Devices

If you no longer want to manage a network device or no longer use it, you can delete it from the
GUI. Deleting a device from the list also deletes all references to its interfaces and discovered
items.
To delete a network device
opens.
3. Tick the network device you want to delete.
5. Click on OK to commit the device deletion. The report opens and closes. The device is no
longer listed.
804
Defining a Network Device as a Group Resource

Adding a network device as one of the resources of a specific group allows the users of that
group to manage the network device(s) in question as long as they have the corresponding rights
and delegations granted.
Granting access to a network device as a resource also grants access to every item it contains.
For more details, refer to the section Assigning Resources to a Group in the chapter Groups.
805
Chapter 51. Managing Routes
The page All routes is dedicated to the network devices routing tables and displays the existing
routes on the layer 3 network devices you manage.
All the information displayed is retrieved via SNMP. Each route corresponds to a subnetwork
and has a unique IP address and prefix. The prefix size can be any number between 0 to 32.
NetChange supports more MIBs to provide detailed route information on the page. Thanks to
L3VPN you can now display the VRF routes configured on your network and also retrieve the
routes Type and Protocol.
Prerequisites
• Managing network devices and/or routers that support and have SNMP enabled.
• To discover VRF routes on your network you must:
• Make sure the routers support the MIB MPLS-L3VPN-STD-MIB.
• Make sure the routers configured with VRF have MPLS enabled.
• Make sure the routers configured with VRF have BGP enabled.
• Enable the registry key module.netchange.enable_vrf_route.
Limitations
• Routes are retrieved automatically when you import network devices. You cannot add, edit or
delete them.
• You can only export routes.
• To display the routes' Type and Protocol, the MIBs IP-FORWARD-MIB and IANA-RTPROTO-
MIB must be implemented on the routers.
• Depending on your infrastructure, enabling the VRF routes discovery can significantly increase
the database size.
Browsing Routes
The routes are the second level of organization in NetChange, along with the VLANs, configura-
tions and ports.
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 51.1. The route in NetChange hierarchy
806
Managing Routes
Browsing the Routes Database

To display the list of routes
1. Go to the NetChange tab.

2. In the breadcrumb, click on All routes. The page All routes opens.
To display the list of routes of a specific network device

3. In the column Name, click on the device of your choice. The page All ports opens.
4. In the menu, select Display > All routes. The page All Routes of the device opens.
Understanding the Icons on the Page All Routes

Table 51.1. The icons on the page
Icon Description
Routes with a prefix size between 0 to 24.
Routes with a prefix size of 30.
Customizing the Display on the Page All Routes

In addition to Route IP address, Network device, Route prefix and Network device IP, the
columns VRF name, Route Distinguisher and Next hop provide detailed information.
Table 51.2. Column information retrieved with L3VPN

Column Description
VRF name The name of the VRF as set on the network device.
Route Distinguisher A 64-bits identifier that differentiates every set of routes on each VRF. It is unique and can
contain IP addresses or AS numbers, according to your needs, as follows: <2-byte ASN>-
<4-byte value> or <4-byte IP>-<2-byte value> or <2-byte ASN>-<4-byte value>.
Next hop The next router to reach the prefix within the VRF.
The column Type provides information for each VRF.
Table 51.3. The possible values of the column Type

Value Description
other The routing is not working, we do not know why.
invalid/reject The routing is not working: the route discards traffic.
local The routing is working: it originates from a local interface.
remote The routing is working: it has a remote destination.
blackhole The routing is working: the route is discarding traffic silently.
807
Managing Routes
The column Protocol allows to determine how the VRF was found.
Table 51.4. The possible values of the column Protocol

Value Description
other No protocol is specified.
local Local interface.
netmgmt Static route.
icmp Result of ICMP Redirect.
egp Exterior Gateway Protocol.
ggp Gateway-Gateway Protocol.
hello FuzzBall HelloSpeak
rip Berkeley RIP or RIP-II.
is-is Dual IS-IS.
es-is ISO 9542.
ciscoIgrp Cisco IGRP.o
bbnSpfIgp BBN SPF IGP.
ospf Open Shortest Path First.
bgp Border Gateway Protocol.
idpr InterDomain Policy Routing.
ciscoEigrp Cisco Enhanced Interior Gateway Routing Protocol.
dvmrp Distance Vector Multicast Routing Protocol.
rpl Routing Protocol for LLNs [RFC-ietf-roll-rpl-19].
dhcp Dynamic Host Configuration Protocol [RFC2132].
ttdp Train Topology Discovery Protocol [IEC 61375-2-5].
Enabling the Registry Key Required to Display the VRF

Routes
Once you met the Prerequisites, you can enable the key module.netchange.enable_vrf_route to
start retrieving all relevant information using L3VPN on the page All routes.
To enable the registry key that controls the switch based on time drift

opens.
3. In the column Name, type in module.netchange.enable_vrf_route. The entry is the only one
listed.
opens.
5. In the field Value, type in 1 to enable it. By default, its value is 0.
808
Chapter 52. Managing VLANs
The All VLANs page simply provides an overview of the amount of existing of Virtual Local Area
Networks of each network device and their ID if you purchased the license NetChange-IPL. If
you have the NetChange license, it also allows add, edit and delete VLANs on your devices. For
more details regarding the two available NetChange licenses, refer to the table NetChange licenses
differences.
Browsing VLANs
The VLANs are the second level of organization in NetChange, along with the routes, configura-
tions and ports.
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 52.1. The VLAN in NetChange hierarchy
Browsing the VLANs Database

To display the list of VLANs

2. In the breadcrumb, click on All VLANs. The page All VLANs opens.
To display the list of VLANs of a specific network device

3. In the column Network device, click on the name of the device of your choice to display only
its VLANs.
To display a VLAN properties page
opens.
3. At the end of the line of the VLAN of your choice, click on . The properties page opens.
809
Managing VLANs
Customizing the Display on the Page All VLANs

Keep in mind that the column Port list contains the number of all the ports associated with each
VLAN. You can edit this list if you purchased the license NetChange, otherwise this list is merely
informative.
Adding a VLAN
With the NetChange license, you can add VLANs to the page All VLANs and then associate them
with existing ports. Using 802.1q VLAN Trunking protocol, a VLAN can cover a network area on
multiple switches.
To add a VLAN from the page All VLANs

3. In the menu, select Add > VLAN. The wizard Add a VLAN opens.
4. In the field Name, name the VLAN.
5. In the field VLAN ID, type in an ID between 1 and 1005 for your VLAN.
6. In the drop-down list Network device, select the network device where you want to add your
VLAN.
7. Click on OK to commit your creation. The report opens and closes. The VLAN is listed.
You can also add a VLAN from the list All VLANs of a specific device, in this case the Network
device drop-down list does not appear.
In addition, you can use existing VLANs ID and name and add them to another device. That way,
you only need to specify a device for the VLAN name and ID to be used automatically upon cre-
ation. Obviously, the ports configuration of the selected VLAN is not created in the target network
device.
To add a VLAN from the page All VLANs using an existing name and ID

3. Right-click over the ID of the VLAN of your choice. The contextual menu opens.
4. Click on . The Add a VLAN wizard opens.
5. In the fields Name and VLAN ID are displayed in the gray the name and ID of the chosen
VLAN.
6. In the drop-down list Network device, select the device of your choice.
7. Click on OK to commit your creation. The report opens and closes. There are now two VLAN
with the same name and ID listed, only their device differs.
810
Managing VLANs
Editing a VLAN
Editing a NetChange VLAN means renaming it. However, with the NetChange license you can
decide to use it with one or several of your network ports. For more details regarding the port
and VLAN interaction, refer to the section Associating a Port With a VLAN.
To rename a VLAN

4. Right-click over the Name of the VLAN you want to rename. The contextual menu opens.
5. Click on . The Add a VLAN wizard opens.
6. In the field Name, rename the VLAN.
7. In the field VLAN ID, the ID is displayed but cannot be edited.
8. Click on OK to commit your changes. The report opens and closes. The list refreshes, the
new VLAN name is listed.
Deleting a VLAN
With the NetChange license you can delete any VLAN from any network device as long as it is
not used on any port.
To delete a VLAN

its VLANs.
4. Tick the VLAN(s) you want to delete.
6. Click on OK to commit the VLAN deletion. The report opens and closes. The VLAN is no
longer listed.
811
Chapter 53. Managing Ports
The ports are physical interfaces of the network devices. NetChange discovers the network
devices ports using a discovery algorithm that automatically analyzes each port and displays its
type and status. It also allows to know which MAC or IP addresses should be looked for and the
devices connection on the network. Typically the listed ports can be:
• Edge or terminal ports: used to connect the terminal network devices of the network (servers,
workstations, printers, ...);
• Interconnection ports: used to link the network devices between them (the backbone).
Depending on your network devices, some ports can actually be both. Some columns on the
page provide all this information:
• Interco (for interconnection) is purely informative even if you can manually force its value to
Yes, No or Autodetect in the GUI.
• Trunking/Tagging mode provides the actual port type, edge ports are marked Access and
interconnection ports are marked Trunk or Tagged.
NetChange module allows to edit a port and associate it with existing VLANs on your device
(existing by default or that you added). To be able to edit a port, you must meet the following
prerequisites:
1. The SNMP service is configured properly. For more details, refer to the section Managing the
SNMP Service.
2. The SNMP profile used with network devices has a read/write access to interact with the
device(s). For more details, refer to the sections Managing SNMP Profiles and Editing the
SNMP Properties of a Network Device.
3. You have the NetChange license. NetChange-IPL does not provide ports edition options. For
more details, refer to the table NetChange licenses differences.
4. The network device on which you edit the port supports MIBs that allows ports edition.
Once these prerequisites are met, you can edit your ports. This allows to associate them with
any VLAN on your network or even use them in a tagged or untagged mode and influence their
behavior on the network. As a general rule, when choosing to tag or not a port you should take
into account the following:
• The untagged mode (called Access on Cisco devices) uses the ID of the tagged VLAN the port
is associated with when sending and receiving data. That way packages are identified
throughout the transfer on the network from the sending port to the receiving one. Once the
package is received, the tag number is dismissed, in other words, untagged. This transfer
mode is based on terminal, or edge, ports as packages always reach their destination thanks
to their tag once sent. In the columns VLAN name list and VLAN # list, the untagged/access
VLAN of the port is followed by a star.
• The tagged mode (called Trunk on Cisco devices) uses the ID of the VLANs associated with
the port only when sending packages. The tag identifies the target port. Once the package is
received, the tag number is kept. This transfer mode is based on interconnection ports as it
allows to send out data all over the network.
812
Managing Ports
Browsing Ports
The ports are the second level of organization in NetChange, along with the routes, configurations
and VLANs.
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 53.1. The port in NetChange hierarchy
Browsing the Ports Database

To display the list of ports
opens.
2. Click on Network ports. The page All ports opens.
To display the list of ports of a specific network device
opens.
3. Click on the name of the network device of your choice.The page All ports opens and displays
only the device's ports.
To display a port properties page
opens.
3. At the end of the line of the port of your choice, click on . The network port properties page
opens.
Customizing the Display on the Page All Ports

Keep in mind that the columns can help you filter the list on specific port settings: Trunking/Tagging
mode, Configured speed, Configured duplex, VLAN name list, VLAN # list, Operating speed,
Operating duplex...
813
Managing Ports
Understanding the Port Statuses

The column Status provides information regarding the ports you manage.
Table 53.1. NetChange port statuses

Status Description
Active The port is active, or up.
Inactive The port is inactive, or down.
Testing The port is up but no operational packets can be passed.
LowerLayerDown
The port is inactive. These statuses are very rare. For more details, refer to the description
NotPresent of the MIB IF-MIB.
Dormant
Unknown The port status is unknown.
Disabled The port was disabled. For more details, refer to the section Enabling or Disabling a Port.
Enabling or Disabling a Port

As an experiment, NetChange offers a function to disable or enable ports of any network device,
as soon as it has been validated. This function allows you to disable directly through the web in-
terface any port, typically when a workstation has been detected as infected by a virus or when
a user has not been authorized on the network. To work properly, you must have defined the
Write community string of the SNMP profile used by the network device.
Keep in mind that you should never disable interconnection ports as you take the risk of
losing access to your network device.
To enable/disable a port
opens.
3. Tick the port(s) for which you want to change the status.
4. In the menu, select Edit > Port status > Enable or Disable.The wizard Change the status
of a port opens.
5. Click on OK to commit your modification. The report opens and closes. The page is visible
again.
Keep in mind that on some devices, especially Cisco Catalyst, the configuration is not written
after the modification has been done, so if no write configuration command is made through
CLI, modifications can be lost if the switch is reloaded.
Editing a Port Interconnection

Interconnection ports are used to link the network devices (the backbone) between them. Most
of the network traffic is done through these ports.
814
Managing Ports
NetChange discovery algorithm automatically isolates interconnection ports: they are marked
Yes in the column Interco if the number of discovered items on a port is greater than a defined
limit (4 by default).
The value of the column Interco is merely a way of filtering the ports in the list. However, if a port
interconnection is set to Yes, any MAC address discovered via the port is not logged in the dis-
covered item History view.
To tag a port interconnection status
opens.
3. Tick the port(s) you want to use as an interconnection.
4. In the menu, select Edit > Interconnection > Force to yes, Force to no or Autodetect. The
wizard Manually force ports interconnection opens.
again. The value of the Interco column switches to Yes (forced) on selected ports.
Editing a Port Speed and Duplex Mode

You can edit the port speed and duplex on each port individually. In some cases you might only
be able to edit the speed. During the configuration, the available values depend on the port
possible speed and duplex configuration. We recommend that you display the Configured speed,
Configured duplex, Operating speed and Operating duplex columns to rapidly see the speed
and duplex configuration of the ports.
Keep in mind that you can only see the speed and duplex changes of active ports. If you edit the
port and speed of an inactive port, the changes are never visible in the GUI.
To edit a port speed and duplex mode
opens.
4. Right-click over the Name of the port you want to edit. The contextual menu opens.
5. Click on . The wizard Edit a port opens.
6. If you or your administrator created classes at the port level, in the list Port class, select a
class or None. Click on NEXT . The next page of the wizard opens.
7. In the drop-down list Speed and duplex mode, select the port <speed> <duplex> of your
choice.
9. Click on OK to commit your changes. The report opens and closes. The ports list is visible
again.
815
Managing Ports
Once you edited the port speed and duplex, you need to refresh the port to see your changes in
the columns Configured speed and Configured duplex. For more details, refer to the section
Refreshing the Ports Database below.
Updating a Port Description

Even though the name of a switch port cannot be edited, it is possible to modify its description
through NetChange to help you recognize it instantly from the graphical interface. The description
is directly updated on the port itself and is visible by any user that discovers the device. To work
properly, you must have defined the Write community of the SNMP profile used by the network
device.
To update a port description
opens.
3. Tick the port(s) for which you want to change the description.
4. In the menu, select Edit > Update port description.The wizard Update port description
opens.
5. In the field Port description, type in the description of your choice.
6. Tick the box Refresh NetChange if you want to refresh the ports list immediately after your
modification.
7. Click on OK to commit your changes. The report opens and closes. The page is visible again
and displays the new value in the column Description.
Managing the 802.1X Authentication on a Port

With the NetChange license, you can individually enable or disable the 802.1X authentication on
a port as long as:
1. The network device that the port belongs to supports the 802.1X authentication.
2. The 802.1X authentication has been enabled on the network device the port belongs to.
3. The requirements and limitations listed below have been taken into account or met.
We recommend that you display the column 802.1X on the page All network devices and All
ports. For more details, refer to the section Customizing the List Layout.
Prerequisites
• The 802.1x must be activated on the device to be managed from the GUI.
• The 802.1X configuration has to be done on each port individually.
Limitations
• On HP devices, only the HP-DOT1X-EXTENSIONS-MIB is supported;
• On Cisco devices, the interface vlanTrunkPortDynamicState should not be set to "auto" or
"desirable".
816
Managing Ports
Enabling or Disabling 802.1x

To enable or disable Port-security on a port, you must edit it.You can enable both 802.1x authen-
tication and port-security on a port, but keep in mind that on HP devices, if 802.1x is enabled,
only the port-security mode 8021xAuthorised is available.
To enable/disable the 802.1X authentication on a port
opens.
3. Click on the name of a device marked Active in the column 802.1X. The page All ports of
the device opens.
8. The section Security configuration is visible.
a. To enable the 802.1X authentication, tick the box 802.1X. The page refreshes.
b. To disable the 802.1X authentication, untick the box 802.1X. The page refreshes.
9. Click on OK to commit your changes. The report opens and closes. The port is marked
Enabled or Disabled in the column 802.1X.
Restricting Access to a Port with the Protocol Port-security

With the license NetChange, you can edit a port and choose to use the protocol Port-security if
the device supports it.
This protocol allows to restrict input to an interface by limiting and identifying MAC addresses
that are allowed to access the port.
By default, the protocol is enabled on the devices that support it and you can enable or disable
it individually on each port.
Prerequisites
• On Cisco devices, the port mode Trunking/Tagging (i.e. switchport) is set to Access or Trunk.
Limitations
• On Cisco devices, only the CISCO-PORT-SECURITY-MIB is supported.
• Only HP devices supporting the HP-ICF-GENERIC-RPTR MIB can be configured.
817
Managing Ports
• On HP devices, if you enable Port-security and 802.1x on a port, only the port-security mode
8021xAuthorised can be configured.
• On HP devices, if you enable Port-security and 802.1x on a port, you cannot limit the number
of MAC addresses that can access the port.
Enabling or Disabling Port-Security

To enable or disable Port-security on a port, you must edit it. You can enable both port-security
and 802.1x authentication on a port, but keep in mind that on HP devices, if 802.1x is enabled,
only the port-security mode 8021xAuthorised is available.
We recommend that you display the columns Port-security on the page All ports to see which
ports support it. For more details, refer to the section Customizing the List Layout.
To enable/disable the Port-security option on a port
opens.
3. Click on the name of a device of your choice. The page All ports of the device opens.
8. In the section Security configuration:
a. To enable Port-security, tick the box Port-security. The page refreshes and displays
the fields Mode, Maximum number of secured MAC addresses and/or Action. For more
details, refer to the section Configuring Port-Security Modes on HP or Cisco Devices
and or Limiting the Number of MAC Addresses Allowed to Access a Port.
b. To disable Port-security, untick the box Port-security. The page refreshes, the dedicated
fields are no longer visible.
9. Click on OK to commit your changes. The report opens and closes. The port is marked
Enabled or Disabled in the column Port-security.
Limiting the Number of MAC Addresses Allowed to Access a Port

You can limit access to a port by setting a maximum number of MAC addresses when you edit
the port. This option can only be set if you enable the protocol Port-security.
We recommend that you display the columns MAC number limit on the page All ports to see
which ports you restricted the access to, by default it contains the value 1. For more details, refer
to the section Customizing the List Layout.
818
Managing Ports
Note that on HP devices you cannot set a maximum number of MAC address on a port configured
both with 802.1x authentication and Port-security, the Port-security mode 8021xAuthorised does
not allow it.
To set a maximum number of MAC addresses that can access a port
opens.
8. In the section Security configuration, tick the box Port-security. The page refreshes.
9. If you are editing the port of a HP device, make sure the Port-security Mode selected is either
FirstN or LimitedContinuous.
10. In the field Maximum number of secured MAC addresses, type in the number of MAC ad-
dresses that can access the port. This number depends on your device. By default, Port-
security is configured with 1 MAC address.
To configure an Action for the port once the number of secured MAC addresses exceeds
the one you just set, refer to the section Configuring Port-Security Modes on HP or Cisco
Devices.
11. Click on OK to commit your changes. The report opens and closes. The column MAC number
limit displays the new value.
Configuring Port-Security Modes on HP or Cisco Devices

SOLIDserver supports the configuration of some Port-security modes on the ports belonging to
HP and Cisco devices. The Action that you select
To configure the option Port-security on HP devices
opens.
3. Click on the name of the HP device of your choice. The page All ports of the device opens.
819
Managing Ports
8. In the section Security configuration, tick the box Port-security if it is not ticked.
9. In the field Mode, select FirstN, 8021xAuthorized or LimitedContinuous. If the authentication
802.1x is enabled, you can only select 8021xAuthorized.
Note that the modes FirstNConditionally and configureSpecific cannot be selected during
the Mode configuration. They are automatically retrieved and displayed if they are configured
on a port you are editing.
10. In the field Action, select disable, sendTrap or sendTrapAndDisablePort.
If you configured a Maximum number of secured MAC addresses, the Action applies to the
extra MAC addresses: it is performed when the number of MAC addresses exceeds the one
you set in the field.
To configure the option Port-security on Cisco devices
opens.
8. In the section Security configuration, tick the box Port-security if it is not ticked.
9. In the field Action, select shutdown, dropNotify or drop.
If you configured a Maximum number of secured MAC addresses, the Action applies to the
extra MAC addresses: it is performed when the number of MAC addresses exceeds the one
you set in the field.
Limiting Port Edition Rights to Specific Groups of Users

With the license NetChange, you can use a class and a rule to define which groups of users are
allowed to edit the ports of your choice. For instance, you can decide that all the interconnection
ports can only be edited by users of the group admin.
To limit edition rights on a port you must:
820
Managing Ports
1. Enable the class reserved in Class Studio.

2. Add and configure the rule 378.
3. Apply the class to the port you want to limit access to.
Keep in mind that once you configured the rule and enabled and applied the class to a port, only
the users belonging to a group of users authorized in the rule can edit that port. Even users with
edition permissions on the ports and the proper resources are not allowed to edit the ports con-
figured with the class reserved if they do not belong to an authorized group of users.
Enabling the Class reserved

By default, the class reserved is disabled. You must enable it to be able to apply it to a port and
restrict access to it once you configured the rule 378.
To enable the class reserved
opens.
2. In the section Customization, click on Class Studio. The page Class Studio opens.
3. In the column Type, type in Port and hit Enter.
4. In the column Name, type in reserved and hit Enter.
5. Tick the class reserved that does not belong to the directory Library.
6. In the menu, select Edit > Enable class or Disable class. The wizard opens.
7. Click on OK to commit your configuration. The report opens and closes, the page refreshes.
The class is marked as Enabled in the column Status.
Adding and Configuring the Rule 378

You must add and configure the rule 378 to be able to use the class reserved to restrict access
to your ports.
Keep in mind that once the rule is configured, its configuration overrides the port permissions set
for any group of users. Even if a group has all the existing ports within its resources and edition
permissions over them, its users are not allowed to edit the ports set with the class reserved if
they are not listed among the Authorized groups.
To add the rule 378 that defines the groups of users allowed to edit reserved ports
opens.
4. In the drop-down list Module, select NetChange.
5. In the drop-down list Event, select Edit: ports properties.
6. In the list Rule, select (378) Ports configuration permission.
7. In the field Rule name, name the rule. That name is listed in the column Instance.
821
Managing Ports

11. In the list Available groups, select one by one the group(s) of users that can edit the ports
configured with the class reserved.
12. Click on . The group is moved to the list Authorized groups. Repeat this action for as many
groups as needed.
Applying the Class reserved to a Port

Once you enabled the class reserved and configured the rule 378, you can apply the class to the
ports of your choice.
We recommend that you display the column Class on the page All ports to have an overview of
the ports you applied it to. For more details, refer to the section Customizing the List Layout.
To apply the class reserved to a port
opens.
6. In the list Port class, select reserved.
8. Click on OK to commit your changes. The report opens and closes. The ports list is visible
again.
Once the class is applied on a port, only users belonging the Authorized groups configured in
the rule can edit the port.
Configuring VLAN Tagging on a Port

With the license NetChange, you can edit the ports configuration on the network according to
your needs. For instance, set a port with a specific access VLAN.
Keep in mind that the untagged/access VLAN tag of a port is followed by a star (*) in the columns
VLAN name list and VLAN # list.
Configuring the Tagging Mode

When configuring VLAN tagging at ports level, you must choose the relevant tagging mode before
associating a port of specific VLANs. For this reason, we recommend that you display the
Trunking/Tagging mode column to rapidly see your ports configuration.
There are different tagging modes available depending on the network device vendor: Cisco or
others.
822
Managing Ports
Cisco devices tagging modes

Cisco devices offer three tagging modes: Trunk (i.e. tagged), Access (i.e. not tagged) and
auto (the port mode is automatically one or the other). Setting a port to Trunk mode sets its
tag encapsulation mode to 802.1Q .
Other vendors tagging modes
Non-Cisco devices offer two tagging modes: tagged or mixed.
Keep in mind that you can only edit a device Trunking/Tagging mode if the SNMP configuration
set at device level allows to retrieve the MIBs.
To edit a port tagging mode on a non-Cisco network device
opens.
7. In the drop-down list Trunking/Tagging mode, select the mode of your choice: Tagged or
Mixed.
Once you edited the port tagging mode, you need to refresh the port to see your changes in the
column Trunking/Tagging mode. For more details, refer to the section Refreshing the Ports
Database below.
To edit a port tagging mode on a Cisco network device
opens.
7. In the drop-down list Trunking/Tagging mode, select the mode of your choice: Trunk, Access
or Auto.
823
Managing Ports
If you set the trunking/tagging mode to auto, the 802.1X authentication must be inactive.
Once you edited the port tagging mode, you need to refresh the port to see your changes in the
column Trunking/Tagging mode. For more details, refer to the section Refreshing the Ports
Database below.
Associating a Port With a VLAN

Though the port edition wizard you can associate a port with a set of VLANs. These VLANs can
be tagged or untagged depending on the port tagging mode.
To rapidly see your port/VLAN association, make sure the columns VLAN # list and VLAN name
list are displayed.
Associating a Port with an Untagged VLAN
To associate a port with an untagged VLAN, its mode must be Access or Auto (on Cisco devices)
or Mixed (on any other device vendor). To edit the port tagging mode, refer to the section Config-
uring the Tagging Mode above.
You can only associate one untagged VLAN with a port.
To associate a port with an untagged VLAN
opens.
7. In the section VLAN addition, the drop-down list Access/Untagged VLAN displays the un-
tagged VLAN associated with your port. Select the VLAN of your choice. By default, the 1 -
default VLAN is selected.
The lists can be empty if the device port cannot be configured.
If your port mode is Mixed or Auto, the previously selected VLAN is moved to the list Available
VLANs.
8. Click on OK to commit your changes. The report opens and closes. The untagged VLAN
associated with the port is followed by a * in the columns VLAN # list and VLAN name list.
824
Managing Ports
Associating a Port with a Tagged VLAN
To associate a port with tagged VLANs, its mode must be Trunk or Auto (on Cisco devices) or
Tagged or Mixed (on any other device vendor). To edit the port tagging mode, refer to the section
Configuring the Tagging Mode above.
You can add as many untagged as you want with a port.
To associate a port with a tagged VLAN
opens.
7. In the section VLAN addition, the field Trunk/Tagged VLAN list displays all the tagged VLANs
associated with your port. You can add or remove VLANs from the list using the and
buttons. Any VLAN removed is listed in the list Available VLANs.
8. Click on OK to commit your changes. The report opens and closes. The VLANs associated
with the port are displayed in the columns VLAN # list and VLAN name list.
Refreshing the Ports Database

SOLIDserver allows the scheduled refresh of network devices - for more details, refer to the
section Scheduling a Refresh -. Still, you have the possibility to manually refresh the information
for a selection of ports of a specific device directly from the page All ports.
To refresh the ports information manually
opens.
3. Filter the list using the column Network device if need be.
4. Tick the port(s) you want to refresh.
6. Click on OK to commit the refresh. The report opens and closes. The page is visible again.
825
Chapter 54. Managing Configuration
Versioning
SOLIDserver allows to manage configuration file versioning on your network devices. Versioning
allows to automatically save all the changes in the configuration files, and all the revisions of the
files are saved in SOLIDserver backup file.
To monitor versioning from NetChange you must:
1. Create a connection profile from the Administration module.

2. Enable versioning and configure the connection profile on the device.
Once configured, all the revisions are listed on the page All configurations, and you can compare
changes on the page Configuration and download entire files or only changes.
Prerequisites
• SOLIDserver version 6.0.0 with the license NetChange.
• The network device must support versioning. The following vendors do: HP, Cisco, Juniper,
Extreme.
• The network device must already be managed from SOLIDserver. To add a network device,
refer to the section Adding Network Devices.
Limitations
• Disabling the configuration files versioning on a device deletes all the configuration file revisions
from the database.
• Configurations files are local. You cannot push them to the network device you manage from
SOLIDserver.
• Configurations files are read-only. You cannot rollback to a former file version.
• If you configured SOLIDserver with High Availability, keep in mind that the configuration files
versioning of your network devices can only be managed from the Master appliance.
Browsing the Configuration Files

The configurations are the second level of organization in NetChange, along with the routes,
VLANs and ports. They outline the devices use and detail their structure.
826
Managing Configuration Versioning
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 54.1. The configuration in NetChange hierarchy
Browsing the Configuration Files Database

The page All configurations allows to browse all the revisions of the configuration file of the
network devices for which you enabled versioning. The page Configuration displays the content
of the configuration file revision of your choice.
To display the list of configuration files
opens.
2. Click on Configurations. The page All configurations opens.
To display the list of configuration files of a specific device
opens.
3. In the column Name, click on the name of the network device of your choice. All the revisions
of the configuration files of the selected device are displayed.
There are 6 columns on the page All configurations that you can sort and filter. By default, all
the columns are displayed on the page, you cannot change their order.
Table 54.1. The columns on the page All configurations

Column Description
Name The network device name. This column is not displayed if you list the configurations
files of a specific network device.
Vendor The network device vendor. This column is not displayed if you list the configurations
files of a specific network device.
IP address The IP address of the network device management interface.
Revision The configuration file revision number, the latest revision is displayed as follows:
r.<number> (last). This revision number is based on a version control system and
does not reflect the number of changes in the file.
Configuration date The date and time when the configuration was saved. It is unique to each revision.
Changed lines The number of lines that changed between the latest revision and the previous one.
At the end of the line of each revision listed, you can find two links.
827
Table 54.2. The links on the page All configurations

Link Description
Compare with previous This link allows to compare side by side the latest revision of the configuration file
with the previous one.
Download This link allows to download any revision of the configuration file of your choice. The
downloaded file is named <network-device-ip-address>_r<revision-number>.txt .
Do not hesitate to set up alerts on the page to monitor any changes. For more details, refer to
the chapter Managing Alerts.
For more details regarding downloads, refer to the section Downloading Versioning Information.
To display the latest configuration file from the page All network devices
opens.
3. In the column Revision, click on r.<revision-number>. The page Configuration opens and
displays the latest version of the network device configuration file.
Above the configuration file content, a gray area contains the network device details: its
name, its IP address, and the date and time when the configuration version was saved.
To display a configuration file from the page All configurations
opens.
3. Filter the list of need be. If you click on a network device Name, only the revisions of that
device are displayed.
4. In the column Revision, the latest revision number is named r.<number> (last), click on the
revision number of your choice. The page Configuration opens and displays the chosen
revision of the configuration file.
By default, the configuration file displays all the passwords in plain text, if you do not want
all the users to see them you can edit a registry database entry to hide them. For more details,
refer to the section Configuring the Passwords Display in the Configuration Files.
Displaying Versioning Information on the page All network devices

A set of columns dedicated to network devices versioning provide information directly from the
page All network devices.
Table 54.3. The columns on the page All network devices

Column Description
Last config. check The date and time of the last configuration check on the device. This column is displayed
by default on the page.
Revision The last known device configuration revision number, following the format r.<revision-
number>. This revision number does not reflect the number of changes on the device
828
Column Description
configuration file. The number is a link toward the latest version of the configuration file
on the page Configuration. This column is displayed by default on the page.
Versioning The device configuration versioning status: Yes means the versioning is active; No means
it is inactive; Error means it is active but an error occurred during the last operation; Un-
supported means that versioning is not supported by the device. This column is displayed
by default on the page.
Connection profile The device connection profile, the name of the profile currently associated with the device.
Configuration refresh The configuration refresh schedule for the versioning.
Last configuration The date and time of the last configuration date, the last known configuration for the device.
It corresponds to the Revision number displayed on the page All network devices.
First configuration The date and time of the first configuration date, the first known configuration for the device.
It corresponds to the first known Revision available on the page All configuration for the
device.
No config. change for The number of hours that passed between the Last config. check and the Last configuration
on the device.
Do not hesitate to set up alerts based on these dedicated columns. For more details, refer to the
chapter Managing Alerts.
Managing Connection Profiles

To enable and configure versioning on a network device, a connection profile must be created
and associated with a network device that supports it.
Connection profiles are managed on the page Network devices connection profiles in the Ad-
ministration module.
Only from the group admin can add, edit and delete connection profiles.
Adding Connection Profiles

They can create as many connection profiles as needed.
Keep in mind that one profile can be used for several devices as long as the profile configuration
suits all the devices it is associated with.
To add a connection profile
opens.
2. In the menu, select System > Network devices connection profiles. The page Network
devices connection profiles opens.
3. In the panel Profiles, click on ADD . The wizard Add a connection profile opens.
4. In the field Connection profile name, name the profile.
5. In the field Description, you can type in a description for the profile.
6. In the drop-down list Connection protocol, select the protocol used by the profile: SSH,
TELNET or RSH.
7. In the field Login, you can type in the name of the user connecting.
829
8. In the field Password, you can type in the connecting user password.
9. If you want to configure the profile with more details, tick the box Expert mode and follow
the table below.
Table 54.4. Connection profile Expert mode fields

Field Description
"enable" login You can type in the name of user with enable privileges. This field can empty.
In connection profiles created for Juniper network devices, you cannot use a
superuser login.
"enable" password You can type in a password of the enable mode on the network device. This field
can be empty. In connection profiles created for Juniper network devices, you
cannot use a superuser login.
Auto enable You can tick this box if the enable mode is automatic on the network device.
No "enable" privileges You can tick this box if you do not want to use enable privileges for the profile.
In connection profiles created for Juniper network devices, you might have to
tick this box.
Cypher type If you selected SSH as your connection protocol, you can select the protocol
cypher type: 3des, blowfish or des. By default, 3des is selected.
SSH identity If you selected SSH as your connection protocol, you can paste your SSH key.
Port If you selected TELNET as your connection protocol, you can specify the Telnet
port number on the network device.
Connection timeout You can set the number of seconds after which the network device is considered
unreachable. By default, it is set to 20 seconds.
10. Click on OK to commit your connection profile creation. The report opens and closes. The
page is visible again, in the list Network devices connection profiles the new profile is listed
as follows: <profile-name> [PROTOCOL].
Editing Connection Profiles

At any time you can edit connection profiles.
Keep in mind that editing a connection profile associated with a device sets its status in the
column Versioning to Yes on the page All network devices.
To edit a connection profile
opens.
2. In the menu, select System > Network device connection profile. The page Network devices
connection profiles opens.
3. In the panel Profiles, select in the list Network devices connection profiles the profile you
want to edit.
4. Under the list, click on EDIT . The wizard Edit a connection profile opens.
5. Edit the profile. For more details, refer to the section Adding Connection Profiles.
If the profile you edited is used on a network device, its Versioning status is now Yes.
830
Deleting Connection Profiles

A connection profile can be deleted only if it is no longer used on any network device.
If you want to delete a connection profile already associated with a network device, you must
edit the network device in question and select another connection profile. For more details, refer
to the section Configuring Versioning on One Device.
To delete a connection profile
opens.
2. In the menu, select System > Network device connection profile. The page Network devices
connection profiles opens.
3. In the panel Profiles, select in the list Network devices connection profiles the profile you
want to delete.
4. Under the list, click on DELETE . The wizard Delete opens.
5. Click on OK to commit the profile deletion. The report opens and closes. The profile is no
longer listed.
Configuring the Versioning of a Network Device

Configuring versioning implies to enable it and set associate your network device with a connection
profile. It can be done on one network device at a time or on several network devices at once.
When versioning is enabled, you can manage the configuration files versioning from the pages
All configurations, Configuration and All network devices.
Configuring Versioning on One Device

You can configure versioning for the network devices that support directly on their properties
page once you created a connection profile.
To configure versioning on a network device
opens.
opens.
4. In the panel Configuration versioning properties, click on EDIT . The wizard Network device
connection profile opens.
5. Tick the box Enable configuration versioning. A drop-down list appears.
6. In the drop-down list Network device connection profile, select the connection profile of
your choice.
831
7. Click on OK to commit your configuration. The report opens and closes. In the panel, the
line Enable configuration versioning is marked yes and the Connection profile name and
Connection protocol of the device are displayed.
At any time you can change the connection profile associated with your network device. Follow
the procedure above and select another connection profile.
Once you enabled versioning, the page All configurations allows to display the list of configuration
file revisions and click on a revision number to open that version of the configuration file. To refresh
a configuration files database, compare revisions or download revisions, refer to the dedicated
sections.
Configuring Versioning on Several Devices

You can enable and set the configuration versioning on several network devices at once from
the page All network devices. As the configuration is done from a single wizard, you have to
make sure that the existing connection profile that you select matches the network devices'
configuration needs.
To configure versioning on several network devices at once
opens.
3. Tick the network devices that you want to associate with your connection profile.
4. In the menu, Tools > Set connection profile. The wizard Network device connection profile
opens.
5. Tick the box Enable configuration versioning. A drop-down list appears.
6. In the drop-down list Network device connection profile, select the connection profile of
your choice.
7. Click on OK to commit your configuration. The report opens and closes. On the properties
page of the selected devices, in the panel Connection properties: the line Enable configur-
ation versioning is marked yes and the Connection profile name and Connection protocol
of the device are displayed.
At any time you can change the connection profile associated with several network devices.
Follow the procedure above and select another connection profile.
Once you enabled versioning, the page All configurations allows to display the list of configuration
file revisions and click on a revision number to open that version of the configuration file. To refresh
a configuration files database, compare revisions or download revisions, refer to the dedicated
sections.
Refreshing a Configuration File

In addition to refreshing the database at any time, SOLIDserver allows to refresh the configuration
files of the devices for which versioning is enabled. Refreshing the configuration file checks that
the latest revision on the page All configurations matches the configuration of the network device
you manage from the GUI at the time of the refresh.
832
Note that you can limit the refresh and only allow it for network devices which Status is OK. For
more details, refer to the section Limiting Configuration Refresh Based on the Network Device
Status.
Refreshing Manually a Network Device Configuration File

The manual refresh allows to get the latest configuration available on a network device.
Keep in mind that the device parameter SNMP transfer timeout can impact the success of the
refresh. For more details, refer to the section Editing the SNMP Properties of a Network Device.
To manually refresh the configuration file of a device
opens.
3. Tick the network device(s) you want to refresh.
5. The box Device data is ticked. This box refreshes the database but not the configuration file
of the selected network device(s). You can leave it ticked if you want. For more details, refer
to the section Refreshing the Network Devices Database.
6. Tick the box Configuration versioning to retrieve the latest revision of the configuration file
of the selected device(s). This revision is retrieved only if any changes are detected.
7. Click on OK to refresh the device(s). The report opens and works for a while. The revision
number is incremented if changes were detected. To compare the changes, go to the page
All configurations of the network device and click on Compare with previous version.
Scheduling the Versioning Refresh on a Network Device

The configuration file refresh can be planned ahead and queried out automatically. The scheduled
refresh can be set on any network device.
To set up a network device configuration file scheduled refresh
opens.
3. Tick the network device(s) for which you want to schedule the refresh.
4. In the menu, select Edit > Scheduling > Configure refresh.The wizard Set refresh parameters
opens.
5. Configure the refresh frequency using the table below.
Table 54.5. Scheduled refresh parameters

Field Description
833
Field Description
day of the week.
6. The box Device data is ticked. This box refreshes the database at the scheduled time but
not the configuration file of the selected network device(s). You can leave it ticked if you
want. For more details, refer to the section Refreshing the Network Devices Database.
7. Tick the box Configuration versioning to retrieve the latest revision of the configuration file
of the selected device(s). This revision is retrieved only if any changes are detected at the
time of the scheduled refresh.
visible again. The refresh frequency that you set is displayed in the panel Refresh properties
on the properties page of your network device.
To disable a scheduled refresh, refer to the section Disabling a Scheduled Refresh.
Comparing Configuration Files

From the page All configurations, you can access the page Configuration that provides a com-
parison of all the changes between two revision numbers, as raw data. The page Configuration
in comparison display provides the following information:
• Changed lines, on the left-end side, indicates the number of lines edited between the two revi-
sions.
• The buttons Full diff and Short diff, on the right-end side, allow to display the whole configur-
ation files (Full diff), or only the lines that were edited (Short diff).
No matter the amount of information displayed, it is displayed as follows: on the left, the oldest
revision where changes are highlighted in orange; on the right, the latest revision where changes
are highlighted in green.
• Previous changes, on the right-end side, allows to compare older revisions of the configuration
file, when possible. It actually compares the oldest revision with the previous revision of the
configuration.
• Next changes, on the right-end side, allows you to navigate between comparisons of two revi-
sions: toward more recent and/or older changes.
• revision <number> , on the right-end side of each file revision allows to open the configuration file
revision on its own, without the changes.
You can compare consecutive revisions of a device configuration file or even non-consecutive
revisions of a configuration file or configuration files from different network devices.
Comparing Consecutive Revisions of a Configuration File

From the page All configurations, you can use the button Compare with previous to automatically
open the page Configuration and display the revision of your choice compared with its previous
version.
The very first revision available compares an empty file with that revision.
834
To compare consecutive revisions of a configuration file
opens.
3. In the column Name, click on the network device of your choice. Only the configuration file
revisions of the device are listed; in the column Revision, the latest revision is named
r.<number> (last).
4. At the end of the line of the revision of your choice, click on Compare with previous. The
page Configuration opens.
The oldest revision is on the left and the latest on the right. Each revision has its own gray
area with the device revision details.
5. You can use the buttons to navigate the revisions changes, display the entire file with the
changes or only the changes or even display only one revision. For more details, refer to
the introduction of the section Comparing Configuration Files.
Comparing Any Configuration File Revisions

From the page All configurations, you can tick several revisions - consecutive ones, the first and
last revisions of a network device, two revisions belonging to different network devices - and
compare them on the page Configuration using the menu.
To compare non-consecutive revisions of a configuration file
opens.
4. Tick the two revisions that you want to compare. It can be non-consecutive revisions of the
same configuration file or from two different configuration files.
5. In the column Name, click on the network device of your choice. Only the configuration file
revisions of the device are listed: in the column Revision, the latest revision is named
r.<number> (last).
6. At the end of the line of the revision of your choice, click on Compare with previous. The
page Configuration opens.
The oldest revision is on the left and the latest on the right. Each revision has its own gray
area with the device revision details.
7. You can use the buttons to navigate the revisions changes, display the entire file with the
changes or only the changes or even display only one revision. For more details, refer to
the introduction of the section Comparing Configuration Files.
Monitoring the Configuration Versioning in the Logs

You can monitor versioning changes on the page Syslog, in the Administration module.
Versioning dedicated logs include: notifications if the device does not support it, if versioning is
enabled/disabled, the new configurations, etc.
835
To display the versioning dedicated logs
opens.
2. In the section Monitoring, click on the button Logs visualization. The page Syslog opens.
3. Under the menu, in the drop-down list SOLIDserver, make sure your local SOLIDserver is
selected.
4. Under the menu, in the drop-down list Services, select ipmserver.
5. In the column Description, filter the list using the keyword configuration.
The logs indicate when versioning has been enabled or disabled, they include the network
device name and IP address.
Downloading Versioning Information

Once you enabled versioning, any configuration file in the database can be downloaded.
From the page Configuration, you can download one revision or the differences between two
compared configuration files. From the page All configurations, you can display an archive file
containing as many configuration file revisions as you need.
Downloading a Configuration File

You can download any configuration file revision displayed on the page Configuration in a .txt
file.
To compare consecutive revisions of a configuration file
opens.
2. In the breadcrumb, click on All configurations. The page All configurations opens.
3. In the column Revision, click on the revision of your choice. The page Configuration opens.
4. On the right-end side of the network device details, click on Download and save the file. The
downloaded file is named <device-ip-address>_r<revision-number>.txt.
Downloading Compared Configuration Files

You can download the compared display of two comparison files on the page Configuration in
a .diff file.
Keep in mind that the downloaded file only contains the differences between the two revisions,
even if you display the Full diff.
To download compared configuration file revisions
opens.
836
3. Compare the revisions of your choice. For more details, refer to the sections Comparing
Consecutive Revisions of a Configuration File and Comparing Any Configuration File Revi-
sions.
4. Above the configuration files content, in the right-end side, click on Download diff and save the
file. Only the differences between the files are downloaded.
Depending on the revisions you chose to compare, the downloaded file is named <device-
ip-address>_r<oldest-revision>_r<latest-revision>.diff or <device-1-ip>_r<revision-num-
ber>_<device-2-ip>_r<revision-number>.diff.
Downloading Several Configuration Files in an Archive

You can download one or several revisions from the page All configuration in a .tar file.
To download configuration file revisions in an archive file
opens.
3. Tick the revision(s) you want to download.
4. In the menu, select Tools > Download device configurations. The wizard Download device
configurations opens.
5. Click on OK to commit your download. The report opens, you can DOWNLOAD and save the
file directly from the wizard.
The downloaded file is named configs_<date>_<time>.tar and is available in the Administration

tab, on the page Local files listing.
Configuring Advanced Versioning Options

Some registry database entries allow to customize the configuration files refresh possibilities and
the passwords display within the files.
Configuring the Passwords Display in the Configuration Files

SOLIDserver allows to manage versioning for your network devices, which is supported by most
vendors, to automatically save all the changes in the configuration files. All the revisions of the
files are then saved in SOLIDserver backup file.
Thanks to a registry database key, you can show or hide all or some of the passwords of the
configuration file. By default, they are all hidden and we strongly recommend leaving it this way.
To configure the passwords display in the configuration files

opens.
3. In the column Name, type in module.iplocator.rancid.show_passwords and hit Enter. The
key is the only one listed.
837
4. In the column Value, click on the value listed. The Registry database Edit a value wizard
opens.
5. In the field Name, the key name is displayed in a read-only gray field.
6. In the field Value, set the value that suits your needs:
Table 54.6. The accepted values of the configuration file password display key
Value Description
0 Hide all the passwords in the configuration files. This is the default value.
1 Display only the encrypted passwords of the configuration files, in their encrypted form. All the
non-encrypted passwords are hidden. Setting the key to 1 can be useful to keep track of the
password changes without displaying them.
2 Display all the passwords of the configuration files. Setting the key to 2 is not recommended.
We strongly recommend leaving the default value 0.

7. Click on OK to commit your changes.The report opens and closes.The column Value contains
the value you set.
Limiting Configuration Refresh Based on the Network Device Status

Thanks to a registry database key, you can prevent users from refreshing the configuration of
the network devices with a Status different from OK. By default, the configuration refresh is allowed
no matter the network device's status.
To set configuration refresh permissions based on status

opens.
3. In the column Name, type in module.iplocator.rancid.ignore_snmp_status and hit Enter. The
key is the only one listed.
4. In the column Value, click on the value listed. The Registry database Edit a value wizard
opens.
6. In the field Value, set the value that suits your needs:
Table 54.7. The accepted values of the configuration file refresh key
Value Description
0 Prevent users from refreshing the configuration of network devices which Status is not OK.
1 Allow configuration refresh of network devices no matter their Status. This is the default value.
7. Click on OK to commit your changes.The report opens and closes.The column Value contains
the value you set.
Disabling Versioning on a Network Device

To disable versioning, you have to edit the network device network connection profile.
838
Keep in mind that disabling the configuration files versioning on a device deletes all the
configuration file revisions saved in the database.
To disable versioning on a network device
opens.
opens.
4. In the panel Configuration versioning properties, click on EDIT . The wizard Network device
connection profile opens.
5. Untick the box Enable configuration versioning. The page refreshes and the drop-down list
Network device connection profile is no longer visible.
6. Click on OK to commit your choice. The report opens and closes. In the panel, only the line
Enable configuration versioning remains, it is marked no.
Once disabled, the network device is marked No in the column Versioning on the page All network
devices.
To disable versioning on several network devices at once
opens.
3. Tick the network devices that you want to associate with your connection profile.
4. In the menu, Tools > Set connection profile. The wizard Network device connection profile
opens.
5. Untick the box Enable configuration versioning. The page refreshes and the drop-down list
Network device connection profile is no longer visible.
6. Click on OK to commit your choice. The report opens and closes. On the properties page of
the selected devices, in the panel Configuration versioning properties: only the line Enable
configuration versioning remains, it is marked no.
Once disabled, all the network devices selected are marked No in the column Versioning on the
page All network devices.
839
Chapter 55. Managing Discovered Items
The discovered items are devices connected to the network devices, and usually edge devices
(workstations, servers, printers...). These devices are inserted in the database automatically after
each discovery, and put in the history. This allows the administrator to know where a device (IP
or MAC address) has been connected at a specific time and on which port of which device, in
which VLAN, etc.
Browsing Discovered Items

The discovered items are the third and last level of the organization of the NetChange module.
ROUTE
VLAN
NETWORK DISCOVERED
DEVICE VLAN
ITEM
PORT
CONFIG
Figure 55.1. The discovered items in the NetChange hierarchy
Browsing the Discovered Items Database

To display the list of discovered items

2. In the breadcrumb, click on All discovered items. The page All discovered items opens.
To display the list of discovered items of a specific network device

2. Click on Discovered items. The page All discovered items opens.
its discovered items.
You can sort the list if you click on a column name, like the column Last seen that sorts your
results in a chronological order, from more recent to the oldest record. You can click on it again
to change the sorting order.
You can also filter the list using the columns search engine and, for instance, display a specific
workstation using its IP address, MAC address, port or date and time. Like in the example below.
To find discovered items using an IP address
opens.
840
Managing Discovered Items
3. In the search engine of the column IP Address, type in the IP address you are looking for.
4. Click on REFRESH to only display the discovered items matching the IP address on the network.
Customizing the Display on the Page All Discovered Items

Some columns on the page provide specific information regarding the discovered items:
Table 55.1. Available columns on the page All discovered items

Column Description
DNS name The name of each discovered item is automatically retrieved by NetChange if it is declared
a
in an A or PTR record in one of your DNS resolvers .
Last seen The time and date when the MAC address was last seen on a specific port and VLAN.
This column is displayed by default on the page.
Discovered on The time and date when the MAC address was seen for the first time on a specific port
and VLAN. This column is displayed by default on the page.
First seen The time and date when the MAC address was seen for the first time on a port, VLAN or
network device. By default, this information is not retrieved, to retrieve it, refer to the section
Enabling the Data Retrieval for the Column First Seen.
Source The origin of the IP address, it indicates where it was retrieved.
ARP: the IP address comes from the ARP database of the network device.
lease: the IP address is a lease allocated in SOLIDserver DHCP database.
static: the IP address is a static reserved in SOLIDserver DHCP database.
IPAM: the IP address comes from SOLIDserver IPAM database.
Network device IP The IP address of the network device the item was discovered on.
a
Setting the DNS Resolver can be performed from the page Network configuration. NetChange does not retrieve the in-
formation in the records of the DNS servers you manage.
Enabling the Data Retrieval for the Column First Seen
The column First seen allows to display the time and date that the discovered items have ever
been seen connected to a port, VLAN or network device. Retrieving that information can lower
NetChange performances, which is why by default it is disabled.
To enable the retrieval of the data displayed in the column First seen, you must add a dedicated
key in the registry database and reboot SOLIDserver.
To enable the data retrieval in the column First seen
1. Add the registry key
a. Double-click on the tab Administration to open the module homepage.

b. In the menu, select System > Expert > Registry database. The page Registry database
opens.
c. In the menu, select Add > Registry item. The wizard Registry database Add an item
opens.
d. In the field Name, type in module.iplocator.activate_first_seen .
841
e. In the field Value, type in 1 to enable the data retrieval.

f. Click on OK to commit your changes. The report opens and closes. The key is listed.
2. Reboot SOLIDserver
a. Double-click on the tab Administration to open the module homepage.

b. In the menu, select Maintenance > Reboot SOLIDserver. The wizard Reboot the system
opens.
c. Click on OK to commit the operation. You are logged out, the login page details the
progression until the connection is lost.
d. Refresh the page until the login page appears.
Once the reboot is complete and the login page is visible again, log in and go to the page
All discovered items. In the column First seen, all the information available is displayed.
Refreshing the Discovered Items Database

SOLIDserver allows the scheduled refresh of network devices - for more details, refer to the
section Scheduling a Refresh -. Still, you have the possibility to manually refresh a selection of
discovered items directly from the page All discovered items.
To refresh the discovered items manually
opens.
2. Click on Network ports. The page All discovered items opens.
3. Tick the discovered item(s) you want to refresh.
5. Click on OK to commit the refresh. The report opens and closes. The page is visible again.
Populating Device Manager

The same way you can create a discovered network device into Device Manager, you can populate
Device Manager with a selection of discovered items. This allows to create the corresponding
device and interface in Device Manager, with the MAC address differentiating each interface.
For more details, refer to the section Automatically Adding Discovered Items in Device Manager.
Creating the IP Address of a Discovered Item in the IPAM

NetChange offers the possibility to create the IP address of a discovered item.
To successfully create IP addresses in the IPAM based on the discovered items database, make
sure that:
1. The IP address of the discovered item is actually retrieved and displayed. It might not be
available if the router has not found any equivalence between the MAC and IP address, neither
from the equipment nor from the DHCP.
2. The IP address of the discovered item is available in the IPAM. The option allows to:
842
• Select a Target space, either the same space as the one set for the network device managing
your item or another space, as long as this space contains a terminal network with free ad-
dresses that you can assign to your discovered items. For more details, regarding the space
selection at network level, refer to the section Adding Network Devices.
• Tick the box Use best space to automatically find a space that can receive the discovered
item in the smallest terminal network available.
To create the IP address of a discovered item in the IPAM
opens.
3. Tick the discovered item(s) you want to create in the IPAM.
4. In the menu, select Tools > Create IP address in the IPAM. The wizard Create IP addresses
in the IPAM opens.
5. Specify the space where the IP address of the items is created in the IPAM:
a. Either tick the box Use best space to place the discovered item(s) into the space con-
taining the smallest network able to receive them.
b. Or select in the drop-down list Target space the space that suits your needs.
6. Click on OK to commit the creation. The report opens and closes and the list is visible again.
The IP address is listed on the page All addresses, in the IPAM.
Using the History View to Track the Movements of a Specific

Device
NetChange database is not erased automatically and allows you to have an overview of the
movements of a specific edge device during previous discoveries from the History view.
That way, using a MAC address, you can see the different IP addresses an edge device had, at
different periods of time, which switch and port it was connected and which VLAN it belonged to.
This function also allows to track laptops on the network and see on which switches and ports
they have been successively connected.
On the page all the columns can be filtered. Using the breadcrumb, you can display the History
view of a specific device, port or VLAN or all of them. For more details regarding the columns on
the page, refer to the section Customizing the Display on the Page All Discovered Items.
To display the discovered items history view of all the network devices
opens.
3. In the menu, select Display > History view. The page refreshes.
4. If need be, filter the list using the search engine of any column to look for a specific MAC
address, IP address, MAC vendor... and hit the key Enter.
843
To limit the number of discovered items saved in the history, you can configure and enable a rule
dedicated to purging the NetChange database, including discovered items.
To configure and enable the rule 008 that purges NetChange History
opens.
3. In the column Rule # search field, type in 008. The rule Purge NetChange history is listed.
4. Configuring the rule
a. In the column Instance, click on iplocator_cron_purge_history. The rule properties page

opens.
b. In the panel Main properties, click on EDIT . The wizard Edit a rule opens.
c. Click on NEXT . The page Rule filters appears.
d. If you want to schedule the purge, configure the fields according to the table below:

Field Description
Day(s) of the week Select a day or a period of days.
Date of the month Select a date.
Month Select a month.
Hour Select a specific time or one of the available schedules.
Minute Select a period of time, minutes-wise.
e. Click on NEXT . The page Rule parameters appears.
Table 55.3. Rule parameters

Field Description
Purge MAC/port In this drop-down list, you can keep (No) or delete (Yes) the history data of all the
history MAC addresses that were discovered thought a port, when their lifespan exceeds
the Number of days to keep. By default, Yes is selected.
Purge MAC/IP his- In this drop-down list, you can keep (No) or delete (Yes) the association history
tory of all the MAC addresses that were retrieved from the ARP table of the network
device, when they their lifespan exceeds the Number of days to keep. By default,
Yes is selected.
Number of days to In this field, type in the maximum number of days that you want to keep NetChange
keep history, this includes the discovered item and time entries are listed in the History
view.
f. Click on OK to commit your configuration.The report open and closes.The rule properties
5. Enabling the rule
a. Tick the rule 008 and, in the menu, select Edit > Enable. The menu Enable opens.
b. Click on OK to commit your choice. The wizard closes, the page refreshes.The rule is
Enabled.
844
Chapter 56. Managing Statistics
NetChange can provide a set of specific statistics. These statistics are all displayed as pie and
bar charts that can present vendors, speed, usage, etc.
Displaying NetChange Statistics

By default, NetChange dashboard displays four gadgets (pie charts) that present the database
network devices vendors, number of ports per device, ports status and ports speed.
To display NetChange gadgets
1. From anywhere in the appliance, through the menu, select Preferences > My Dashboards
> Gadgets Library. The Gadgets Library opens.
2. In the list, tick the gadget(s) of your choice: Number of NetChange ports per device,
NetChange network devices vendor, NetChange active ports speed (bps) and/or NetChange
ports status.
3. In the menu, select Edit > Assign Gadget(s). The gadget configuration wizard opens.
4. In the list Available, select a module and click on .
5. The module name is moved to the list Configured. The gadget(s) can be displayed from the
selected module dashboard.
6. Click on OK to commit your choice. The report opens and closes. The gadgets are displayed
on the selected modules homepage and the column Dashboard is updated with the selected
module(s).
In addition to these holistic charts, NetChange provides specific charts on the network devices
and port properties pages.
Displaying Network Device Statistics

The properties page of the network devices contains a chart summing up the device ports status.
To display the statistics of a network device

2. In the breadcrumb, click on All network devices. The page All network devices opens.
3. At the end of the line of the device of your choice, click on . The properties page opens.
4. Open the panel Network device ports status to display the graph.
Displaying Port Statistics

The ports properties page provides a set of charts that display accurate data if you enable the
rule 067.
Enabling the Rule That Retrieves Ports Information

The rule 067 allows to retrieve ports information and display it on the ports properties page. By
default, it is listed among the Rules but disabled, so you have to activate it to retrieve data.
845
Managing Statistics
To activate the collection of data rule
1. Go to the Administration tab homepage.

3. Through the columns filters, look for the rule 067 called Charts of NetChange ports bandwidth
usage.
4. Tick the rule.
5. In the menu, select Edit > Enable. The wizard Enable opens.
6. Click on OK to activate the rule.
Displaying a Port Charts

On the port properties page, you can display four different charts: NetChange port traffic,
NetChange port broadcast traffic, NetChange port unicast traffic and NetChange port error
packet traffic.
To display the statistics of a port

2. In the breadcrumb, click on All network devices. The page All network devices opens.
3. Click on the name of the device of your choice. The page All ports of the device opens.
4. At the end of the line of the port of your choice, click on . The properties page opens.
5. Click on in the upper right corner of the page to open all the panels.
The charts contain In and Out parameters. To better understand them, refer to the table below.
Table 56.1. NetChange ports charts information

Information Description
In octets The total number of octets received on the port, including framing characters.
Out octets The total number of octets transmitted out of the port, including framing characters.
In broadcast The number of non-unicast (i.e., subnetwork- broadcast or subnetwork-multicast) packets de-
livered to a higher-layer protocol.
Out broadcast The total number of packets that higher-level protocols requested be transmitted to a non- unicast
address, including those that were discarded or not sent.
In unicast The number of unicast packets delivered to a higher-layer protocol.
Out unicast The total number of packets that higher-level protocols requested be transmitted to a subnetwork-
unicast address, including those that were discarded or not sent.
846
Chapter 57. Monitoring and Tuning
NetChange offers a set of options to monitor and tune your network devices and discovered
items.
Generating NetChange Reports

EfficientIP provides NetChange dedicated reports for network devices. The reports on inconsist-
encies might be empty if the devices configuration is correct.
Table 57.1. Available NetChange reports

Page Report
All network devices Network Devices Properties
NetChange/IPAM/DHCP data comparison
Network devices summary
Keeping NetChange Data Up-to-date

To always have an up-to-date data, you should periodically refresh the network devices using
scheduling, as explained in the chapter Managing Network Devices. You should also remove old
data from the history to speed up the processes and have only the relevant IP or MAC address
information. The choice of periodicity depends completely on your environment and what you
intend to do with NetChange: you may need to have a history of all movements (so you might
need to purge the database every month or trimester), or you may need only the most relevant
data when looking for a host (so you might want to purge every week).
To configure the purge frequency of the data listed on the page All discovered items, you should
edit and enable the rule 008.
To configure and enable the rule 008 that purges NetChange History
opens.
3. In the column Rule # search field, type in 008. The rule Purge NetChange history is listed.
4. Configuring the rule
a. In the column Instance, click on iplocator_cron_purge_history. The rule properties page

opens.
b. In the panel Main properties, click on EDIT . The wizard Edit a rule opens.
c. Click on NEXT . The page Rule filters appears.
d. If you want to schedule the purge, configure the fields according to the table below:

Field Description
Day(s) of the week Select a day or a period of days.
847
Monitoring and Tuning
Field Description
Date of the month Select a date.
Month Select a month.
Hour Select a specific time or one of the available schedules.
Minute Select a period of time, minutes-wise.
e. Click on NEXT . The page Rule parameters appears.

Field Description
Purge MAC/port In this drop-down list, you can keep (No) or delete (Yes) the history data of all the
history MAC addresses that were discovered thought a port, when their lifespan exceeds
the Number of days to keep. By default, Yes is selected.
Purge MAC/IP his- In this drop-down list, you can keep (No) or delete (Yes) the association history
tory of all the MAC addresses that were retrieved from the ARP table of the network
device, when they their lifespan exceeds the Number of days to keep. By default,
Yes is selected.
Number of days to In this field, type in the maximum number of days that you want to keep NetChange
keep history, this includes the discovered item and time entries are listed in the History
view.
f. Click on OK to commit your configuration.The report open and closes.The rule properties
5. Enabling the rule
a. Tick the rule 008 and, in the menu, select Edit > Enable. The menu Enable opens.
b. Click on OK to commit your choice. The wizard closes, the page refreshes.The rule is
Enabled.
Synchronizing the Network Devices with a CSV File

Thanks to the rule 010, it is possible to automatically synchronize the list of network devices with
a local file containing on each line the IP address of a network device to be managed in
NetChange. If the CSV file contains devices that are not managed by NetChange yet, they are
automatically imported during the synchronization.
To activate the automated retrieval of devices from a specific CSV import

3. In the column Name, type in the rule name Synchronize NetChange network devices with a
CSV file.
7. Define the frequency of execution of the rule. The default frequency is every 5 minutes.
848
9. Fill in the following fields:

Field Description
Local CSV file Type in the path toward the CSV file containing the list of addresses. This
CSV file must already be part of the local SOLIDserver file system.
Devices missing in CSV file You can Delete or perform No action over the devices already listed in the
page All network devices but not present in the CSV file to import.
Site id Select the space where you want the IP address of the devices to be impor-
ted. This field is required.
Delimiter Select the delimiter that separates the data in your CSV file: It can be a
comma, a semicolon or a tab. By default, the comma is selected. This field
is optional.
Once the rule is configured, you have to enable it. Before following the procedure below, check
in the column Status if the rule is marked Disabled or OK (i.e. It is enabled). Note that if you enable
the rule before configuring it, no action is performed for lack of specifications (without a path toward
a CSV file the options were configured with no file to perform them on).
To enable the devices synchronization rule

3. In the column Name, type in the rule name Synchronize NetChange network devices with a
CSV file.
4. Tick the rule.
6. Click on OK to commit your choice. The report opens and closes. The page is visible again
and the rule is marked OK in the column Status.
Customizing the Network Devices' Type

On the page All network devices, the column Type displays partial vendor and/or model information
about each network device. You can customize the content of this column via CLI.
By default, the file custom_sysoid.csv allows to include the system OID of the network device of
your choice and the name you want to display in the column Type. Keep in mind that:
• Only users with administrative rights over SSH connections to SOLIDserver can edit the file.
• On the page All network devices, the OID of each network devices is available in the column
System OID.
• You must refresh the devices to display the new information in the column.
To customize the type of a network device
1. Edit the file via CLI:
a. Connect to your appliance using an SSH session or a port console and root credentials.
849
b. Edit the file /data1/etc/custom_sysoid.csv to include a line for each network device.
The system OID of each device and the name to display must be separated by a comma.
<Full.system.OID>,<Information displayed in the column>
#For instance, renaming EfficientIP network devices could look as follows in the file:
#.1.3.6.1.4.1.2440,EfficientIP network device
2. Refresh the network devices:
a. Go to the NetChange tab. If the homepage is not displayed, click on . The homepage
opens.
b. Click on Network devices. The page All network devices opens.
c. Tick the network device(s) you want to refresh.
d. In the menu, select Edit > Refresh. The wizard Refresh a network device opens.
e. Tick the Device data to refresh the database of the selected network device(s).
f. Click on OK to refresh the device(s). The report opens and works for a while.
When the refresh is over, a report might appear. You can download this report in the
format of your choice.
g. Click on CLOSE to go back to the page All network devices. The page refreshes. In the
column Type, the information regarding the device(s) matching the OID you specified
in the file is updated.
850
Part IX. Workflow
The Workflow is a request-based module allowing standard users to ask for changes in the IPAM and DNS:
• DNS zones addition, edition or deletion.

• IPAM non-terminal networks addition, edition or deletion. These can be block-type or subnet-type net-
works.
• IPAM terminal networks addition, edition or deletion.
• IPAM pools addition, edition or deletion.
• IPAM IP addresses addition, edition or deletion.
From the Workflow dashboard, or homepage, you can access the request pages.
Figure 204. The Workflow dashboard
All the requests are listed on both pages of the module:
• Outgoing requests, where users - requestors - can create requests and monitor their status evolution.
For more details, refer to the chapter Managing Outgoing Requests.
• Incoming requests: where request managers and administrators can deal with the user requests. For
more details, refer to the chapter Managing Incoming Requests.
In addition, you can:
• Automate the requests' execution. You can set up automated execution of incoming requests, either
using the Workflow default classes and the button Execute or include pending operations to the class
objects of their customized classes. For more details, refer to the chapter Executing Requests.
• Customize the requests acceptance cycle. Some registry database entries determine the requests' life
cycle using their statuses. For more details, refer to the chapter Customizing the Requests Administration.
Keep in mind that to use the Workflow at the best of its potential you must:
1. Grant sufficient rights to requestors and request managers: the group they belong to needs to be
granted the appropriate IPAM, DNS and/or Workflow rights. For more details, refer to the section Managing
the Permissions of a Group of Users in the chapter Managing Groups.
2. Grant users access to request classes, the existing classes or the ones you created. For more details,
refer to the chapter Granting Access to Workflow Classes.
3. Customize the page Incoming requests if need be. For more details, refer to the chapter Customizing
the Requests Administration.
4. Grant relevant users access to the Workflow pages, that way they can create or deal with the requests.
5. Executing the action required in the requests if they are accepted.
Chapter 58. Granting Access to Workflow
Classes
As every request is based on a specific Workflow class, users need to be granted access to the
relevant ones. That way, they can select a class when adding a request and fill in the fields
defined through the class.
There are five classes dedicated to Workflow requests. They define all the mandatory fields when
asking for the addition, edition or deletion of the object they are named after:
• request_dns_zone is dedicated to requests regarding DNS zones.

• request_ip_block is dedicated to requests regarding IPv4 non-terminal networks, block-type
or subnet-type.
• request_ip_subnet is dedicated to requests regarding IPv4 terminal networks.
• request_ip_pool is dedicated to requests regarding IPv4 pools.
• request_ip_address is dedicated to requests regarding IPv4 addresses.
The users that do not have access to Workflow request classes are not able to properly complete
the request addition wizard: the request addition wizard is still available, but it is impossible to
define the needed containers or resources to apply the requested changes to.
Obviously, you can add your own Workflow request classes. These classes must be dedicated
to the Module Workflow and the Type Request. For more details, refer to the chapter Configuring
Classes.
Keep in mind that in this case, the Execute option is not available in the page Incoming requests.
For more details, refer to the section Executing Requests Using the Execute Option.
To add an existing request class as group resource
opens.
2. Click on Users, Groups & Rights. The page Users opens.
4. Click on the Name of the group of your choice, except admin that already has access to all
resources. The page Resources opens.
5. In the menu, select Add > Resources > Classes.The wizard Administration: Classes opens.
6. In the search engine of the column Type, type in request to filter the list.
7. Tick the class(es) you want to grant the group access to. Keep in mind that the default
Workflow classes are request_dns_zone, request_ip_block, request_ip_subnet, re-
quest_ip_pool and request_ip_address.
8. Click on OK to close the wizard. The report opens and closes. The page refreshes, the list
of resources now includes the selected class(es).
Once the classes of your choice are part of the resources of a group, its users can choose from
one of them when requesting the addition, edition or deletion of objects in the DNS or IPAM
database.
852
Chapter 59. Managing Outgoing
Requests
From the page Outgoing requests, users with sufficient Workflow rights can:
• Add requests for addition/edition/deletion.

• Edit the requests they created.
• Cancel the requests they created.
The requests management respects the groups hierarchy by default. Therefore, once created if
the user belongs to a group that has a parent group, then by default the request can be dealt
with by all the users of the parent group as well as the users of the group admin. If the users
want the request to be dealt with by specific users, they can set a managing group when creating
or editing the request.
Browsing Outgoing Requests

The Outgoing requests page is one of the two pages of the module. Requestors use this page
to add, edit and cancel requests.
Browsing the Outgoing Requests Database

To display the list of outgoing requests
1. Go to the Workflow tab. If the homepage is not displayed, click on . The homepage opens.
2. Click on Outgoing requests. The page Outgoing requests opens.
To display an outgoing request properties page
3. To display a request properties page you can:
a. Click on the name of the request of your choice. The properties page opens.
b. At the end of the line of the incoming request of your choice, click on . The properties
page opens.
Customizing the Display on the Page Outgoing Requests

853
Managing Outgoing Requests
Adding Requests for Creation

Users with sufficient rights can add requests asking for objects creation. This request can only
contain basic information regarding the object, the advanced properties can only be configured
by administrators and request managers when they execute the request.
The procedure below uses the request_dns_zone class as an example.
Reminder
To add a DNS zone creation request, the group of the user must have at least been granted
the following rights:
• In the panel Workflow, all the rights that suit your needs
• In the panel DNS, the right Display: DNS servers list.
To add a DNS zone creation request, the group of the user must include among its resources:
• At least one server to grant access to all the objects it contains.
To add a request for creation
3. In the menu, select Add > Request. The wizard Add a request opens.
4. In the list Workflow request class, select request_dns_zone .
5. Click on NEXT . The page Requesting: Zone opens.
6. In the drop-down list Action requested, select New (Create). The page refreshes.
7. In the drop-down list DNS Server, select the server of your choice.
8. If your server contains views, in the drop-down list DNS view, select the view of your choice.
9. In the field DNS zone, name your zone.
10. In the drop-down list Zone type, you can select either master, slave, stub or forward. By
default, master is selected.
11. In the field Motivation, type in a text or a maximum of 3000 characters explaining the reason
for the zone addition request.
13. If you want, you can select a group to manage your request as described in the table below.
Otherwise, users of the group admin can manage it.
Table 59.1. Group of users administrating the request dedicated fields

Set a group to manage Allows to decide that a specific group of users manages the request. By default,
the request it is set to No.
No Only the users from the requesting user parent group or the users of the group
admin can manage your request.
Yes You can select an existing group of users to manage your request. Once the
option is selected, the drop-down list Managing group appears.
Managing group Select an existing group. This action allows the request managers of the group
to accept the request and deal with it, or deny it.
854
14. Click on OK to commit the request creation. The report opens and closes. The request is
listed and marked as New in the column Status.
Each request is named as follows: <request-number>-<requestor>, where <request-number>

corresponds to the number of requests in the Workflow database and not the number of requests
of a particular requestor.
On the request properties page, the Main properties and Request parameters sum up the request
details.
Adding Requests for Edition

Users with sufficient rights can add requests asking for objects edition. This request can only
contain basic information regarding the object, the advanced properties can only be configured
by administrators and request managers when they execute the request.
The edition request only applies to the values that you can usually edit in each module, so:
• You cannot ask for the edition of anything configured for DNS zones.
• You can only ask for the edition of the name of the networks, pools and addresses.
The procedure below uses the default request_ip_address class as an example.
Reminder
To add an IPv4 address edition request, the group of the user must have at least been
granted the following rights:
• In the panel IPAM, the right Display: spaces list.
To add an IPv4 address edition request, the group of the user must include among its re-
sources:
• At least one space, which grants access to all the objects it contains.
To add a request for edition
4. In the list Workflow request class, select request_ip_address .
5. Click on NEXT . The page Requesting: IP address opens.
6. In the drop-down list Action requested, select Modify. The page refreshes.
8. In the list Choose a terminal network, select the terminal network containing the IP address
you want to edit. Once selected, the line is highlighted in blue.
10. In the field Name to edit, type in the first letter(s) of the IP name. The auto-completion provides
a list of addresses matching these letters, select the one you want to edit.
11. In the field IP address name, type in the new name of the address.
855
12. In the gray field IP address, the IP address is displayed as a reminder.

for the IP address edition request.

listed. It is marked New in the column Status and Modified in the column Action.

details.
Adding Requests for Deletion

Users with sufficient rights can add requests asking for objects deletion. Besides, the terminal
networks deletion request can be created from the page All networks. For more details, refer to
the section Creating a Network Deletion Request From the IPAM.
Creating a Request for Deletion

In the procedure below we use the default request_ip_subnet class as an example.
Note that to the class request_ip_block applies to non-terminal networks of both subnet and block
type.
Reminder
To create a terminal network deletion request, the group of the user must have at least been
granted the following rights:
To edit an IP address related request, the group of the user must include among its resources:
• At least one space to grant access to all the objects it contains.
856
To add a request for deletion
4. In the list Workflow request class, select request_ip_subnet .
5. Click on NEXT . The page Requesting: Network (subnet) opens.
6. In the drop-down list Action requested, select Delete. The page refreshes.
8. In the list Choose a terminal network, select the terminal network you want to delete. Once
selected, the line is highlighted in blue.
10. The fields Network name, Network address, Netmask, Prefix and Comments display the
selected network information as a reminder.
for the network deletion request.

listed. It is marked New in the column Status and Delete in the column Action.

details.
Creating a Network Deletion Request From the IPAM

In addition to the standard addition of requests for deletion from the page Outgoing request, it is
possible to create a request for network deletion from the page All networks.
It automatically creates a request in the Workflow using the default class request_ip_subnet for
terminal networks or request_ip_block for non-terminal networks (block-type or subnet-type).
857
Reminder
To add a network deletion request, the group of the user must have at least been granted
the following rights:
• In the panel Workflow, all the rights that suit your needs.
To edit an IP address related request, the group of the user must include among its resources:
• At least one space to grant access to all the objects it contains.
To add a request for networks deletion from the IPAM
4. Tick the network for which you want to create a request for deletion.
5. In the menu, select Edit > Request for deletion. The wizard Workflow Creating a network
deletion request opens.
6. In the drop-down list Source, select a group if you belong to several groups. If you only belong
to one group, it is automatically selected. The managing group of the selected group handles
the request.
7. Click on OK to commit the request creation. The report opens and closes.
8. Go to the Workflow tab page Outgoing requests. The request is listed. It is marked New in
the column Status and Delete in the column Action.
Editing Requests
Once you created a request, you can edit its details or provide additional information via a note
and/or file upload.
Editing a Request Details

Once created, the details of a request can be edited to a certain point: you cannot edit the action
required or the object it applies to.
To edit a request from the outgoing request page
3. Right-click over the Name of the request you want to edit. The contextual menu opens.
4. Click on . The wizard opens.
5. Edit the fields as needed. Only the fields with a white background can be edited.
6. Once you get to the last page of the wizard, click on OK to commit the request edition. The
report opens and closes. The changes are visible on the properties page panel Request
parameters.
858
To edit a request from its properties page
4. Click on . The request properties page opens.
6. Edit the fields as needed. Only the fields with a white background can be edited.
7. Once you get to the last page of the wizard, click on OK to commit the request edition. The
report opens and closes. The changes are visible in the panel Request parameters.
Adding Information to a Request

From a request properties page, users can add information to a request via notes and files upload.
Uploading a File
Requestors can add up to 10 files to their request. They cannot upload more than 5 Mb of files.
To upload a file to a request properties page
5. In the panel Upload file, click on EDIT . The wizard Upload file opens.
6. Click on BROWSE to select the file of your choice on your local computer.
7. Once selected, it is displayed in the fields File name and Final value.
8. Click on to add the file to the list Attached files. Repeat these actions for as many files
as you want.
9. Click on OK to commit the file(s) upload. The report opens and closes. The panel Upload
file contains the file(s).
Adding a note
Requestors can add notes to their request in addition to the Motivation expressed when creating
the request.
To add a note to a request
5. In the panel Note, click on EDIT . The wizard Enter a note opens.
6. Click on ADD . In the field List, the line new_<number> appears.
859
7. In the field Note, type in your note. The note must not include special characters or exceed
3993 characters.
8. Click on ADD to save it. The note is saved. In the field List, the note is now displayed as fol-
lows: <date> <time> <beginning-of-note> [author]. Repeat these actions for as many notes
as needed.
9. Click on OK to save all the notes. The report opens and closes. The panel Note displays the
note(s).
Canceling Requests
At any time, you can cancel a request you created. By default, this action is only possible is the
request status is New. Once it is handled or accepted, you can no longer cancel it.
Once canceled, you no longer see it on the page, only request managers can still see it.
To cancel a request
3. Tick the request you want to cancel.
4. In the menu, select Edit > Cancel. The wizard Status edition opens.
5. In the field Enter a note, you can type in a text of 3000 characters at most, explaining why
you want the request canceled.
6. Click on OK to commit the request cancellation.The report opens and displays the cancellation
report status.
7. You can click on CSV (DATA) , TEXT , HTML or EXCEL to download the cancellation report in the
corresponding format.
8. Click on CLOSE to close the wizard. The page refreshes. The request is no longer listed on
the page.
860
Chapter 60. Managing Incoming
Requests
From the page Incoming requests, administrators or request managers can:
1. Deal with pending requests using the default options of the menu Edit: handle, edit, execute,
reject, finish and finally delete the requests.
2. Deal with pending requests using custom options. The available options would then depend
on the administrator configuration and intern use of the module.
Keep in mind that by request managers, we mean users belonging to a group with sufficient rights
and resources. Make sure they belong to a group configured with:
• All the Workflow rights, to be able to manage the requests completely.

• All the DNS and IPAM objects that regular users can create requests for among the group re-
sources.
• All the relevant IPAM and DNS rights that allow them to comply with the request.
Browsing Incoming Requests

The Incoming requests page allows the request managers and administrators to deal with the
requests.
Browsing the Incoming Requests Database

To display the list of incoming requests
2. Click on Incoming requests. The page Incoming requests opens.
To display an incoming request properties page
2. Click on Incoming requests. The page Incoming requests opens.
3. To display a request properties page you can:
a. Click on the name of the request of your choice. The properties page opens.
b. At the end of the line of the incoming request of your choice, click on . The properties
page opens.
Customizing the Display on the Page Incoming Requests

861
Managing Incoming Requests
Managing the Requests Content

Once a request is created, it is listed on both pages of the module. Administrators and request
managers deal with them from the Incoming requests.
On the request properties page are displayed all the request details as well as the requestor
notes and uploaded files. In the Request history are listed all the administrators and request
managers notes added when editing the request status.
To download an uploaded file
6. In the panel Upload file, click on the name of the file you want to download.
To display notes
5. In the panel Note, all the notes are displayed under the Date and User. You can scroll down
if there are several notes.
The administrators and request managers can also add notes and upload files. For more details,
refer to the section Adding Information to a Request.
Administrating Requests Using the Default Statuses and

Options
There are 6 default statuses on the page Incoming requests of the Workflow module. They allow
administrators and request managers to see what requests need to be dealt with. All these
statuses can be set from the menu Edit on the page Incoming requests. Except canceled that
has to be set from the page Outgoing requests.
Every time a request status is edited, it sends an email to the user who requested it to inform
them of the request evolution. Therefore, make sure your requesting users profile is set up
properly. For more details, refer to the chapter Managing Users.
Only the Archive option does not correspond to any status as it basically deletes the request from
the page and stores it on the page Local files listing.
Table 60.1. Request statuses

Status Description
New The request was created on the page Outgoing requests and has not been dealt with yet.
862
Status Description
Handled The request was acknowledged by a request manager or administrator, it still has to be accepted
or rejected. This status can only be set from the page Incoming requests.
Accepted The request was accepted by the request manager or administrator handling it: the requested
creation/edition/deletion will be performed. This status can only be set from the page Incoming
requests.
Rejected The request was denied by the request manager or administrator handling it. Whatever was
requested is ignored. This status can only be set from the page Incoming requests.
Canceled The request was canceled by the requestor. It is no longer requested creation/edition/deletion
has to be ignored by the request manager or administrator handling it. This status can only be
set from the page Outgoing requests.
Finished The requested creation/edition/deletion was performed. This status can only be set from the
page Incoming requests.
By default, the requests managers can set these statuses as long as they respect the following:
• New requests can be handled, accepted, rejected and canceled.

• Handled requests can be accepted, rejected and canceled.
• Accepted requests can only be dealt with and finished.
• Rejected requests can only be archived.
• Canceled requests can only be archived.
• Finished requests can only be archived.
Using the default options and statuses is useful as it allows to use the Execute option. This option
allows to execute a request from the Incoming requests directly. For more details, refer to the
section Executing Requests Using the Execute Option.
Handling Requests
The request managers and administrators can at any point handle New requests.
You cannot handle Accepted, Rejected or Finished requests.
To handle a request
2. In the breadcrumb, click on Incoming requests. The page Incoming requestst opens.
3. Tick the request(s) you want to handle.
4. In the menu, select Edit > Handle. The wizard Status edition opens.
5. In the field Enter a note, you can type in a reason for accepting or the user performing the
task. This text is available on the request properties page, in the Request history panel.
6. Click on OK to commit your choice. The report opens and indicates the operation success.
7. Click on CLOSE to go back to the page Incoming requests.
Accepting Requests
The request managers and administrators can, at any point, accept New and Handled requests.
You cannot accept Rejected and Finished requests.
863
To accept a request
2. In the breadcrumb, click on Incoming requests. The page Incoming requests opens.
3. Tick the request(s) you want to accept.
4. In the menu, select Edit > Accept. The wizard Status edition opens.
task. This text is available on the request properties page, in the Request history panel.
Rejecting Requests
The request managers and administrators can at any point reject New and Handled requests.
You cannot reject Accepted and Finished requests.
To reject a request
3. Tick the request(s) you want to reject.
4. In the menu, select Edit > Reject. The wizard Status edition opens.
task. This text is available on the request properties page Request history module.
Finishing Requests
Once the request has been dealt with, when the object has been added, edited or deleted, the
request managers and administrators can set the requests to Finished.
Only Accepted requests can be finished.
To finish a request
3. Tick the request(s) you want to finish.
4. In the menu, select Edit > Finish. The wizard Status edition opens.
task. This text is available on the request properties page Request history module.
864
Archiving Requests
Archiving a request actually means moving it to the Local Files Listing. This means that it is no
longer listed on the Incoming requests and Outgoing request pages.
Archiving a request is useful for requests that have been dealt with, have been canceled or that
were rejected. In any of these cases, once the requesting user has been informed, it is probably
useless to keep the request in the list.
The request managers and administrators can archive Canceled, Rejected and Finished requests.
To archive a request
3. Tick the request(s) you want to remove from the list.
4. In the menu, select Edit > Archive. The wizard Status edition opens.
5. In the field Local file name, type in the name of the .txt file that contains the request details
following the format <file-name>.txt .
By default, the file is saved in the directory /data1/exports but you can save it in an existing
sub-directory of /data1 if you want: specify the subdirectory name following the syntax <sub-
directory-name>/<file-name>.txt .
Administrating Requests Using Your Own Settings

You can customize the Workflow administration methods by editing some Workflow dedicated
registry database entries. For more details, refer to the chapter Customizing the Requests Admin-
istration.
Once you customized these entries, the restrictions detailed in the section Administrating Requests
Using the Default Statuses and Options might not apply anymore. However, requests managers
and administrators may still rely on the procedures detailed in said section to administer the re-
quests from the page Incoming requests.
865
Chapter 61. Executing Requests
There are different ways of executing requests:
1. Use the Execute option from the page Incoming requests if you are using the Workflow default
classes. For more details regarding this option, refer to the section Executing Requests Using
the Execute Option.
2. Use classes to integrate the requests to the addition, edition or deletion wizard. This method
can be used if you use the default Workflow classes or if you use customized ones. For more
details, refer to the section Executing Requests Using Classes.
3. Go to the IPAM or DNS module and add, edit or delete the requested objects and change the
status to Finished once the request was executed.
Executing Requests Using the Execute Option

If you are using the Workflow default classes listed in the chapter Granting Access to Workflow
Classes, you can use the option Execute to perform the action requested in the New, Handled
and Accepted requests directly from the page Incoming requests.
To execute an addition request using the option Execute
3. In the column Action, filter the list to display only requests for addition using the key word
new.
4. At the end of the line of the request for addition you want to execute, click on Execute. The
wizard opens.
5. Depending on the classes configured you might have class dedicated pages. Select a class
or none and click on NEXT .
6. On the object addition page, the object name and details are in a gray field as a reminder.
If the request demands a network addition, the wizard skips the network type selection page
and directly creates the relevant network.
7. If need be, you can fill in the optional object details fields and configure advanced properties.
Click on NEXT . The Workflow dedicated page opens.
8. In the drop-down list Ticket, the request you are executing is selected by default. The list
can also contain other request numbers if other requests for addition of a similar resource
were created.
9. Under this field, the fields Requested <object> name and Requestor motivation contain the
request original details as a reminder.
10. The requests for IP address addition have an extra page: the page Aliases configuration.
You can add aliases if need be. Then click on NEXT to display the last page of the wizard.
11. Click on OK to commit the request execution. The report opens and closes. The request
status is now Finished, the object is now created.
866
Executing Requests
To execute an edition request using the option Execute
3. In the column Action, filter the list to display only requests for edition using the key word
modify.
4. At the end of the line of the request for edition you want to execute, click on Execute. The
wizard opens.
5. Depending on the classes configured you might have class dedicated pages. Select a class
or none and click on NEXT .
6. On the object edition page, the object name and details are in a gray field as a reminder.
7. If need be, you can fill in the optional object details fields and configure default parameters.
Click on NEXT . The Workflow dedicated page opens.
8. In the drop-down list Ticket, the request you are executing is selected by default. The list
can also contain other request numbers if other requests for edition of a similar resource
were created.
9. Under this field, the fields Requested <object> name and Requestor motivation contain the
request original details as a reminder.
10. The requests for IP address edition have an extra page: the page Aliases configuration. You
can add aliases if need be. Then click on NEXT to display the last page of the wizard.
status is now Finished, the object is now edited.
To execute a deletion request using the option Execute
3. In the column Action, filter the list to display only requests for deletion using the key word
delete.
4. At the end of the line of the request for edition you want to execute, click on Execute. The
wizard Delete opens.
5. The fields Name, Address, Space name and/or DNS server name contain the objects details
as a reminder.
status is now Finished, the object is now deleted.
Once the request is executed, the requestor receives a notification email. The administrator or
request manager can archive the request. For more details, refer to the section Archiving Requests.
On the request properties pages, in the panel Attached objects, are listed all the object configur-
ation details if the request concerned an addition or an edition. For instance, if a specific class
or default parameters were set by the administrator or request manager.
Executing Requests Using Classes

You can use classes to automate the addition and edition requests execution. You cannot use
them to automate the deletion requests. Using classes for the automation implies:
867
Executing Requests
1. From Class Studio:

• Creating a class applying to IPAM network, pool, address or DNS zone.
• Adding the corresponding Pre-defined variable object to the class.
2. From the IPAM or DNS module:
• Applying the class when adding or editing the object.
• At the end of the wizard, selecting the request matching the operation performed.
3. Archiving the request. For more details, refer to the section Archiving Requests.
Configuring a Workflow Request Association Class

The classes that can automate the request execution apply to IPAM networks, pools, addresses
or DNS zones.
If you do not already use a class for which you would like to add the Pre-defined variable, create
a class. Otherwise, directly follow the procedure To add a Workflow request association pre-
defined variable.
To add a class to automate the Workflow request association
opens.
3. In the menu, select Add > Class. The wizard Add a new class opens.
4. In the field Filename, name your class. The name cannot contain any special characters.
This field is mandatory.
5. In the field Sub directory, you can fill in the directory where you want to save your class. If
it does not exist, it is created. On the wizards class selection page, classes placed in a dir-
ectory are displayed as such: <directory>/<class>. This field is optional.
6. In the drop-down list Module, select DNS or IPAM.
7. In the drop-down list Type, select the resource of your choice: DNS zone, Network, Pool or
Address.
8. In the section Enable class, tick the box.
9. Click on OK to commit your creation. The report opens and closes. The class is listed.
To add a Workflow request association pre-defined variable
opens.
3. In the column Name, click on the class you want to edit. Class Editor opens.
4. In the class objects drop-down list, select All Objects. The class objects list refreshes.
5. In the list, click on Pre-defined variable . The wizard Pre-defined variable opens.
6. In the drop-down list Name, select the variable that suits your needs:
• WORKFLOW_ADD_TICKET_SPACE to associate the class with space addition and/or

edition requests.
868
Executing Requests
• WORKFLOW_ADD_TICKET_BLOCK to associate the class with non-terminal (block-type

or subnet-type) network addition and/or edition requests.
• WORKFLOW_ADD_TICKET_SUBNET to associate the class with terminal network addition
and/or edition requests.
• WORKFLOW_ADD_TICKET_POOL to associate the class with pool addition and/or edition
requests.
• WORKFLOW_ADD_TICKET_ADDRESS to associate the class with address addition
and/or edition requests.
• WORKFLOW_ADD_TICKET_DNSZONE to associate the class with zone addition and/or
edition requests.
7. In the field Value, type in the value 1 (one) to enable the variable.
8. Click on OK to commit your addition. The object is now embedded into the class and listed
in the creation panel.
Once the class is configured, you can apply it from the DNS and/or IPAM module to automate
the addition or edition of objects.
Applying a Workflow Request Association Class

To apply the Workflow request association class, it must be enabled and then selected in the
addition or edition wizard.
To apply the Workflow request association class when adding an object
1. Go to the IPAM or DNS tab.

2. Display the page the suits your needs: All networks, All pools, All addresses or All zones.
3. If you are applying the class for in the IPAM, click on V4 .
4. In the menu, select Add > <object>. The corresponding wizard opens.
5. On the page <Object> class, select the class configured for the Workflow request association.
6. Configure the object according to your needs and click on NEXT until you get to the Workflow
related page.
7. In the drop-down list Ticket, select an existing request for addition of the chosen object.
8. If you are adding an IP address, the page Aliases configuration opens.You can add aliases
if need be. Then click on NEXT to display the last page of the wizard.
9. Click on OK to commit your creation. The report opens and closes. The object is listed. On
the Workflow pages, the selected request is now Finished.
To apply the Workflow request association class when editing an object
1. Go to the IPAM or DNS tab.

2. Display the page the suits your needs: All networks, All pools, All addresses or All zones.
3. If you are applying the class for in the IPAM, click on V4 .
4. Right-click over the object you want to edit. The contextual menu opens.
5. Click on . The corresponding wizard opens.
6. On the <page Object> class, select the class configured for the Workflow request association.
869
Executing Requests
7. Edit the object according to your needs and click on NEXT until you get to the Workflow related
page.
8. In the drop-down list Ticket, select an existing request for addition of the chosen object.
9. If you are editing an IP address, the page Aliases configuration opens.You can add aliases
if need be. Then click on NEXT to display the last page of the wizard.
10. Click on OK to commit your creation. The report opens and closes. The object is listed. On
the Workflow pages, the selected request is now Finished.
Once the request is executed, the requestor receives a notification email. The administrator or
request manager can archive the request. For more details, refer to the section Archiving Requests.
870
Chapter 62. Customizing the Requests
Administration
Depending on your needs, you can entirely customize the menu Edit of the page Incoming requests
as well as the restrictions associated with the status edition. As detailed in the section Adminis-
trating Requests Using the Default Statuses and Options, you cannot set all the statuses to the
requests as you please. As you can see in the image below.
Executed request Rejected request Cancelled request

Full default cycle By a requestor
1 New
2 Handle
Request
3 Accept execution 4 Reject 5 Cancel
6 Finish
Archive
Figure 62.1. Workflow default status cycle
These default edition restrictions are all set in the registry database. The default configuration of
the Workflow in the registry database is the following:
Table 62.1. Workflow registry database entries default value

Registry database entry Default value
module.workflow.state.accept incoming, wf-accept, t, nocallback, new-target,handle-operator
module.workflow.state.archive incoming, wf-archive, t, archive_callback, cancel-admin, reject-admin,finish-
admin, accept-operator
module.workflow.state.cancel outgoing, wf-cancel, t, cancel_callback, new-source,handle-source
module.workflow.state.finish incoming, wf-finish, t, finish_callback, accept-operator
module.workflow.state.handle incoming, wf-handle, t, nocallback, new-target,handle-target
module.workflow.state.new incoming, wf-new, f, nocallback, finish-admin
module.workflow.state.reject incoming, wf-reject, t, nocallback, new-target,handle-operator
module.workflow.state_mail new,handle,accept,reject,finish
871
Customizing the Requests Adminis-
tration
You can edit default statuses, remove default statuses from the GUI and add new statuses.
Whatever the customization you have in mind, we recommend that you take into consideration
the section Customized Statuses Best Practices.
Editing the Workflow Statuses

All the entries of the registry database dedicated to the Workflow configuration can be identified
and filtered.You can edit these entries to suit internal processes, for instance skip some statuses
that are obsolete to your organization or even grant more permissions to requestors and request
managers.
Whether you decide to edit an existing status or hide it from the GUI, to make sure the request
cycle is complete, we recommend that you follow, the sections Status Edition Best Practices and
Status Deletion Best Practices.
To edit the Workflow request statuses
1. Edit the status entries value:

homepage opens.
opens.
c. In the search engine of the column Name, type in module.workflow.state. Only the
Workflow status related keys are listed.
d. In the column Value , click on the value of the entry you want to edit. The wizard Registry
database Edit a value opens.
e. In the field Value, specify the value of your choice following the description of the
Workflow Status Entries String below.
f. Click on OK to commit your changes. The report opens and closes. The page refreshes
and the new value is displayed.
2. Register your changes:

homepage opens.
b. In the menu, select System > Expert > Register new macros/rules. The wizard Register
all the latest macros and rules opens.
c. Click on OK to commit your choice. The report opens and works for a while. A notification
pop-up appears in the lower right corner of the GUI when the operation is over.
The Workflow configuration entries are all named module.workflow.state<detail>. There are
seven entries dedicated to the default statuses.
1. module.workflow.state.accept .
2. module.workflow.state.archive .
3. module.workflow.state.cancel .
872
tration
4. module.workflow.state.finish .
5. module.workflow.state.handle .
6. module.workflow.state.new .
7. module.workflow.state.reject .
Each entry is important as it sets the permissions and restrictions related to the status. The status
key value is a string in which the order matters. They must be separated by a coma as follows:
<page>, <icon>, <visibility>, <callback>, <attribute_1, attribute_2, ..., attribute_n> .
As an example, the Accept status is detailed in the image below:
Figure 62.2. Structure of a workflow status registry entry
Page where the status can be set.

Icon preceding the Accepted status on the page.
Visibility in the menu configuration.
This section of the value is obsolete.
Attributes defines who can set the Accept status and in what conditions.
In this example, the Accept status is displayed (t) on the page Incoming requests (incoming) and
is preceded by the green icon. Any user with sufficient rights can accept New requests (new-
target) and only the request manager who Handled or Rejected the request can accept it (accept-
operator, reject-operator).
Each element of the string has a set of acceptable values that define the request status logic and
organization that suits your needs:
Page
incoming specifies that the status is available on the page Incoming requests.
outgoing specifies that the status is available on the page Outgoing requests.
Icon
wf-accept allows to display the icon 3, before the status name.
wf-archive does not display any icon as archiving means removing the request from the list.
wf-cancel allows to display the icon 5, before the status name.
wf-finish allows to display the icon 6, before the status name.
873
tration
wf-handle allows to display the icon 2, before the status name.
wf-new allows to display the icon 1 , before the status name.
wf-reject allows to display the icon 4 , before the status name.

Visibility
t stands for true and indicates that the status is available in the menu Edit of the specified
<page>.
f stands for false and indicates that the status is not displayed in the menu Edit of the specified
<page>.
Callback parameters
This parameter is obsolete. You can find in the keys the values: callback, nocallback,
archive_callback and cancel_callback. Do not edit them, they are part of the string.
Attributes
This last part of the string sets which user can set the status described in the string. This
permission depends on who set the previous status: the user who set the status listed can
now set the status described in the string.
The permissions structure follows the format: <action>-<user> in which action can be: accept,
archive, cancel, finish, handle, new and reject, each one corresponds to the default
statuses.
The users are:

• admin that is to any user in the group admin, including ipmadmin.
• operator the user that deals with the request.The other users belonging to the same group
cannot perform the actions associated with operator: only the user who performed the action
detailed in the status entry Value is the operator.
• source the user who created the request, i.e. the requestor.
• target any user with sufficient Workflow permissions, including ipmadmin. In other words,
any user that can see the request in the list.
Therefore, only the users specified in the field Value of the status entry can set the status
described and only if the previously set one of the statuses associated with their <user>
name.
Editing the Email Notification Details

In addition to the status dedicated entries, there is one key dedicated to the notification of re-
questors via email: module.workflow.state_mail.
The default configuration sends an email to the requestors whenever the status request they
created is edited. This is why, by default, it contains new,handle,accept,reject,finish .
The requestors only receive an email if their User profile was set properly. For more details, refer
to the chapter Managing Users in the section Adding Users or Editing Users.
To edit the email notification trigger details
1. Edit the status entries value:
874
tration

homepage opens.
b. In the menu, select System > Expert > Registry data. The page Registry database
opens.
c. In the search engine of the column Name, type in module.workflow.state_mail. Only this
key is listed.
d. In the column Value , click on the value listed. The wizard Registry database Edit a value
opens.
e. In the field Value, edit the content according to your needs. An email is sent to the re-
questor if the status attributed to a request they created is listed in the field. By default,
the field contains new,handle,accept,reject,finish.

homepage opens.
Adding a Workflow Status

You can add new statuses to the Incoming and Outgoing requests pages. This implies:
1. Adding the registry database entry following the Workflow entries format.
2. Translating the related menu option and status on the page.
3. Follow the Status Addition Best Practices.
To add a Workflow request status
1. Add the status entry:

homepage opens.
b. In the menu, select System > Expert > Registry data. The page Registry database
opens.
c. Filter the list to only display the Workflow status related entries using the keyword:
module.workflow.state.
d. In the menu, select Add > Registry item. The wizard Registry database Add an item
opens.
e. In the field Name, type in the status name following the format: module.work-
flow.state.<your-status-name> .
875
tration
f. In the column Value, type in the characteristics if the new status following the format
<page>, <icon>, <visibility>, nocallback, <attribute_1>, <attribute_2>, <attribute_n> .
For more details, refer to the description of the Workflow Status Entries String.
g. Click on OK to commit your creation. The report opens and closes. The new entry is
listed.

homepage opens.
Once the entry is created and registered, the new status is visible in the menu Edit of the selected
page as followed: rq_<your-status-name>. Once you attributed the status to a request, the request
Status is rq_in_<your-status-name>. You can translate both using the page Language editor.
To translate the name of your Workflow statuses
1. From any page or wizard within SOLIDserver, copy the name of a field, page, column or
menu that you want to replace with your label.
opens.
3. In the menu, select Customization > Language editor. The page Language editor opens.
4. In the menu, select Add > Entry. The wizard opens.
5. In the field Key, paste the status name. We recommend that you copy/paste the label name
because Language editor is case sensitive.
6. If your appliance is displayed in English, in the field English, type in the new label value.
7. Click on OK to commit your creation. The entry is listed. Go back to the page where you
copied the label to see the new name.
Customized Statuses Best Practices

Whether you decide to add statuses, edit statuses or remove them from the GUI, to complete
the status customization we recommend that you follow the best practices below.
Status Addition Best Practices

Once you created a new status, you should:
• Edit the list attributes in the entries describing the statuses you do use. For instance, if you
want to add a Postpone status that can be set after a request is accepted, you should add the
postpone-<user> attribute in the value of the finish entry as well as the accept-<user> in the
1
value of the postpone entry . For more details, refer to the description of the Workflow Status
Entries String below.
1
This example is only valid if you still use the default statuses cycle.
876
tration
• Edit all the status icons to make sure that the GUI respects your new request cycle.
• Add the status in the email notification entry. For more details, refer to the section Editing
the Email Notification Details.
• The new status cannot be executed using the Execute option as it only applies to New, Handled
and Accepted requests. For more details, refer to the section Executing Requests Using the
Execute Option.
• The restrictions detailed in the Administrating Requests Using the Default Statuses and Options
no longer apply to your request status cycle.
• The request execution automation using the pre-defined variables class objects can still be
configured. For more details, refer to the section Executing Requests Using Classes.
Status Edition Best Practices

Once you decided to edit statuses or add new ones, keep in mind that:
• Once you edited the registry database entries the Execute option still only applies to New,
Handled and Accepted requests. For more details, refer to the section Executing Requests
Using the Execute Option.
• The restrictions detailed in the Administrating Requests Using the Default Statuses and Options
no longer apply to your request status cycle.
• The request execution automation using the pre-defined variables class objects can still be
configured. For more details, refer to the section Executing Requests Using Classes.
Status Deletion Best Practices

To remove a status from the GUI, you recommend that you edit the status registry entry Value
and set its visibility attribute to f (false). From then on the status is no longer visible in the menu
Edit, and can no longer be used by users. Keep in mind that:
• Edit the list attributes in the entries describing the statuses you do use. For instance, if you
want to remove the Handle status from the request management steps, you should remove
all the handle-<user> attributes from the other statuses value field. For more details, refer to
the description of the Workflow Status Entries String below.
• Edit all the status icons to make sure that the GUI respects your new request cycle.
• Remove the status from the email notification entry. For more details, refer to the section
Editing the Email Notification Details.
• Keep in mind that if the status was already set before you remove it from the menu, it is still
displayed in the list.
877
Part X. Device Manager
Device Manager provides an overview of all the equipment on your network and allows to organize devices
and their content.
Relying on both manual and automatic management options, it helps to piece together the data registered
in the modules NetChange, IPAM, DHCP and DNS to map out the devices interactions and their connections
through interfaces and ports.
Network device: local.switch

Port name: FastEthernet 0/10
Hostname: local.computer
MAC address: a0:12:34:56:78:90
NetChange DHCP
Device Manager View

Device name: local.switch
Port name: FastEthernet 0/10
Device name: local.computer

Interface name: eth1 MAC address: a0:12:34:56:78:90
Figure 207. Information retrieved from NetChange and the DHCP
Note that all the data saved in Device Manager is never deleted, unless you decide to delete it. Therefore
you can save a lot of information regarding users or pieces of equipment through their MAC address or IP
address without impacting the other modules.
Within SOLIDserver, Device Manager has a dedicated module. From its dashboard, or homepage, you can
access the key levels of the hierarchy.
Figure 208. The Device Manager dashboard
Device Manager has a 2-level hierarchy:
• Devices: the highest level of the hierarchy, it provide an overview of all the equipment connected to your
network. You can create or automatically retrieve the devices you manage. They contain ports and/or in-
terfaces. For more details, refer to the chapter Managing Devices.
• Ports & interfaces: the lowest level of the hierarchy. The ports link the devices together on the network
and can be linked to interfaces. The interfaces have a MAC address and can also have one or several
IPv4 and/or IPv6 addresses, all listed on the same page. For more details, refer to the chapter Managing
Ports and Interfaces.
In addition, the module allows to:
• Replicate data to and from the IPAM. Using the interfaces MAC address and/or IP address, you can
automate updates. For more details, refer to the section Managing the Interaction with the IPAM.
• Automate updates from the DHCP. A couple of rules allow to automatically update the database
whenever relevant data is added in the DHCP. For more details, refer to the chapter Rules Impacting
Device Manager.
Chapter 63. Managing Devices
The devices are managed from the page All devices, where any device on the network can be
managed (network devices, computers, virtual machines...) and uniquely identified based on the
ports or interfaces it manages.
You can add them manually or automatically retrieve them. Devices can contain interfaces and/or
ports, depending on the discovered MAC and IP addresses.
You can merge devices, duplicate them, edit their content or delete them. You cannot rename
them.
Browsing Devices
Within the module Device Manager, the devices are the highest level of the hierarchy. It is required
to create devices to manage ports and interfaces.
INTERFACE
DEVICE
PORT
Figure 63.1. The device in Device Manager hierarchy
Browsing the Devices Database

To display the list of devices
opens.
To display a device properties page
opens.
3. At the end of the line of the device of your choice, click on . The properties page opens.
Customizing the Display on the Page All Devices

Keep in mind that a set of columns provides an overview of the devices interfaces and ports
content:
• Interfaces usage and Ports usage: the total portion, in percent of used interfaces/ports on a
device, along with a progression bar,
• Number of Interfaces and Number of Ports: the total number of interfaces/ports on the device,
880
Managing Devices
• Free Interfaces and Free Ports: the number of available interfaces/ports on the device.
Note that the data listed in the column IP Address can be sorted but not filtered. It only retrieves
and displays the IP address of all the interfaces of the device.
Managing the Devices Status and Visibility

Devices can be Managed, Unmanaged or Imported. Based on these statuses, you can filter the
list from the column Status and, for example, only display the managed and imported devices
using the value != Unmanaged (different from Unmanaged).
The option Manage allows to manage or unmanage the device of your choice, whether you added
it yourself or it was Imported from another module.
Keep in mind that you cannot unmanage a device associated with an IP address of the IPAM.
To manage/unmanage devices
opens.
3. Tick the device(s) of your choice.
4. In the menu, select Edit > Manage > Yes or No. The wizard Items management opens.
device is marked Unmanaged or Managed.
Adding Devices
You can add devices manually or automatically from several modules.
Before adding any device, we recommend Configuring Device Manager to make sure the data
listed is consistent with the equipment configuration of your network.
Once added, you can decide which devices you want to display and deal with on the page All
devices. For more details, refer to the section Managing the Devices Visibility.
Keep in mind that Device Manager does not delete on its own the entries that you might delete
in other modules. In that way, it provides an overview of former devices. To delete devices and
their content refer to the section Deleting Devices.
Note that you can also import devices from a CSV file from the page All devices. From then on,
you can add or import the ports and interfaces it contains and organize your network as you
please. For more details, refer to the section Importing Data to Device Manager.
Configuring Device Manager

The option Configure Device Manager ensures the consistency of the links between the devices
listed. You can execute it from any page in the module, from the homepage to the listing pages.
We recommend configuring Device Manager before managing any device, port and interface
because it compares the information of the other modules with what is listed in Device Manager.
On the page All ports & interfaces of each device, the columns Manually linked to and Automat-
ically linked to identify how the devices are linked together. If the column Manually linked to is
881
Managing Devices
empty, configuring Device Manager overwrites its content with the information collected during
the automatic addition. This ensures that the data listed reflects the interaction between the
devices on your network.
This option has to be ticked once. Afterward, a data check is performed each time a port or inter-
face is added or edited.
To configure Device Manager automatic data check
opens.
3. In the menu, select Tools > Configure Device Manager. The wizard Configure Device
Manager reconciliation opens.
4. Tick the box.
5. Click on OK to commit the automation. The wizard closes, the page is visible again.
Automatically Adding Devices

A set of options automatically adds devices and the ports and interfaces they contain from Device
Manager, NetChange and the IPAM.
Once you retrieved data automatically, you should monitor the column Reconciliation on the
page All ports & interfaces to prevent any drift. For more details, refer to the section Tracking
Changes on the Page All ports & interfaces.
Automatically Adding Devices from the Page All Devices
After Configuring Device Manager, you can execute the the option automatic discovery from the
page All devices.
The option Automatic discovery performs a sweep of the other modules data and retrieves all
the devices along with the ports and interfaces they contain. The option analyzes data in the
modules NetChange, DHCP, IPAM and DNS. The more information there is in these modules,
the more efficient is the option as it behaves as follows:
1. It retrieves NetChange data: network devices, ports and discovered items. The MAC ad-
dresses linked to the ports that have the interconnection set to No become interfaces in Device
Manager. The discovered items DNS name is retrieved as well, the IP address is only retrieved
if it is part of the IPAM. NetChange network devices can be managed as several devices in
Device Manager depending on their content.
Note that if several ports in NetChange are linked to one MAC address, the option retrieves
all the ports and the MAC address but randomly links it to one of the ports.
2. It retrieves the names of the devices, ports and interfaces if the information is available in
the modules NetChange, IPAM, DHCP or DNS:
a. In NetChange, on the page All discovered items, the option retrieves all the MAC addresses,
DNS names and IP addresses, only if they are part of the IPAM database.
882
Managing Devices
If the MAC addresses retrieved have a DNS name, the option stops here.
If the MAC addresses do not have a DNS name, the option looks for it in the IPAM.
b. In the IPAM, on the page All addresses, the option tries to match the collected MAC ad-
dresses with a name, using the available IPv4 and IPv6 addresses.
If a name is found for the MAC addresses, the option stops here.
If no name is found, the option looks for it in the DHCP.

c. In the DHCP, on the page All statics, the option tries to match the collected MAC addresses
with a name, using the available IPv4 statics and statics without IP.
If a name is found for the MAC addresses, the option stops here.
If no name is found, the option looks for it in the DNS.

d. In the DNS, on the page All RRs, the option tries to match the collected IP addresses with
a name, using the available A records.
If a name is found for the IP addresses, the option stops here.
If no name is found, Device Manager assigns the relevant MAC and IP addresses a name
based on the information collected in all four modules.
3. It assigns a name to:
a. Devices
In Device Manager, the name of devices, including network devices, depends on their
content.
• Network devices that contain one or several ports keep their NetChange name and only
manage ports. The interfaces are managed in a different device.
• Devices which IP address is declared in an A record of the DNS are listed under that
name in Device Manager.
• Network devices hosting the MAC address of one virtual machine, are named using the
hostname of the virtual machine.
• Network devices hosting the MAC address of several virtual machines are named
1
vm_server_# .
• Devices hosting an interface from which few information was retrieved are named gener-
ic_#.
b. Ports
All ports keep their NetChange name.

• Ethernet ports are named Ethernet <slot>/<port>, FastEthernet <slot>/<port>,
GigaEthernet <slot>/<port> or TenGigaEthernet <slot>/<port>.
• Wifi ports are named wifi#, where # differentiates the ports belonging to one device.
• Virtual ports are named Virtual port <slot>/<port>.
c. Interfaces
1
# is a number used to differentiate all these devices.
883
Managing Devices
All interfaces are named according to the port they are linked to. When a MAC address has
a name, this name is used to name the device it belongs to.
• Interfaces linked to an ethernet port are named eth#, where # differentiates the interfaces
belonging to one device.
• Interfaces linked to a wifi port are named wifi#.
• Interfaces linked to a virtual port are named vm_interface_#.
• Interfaces from which few information - except the MAC address - was retrieved are
named generic_#.
To automatically add devices from the page All devices
opens.
3. In the menu, select Tools > Automatic Discovery. The wizard Automatic discovery opens.
4. Click on OK to start the automatic retrieval of data. The report opens and closes. In the
column Status, the devices are marked Imported and you can manually manage and edit
the devices, ports and interfaces.
Keep in mind that the automatic discovery retrieves data but does not automatically update
it, if you delete data or make changes in NetChange, you must make the same changes in Device
Manager.
If the automatic discovery created more devices that your need, you can merge devices to reor-
ganize the data as you need. For more details, refer to the section Merging Devices.
Automatically Adding Devices from NetChange
From the NetChange pages All network devices and All discovered items you can select objects
to create devices, with the ports and interfaces they contain, in Device Manager.
Automatically Adding Network Devices in Device Manager
After Configuring Device Manager, you can use the option Create in Device Manager on the
page All network devices to select network devices and create them in Device Manager. It takes
into account the information available on the pages All network devices, All ports and All discovered
items and behaves as follows:
1. The device is created in Device Manager, it keeps the same name and contains all the network
device ports, no matter their interconnection configuration.
2. The interfaces (discovered items) of the device are retrieved and based on the MAC address:
a. If the MAC address has a DNS name, a device is created using that name. The interface
2
is named eth# .
b. If the MAC address has no DNS name, a device is created, it is named generic_#. It contains
the MAC address, it is named eth#.
If the option creates more devices that your need, you can merge devices to reorganize the data
as you need. For more details, refer to the section Merging Devices.
2
# differentiates interfaces within one device.
884
Managing Devices
To automatically create Device Manager devices from NetChange
opens.
3. Tick the network device(s) you want to create in Device Manager.
4. In the menu, select Tools > Create in Device Manager.The wizard Create NetChange devices
in Device Manager opens.
5. Click on OK to commit the creation. The report opens and closes and the page is visible
again.
6. Go to the Device Manager tab and open the page All devices, the new devices are marked
Imported in the column Status.
Automatically Adding Discovered Items in Device Manager
After Configuring Device Manager, you can use the option Populate Device Manager on the
page All discovered items to create interfaces from the discovered item of your choice. The MAC
addresses selected create interfaces and devices as follows:
3
• If the selected MAC address has a DNS name, it creates an interface named generic_# that
belongs to a device named using the DNS name.
• If the selected MAC address has no DNS name, it creates an interface named generic_# that
belongs to a device named generic_#.
To populate Device Manager with NetChange discovered items
opens.
3. Tick the discovered item(s) you want to create in Device Manager.
4. In the menu, select Tools > Populate Device Manager. The wizard Populate device manager
opens.
5. Click on OK to commit the creation. The report opens and closes and the page is visible
again.
6. Go to the Device Manager tab and open the page All devices, the discovered item created
a device that contains the interface. In the column Status, it is marked Imported.
Automatically Adding Devices from the IPAM
From the IPAM page All addresses you can automatically add devices managing interfaces created
from the IPv4 and IPv6 addresses In use of your choice. The option names the objects as follows:
• The devices are named using the selected IP address name. If the IP addresses, v4 and/or
v6, share the same name, like the addresses Gateway, they belong to one device. If the selected
IP address does not have a name, the device is named generic_#.
3
# differentiates interfaces within one device.
885
Managing Devices
• The interfaces are all named generic_#, where # differentiates interfaces within one device.
Their IP address and the space they originated from are displayed in the column Status.
To create devices and interfaces from the page All addresses
3. On the right-end side of the menu, click on V4 to display the IPv4 addresses or V6 to display
the IPv6 addresses.
4. Tick the Used IP addresses for which you want to create devices and interfaces.
5. In the menu, select Tools > Populate Device Manager. The wizard Populate Device Manager
opens.
6. Click on OK to commit your choice. The report opens and works for a while and closes. The
page is visible again. From the IPAM you can see the device and interface of the IP address
in the columns Device manager name and Device manager interface.
In the module Device Manager, the device and interface are marked Imported in the
column Status. In the column IP address, the IP address and the space they originated from
are displayed as follows: <ip-address> (<space>).
Manually Adding Devices

You can add a device manually in two different ways, either from the page All devices or when
assigning an address from the IPAM.
Manually Adding Devices from the Page All devices
After Configuring Device Manager, you can add a device manually from the page All devices.
To manually add a device
opens.
3. In the menu, select Add > Device. The wizard Add Device opens.
4. If you or your administrator created classes at the device level, in the list Device class select
5. In the field Device, name your device.
6. In the field Description, you can add a description.
886
Managing Devices
7. Click on OK to commit the addition. The report opens and closes. The device is listed.
Note that, from the device addition wizard, you can also add the ports and/or interfaces it manages.
For more details, refer to the section Manually Adding Ports and Interfaces.
Manually Adding Devices from the IPAM
From the IPAM page All addresses you can assign an IPv4/IPv6 address and link it to a device
and an interface directly from the IP address addition wizard. You can add as many devices and
interfaces as you need.
First, you need to display the relevant advanced property via the wizard Advanced properties
customization.
Table 63.1. IPAM / Device Manager advanced properties

Enable to create devices from the IPAM Create a device
Device name
Interface name
To display the device addition advanced properties at IP address level
5. In the IPAM / Device Manager interaction section, tick the box Enable to create devices
from the IPAM.
again.
Once you set the advanced properties display, the box Create a device allows to add new devices
directly from the IP address addition and edition wizard both in IPv4 and IPv6.
To add a device when adding/editing an IP address
4. Add or edit an IP address to display the Device Manager dedicated fields. The wizard opens.
For more details regarding IP address addition or edition, refer to the chapter Managing IP
Addresses.
5. On the IP address configuration page of the wizard, configure the device addition advanced
properties:
a. Tick the box Create a device, the fields Device name and Interface name appear. They
are both required.
b. In the field Device name, type in the name of your new device.
887
Managing Devices
c. In the field Interface name, type in the name of your new interface.

7. Configure aliases if need be. For more details, refer to the section Configuring and Managing
IP Address Aliases.
8. Click on OK to commit your changes/configuration. The report opens and closes.
The changes are visible on the IP address properties page, in the panel Advanced properties,
and in the columns Device manager name and Device manager interface. Click on the device
or interface name to access its properties page in Device Manager.
Once added from the IPAM module, you can edit the device and interface from Device Manager.
Duplicating Devices
At any time, you can duplicate the content and class parameters of a device. Duplicating devices
can be used to anticipate provisioning.
For example, if you know that you will add a switch to NetChange that has a configuration similar
to an existing device, you can duplicate the device and then edit it, etc. Once you the new switch
is saved in Device Manager, you can complete the device content edition: you must update the
MAC address of all your interfaces and the links between ports and devices. For more details,
refer to the section Editing Ports and Interfaces Properties.
If you know that you will add a new network device to NetChange and an existing device in Device
Manager has configuration similar, you should duplicate the device to import more easily the
network device to the page All devices. In this case you should:
1. Duplicate your device and name it like the coming NetChange network device, as detailed in
the procedure below.
2. Edit the device content (number of ports and/or interfaces it manages, edit the links between
the devices...) to make sure it matches the network device to come. For more details, refers
to the sections Adding Ports and Interfaces, Editing Ports and Interfaces Properties and Deleting
Ports and Interfaces.
To duplicate a device
opens.
3. Tick the device you want to duplicate. You can only duplicate one device at a time.
4. In the menu, select Edit > Duplicate. The wizard Duplicate device opens.
5. In the field Device name, type in the name of the new device.
6. Click on OK to commit the duplication. The report opens and closes. The device is listed. It
contains the same ports and/or interfaces. However, the link from ports to device has to be
set manually and interfaces MAC addresses are automatically generated.
Merging Devices
You can merge devices to manage the ports and interfaces they contain from a unique device.
888
Managing Devices
Merging devices can be useful if you want to correct what was automatically found on the network.
For instance, if after automatically retrieving information from NetChange, a port and an interface
end up in two different devices even if they both belong to one laptop, you can merge these
devices to manage them from a single device.
To merge devices
opens.
3. Tick the devices you want to merge.
4. In the menu, select Edit > Merge. The wizard Merge device opens.
5. In the drop-down list Name, select the device that should include all the ports and interfaces.
The other device(s) are emptied and deleted.
6. Click on OK to commit your choice. The report opens and closes. The device is listed, the
other devices are no longer listed.
Deleting Devices
At any time you can delete a device, this also deletes the ports and interfaces it contains. This
action is non-reversible.
To delete a device
opens.
3. Tick the device(s) you want to delete.
5. Click on OK to commit the deletion. The report opens and closes. The device and the ports
and interfaces it contains are no longer listed.
889
Chapter 64. Managing Ports and
Interfaces
From the page All ports & interfaces, you can manage the ports and the interfaces that belong
to your devices.
You can add them to a specific device or when you create a device. You can also automatically
retrieve them, along with the device they belong to, from other modules.
The ports link devices together, the interfaces are connected to the ports. Each interface has a
MAC address and sometimes one or several IPv4 and/or IPv6 addresses.
Note that, to minimize any error or distortion between what is really connected to the network
and what is listed, you can track changes and reconcile data on this page. For more details, refer
to the section Tracking Changes on the Page All ports & interfaces.
Browsing Ports and Interfaces

Within Device Manager module, the ports and interfaces are the lowest level of the hierarchy.
They both belong devices, and are listed on the same page.
INTERFACE
DEVICE
PORT
Figure 64.1. The interface in Device Manager hierarchy
INTERFACE
DEVICE
PORT
Figure 64.2. The port in Device Manager hierarchy
Browsing the Ports and Interfaces Database

To display the list of ports and interfaces
opens.
2. In the breadcrumb, click on All ports & interfaces. The page All ports & interfaces opens.
To display the list of ports and interfaces of a specific device
opens.
890
Managing Ports and Interfaces
3. In the Name column, click on the name of the device of your choice to display the ports and
interfaces it contains.
To display a port or interface properties page
opens.
3. Filter the column Type, type in port or interface to list the objects that suit your needs.
4. At the end of the line of the port or interface of your choice, click on . The properties page
opens.
Customizing the Display on the Page All Ports & Interfaces

Keep in mind that the column Addition date provides extra information regarding the devices'
content. You can use it to sort or filter the list.
Managing the Ports and Interfaces Status and Visibility

Ports and interfaces can be Managed, Unmanaged or Imported. Based on these statuses, you
can filter the list from the column Status and, for example, only display the managed and imported
ports and interfaces using the value != Unmanaged (different from Unmanaged).
The option Manage allows to manage or unmanage the port or interface of your choice, whether
you added it yourself or it was Imported from another module.
To manage/unmanage a device
opens.
3. Tick the port and/or interface of your choice. You can tick more than one.
4. In the menu, select Edit > Manage > Yes or No. The wizard Items management opens.
port or interface is marked Unmanaged or Managed.
Adding Ports and Interfaces

You can add ports and interfaces manually or automatically retrieve them.
Before adding any port or interface, we recommend Configuring Device Manager to make sure
the data listed is consistent with the equipment configuration of your network.
Once added, you can decide which items you display and deal with on the page, as detailed in
the section Managing the Ports and Interfaces Visibility.
891
Keep in mind that Device Manager does not delete the entries that you might delete in other
modules on its own. In that way, it provides an overview of former port and interface interactions,
to delete ports and interfaces refer to the section Deleting Ports and Interfaces.
Note that you can also import ports and/or interfaces from a CSV file on the page All ports & in-
terfaces. For more details, refer to the section Importing Data to Device Manager.
Configuring Device Manager

The option Configure Device Manager ensures the consistency of the links between the devices
on your network, through the ports and interfaces they manage.
This option has to be ticked once, if you already configured Device Manager there is no need
to do it again.
On the page All ports & interfaces of each device, the columns Manually linked to and Automat-
ically linked to identify how the devices are linked together. If the column Manually linked to is
empty, configuring Device Manager overwrites its content with the information collected during
the automatic addition. This ensures that the data listed reflects the interaction between the
devices on your network.
To configure Device Manager automatic data check
opens.
3. In the menu, select Tools > Configure Device Manager. The wizard Configure Device
Manager reconciliation opens.
4. Tick the box.
5. Click on OK to commit the automation. The wizard closes, the page is visible again.
Automatically Adding Ports and Interfaces

You can automatically add ports and interfaces, along with the device they belong to when relevant,
from Device Manager or the IPAM.
Once you retrieved data automatically, you should monitor the column Reconciliation on the
page All ports & interfaces to prevent any drift. For more details, refer to the section Tracking
Changes on the Page All ports & interfaces.
Automatically Adding Ports and Interfaces from the page All Devices
After Configuring Device Manager you can use the option Automatic discovery from the page
All devices to retrieves devices, and the ports and interfaces they contain. The name of all the
objects reflect the amount of information available in the modules NetChange, IPAM, DHCP and
DNS.
This option creates devices from network devices. Some of these devices manage only ports
and others manage one or several interfaces based on the MAC addresses retrieved.
892
On the page All network devices, the ports can have the following names:
• Ethernet ports can be named Ethernet <slot>/<port>, FastEthernet <slot>/<port>, GigaEthernet

<slot>/<port> or TenGigaEthernet <slot>/<port>.
• Wifi ports are named wifi#, where # differentiates the ports belonging to one device.
• Virtual ports are named Virtual port <slot>/<port>.
On the page All network devices, the interfaces can have the following names:
• Interfaces linked to an ethernet port are named eth#, where # differentiates the interfaces be-
longing to one device
• Interfaces linked to a wifi port are named wifi#.
• Interfaces linked to a virtual port are named vm_interface_#.
• Interfaces from which few information - except the MAC address - was retrieved are named
generic_#.
For more details regarding what data is retrieved and how it is named, refer to the section Auto-
matically Adding Devices from the Page All Devices.
To automatically add ports and interfaces from the page All devices
opens.
4. Click on OK to start the automatic retrieval of data. The report opens and closes.
5. In the breadcrumb, click on All ports & interfaces. The page opens.
6. In the column Status, the ports and interfaces are marked Imported.
Once the automatic discovery retrieved ports and interfaces, you can rename or edit them if need
be. For more details, refer to the section Editing Ports and Interfaces Properties. You should also
monitor the column Reconciliation as detailed in the section Tracking Changes on the Page All
ports & interfaces.
Keep in mind that the option retrieves data but does not automatically update it, if you delete data
or make changes in NetChange, you must make the same changes in Device Manager.
Automatically Adding Interfaces from the IPAM
From the IPAM page All addresses you can automatically add interfaces and the devices they
belong to from the IPv4 and IPv6 addresses In use of your choice. The option names the objects
as follows:
• The devices are named using the selected IP address name. If the IP addresses, v4 and/or
v6, share the same name, like the addresses Gateway, they belong to one device. If the selected
IP address does not have a name, the device is named generic_#.
• The interfaces are all named generic_#, where # differentiates interfaces within one device.
Their IP address and the space they originated from are displayed in the column Status.
893
No ports are added as the interfaces are created using the MAC address of the selected IP ad-
dresses.
To create devices and interfaces from the page All addresses
3. On the right-end side of the menu, click on V4 to display the IPv4 addresses or V6 to display
the IPv6 addresses.
4. Tick the Used IP addresses for which you want to create devices and interfaces.
5. In the menu, select Tools > Populate Device Manager. The wizard Populate Device Manager
opens.
6. Click on OK to commit your choice. The report opens and works for a while and closes. The
page is visible again. From the IPAM you can see the device and interface of the IP address
in the columns Device manager name and Device manager interface.
In the module Device Manager, the device and interface are marked Imported in the
column Status. In the column IP address, the IP address and the space they originated from
are displayed as follows: <ip-address> (<space>).
Manually Adding Ports and Interfaces

Manually adding ports and interfaces allows to correct what was found in NetChange or simply
manage devices in accordance to your needs. You can add as many ports and interfaces as you
want to a device to virtually link your devices.
Once you added data, you should monitor the column Reconciliation on the page All ports & in-
terfaces to prevent any drift. For more details, refer to the section Tracking Changes on the Page
All ports & interfaces.
Manually Adding Ports
After Configuring Device Manager you can add ports manually from the pages All devices and
From the page All devices you can add as many ports as you want when you add a device. All
these ports have the same name and can be numbered.
To manually add a device and the ports it contains
opens.
894
6. Tick the box Add port(s)/interface(s). The ports and interfaces configuration fields appear
7. In the drop-down list Type, select Port. The port related fields appear.
8. Set the number of ports and their name:
Table 64.1. Port dedicated fields when adding a device

Field Description
Name Type in the port name. If you use the character #, it is replaced by a number no
matter how many ports you want the add at once.
Number of ports Type in the number of ports you want to add in the device you are creating. If
you used # in their name, they are all numbered from 1 to n.
9. Click onADD . The port is listed as such: port: <number of ports> <port name> in the Inter-
faces/Ports list. If you want to add more ports to the device. Repeat these actions for as
many ports as needed.
10. In the list Interfaces/Ports, you can set in which order the ports and interfaces are displayed
selecting the items name and using the and buttons.
the list. If you made changes that you do not want to save, click on CANCEL .This automatically
empties all the fields and allows to add other entries.
11. Click on OK to commit the creation. The report opens and closes. The device is listed. On
the pages All devices and All ports & interfaces, in the column Status, the device and the
port(s) are marked Managed.
From the page All ports & interfaces, you can add one port at a time in a specific device.
To manually add a port
opens.
3. In the menu, select Add > Port/Interface. The wizard Add port/interface opens.
4. In the drop-down list Device, select one of your existing devices.
6. If you or your administrator created classes at the port and interface level, in the list Host
interface class select a class or None. Click on NEXT . The next page of the wizard appears.
7. In the field Name, name the port.
8. In the drop-down list Type, select Port.
895
9. You can link the port you are creating with another device port or interface. This is not re-
quired, if you do not want to link your port go to step 9.
Table 64.2. Options to link a port you are creating to a device

Field Description
Link with device Type in the name of the device you want to link the port with. The auto-completion
retrieves a list of existing devices matching this name that you can choose from.
Link with port/interface Type in the name of the port or interface you want to link the port with. The auto-
completion retrieves a list of available ports and interfaces matching this name
10. Click on OK to commit your configuration. The report opens and closes. The port is listed
and marked Managed.
Manually Adding Interfaces
After Configuring Device Manager you can add interfaces from the pages All devices and All
ports & interfaces.
Keep in mind that you can also add devices and the interfaces they contain from the IPAM. For
more details, refer to the section Manually Adding Devices from the IPAM.
From the page All devices you can add as many interfaces as you want when you add a device.
Each interface has a unique name, they can have be assigned an existing IP address, they must
have a MAC address that you either set or let Device Manager generate automatically, in this
case the MAC address is not displayed on the page.
To manually add a device and the interfaces it contains
opens.
6. Tick the box Add port(s)/interface(s). The ports and interfaces configuration fields appear.
7. In the drop-down list Type, select Interface.
8. In the field Name, type in the interface name.
9. You can link the interface with an IP address. This step is optional.
Table 64.3. Options to link an interface you are creating with an IP address
Field Description
MAC address Type in the MAC address if you know it.You then have to type in the correspond-
ing IP address.
896
Field Description
IP Address Type in a known IP address of the IPAM module, the corresponding MAC address
a
is deduced and entered in the field MAC Address .
a
If the MAC address is already listed on the page All ports & interfaces, this interface addition is impossible.
10. Click on ADD . In the list Interfaces/Ports, the interface is listed as such: interface: <interface
name> <MAC address> <IP Address>. Repeat these actions for as many interfaces as you
need.
11. In the list Interfaces/Ports, you can set in which order the ports and interfaces are displayed
selecting the items name and using the and buttons.
the list. If you made changes that you do not want to save, click on CANCEL .This automatically
empties all the fields and allows to add other entries.
12. Click on OK to commit the creation. The report opens and closes. The device is listed. On
the pages All devices and All ports & interfaces, in the column Status, the device and the
interface(s) are marked Managed.
From the page All ports & interfaces, you can add one interface at a time in a specific device.
To manually add an interface
opens.
3. In the menu, select Add > Port/Interface. The wizard Add port/interface opens.
4. In the drop-down list Device, select one of your existing devices. You can use your keyboard
to find the device you are looking for.
5. Click on NEXT . The next page, regarding ports and interfaces, opens.
7. In the field Name, name the interface.
8. In the drop-down list Type, select Interface. The interface related fields appear.
9. You can link the interface with an IP address. This step is optional.
Table 64.4. Options to link an interface you are creating with an IP address
Field Description
MAC address Type in the MAC address if you know it.You then have to type in the correspond-
ing IP address.
IP Address Type in a known IP address of the IPAM module, the corresponding MAC address
a
is deduced and entered in the field MAC Address .
a
If the MAC address is already listed on the page All ports & interfaces, this interface addition is impossible.
10. In the drop-down list Space, you can select one of the existing IPAM spaces.
897
11. You can link the interface you are creating with another device port or interface. If you do
not want to link the interface to a port, go to step 11.
Table 64.5. Options to link an interface you are creating to another device
Field Description
Link with device Type in the name of the device you want to link the interface with. The auto-
completion retrieves a list of existing devices matching this name that you can
choose from.
Link with port/interface Type in the name of the port you want to link the interface with. The auto-com-
pletion retrieves a list of available ports and interfaces matching this name that
you can choose from.
12. Click on OK to commit your configuration. The report opens and closes. The interface is listed
and marked Managed.
Editing Ports and Interfaces Properties

To edit the ports and interfaces implies:
• Renaming a port or an interface.

• Editing the links between existing ports/interfaces and devices.
• Editing the links between existing interfaces and devices, and the interface MAC address.
Editing port and interfaces is required if you duplicated existing devices. Once you duplicated
the relevant device, you must edit its content as follows:
1. Add/delete the ports and interfaces it contains as needed. For more details, refer to the sections
Adding Ports and Interfaces and Deleting Ports and Interfaces.
2. Manually link the ports/interfaces to the needed device as detailed in the sections Editing a
Port and Editing an Interface.
Renaming a Port or Interface

You can change the name of a port or an interface name from its properties page or from the
contextual menu on the page All port & interfaces.
Keep in mind that ports retrieved from NetChange had a name before you chose to manage them
in Device Manager. Once you renamed a port, both NetChange and Device Manager names are
displayed on its properties page: the field Name displays your name, the field NetChange port
name displays the port original name.
To rename a port from the page All ports & interfaces
opens.
3. In the Type column, type in port to only display the ports.
5. Click on . The wizard Edit a port or interface opens.
898
7. In the field Name, rename the port.
8. Click on OK to commit your edition. The report opens and closes. Your modified port name
is listed, its former name is no longer visible.
To rename an interface from its properties page
opens.
3. In the Type column, type in interface to only display the interfaces.
4. Filter the list if needed.
5. Click on the name of the interface you want to edit. The properties page opens.
6. In the panel Main properties, click on EDIT . The wizard Edit a port or interface opens.
8. In the field Name, rename the interface.
9. Click on OK to commit your edition. The report opens and closes. In the Main properties
panel, the name is edited.
Editing a Port
At any time, the ports' links toward devices can be edited.
If you duplicated a device, you must edit these links. Once a device is duplicated, the newly
created device ports are not linked to any other device. In this case, you have to create the link
between the ports and the needed device port or interface. To successfully edit the port links
between devices, you must:
1. Add a new link toward the newly created device interfaces.

2. Perform an automatic discovery if both the ports and interfaces links are edited.
3. Check the data.
To link a port to another device's interface
opens.
3. Filter the names to display the port name if needed.
899
4. Click on the name of the port you want to link to another device interface. The port properties
page opens.
7. Specify the other device port or interface.
Table 64.6. Options to link a port/interface you are editing to another device
Field Description
Link with device Type in the name of the device you want to link the port with. The auto-completion
retrieves a list of existing devices matching this name that you can choose from.
Link with port/interface Type in the name of the port or interface you want to link the port with. The auto-
8. Click on OK to commit the edition. The report opens and closes. The device you selected is
visible in the panel Main properties in the Manually linked to line, the selected interface is
between brackets. If you go back to the page All ports & interfaces, you have the same in-
formation in the column Manually linked to.
Now that the links are saved, if you already added the new device in NetChange, you can run
the automatic discovery. For more details, refer to the section Adding Network Devices.
If you also have interfaces in that device, edit their links and MAC addresses before running
the automatic discovery. For more details, refer to the section Editing an Interface.
To automatically add ports and interfaces
opens.
4. Click on OK to start the automatic retrieval of data. The report opens and closes. The devices
are all listed, their content and names depend on what was found. For more details, refer to
the section Automatically Adding Devices from the Page All Devices.
Once your changes are done and the list of ports is up-to-date, you can compare the data added
manually and automatically.
To check the automatic discovery results
opens.
3. Click on the Name of the new device. The page All ports & interfaces of the device opens.
4. Compare the content columns Manually linked to and Automatically linked to.
900
5. Make sure there is no drift in the column Reconciliation. For more details, refer to the section
Tracking Changes on the Page All ports & interfaces.
Editing an Interface
At any time, the interfaces' links toward devices can be edited.
If you duplicated a device, you must edit the links. Once a device is duplicated, the newly created
device interfaces are not linked to any other device and their MAC address is probably incorrect.
In this case, you have to create the link between the interfaces and the needed device port or
interface. To successfully edit the interfaces' links between devices, you must:
1. Add a new link toward the newly created device interfaces.

2. Update the MAC address of the interface.
3. Perform an automatic discovery if both the ports and interfaces links are edited.
4. Check the data.
To link an interface to another device's interface
opens.
3. Filter the names to display the interface name if needed.
4. Click on the name of the interface you want to link to another device interface. The port
7. Specify the other device port or interface.
Table 64.7. Options to link an interface to another device's interface

Field Description
Link with device Type in the name of the device you want to link the interface with. The auto-
completion retrieves a list of existing devices matching this name that you can
choose from.
Link with port/interface Type in the name of the interface you want to link the interface with. The auto-
8. Click on OK to commit the edition. The report opens and closes. The device you selected is
visible in the panel Main properties in the Manually linked to line, the selected interface is
between brackets. If you go back to the page All ports & interfaces, you have the same in-
formation in the Manually linked to column.
Once you linked the interfaces to another device interface, update its MAC address.
901
To update a MAC address
opens.
3. Tick the interface which MAC address you want to update. Filter the data if needed.
4. In the menu, select Edit > Update MAC. The wizard Update mac address opens.
5. In the field MAC address, type in the new MAC address.
6. Click on OK to commit the edition. The report opens and closes. The interface is listed with
the new MAC address. The MAC address is also updated within the IPAM module.
Once you updated a MAC address, the former MAC address is deleted and the IP address(es)
it is linked to are saved whether it is an IPv4 or an IPv6 address.
Now that the links are saved and the MAC addresses updated, if you already added the new
device in NetChange, you can run the automatic discovery. For more details, refer to the section
Adding Network Devices.
If you also have ports in that device, edit their links as well before running the automatic
discovery. For more details, refer to the section Editing a Port.
To automatically add ports and interfaces
opens.
4. Click on OK to start the automatic retrieval of data. The report opens and closes. The devices
are all listed, their content and names depend on what was found. For more details, refer to
the section Automatically Adding Devices from the Page All Devices.
Once your changes are done and the list of interfaces is up-to-date, you can compare the data
added manually and automatically.
To check the automatic discovery results
opens.
3. Click on the Name of the new device. The page All ports & interfaces of the device opens.
4. Compare the content columns Manually linked to and Automatically linked to.
5. Make sure there is no drift in the column Reconciliation. For more details, refer to the section
Tracking Changes on the Page All ports & interfaces.
Tracking Changes on the Page All ports & interfaces

To minimize the risk of saving inaccurate information in the module, the page All ports & interfaces
allows to track changes via a column and an option, both called reconciliation.
902
The reconciliation allows to compare the manual and/or automatic links between devices through
ports and interfaces.
The Column Reconciliation

The column Reconciliation compares the data entered in the columns Automatically linked to
and Manually linked to. Note that:
• It works in close relation with the reconciliation option. For more details, refer to the section
The Reconciliation Option.
• The data retrieved automatically always has the upper hand in Device Manager so do not use
the reconciliation option if you know that what you entered manually corresponds to the way
you want to manage your items.
• Editing the devices topology from the IPAM changes the content of the column Manually linked
to. For more details, refer to the section Editing the Devices Topology from the IPAM.
The column can contain the following:
Table 64.8. Possible content of the column Reconciliation

Type Description
OK The information displayed in the columns Automatically linked to and Manually linked to is a match.
N/A No information is displayed in either column.
! Drift The information displayed in the columns Automatically linked to and Manually linked to is not a match.
The Top List Alert on ports/interfaces reconciliation drift tracks any drift in the column. For more
details, refer to the section Gadgets Displayed by Default.
The Reconciliation Option

The reconciliation option is here to proofread the link created manually versus the data entered
automatically. The first way to avoid getting any Drift is to configure Device Manager before
adding any items to it. Indeed, with this option both Automatically linked to and Manually linked
to should basically contain the exact same data.
However, if you decided to enter some data manually, you can reconcile both link related columns
with the reconciliation option.That is to say, the content of the column Manually linked to overwrites
the content of the column Automatically linked to.
To use the reconciliation option to save the manual device links
opens.
3. Filter data if needed. For instance, through Drift in the Reconciliation column.
4. Tick the port(s) and/or interface(s) you want to reconcile.
5. In the menu, select Edit > Reconcile. The wizard Reconciliation opens.
6. Click on OK to commit the reconciliation. The report opens and closes. The items disappear
from the list if the Reconciliation column was filtered by Drift as the value of the selected
items is now OK.
903
Deleting Ports and Interfaces

You can delete interfaces and ports from the page All ports & interfaces. Keep in mind that:
• The ports and interfaces deletion is manual and non-reversible.

• Deleting interfaces linked with the IPAM, breaks the link between the IP addresses and
the device.
To delete ports or interfaces
opens.
3. Tick the port(s) and/or interface(s) you want to delete.
5. Click on OK to commit the deletion. The report opens and closes. The selected item(s) is/are
no longer listed.
904
Chapter 65. Managing the Interaction
with the IPAM
Device Manager offers the possibility to display IPv4 and IPv6 addresses on the same list. Like
the IPAM and the DHCP modules, it uses the Dual Stack protocol. Which is why you have the
possibility to assign IP addresses in both versions of the Internet Protocol to one interface.
The automatic discovery option provides an automated assignment and display of both IPv4 and
IPv6 addresses. It requires the IP address and interface MAC address to be associated in the
IPAM module prior to running the option. Note that the MAC address in question should be part
of NetChange discovered items list. Once you made changes in either module, you can run the
option again following the procedure To automatically add devices from the page All devices.
From the IPAM module, a set of options allows to edit Device Manager database. You can:
• Add devices from the page All addresses when assigning an IP address. For more details,
refer to the section Manually Adding Devices from the IPAM.
• Associate IP addresses to existing interface or remove that link. For more details, refer
to the section Managing the IP Addresses / Interfaces Link from the IPAM.
• Edit the link between devices from the page All addresses. For more details, refer to the
section Editing the Devices Topology from the IPAM.
From Device Manager, setting the MAC address of an interface also updates the IPAM database.
For more details, refer to the section Assigning IP Addresses to an Interface Using their MAC
Address below.
Assigning IP Addresses to an Interface Using their MAC

Address
At any time, you can manually assign IPv4 and IPv6 addresses to existing interfaces provided
that any relevant piece of information is already saved in SOLIDserver database (in the IPAM
and NetChange). For that reason, adding, removing or editing an IP address MAC address, might
change or remove an existing IP address/interface link.
Assigning IPv4 Addresses to an Interface

The IP addresses of newly added IPAM networks are not taken into account by Device Manager
unless you assign them. Therefore, you have to manually assign the MAC addresses to the IP
addresses.
To assign an IPv4 address to an interface using its MAC address
1. Within Device Manager
a. Go to the Device Manager tab. If the homepage is not displayed, click on . The
homepage opens.
b. Click on Ports & interfaces. The page All ports & interfaces opens.
c. Order the list by MAC address. The interfaces are listed first.
905
Managing the Interaction with the
IPAM
d. Right-click over the Name of the interface of your choice. The contextual menu opens.
e. Click on . The interface properties page opens.
f. In the panel Main properties, copy the MAC address.
2. Within the IPAM module
b. Click on Addresses. The page All addresses opens. The button V4 in the upper right
corner is blue.
c. Click on an available address. The pop-up message This address is free, do you want
to assign it? opens.
d. Click on OK . The wizard Add an IPv4 address opens.
e. If you or your administrator created classes, the list IP address class is visible. Select
a class or None and click on NEXT . The next page of the wizard opens.
f. The field IP address name is gray and empty.
g. The field IP address displays the IP address.
h. In the field MAC address, paste your MAC address.
i. In the field Shortname, name your IP address: it is automatically displayed in the field
IP address name.
j. Click on NEXT . The page Aliases configuration opens. There is nothing to set up in this
page when you are simply assigning an IP address to an interface. For more details,
refer to the section Configuring and Managing IP Address Aliases.
k. Click on OK to commit your assignment. The page IPv4 addresses is visible again and
the IP address is listed as used, named and has a MAC address.
If the report page displays the warning message MAC address already used. (Space:
..., Address: ....), on as many lines as IP address(es) used on the interface, click on OK
to commit the addition of the extra IP address on the interface. To cancel the assignment,
click on CLOSE . To modify the MAC address, click on PREVIOUS . The Aliases configuration
page opens first, click on PREVIOUS again to open the page Add an IPv4 address where
you can make the needed changes.
Assigning IPv6 Addresses to an Interface

With IPv6 addresses, the interface assignment also involves going through the IPAM module
and editing the interface within Device Manager. However, we recommend that you make sure
the MAC address of the interface using this IPv6 address is present among the NetChange dis-
covered items. That way it is directly detected by Device Manager.
To assign an IPv6 address to an interface using its MAC address
a. Go to the Device Manager tab. If the homepage is not displayed, click on . The
homepage opens.
b. Click on Ports & interfaces. The page All ports & interfaces opens.
c. Order the list by MAC address. The interfaces are listed first.
906
IPAM
d. Right-click over the Name of the interface of your choice. The contextual menu opens.
e. Click on . The interface properties page opens.
f. In the panel Main properties, copy the MAC address.
2. Within NetChange
a. Go to the NetChange tab. If the homepage is not displayed, click on . The homepage
opens.
b. Click on Discovered items. The page All discovered items opens.
c. In the search engine of the column Interco, click on to remove the default filter.
d. In the search engine of the column MAC Address, paste your address to make sure it
is part of NetChange items.
e. On your keyboard, hit Enter. If the MAC address is listed, go to the next step. If it is not
listed, go back to step 1 and find an interface that is part of the list All discovered items.
3. Within the IPAM module
b. Click on Addresses (v6). The page All addresses opens. The button V6 in the upper
right corner is blue.
c. Click on an available address. The pop-up message This address is free, do you want
to assign it? opens.
d. Click on OK . The wizard Add an IPv6 address opens.
e. If you or your administrator created classes, the list IP address class is visible. Select
a class or None and click on NEXT . The next page of the wizard opens.
f. The field IP address name is gray and empty.
g. The field IP address displays the IP address.
h. In the field MAC address, paste your MAC address.
i. In the field Shortname, name your IP address: it is automatically displayed in the IP
address name field.
j. Click on NEXT . The page Aliases configuration opens. There is nothing to set up in this
page when you are simply assigning an IPv6 address to an interface. For more details,
k. Click on OK to commit your assignment. The report opens and closes. The IPv6 ad-
dresses list opens again and the IP address is listed as used, named and has a MAC
address.
If the report page displays the warning message MAC address already used. (Space:
..., Address: ....), on as many lines as IP address(es) used on the interface, click on OK
to commit the addition of the extra IP address on the interface. To cancel the assignment,
click on CLOSE . To modify the MAC address, click on PREVIOUS . The Aliases configuration
page opens first, click on PREVIOUS again to open the page Add an IPv6 address where
you can make the needed changes.
907
IPAM
a. Go back to the Device Manager tab. The interface properties page opens.
b. Click on EDIT . The wizard Edit a port/interface opens.
c. Click onOK to update the information.The report opens and closes. In the panel Interface
attachments, the IPAM section regarding v6 addresses is updated and display the new
IP address information. The address is visible in the list All ports & interfaces.
You can use the procedure above for as many IP addresses as needed for one interface. Beyond
one IPv6 address, the addition wizard displays a report step listing the IP addresses already used
on this interface to make sure that you actually want to use an extra IP address.
Managing the IP Addresses / Interfaces Link from the IPAM

From the page All addresses, you can associate IP addresses to existing interfaces. You can
either use advanced properties to provide a link between them or a dedicated option in the menu
Edit. This menu also provides an easy way to break the link between an IP address and an inter-
face.
The columns Device manager name and Device manager interface allow to display the interactions
on that page. For more details regarding columns display, refer to the section Customizing the
List Layout.
Any ports and interfaces changes made from the IPAM change the content of the column
Manually linked to. For more details, refer to the section Tracking Changes on the Page All ports
& interfaces.
Using Advanced Properties to Associate IP Addresses with Interfaces

You can associate IP addresses to existing interfaces directly from the IPAM page All addresses.
First, you need to display the relevant advanced property via the wizard Advanced properties
customization.

Enable to link IP addresses with existing devices Device name
Interface name
To display the IP address/interface link advanced properties at IP address level
5. In the IPAM / Device Manager interaction section, tick the box Enable to link IP addresses
with existing devices.
again.
908
IPAM
Once you set the advanced properties display, the fields Device name and Interface name allow
to link the IPv4 or IPv6 addresses you add or edit with existing interfaces.
To link an IP address with an interface using advanced properties
4. Add or edit an IP address to display the Device Manager dedicated fields. The wizard opens.
For more details regarding IP address addition or edition, refer to the chapter Managing IP
Addresses.
properties:
a. In the field Device name, type in the name or part of the name of an existing device.
The auto-completion retrieves a list of devices matching this name that you can choose
from.
b. In the field Interface name, type in the name or part of the name of an existing interface.
The auto-completion retrieves a list of interfaces matching this name that you can choose
from. Once you selected an interface, its name is displayed as follows: <interface name>
(<device name> - <number of IP addresses associated with the interface>).
If you do not specify an interface, the IP address is only associated with the device,
whose name is displayed on the IP address properties page.

IP Address Aliases.
The changes are visible on the IP address properties page, in the panel Advanced properties,
and in the columns Device manager name and Device manager interface. Click on the device
or interface name to access its properties page in Device Manager.
Using the Menu to Manage the IP Addresses / Interfaces Link

From the page All addresses menu, you can set up, edit or remove links between your IP ad-
dresses and an existing Device Manager interface.
Linking IP Addresses with Existing Interfaces
Once you assigned IP addresses, you can link them to the existing device and interface of your
choice through the menu. The wizard also allows you to edit, i.e. overwrite, an existing link
between the IP address and an interface.
The auto-completion provided in the device name and interface name only lists the device and
interfaces marked as Managed and Imported. The Unmanaged items are not listed.
To link an IP address and an interface using the menu
909
IPAM

4. Tick the IP address(es) of your choice.
5. In the menu, select Edit > Link IP addresses to Device Manager interfaces. The wizard Link
IP addresses to Device Manager interfaces opens.
6. Set the link following the table below.
Table 65.2. IP Address / Interface link configuration

Field Description
Device name Type in the name or part of the name of an existing device. The auto-completion re-
trieves a list of devices matching this name that you can choose from.
Interface name Type in the name or part of the name of an existing interface. The auto-completion
retrieves a list of interfaces matching this name that you can choose from. Once you
selected an interface, its name is displayed as follows: <interface name> (<device
name> - <number of IP addresses associated with the interface>).
Overwrite Tick this box to edit an existing link and overwrite it with a link to the device and inter-
face you specified in the above fields.
7. Click on OK to commit the link configuration. The report opens and closes. The list All ad-
dresses is visible again.The changes are visible in the dedicated columns, on the IP address
properties page and in Device Manager.
Removing the Link Between IP Addresses and Interfaces
Once you set a link between an IP address and an interface, you can remove it using the menu
provided that no MAC address was used when assigning the IP address. If your IP address
was assigned a MAC address, you need to edit the IP address, remove the MAC address and
then follow the procedure below to remove the link with the interface. For more details regarding
IP address edition, refer to the section Editing an IP Address.
To remove an IP address / interface link using the menu
4. Tick the IP address(es) of your choice.
5. In the menu, select Edit > Remove IP addresses / Device Manager interfaces link. The
wizard Link IP addresses to Device Manager interfaces opens.
6. Set the link following the table below.
Table 65.3. IP Address / Interface link configuration

Field Description
Device name Type in the name or part of the name of an existing device. The auto-completion re-
trieves a list of devices matching this name that you can choose from.
Interface name Type in the name or part of the name of an existing interface. The auto-completion
retrieves a list of interfaces matching this name that you can choose from. Once you
selected an interface, its name is displayed as follows: <interface name> (<device
name> - <number of IP addresses associated with the interface>).
Overwrite Tick this box to edit an existing link and overwrite it with a link to the device and inter-
face you specified in the above fields.
910
IPAM
7. Click on OK to commit the link configuration. The report opens and closes. The list All ad-
dresses is visible again.The changes are visible in the dedicated columns, on the IP address
properties page and in Device Manager.
Editing the Link Between IP Addresses and Interfaces
Once you set up a link between an IP address and an interface, you can edit it to link the IP ad-
dress with a different interface.
First, as detailed in the section Linking IP Addresses with Existing Interfaces, you can simply
specify a device and interface and tick the box Overwrite.
Second, if the IP address was assigned a MAC address, you can simply edit the MAC address
to link the IP address with another interface. For more details regarding IP address edition, refer
to the section Editing an IP Address.
Editing the Devices Topology from the IPAM

You can manage the devices topology from the IPAM page All addresses, that is to say edit the
link between an interface with another device port.
Note that:
• When adding an IP address, you need to tick the device addition or association property to
allow users to first set the link between the IP address and the interface and then see the Link
with device and Link with interface fields.
• When editing an IP address, the related fields are displayed when you edit an IP address only
if the IP address is already associated with a device and an interface.
First, you need to enable the relevant advanced property via the wizard Advanced properties
customization.

Enable to edit the devices topology from the IPAM Link with device
Link with port
To display the devices link advanced properties at IP address level
5. In the IPAM / Device Manager interaction section, tick the box Enable to edit the devices
topology from the IPAM.
again.
911
IPAM
Once you set the advanced properties display, the fields Link with device and Link with port allow
to link the IPv4 or IPv6 addresses you are adding or editing with any port on the device of your
choice.
To link devices from the IPAM
4. To set a link between devices, add an IP address. The wizard opens. For more details re-
garding IP address addition or edition, refer to the chapter Managing IP Addresses.
5. To edit the topology, edit an IP address already associated with an interface to display the
Device Manager dedicated fields. The wizard opens. For more details regarding IP address
addition or edition, refer to the chapter Managing IP Addresses.
properties:
a. In the field Link with device, type in the name of an existing device. The auto-completion
retrieves a list of devices matching this name.
b. In the field Link with port, type in the name of an existing port. The auto-completion
retrieves a list of ports matching this name. Once you selected an interface, its name
is displayed in the field along with the device.

IP Address Aliases.
The changes are visible on the page All ports & interfaces, in the column Manually linked
to. Therefore, you might need to reconcile the content of the columns Automatically linked
to and Manually linked to. For more details, refer to the section Tracking Changes on the
Page All ports & interfaces.
912
Chapter 66. Rules Impacting Device
Manager
From the module Administration, you can add, enable or disable rules related to Device Manager.
DHCP Rules Impacting Device Manager

The DHCP can interact directly with Device Manager thanks to two rules.These rules automatically
create devices containing an interface every time you add a static or lease.
Note that the rules are first organized by modules ans then event, so even if they both ultimately
impact Device Manager, you will find them under the module DHCP and the event Add: <DHCP-
object>.
Rule 221
Enabling this rule creates an interface every time you add a static, with or without an IPv4
address. The interface has the same name as the static and belongs to a device also named
after the static. To add this rule, refer to the procedure To add a Device Manager rule and
select the Module DHCP and the Event Add: DHCP statics.
Rule 225
Enabling this rule creates an interface every time an IPv4 lease is generated. The interface
is named generic_# and belongs to a device named using the lease hostname. To add this
rule, follow the procedure To add a Device Manager rule and select the Module DHCP and
the Event Add: DHCP leases.
Adding Device Manager Rules

From the page Rules, you can add the rules of your choice. By default, none of Device Manager
related rules are added.
To add a Device Manager rule
opens.
3. In the menu, select Add > Rule. The wizard Add a rule opens.
4. In the drop-down list Module, select the module that triggers the needed behavior. The rules
impacting Device Manager are listed in the section DHCP Rules Impacting Device Manager.
5. In the drop-down list Event, select the action in the selected module that triggers the beha-
vior.
6. In the list Rule, select the rule of your choice. Each rule is listed as follows: (<rule-number>)
<rule-name>.
7. In the Rule name, name the rule. This name is displayed in the column Instance and help
you filter the list without using the rule number.
8. In the field Comment, you can type in a comment.
913
Rules Impacting Device Manager
10. Click on OK to commit the rule addition. The report opens and closes. The rule is listed and
marked OK in the column Status.
Enabling or Disabling Device Manager Rules

At any time, you can enable or disable a rule, only the enabled rules are executed
To enable/disable Device Manager rules
opens.
3. In the search engine of the column Rule #, type in the partial or complete rule(s) number
and hit Enter to filter the list.
4. Tick the rule(s) of your choice.
rule is marked OK or Disabled.
914
Part XI. VLAN Manager
VLAN Manager allows to create and handle Virtual Local Area Networks (VLANs) and set up layer 2 data
exchange between networks and devices.
You can connect VLANs and organize IPAM subnet-type networks belonging to different spaces or networks
using MAC addresses, therefore any device and network can be linked no matter their IP address.
Keep in mind that the VLAN Manager VLANs are different from the VLAN interfaces you can set up on the
page Network configuration. For more details, refer to the section Setting up a VLAN Interface.
VLAN ID: 100

VLAN Name: DC
Network Name: floor2

Network Address: 10.34.15.0/24
Network Name: DC1

Network Address: 10.88.122.0/24
Network Name: floor1 VLAN ID: 1

Network Address: 10.34.2.0/24 VLAN Name: Atrium
Figure 212. Example of a VLAN associating two subnet-type networks
VLAN Manager has a dedicated module. From its dashboard, or homepage, you can access its hierarchy.
Figure 213. The VLAN Manager dashboard
VLAN Manager can include up to 3 levels of organization:
• Domains: the highest level of the hierarchy. They contain ranges and VLANs. For more details, refer to
the chapter Managing VLAN Domains.
• Ranges: an optional second level in the hierarchy. They contain VLANs. For more details, refer to the
chapter Managing VLAN Ranges.
• VLANs: the lowest level of the hierarchy. They have a unique with a VLAN Identifier (ID) and belong to
a domain or range. For more details, refer to the chapter Managing VLANs.
In addition, you can:
• Set up the interaction with the IPAM. For more details, refer to the chapter Managing the IPAM/VLAN
Interaction.
Chapter 67. Managing VLAN Domains
Within VLAN Manager, the domains constitute the highest level of the hierarchy. They can be
composed of VLAN ranges and VLANs or exclusively of VLANs depending on your organizational
needs.
To organize your VLANs you need at least one domain but you can add as many as you want.
A domain can contain between 1 and 4094 VLANs, this number corresponds to the VLAN ID.
Each domain then contains a set of VLANs listed through their identifier.
Every time you add a domain, you can set the same set of IDs. They are duplicated on the page
All VLANs, and even if you have several VLANs with the ID 1, they are different. Indeed, they do
not belong to the same domain or range and might finally be assigned different names.
Browsing VLAN Domains

To manage your VLANs it is required to have at least one domain.
RANGE
DOMAIN
VLAN
Figure 67.1. The domain in VLAN Manager hierarchy
Browsing the VLAN Domains Database

To display the list of VLAN domains
opens.
2. In the breadcrumb, click on All domains. The page All domains opens.
To display a VLAN domain properties page
opens.
3. At the end of the line of the domain of your choice, click on . The properties page opens.
Customizing the Display on the Page All Domains

Adding VLAN Domains

Adding a domain sets the number of VLANs that you manage. You can set the start and end
VLAN ID of your choice; for instance, you can choose to manage the VLANs 25 to 500.
916
Managing VLAN Domains
Note that you can also import domains from a CSV file. For more details, refer to the section
Importing VLAN Domains.
To add a VLAN domain
opens.
3. In the menu, select Add > Domain. The wizard Add a VLAN domain opens.
4. If you or your administrator created classes at the domain level, in the list Domain class,
select a class or None. Click on NEXT . The last page of the wizard opens.
5. In the field Domain, name your VLAN domain.
6. In the field Description, you can add a description. This field is optional.
7. In the field Start VLAN ID, type in the number of your choice (between 1 and 4094) to set
the ID of the first VLAN managed through the domain. By default, 1 is displayed in the field.
8. In the field End VLAN ID, type in the number of your choice (between 1 and 4094) to set the
ID of the last VLAN managed through the domain. This also defines the number of VLANs
in the domain, depending on the Start VLAN ID you just chose. By default, 4094 is displayed
in the field.
9. Click on OK to commit the addition. The report opens and closes. The domain is listed, in
the Start ID and End ID fields you can see the ID of first and last VLANs of the domain.
Editing VLAN Domains

Editing a domain means renaming it or changing its description field: edit, add or remove the
description.
Once created, you cannot change its start and end ID, if it does not match your needs anymore.
In this case, create a new one, assign the same name to the VLANs it contains if need be, and
finally delete the obsolete domain; or export the VLANs and reimport them in the new domain.
You can edit a VLAN domain from the right-click contextual menu of the page All domains or
from its properties page.
To edit a VLAN domain
opens.
3. Right-click over the Name of the domain you want to edit. The contextual menu opens.
4. Click on . The wizard Add a VLAN domain opens.
5. If you or your administrator created classes at the domain level, in the list Domain class,
select a class or None. Click on NEXT . The last page of the wizard opens.
917
Managing VLAN Domains
6. Edit the Domain and/or field Description according to your needs.
7. Click on OK to commit the changes. The report opens and closes. The domain is listed with
the changes you just made.
Deleting VLAN Domains

Deleting a domain is only possible if it does not contain any range or VLANs that were assigned
a name. You cannot delete a domain that has Used VLANs.
To delete a VLAN domain
opens.
3. Tick the domain(s) you want to delete.
5. Click on OK to commit the domain(s) deletion. The report opens and closes. The domain is
no longer listed, the VLANs it contained are deleted as well.
Defining a VLAN Domain as a Group Resource

Adding a VLAN domain as one of the resources of a specific group allows the users of that group
to manage the VLAN domain(s) in question as long as they have the corresponding rights and
Granting access to a domain as a resource also grants access to every item it contains. For more
918
Chapter 68. Managing VLAN Ranges
Within VLAN Manager, the ranges constitute the second level of the hierarchy. They are optional.
Contrary to the domains, the ranges start and end ID can be modified.
You can add ranges in your VLAN domains to polish your VLANs organization. A VLAN range
can contain as many VLANs as the domain it belongs to, as long as the VLAN IDs match. A
range contains a number of the VLANs of a specific domain, these VLANs can be identified
through their ID. Therefore, you cannot create a range with the start and end ID 5-10 if your domain
start and end IDs are 6-10.
Within a domain, you can create as many ranges as you want. The first range created manages
VLANs of the domain. You can add extra ranges managing the same VLAN IDs: the VLANs are
different as they belong to different ranges.
Browsing VLAN Ranges

You can create ranges to set up an extra level of management for your VLANs.
RANGE
DOMAIN
VLAN
Figure 68.1. The range in VLAN Manager hierarchy
Browsing the VLAN Ranges Database

To display the list of VLAN ranges
opens.
To display the list of ranges of a specific domain
opens.
3. In the Name column, click on the name of the domain of your choice to display the VLANs
it contains.
4. In the breadcrumb, click on click on All ranges. The page All ranges of the selected domain
opens.
To display a VLAN range properties page
opens.
919
Managing VLAN Ranges
Customizing the Display on the Page All Ranges

Adding VLAN Ranges

You can create as many ranges as you need. Keep in mind that, if you set several ranges with
common VLANs, the VLAN IDs are replicated on the page All VLANs with only their range and
potentially assigned name to differentiate them.
If you want to create range with unique sets of VLAN ID, you can tick the box No ID overlapping
when adding the range. Keep in mind that the overlap restriction applies whether it was set on
existing ranges or ranges you are trying to create. Therefore, if a range manages the VLAN IDs
1-512 already exists and you try to create the range 512-550: an error message appears on the
wizard Report page whether the box was ticked on the existing range or on the new range creation
wizard.
Note that you can also import ranges from a CSV file. For more details, refer to the section Im-
porting VLAN Ranges.
To add a VLAN range
opens.
3. In the menu, select Add > Range. The wizard Add a VLAN range opens.
4. If you or your administrator created classes at the range level, in the list Range class, select
5. In the list Domain, select the domain of your choice.
7. In the field Range, name your VLAN range.
8. In the field Description, you can add a description. This field is optional.
9. In the field Start VLAN ID, type in the number of your choice (between 1 and 4094) to set
the ID of the first VLAN managed through the domain. By default, 1 is displayed in the field.
10. In the field End VLAN ID, type in the number of your choice (between 1 and 4094) to set the
ID of the last VLAN managed through the domain. This also defines the number of VLANs
in the domain, depending on the Start VLAN ID you just chose. By default, 4094 is displayed
in the field.
11. The box No ID overlapping is ticked by default, you can untick it if you want to create the
same VLAN ID in several ranges.
12. Click on OK to commit the addition. The report opens and closes. The range is listed, in the
Start ID and End ID columns you can see the ID of first and last VLANs of the range.
920
Editing VLAN Ranges

Like for the VLAN domains, a range can be renamed and its description can be changed. However,
you can also decide to manage more or less VLANs in a range through the Resize ranges option.
Changing a Range Properties

Editing a domain means renaming it or changing its description field: edit, add or remove the
description.
You can edit a VLAN range from the right-click contextual menu of the page All ranges or from
its properties page.
To edit a VLAN domain from the properties page
opens.
4. In the panel Main properties, click on EDIT . The wizard Add a VLAN range opens.
5. If you or your administrator created classes at the range level, in the list Range class, select
6. Edit the fields Domain, Description and/or No ID overlapping according to your needs.
7. Click on OK to commit the changes. The report opens and closes. The range is listed with
the changes you just made.
Changing a Range Size

VLAN Manager provides an option only at range level that allows to change the number of VLANs
managed. You can decide to manage more or less VLANs, i.e. VLAN IDs. This option basically
shifts the VLAN identifier number to add IDs to the VLAN range or remove some IDs.
This option respects a set of rules:
1. You cannot reduce the size of a range if it contains Used VLANs (i.e. VLAN that were assigned
a name and might therefore be linked to a subnet-type network in the IPAM)
2. You can extend the size of a range as much as you want provided that:
• The new range size is not greater than the domain it belongs to.
If you want a range to manage the IDs 10-20, instead of the 10-15 it is currently managing,
this cannot work if the domain manages the 1-15. You would be asking to manage IDs that
do not exist in the domain.
• The shift in ID that you set does not include Used VLAN belonging to another range: the
overlap is impossible.
921
In case of overlap, you can either delete the used VLAN and recreate it in the new range or export
it and reimport it in the new range.
To resize a VLAN range
opens.
3. Tick the range(s) that you want to resize.
4. In the menu, select Edit > Resize ranges. The wizard Resize ranges opens.
5. In the Start ID shift, type in the shift value. Any number typed in is added to the current range
Start ID. If you want to extend the number of IDs managed, type in - before the number. If
you do not want to change the Start ID, type in 0.
6. In the End ID shift, type in the shift value. Any number typed in is added to the current range
Start ID. If you want to reduce the number of IDs managed, type in - before the number. If
you do not want to change the End ID, type in 0.
7. Click on OK to commit the changes. The report opens and closes. The range is listed with
the new start and end ID.
Deleting VLAN Ranges

Deleting a range is only possible if the VLANs it contains were not assigned a name. You cannot
delete a range that has Used VLANs.
To delete a VLAN range
opens.
3. Tick the range(s) you want to delete.
5. Click on OK to commit the domain(s) deletion. The report opens and closes. The range is
no longer listed, the VLANs it contained are deleted as well.
Defining a VLAN Range as a Group Resource

Adding a VLAN range as one of the resources of a specific group allows the users of that group
to manage the VLAN range(s) in question as long as they have the corresponding rights and
Granting access to a range as a resource also grants access to every item it contains. For more
922
Chapter 69. Managing VLANs
Within VLAN Manager, once you created one or several domains or even a set of ranges, the
VLANs are the lowest level of the hierarchy. They are identified through their ID and can be as-
signed a name. This name is used to interact with the IPAM module at network level to set up a
channel of communication between several subnet-type networks or devices. Which is why, once
they have a name, the range and/or domain they belong to cannot be deleted.
Managing VLANs implies assigning them a name to be used in the IPAM module to help you
organize the interaction between several networks or devices within a network.
Browsing VLANs
RANGE
DOMAIN
VLAN
Figure 69.1. The VLAN in VLAN Manager hierarchy
Browsing the VLANs Database

To display the list VLANs through the breadcrumb
1. Go to the VLAN Manager tab.

2. In the breadcrumb, click on All VLANs. The page All VLANs opens.
To display the list of VLANs of a specific VLAN domain
opens.
3. In the column Name, click on the name of the domain of your choice to display the VLANs
it contains.
To display a VLAN range properties page
opens.
3. At the end of the line of the VLAN of your choice, click on . The properties page opens.
Customizing the Display on the Page All VLANs

Understanding the VLAN Statuses

The column Status provides information regarding the VLANs you manage.
923
Managing VLANs
Table 69.1. VLAN statuses

Status Description
Free The VLAN can be assigned a name.
Used The VLAN already has a name and can therefore interact with the IPAM.
Adding VLANs
Considering that the list of VLANs of a specific domain are added at the same time as the domain
itself, and that the ranges only manage VLANs within that domain, the Add option on the page
All VLANs is not an addition per se. It allows to set as Used the VLAN and assign it a name if
need be.
Note that you can also import VLANs from a CSV file. For more details, refer to the section Im-
porting VLANs.
To add a VLAN from the menu
opens.
3. In the menu, select Add > VLAN. The wizard Add a VLAN opens.
4. In the list Domain, select the domain of your choice.
6. In the list Range, select the range of your choice or none.
8. In the field VLAN name, name the VLAN. This field is optional.
9. In the column VLAN ID, type in the VLAN ID of the VLAN to which you want to assign this
name.
10. Click on OK to commit the name assignment. The report opens and closes. The page re-
freshes and the VLAN is now listed and marked as ? Used. If you gave it a name, it is dis-
played in the Name column.
If you are assigning a VLAN within a domain or a range, the procedure is shorter as the list Domain
and/or Range is not displayed.
To add a VLAN from the listing page
opens.
4. In the column VLAN ID, click on the VLAN of your choice. The wizard Add a VLAN opens.
5. In the field VLAN name, name the VLAN. This field is optional.
6. In the field VLAN ID, the VLAN ID of the VLAN you chose is displayed in gray.
7. Click on OK to commit the changes.The report opens and closes.The VLAN is listed, marked
as ? Used and has a name in the Name column if you gave it one.
924
Managing VLANs
Editing VLANs
You can change a VLAN name from its properties pages. Keep in mind that changing the VLAN
name breaks the IPAM / VLAN interaction.
To rename a VLAN
opens.
4. Click on the name of the Used VLAN you want to edit. The properties page opens.
5. In the panel Main properties, click on EDIT . The wizard Add a VLAN opens.
6. In the field VLAN name, rename the VLAN.
7. Click on OK to commit the changes. The report opens and closes. The new VLAN name is
Deleting VLANs
There are two kinds of VLANs: unused ones and used ones.
Considering that the unused VLAN are merely listed on the page All VLANs, you cannot delete
them. To remove them from the list, you must delete the range and/or domain they belong to.
The used VLANs have a name and are marked as Used in the status column. Before deleting
them, keep in mind that:
• Once deleted, they are still listed but no longer have a name.
• If the VLANs were associated with a subnet-type network, deleting them breaks this association
and removes the VLAN information from the network properties. For more details, refer to the
To delete a VLAN name
opens.
3. Tick the VLAN(s) which assigned name you want to delete.
5. Click on OK to commit the VLAN assigned name deletion. The report opens and closes. The
VLAN is listed but no longer has a name in the Name column and its status is now Free.
925
Chapter 70. Managing the IPAM/VLAN
Interaction
The purpose of VLAN Manager is to create and control the interaction between virtual local area
networks and your IPAM subnet-type networks. Within the IPAM module, this interaction is
managed at network level through the advanced properties and can be set both from IPv4 and
IPv6 networks.
Displaying the IPAM/VLAN Interaction Advanced Properties

There are two advanced properties that the administrators (members of the group admin) can
configure and make visible to standard users:
• Associate a subnet-type network with an existing VLAN.

• Create the VLAN associated with a subnet-type network.
Like any advanced property, you need to display the relevant advanced property via the wizard
Advanced properties customization.
Table 70.1. IPAM/VLAN interaction advanced properties

Display the VLAN association fields VLAN domain
VLAN range
VLAN ID
Display the field "Create a VLAN" Create a VLAN
To configure VLAN advanced properties
5. In the section IPAM/VLAN interaction, tick the box Display the VLAN association fields.
The box Display the field "Create a VLAN" appears.
6. Tick the box Display the field "Create a VLAN".
7. Click on OK to commit the configuration. The report opens and closes. The page All networks
is visible again.
Follow this procedure on the IPv4 and IPv6 pages if you want to set it up for IPv4 and IPv6
terminal subnet-type networks.
Once you set the advanced properties display, you can configure the interaction.
926
Managing the IPAM/VLAN Interac-
tion
Configuring the IPAM/VLAN Interaction

Once the properties are displayed, the interaction fields are available in the subnet-type networks
addition/edition wizards in IPv4 or IPv6.
To make two networks communicate, you must configure them with a common VLAN. That
configuration enables them send/receive packets, etc. no matter what block-type network either
network belongs to. The network/VLAN interaction can be set between a terminal or a non-
terminal subnet-type network and a VLAN.
To link a subnet-type network to an existing VLAN
4. Add or edit a subnet-type network. The corresponding wizard opens. For more details regard-
ing the first steps of addition or edition, refer to the chapter Managing Networks.
If you edit an existing non-terminal subnet-type network that contains terminal net-
works, linking it to a VLAN does not link the networks it contains to the VLAN.
5. On the last page of the wizard, in the section IPAM/VLAN interaction, associate your subnet-
type network with a VLAN:
a. In the drop-down list VLAN domain, select the VLAN domain containing the VLAN you
want to associate with your subnet-type network.
b. In the drop-down list VLAN range, select the value that suits you needs:
Table 70.2. Available options in the drop-down list VLAN range

Option Description
<range-name> Select the name of an existing range to narrow down the auto-complete search
of the field VLAN ID.
None Use this option if there is no range in the domain or if the VLAN you are looking
for is not managed by a range.
All Use this option if you do not know in which range is the VLAN you are looking
for. This option is not available if several ranges in your domain have the same
VLAN ID assigned, even if they have a different name.
c. In the field VLAN ID, type in the first digit(s) of the ID of the VLAN you are looking for.
This field auto-completes and displays the matching VLAN in the field or provides a list
of the matching VLAN IDs (partially or entirely).
The VLAN is displayed as follows: <VLAN_ID> (<VLAN_name> - <range_name>).

Where <range_name> can be replaced by #, if there is no range.
6. Click on OK to commit your changes/configuration. The report opens and closes. The VLAN
configuration is visible on the network properties page in the panel Advanced properties.
To create and link a VLAN to a subnet-type network
927
tion

4. Add or edit a subnet-type network. For more details, refer to the chapter Managing Networks.
The corresponding wizard opens.
5. On the last page of the wizard, in the IPAM/VLAN interaction section, associate your subnet-
type network with a VLAN:
a. In the drop-down list VLAN domain, select the VLAN domain of your choice.
b. In the drop-down list VLAN range, select a VLAN range; none if there is no range in the
domain; or all if you don't want to pick a range.
c. Tick the box Create a VLAN. The field VLAN name appears.
d. In the field VLAN ID, type in the ID of the VLAN you want to create or type in the first
digit of the ID: the field auto-completes and provides you with the list of all the available
IDs in the domain or range you selected.
The VLAN ID is displayed as follows: <VLAN_ID> (<range_name>). Where

<range_name> can be replaced by #, if the VLAN is not managed through a range.
e. In the field VLAN name, you can name the VLAN.
6. Click on OK to commit your changes/configuration. The report opens and closes. The VLAN
configuration is visible on the network properties page in the panel Advanced properties.
Once the association is set, you can display it in the page All networks in IPv4 and IPv6 using
the wizard Listing template: the columns VLAN Domain, VLAN Range, VLAN name and VLAN
ID can be displayed in any listing template. For more details, refer to the section Customizing the
List Layout.
Removing the IPAM/VLAN Interaction

At any time, you can remove the IPAM/VLAN interaction. There are two ways of proceeding:
1. Removing the association of one subnet-type network with a VLAN from the IPAM module.
2. Removing the association of a VLAN with all its subnet-type networks from the VLAN Manager
module.
To remove the link between one subnet-type network and a VLAN
4. Using the right-click contextual menu, edit the subnet-type network of your choice. The wizard
opens.
5. If you or the your administrator created classes, the page Network class opens.
6. Click on NEXT . The last page opens.
7. In the drop-down list VLAN domain, select None. The fields VLAN range and VLAN ID are
no longer visible.
8. Click on OK to commit your changes. The report opens and closes. On the network properties
page, the VLAN configuration details of the panel Advanced properties are set to None.
928
tion
To remove a VLAN association with all subnet-type networks at once
opens.
3. Tick the VLAN(s) which assigned name you want to delete.
5. Click on OK to commit the VLAN assigned name deletion. The report opens and closes. The
VLAN is listed but no longer has a name in the Name column and its status is now Free.
On the properties page of each of the networks that were associated with it, the VLAN con-
figuration details of the panel Advanced properties are set to None.
929
Part XII. Rights Management
Managing users, groups and their authentications is an essential part of SOLIDserver configuration. Users
can access any module if they belong to a group that has sufficient resources and permissions. For that
reason, configuring user access requires to:
1. Add or import users.

2. Create a group of users.
3. Configure that group with users. At group level, the users are managed as Resources, you must add
them as group resource.
4. Configure that group with the permissions that suit your needs. From the properties page of a group you
can define which operations its users can perform (add IPAM networks, delete DHCP statics, move DNS
zones...).
5. Configure that group with actual resources, i.e. existing objects from any module. Without objects as
Resources, the users of the group can perform operations but cannot perform them on anything.
In addition, you can configure rules to authenticate external users.
Rights
display: space
add: network
edit: network
delete: network display: space
...
display: network
IPAM
edit: pool
add: address Resources
Group A ...
IPAM
Group B
display: server
display: scope
edit: range
delete: range
...
DHCP
Group C
Figure 217. The rights and resources of a user depend on the group they belong to
From the module Administration, the hierarchy of Rights Management can include up to 3 levels:
• Groups: the highest level of the hierarchy. The groups contain resources, users and objects. For more
details, refer to the chapter Managing Groups.
• Authentication Rules: an optional second level. The rules define if external AD, RADIUS and LDAP
users can access SOLIDserver. These rules allow to retrieve user credentials stored in the corresponding
remote directory and to secure remote authentications.The authenticated users are granted the permissions
defined by the group they belong to. For more details, refer to the chapter Managing Authentication Rules.
• Users: the lowest level of the hierarchy. You can manage local and external users on one page. Once
created, you can set them as resource of a group to manage their access rights and restrictions. For more
details, refer to the chapter Managing Users.
Note that the superuser, ipmadmin, is granted all permissions by default and has access to all existing objects.
They belong to the most privileged group, admin.
Chapter 71. Managing Groups
The groups of users define users profiles. Once a set of rights is granted to a group, the users
belonging to that group can perform tasks on the resources of the group (networks, DNS zones,
DNS servers...) and nothing else. In other words, the group of users delegate administrative
rights to users. Typically, you would create a group, add resources to the group and grant it a
set of services, also called rights or permissions. These steps would create a profile that apply
to the users you manage through the group.
The number of groups is unlimited. You can therefore create as many groups as user profiles as
you want. For more details regarding users addition, refer to the chapter Managing Users.
From the Groups page you can have full control over the groups of users (users, resources and
rights) except to the group admin as it has access to everything by default and cannot be edited.
The groups can manage remote users which authentication is based RADIUS, Microsoft Active
Directory or LDAP directory. For more details regarding users secure authentication, refer to the
chapter Managing Authentication Rules.
Browsing Groups of Users

As far as rights management is concerned, the groups of users constitute the highest level and
most important element of the rights delegation management.
AUTHENTICATION
GROUP OF USER
USERS
RESOURCE
SERVICE
Figure 71.1. The group of users in the rights management hierarchy
By default, the group admin is listed on the page. It manages ipmadmin, also called the superuser
as it has all the rights over all the resources available to management in SOLIDserver. Any user
added as resource of this group shares the same rights as ipmadmin.
Browsing the Groups Database

To display the list of groups of users
opens.
931
Managing Groups
To display a group of users properties page
opens.
Customizing the Display on the Page Groups

Adding Groups of Users

You can add as many groups as you need. For each group you can then define users, resources
and rights.
Note that you can also import groups pf users from a CSV file. For more details, refer to the
chapter Importing Groups of Users.
We strongly suggest that you configure your group of users profiles before enabling the
remote authentication rules. Once the authentication rules are enabled, the corresponding
users can log in SOLIDserver. This goes especially for AD authentication: once the rule is enabled,
any AD user can log in the appliance. If you created a group of users named after the AD group
the users belong to, SOLIDserver automatically creates a user in the GUI and put it in the corres-
ponding group of users. For more details, refer to the chapter Managing Authentication Rules.
To add a group
opens.
4. In the menu, select Add > Group. The wizard Add a group opens.
5. In the list Parent group, select the parent group of your choice or None. The selected parent
group can add users to the group you are creating.
7. If you or your administrator created classes, in the list Group class select a class or None.
Click on NEXT . The last page of the wizard opens.
8. In the field Group name, name the group. If you want users to be authenticated via AD, name
the group after an existing AD group.
932
Managing Groups
10. In the drop-down list Copy rights from group, you can select any group, except admin. The
rights of the selected group are granted to the group you are creating.
This option can be used as a template for standard rights/permissions for regular end users
that you can simply use when creating a group and then adapt to each new group: edit the
group to add or remove rights.
11. Click on OK to commit your creation. The report opens and closes. The group is listed.
Editing Groups of Users

Editing a group means editing the group main properties as well as the group access and restric-
tions. For more details regarding user rights, refer to the section Managing the Permissions of a
Group of Users below.
To edit a group main properties
opens.
4. At the end of the line of the group you want to edit, click on . The properties page opens.
5. In the panel Main properties, click on EDIT . The wizard Edit a group opens.
6. If you or your administrator created classes, in the list Group class select a class or None.
Click on NEXT . The last page of the wizard opens.
7. In the field Group name, name the group. If you want users to be authenticated via AD, name
the group after an existing AD group.
9. In the drop-down list Copy rights from group, you can select any group, except admin, or
None. The rights of the selected group are granted to the group you are adding.
This option can be used as a template when you add new groups. If some rights should be
granted or denied, you can edit the group Rights later on.
visible again and includes the changes in the panel.
Managing the Resources of a Group of Users

In SOLIDserver, the resources represent various objects used in the DNS, DHCP, IPAM and
NetChange modules on which delegation right can be applied. Assigning a resource to a group
allows to display in read-only mode the objects set as resource for the users of a group.
933
Managing Groups
AUTHENTICATION
GROUP OF USER
USERS
RESOURCE
SERVICE
Figure 71.2. The resource in the rights management hierarchy
Following each module internal hierarchy, once an object is set as a resource the whole path in
the internal hierarchy of the module is available for display.
For instance, if you set an IPv4 block-type network as resource for a group, the space containing
the block-type network should be listed once a user of that group connects to SOLIDserver.
Clicking on the space name displays the block-type network set as resource and only that one
no matter how many block-type networks the space contains. Going down in the hierarchy, the
user can display all the networks of the block-type network as well as all the pools and all the
addresses it contains. From that point on, and to continue with the example above, the group
can be given a set of rights on IPv4 block-type networks to allow its users to edit, delete or add
new block-type networks . The users can then add, edit or delete the block-type network they
have in their list of resources as well as the ones they added but not any other block-type network.
Hence the importance of checking in detail the resources of a group and the rights they are
granted.
Understanding Resources
As explained above, setting an object as resource grants access to its container and the objects
it contains in read-only. This provides a clear overview of the object within the network.
To display the resources of a specific group
opens.
4. Click on the name of the group of your choice. The page Resources opens.
Here below is detailed for each object set as group resource, what other objects the users of a
group have access to. It follows the internal hierarchy of each module. Keep in mind that the
complete path toward the object is also available in read-only: if you set a terminal network
as resource, you see its containing network and space as well. However, if the space contains
ten block-type networks you can only see the one parent network of the terminal network listed
among the resources, not the other nine.
IPAM Resources
The resources of the IPAM module can be applied to a group in order to design a delegation
rights according to an organizational scheme. The hierarchy of the resource allows to simplify
934
Managing Groups
the configuration of the delegation. For instance, if a group contains a block-type network among
its resources, its users can display the objects it contains: subnet-type networks, pools, addresses.
For each resource, the users of the group also have access to the properties page. In the panel
Group access, you can list of all the groups that have the object listed as a resource followed by
the permissions of the group over the resource.
Table 71.1. Resources of the IPAM module

Resource Provides access to
Space Block-type network
Subnet-type network
Pools
Address
Block-type network (v6)
Subnet-type network (v6)
Pool (v6)
Address (v6)
a
Block-type network Subnet-type network
Pool
Address
Block-type network (v6) Subnet-type network (v6)
Pool (v6)
Address (v6)
b
Subnet-type network Pool
Address
Subnet-type network (v6) Pool (v6)
Address (v6)
Pool Address
Pool (v6) Address (v6)
a
On the page Resources of a group, the menu refers to block-type networks as Networks (block).
b
On the page Resources of a group, the menu refers to subnet-type networks as Networks.
DNS Resources
The resources of the DNS module can be applied to a group in order to design a delegation of
right according to an organizational scheme. The hierarchy of the resource allows to simplify the
configuration of the delegation. For instance, if a group contains a zone among its resources, it
gives its users access the objects it contains: resource records.
Group access, you can find a list of all the groups that have the object listed as a resource followed
by the permissions of the group over the resource.
Table 71.2. Resources of the DNS module

Server Options (all) including Forwarding, Access control, Notify...
View
Zone
Resource record
935
Managing Groups

Key
Access control List
RPZ rules
View Options (all) including Forwarding, Access control, Notify...
Zone
Resource record
Access control List
RPZ rules
Zone Zone options
Access Control List
Resource record
RPZ rules
DHCP Resources
The resources of the DHCP module can be applied to a group in order to design a delegation of
right according to an organizational scheme. The hierarchy of the resource allows to simplify the
configuration of the delegation. For instance, if a group contains a range among its resources, it
gives its users access the objects it contains: ranges, statics, options.
Table 71.3. Resources of the DHCP module

Server Scope
Range
Static
Group
Failover channel
Option configuration
Option definition
ACL
Server (v6) Scope (v6)
Range (v6)
Static (v6)
Group (v6)
Failover channel (v6)
Option configuration (v6)
Option definition (v6)
Scope Range
Static included in the scope
Option configuration
Scope (v6) Range (v6)
Static included in the scope (v6)
936
Managing Groups

Option configuration (v6)
NetChange Resources
The resources of the NetChange module can be applied to a group in order to design a delegation
of right according to an organizational scheme. The hierarchy of the resource allows to simplify
the configuration of the delegation. For instance, if a group contains a network device among its
resources, it gives its users access the objects it contains: ports, VLANs and discovered items.
Table 71.4. Resources of the NetChange module

Network device Ports
VLANs
Discovered items
VLAN Manager Resources
The resources of the VLAN Manager module can be applied to a group in order to design a del-
egation of rights according to an organizational scheme. The hierarchy of the resource allows to
simplify the configuration of the delegation. For instance, if a group contains a domain among its
resources, it gives its users access the objects it contains: ranges and VLANs.
Table 71.5. Resources of VLAN Manager

VLAN domain VLAN ranges
VLANs
VLAN range VLANs
Administration Resources
In the Administration module, Class Studio classes can be set as resources for the users of the
group admin. Once assigned, the class objects are available to the users of the group.
Table 71.6. Resources of Class Studio

Class Class objects (Class Editor)
Assigning Resources to a Group

Any of the objects listed in the tables above can be used as a resource and assigned to a group.
All the objects, except the classes, follow the addition procedures below.
937
Managing Groups
Once an object is set as a resource, on its properties page the panel Groups access lists all the
groups that have it among their resources. In the same way, the list Resources of each group
displays both its users and resources.
Before assigning resources to a group keep in mind that:
• A group must be configured with resources and the rights (or permissions) to manage them.
Without management rights, its users can see the resources, at most, but cannot edit them,
delete them or add similar objects. For more details, refer to the section Configuring the Groups
Permissions.
• A group managing objects configured with customized classes should have these classes
among its resources. Otherwise, its users cannot see or edit the class parameters and every
time they edit resources configured with this class, they delete the value of all the class para-
meters set for the object.
• A group of users cannot be set as resource of a group. Only users of the group admin can add,
edit their permissions or delete them.
• Users of the group admin have all the rights by default and do not need to be granted specific
rights to assign resources.
You can add objects as resource of a group from the page Resources, the listing page All <object>
or the properties page of an object.
To add resources to a group from the group resources list
opens.
1
4. Click on the name of the group of your choice . The page Resources opens.
5. In the menu, select Add > Resources > <resource-of-your-choice>. The wizard opens.
6. Tick the resources you want to attribute to the group and click on ADD . A confirmation pop-
up window opens.
7. Click on OK to commit the resource(s) addition. The selected resources are no longer listed
in the wizard.
8. Click on CLOSE to get back to the page Resources. The selected resources are listed on the
page.
On the object(s) properties page, the panel Groups access lists the group.
To add resources to a group from a listing page
1. From the listing page of your choice, tick the object(s) you want to set as a resource to a
group.
2. In the menu, select Edit > Rights > Add as group(s) resource(s). The wizard Resources
Management opens.
1
Any group EXCEPT the group admin as, by default, it has authority over all the resources of SOLIDserver database.
938
Managing Groups
3. In the list Available group(s), select a group and click on to add the selected resources
to its Resource list. The group is moved to the list Add to the resources of the group(s).
Repeat these actions for as many groups as needed.
4. In the list Add to the resources of the group(s), the groups that have the selected objects
as resource are listed. You can remove one (or several) group from that list if you do not
want it to have the selected objects as a resource anymore: select the group and click on
. The group is listed back in the list Available group(s).
5. Click on OK to commit your resource addition. The report opens and closes. The page re-
freshes.
To add resources to a group from a resource properties page
1. From the listing page of your choice, display the properties page of the object of your choice
using .
2. In the panel Group access, you can see all the groups that have the object among their re-
sources and the actions what actions they can perform over it. Click on EDIT to add a group
to the list. The wizard Groups opens.
3. In the field Available group(s), select a group and click on to move it to the list Selected
group(s). Repeat this action for as many groups as needed. All the existing groups of users
are listed except admin as all the objects of the database are resources of the group by de-
fault.
4. In the field Selected group(s), the groups that have the object as a resource are listed.
5. Click on OK to commit the resource(s) addition. The report opens and closes. The page re-
freshes and the panel is updated. If you add a group that was already listed, the panel content
stays the same.
Removing Resources from a Group

At any time you can remove objects from a group list of resources. This prevents the users of
the group from accessing them unless a container or lower object of the same hierarchy is listed
among their resources.
For instance, if a group has among its resources the space Local and a network local-terminal-
network, when you decide to remove access to the space, you can remove it from their resources.
Keep in mind that removing the space prevents users from performing operations on the space
but they can still access its content because the network local-terminal-network is still part of
their resources: users have read-only access to the resource path within the module.
Keep in mind that to remove resources from a group, users that do not belong to the group admin
need to be granted the appropriate rights.
To remove a resource from a group
opens.
4. Click on the name of the group for which you want to remove resources. The page Resources
opens.
939
Managing Groups
5. Tick the box of the resource(s) you want to delete.

6. In the menu, select Edit > Delete. The wizard Delete resources opens.
7. Click on OK to commit the resource(s) deletion. The report opens and closes. The selected
resources are no longer listed.
Managing the Permissions of a Group of Users

The permissions, also called rights or services, are applicable for each group of users and are
classified per module.
AUTHENTICATION
GROUP OF USER
USERS
RESOURCE
SERVICE
Figure 71.3. The service in the rights management hierarchy
The group admin is the only one with full administration rights, you cannot edit any panel on this
group properties page as it already has all the permissions, it has access to all the services.
On the group properties page of every group you can find the following panels:
Table 71.7. Available panels on a group of users properties page

Panel Description
Main properties This panel contains the group settings that you configured upon creation.
Report This panel contains a list of all the reports that can be generated in the GUI. Once
moved to the Authorized services list in the wizard, you allow users of the group to
generate the selected reports.
Rights & delegation This panel contains all the rights & delegation related rights. To ease up their man-
agement, they are preceded by a specific page name; if not; the permission granted
applies to any page of SOLIDserver.
DHCP This panel contains all the DHCP related permissions that you can grant end users.
DNS This panel contains all the DNS related permissions that you can grant end users.
VLAN Manager This panel contains all the VLAN Manager related permissions that you can grant
end users.
Workflow This panel contains all the Workflow related permissions that you can grant end
users.
Device Manager This panel contains all the Device Manager related permissions that you can grant
end users.
IPAM This panel contains all the IPAM related permissions that you can grant end users.
NetChange This panel contains all the NetChange related permissions that you can grant end
users.
RIPE This panel contains all the RIPE related permissions that you can grant end users.
Administration This panel contains all the permissions that can be granted on the Administration
module pages. To ease up the management, each service is preceded by the name
of the page it applies.
940
Managing Groups
Panel Description
VRF This panel contains all the VRF related permissions that you can grant end users.
In each panel, you can find a button EDIT that allows you to set the permissions one module at
a time. All the services (also called rights or permissions) listed that you can delegate to groups
of users appear as follows: <action-granted>: <object-concerned>. You can therefore find a set
of verbs corresponding to the action in the menu or wizard preceding the object it applies to.
Table 71.8. Most used permissions on a group of users properties page

Verb Description
Display This service allows the users of the group to display the complete list of objects.
Add This service allows the users of the group to add an object.
Edit This service allows the users of the group to edit an object.
Delete This service allows the users of the group to delete an object.
List This service allows administrators to delegate other administrators rights over a
group of users: rights of groups to add or edit specific objects, groups that can access
specific levels of hierarchy, etc.
Among the permissions you can also find other actions as: Remove, Copy, Copy/Move, Convert,
Split, Migrate, Find, Perform, etc. As well as a set of very specific actions, notably for HSM or
RIPE dedicated operations.
In the Rights & delegation and Administration panels, the verb is preceded by the module or page
concerned as both panels gather rights from everywhere in the appliance.
Permission particularities
Within the group admin:
• All the users, including ipmadmin, have all the existing permissions and rights granted by
default and can therefore perform all the advanced administrating tasks.
Specific access details:

• All the users have access to the User tracking page, where they can display the list of all
the operations they performed in every module they have access to. Granting the User
tracking related right in the Administration panel actually allows the users of a particular
group display the operations performed by all SOLIDserver users.
Configuring the Groups Permissions

From a group properties, you can set the permissions to shape the users of the group profile. By
default upon creation, a group of users has all read permissions. The other rights, to add, edit,
delete... objects must be granted specifically in each module panel of the properties page.
Keep in mind that:
• If you set rights but do not assign resources to the group, the rights granted are useless for
the users of the group. For instance, if you grant a group the right to edit networks but did not
assign them any network, the users of the group have access to the page All networks and to
the menu Edit but cannot see the list of existing networks. Hence the need to grant right AND
assign resources. For more details regarding resources assignment, refer to the section As-
signing Resources to a Group above.
• Only users from the group admin can configure the rights and permissions of a group of users.
941
Managing Groups
To grant permissions to a group
opens.
5. In the panel of your choice, click on EDIT . The wizard Edit group access opens.
Note that when resources are assigned to a group, by default the users of this group have
read-only access to the resources. Access control is only carried out on the rights Add:<re-
source> or Delete:<resource> (read-only access was preserved on certain, specific rights,
such as those relating to the group admin).
6. The Unauthorized services list displays the services that the group is not granted access
to. Select one by one the services you want to grant access to the group and click on .
The service is moved to the Authorized services list.
7. The Authorized services list displays the services that the group has access to. Select one
by one the services you want to deny to a group and click on . The service is moved to the
list Unauthorized services.
8. Once all the services you wanted to grant are present in the list Authorized services, click
on OK to commit your configuration. The report opens and closes. The page refreshes. In
the panel, the list Permissions displays the services granted.
Editing a Group of Users Permissions

At any time, you can grant more access or deny access to a group. You simply need to display
the group properties page and edit the panel of your choice.
Just like for the configuration, make sure that the services you add correspond to a resource in
the group Resource list, otherwise granting the service might be useless.
To edit a group administrative rights
opens.
5. Open the panel you want to edit.
6. Click on EDIT . The Edit group access wizard opens.
7. Edit the rights to fit your needs.
8. Click on OK to commit your changes. The report opens and closes. The list Permissions
displays the module granted services.
942
Managing Groups
Managing the Users of a Group of Users

The purpose of a group is to define a set of rights and resources for the users it contains. Once
you configured the group, you can add the existing users that fit the group profile.
Adding a User to a Group

Once you created a user, you can add it as the resources of any group. It can also belong to
several groups with different resources and rights. The user credentials are the same but their
access correspond to the group they belong to.
For more details regarding user creation, refer to the chapter Managing Users.
To add a user to a group
opens.
4. Click on the name of the group of your choice. The page Resources of that group opens.
5. In the menu, select Add > Users. The wizard Rights & delegation: Users opens.
6. Tick the user(s) you want to add to the group and click on ADD . A pop-up window opens.
7. Click on OK to confirm the addition. The user is no longer listed in the wizard.
8. Click on CLOSE . The wizard closes and the page refreshes. The user is listed among the re-
sources of the group.
Removing a User from a Group

To restrict user permissions, you can remove them from a group. If they do not belong to a group,
their credentials can open SOLIDserver GUI but they cannot display or edit any module or re-
source.
To remove a user from a group
opens.
4. Click on the name of the group of your choice. The page Resources of that group opens.
6. Tick the user(s) you want to remove from the group.
8. Click on OK to commit the resource deletion. The report opens and closes. The user(s) is
no longer listed in the resources so can no longer benefit from the group permissions. The
user is still listed on the Users page.
943
Managing Groups
Enabling or Disabling Groups of Users

By default when you add groups, they are enabled but you can disable them.
Keep in that if you disable a group, the users its contain are still able to connect to
SOLIDserver but do not have access to any module or resource.
To enable/disable a group
opens.
4. Tick the group(s) of your choice.
5. In the menu, select Edit > Status > Enable or Disable. The corresponding wizard opens.
6. Click on OK to commit your choice. The report opens and closes. The group(s) is marked
OK or Disabled in the column Status.
Deleting Groups of Users

At any time you can delete a group.
Keep in mind that if you delete a group, the users its contain are still able to connect to
SOLIDserver but do not have access to any module or resource.
To delete a group
opens.
4. Tick the group(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The group is no longer
listed.
944
Chapter 72. Managing Users
The notion of user allows to define administrator accounts vs. standard user accounts. It also
allows to set up different profiles and levels of management.
By default, users authentication is performed using the local database. However you can create:
Local users
If you want to use local authentication, you must configure a group and manually add this
local user into the group. Once added to a group, a user is considered as a resource of the
group. For more details, refer to the section Managing the Users of a Group of Users of the
chapter Groups.
Remote users
If you want to authenticate users remotely via LDAP, Active Directory and RADIUS directory
in addition to local authentication, you must configure those services on SOLIDserver. A
local user and a remote user cannot share the same login account: if a user is already declared
in the local database, it can no longer be authenticated externally. SOLIDserver comes with
an authentication subsystem that manages authentications to securely log in to its web user
interface. For more details, refer to the chapter Managing Authentication Rules.
If you are using remote authentication, you must always have at least one local admin user
in a local group to ensure connectivity to SOLIDserver in case your remote directory is un-
reachable.
If you want to manage RIPE persons, refer to the appendix SPX.
Browsing Users
As far as the rights management is concerned, users constitute, along with objects, the second
level of the rights delegation management. Users are merely created and configured to be man-
aged by one or several groups that set their profile and permissions.
AUTHENTICATION
GROUP OF USER
USERS
RESOURCE
SERVICE
Figure 72.1. The user in the rights management hierarchy
By default, the superuser ipmadmin is the only user listed on the page. It belongs to the admin
group and has all the rights and every manageable object among its resources.
945
Managing Users
Browsing the Users Database

To display the list of users
opens.
To display a user properties page
opens.
3. At the end of the line of the user of your choice, click on . The properties page opens.
Customizing the Display on the Page Users

Adding Users
In the section, we describe the addition of local users, that is to say users to the Users page, or
local SOLIDserver database.
You can add as many users as you want. Their profiles depend on the group(s) they belong to.
Keep in mind that the user permissions are closely liked to the resources available in the group.
If a group has edition rights over a scope but no scope assigned as a resource, this permission
is useless.
Note that you can also import local users from a CSV file. For more details, refer to the chapter
Importing Users.
To add a local user
opens.
3. In the menu, select Add > User. The wizard Add a user opens.
4. If you or your administrator created classes, in the list User class, select a class or None.
Click on NEXT . The next page of the wizard opens.
5. In the field Login, type in the user login. This login cannot be an email address.
1
6. In the field Password, type in the user password .
7. In the field Confirm password, type in the user password again.
1
If the user is of Unix type and the password is not printable, the system password is used.
946
Managing Users
8. If need be, configure additional parameters:
a. Tick the box Expert mode.

b. In the field First name, type in the user first name.
c. In the field Last name, type in the user last name.
d. In the field Pseudonym, the user last and first name are automatically displayed. You
can replace them by a shortname or shorter name if you want.
e. In the field Email, type in the user email address.
f. In the field Login URL, type in the URL toward which the user should be directed after
being authenticated.
g. In the drop-down list Maintainer group, select the group of users that should be able to
edit the user information (names, credentials, email...) and classes.
9. Click on OK to commit the creation. The report opens and closes. The user is listed among
the users with its Login, Official name and Origin in the corresponding columns.
Connected users can edit their session time and date or listing page display, interface language
or password. For more details, refer to the section Account Configuration.
Editing Users
At any time an administrator can edit a user details or group.
Keep in mind that users must belong to a group: a user not belonging to any group, they can
connect to SOLIDserver but their session does not contain any module or they cannot perform
any action as no permission is granted to individual users.
Editing the User Details

Editing the user details means modifying the panel Main properties on the user properties page.
Keep in mind that in the procedure below, the changes are performed from the button EDIT in
the panel, but you can also make these changes from the menu Edit.
To edit a local user information
opens.
3. In the column Login, click on the user name of your choice. The properties page opens.
4. In the panel Main properties, click on EDIT . The wizard Edit a user opens.
6. Edit the user information according to your needs. For more details, refer to the procedure
To add a local user.
947
Managing Users
If you type in a different password than the original one, you overwrite the user current
password. Said user could then be logged out after your changes or no longer be able to
log in.
7. Click on OK to commit your modifications. The report opens and closes. The properties page
is visible again and includes the changes in the panel.
Editing the User Group

Editing the user details means modifying the panel Groups access on the user properties page.
Keep in mind that in the procedure below, the changes are performed from the button EDIT in
the panel, but you can also make these changes from the menu Edit.
To edit a local user group
opens.
3. In the column Login, click on the user name of your choice. The user properties page opens.
4. In the panel Groups access, click on EDIT . The wizard Groups opens.
6. In the list Available group(s), you can select a group and click on . The group is moved to
the Selected group(s).
7. In the list Selected group(s) are displayed the group(s) the user belongs to. In other words,
the user profiles. You can remove a group from the list clicking on , the group is moved to
the list Available group(s).
visible again and includes the changes in the panel.
Changing the User Password

At any time an administrator can change a user password, from the user properties page.
If you want to set a specific password complexity, refer to the section Configuring the User
Password Complexity.
To change a user password
opens.
2. Click on Users. The page User opens.
948
Managing Users
6. In the field Password, type in the new password.
7. In the field Confirm password, type in the password again.
visible again.
Configuring the User Password Complexity

At any time an administrator can set up a specific complexity level for all users' passwords.
From the registry database, you can add a dedicated key and set its value using the regular ex-
pression, regex, that suits your needs. For instance:
# The following regex requires in the password at least: one uppercase character, one lowercase
# character, one digit and one punctuation mark.
.*(?=.{8,})(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.*[^0-9a-zA-Z]).*
Once you added the registry key, you must change the passwords that do not match the regular
expression you set.
To set the users' password complexity level
opens.
opens.
4. In the field Name, type in ipmserver.login.regex_password_complexity.
5. In the field Value, type in a valid regular expression. By default, the key is set to 0, i.e. dis-
abled.
6. Click on OK to commit your creation. The report opens and closes. The page refreshes.
7. Make sure the users' password match the regular expression you just set, otherwise the
users in question can no longer log in. To edit users' password follow the procedure To
change a user password.
Configuring Users Connection Parameters

At any time an administrator can configure how to handle attempts to connect using wrong cre-
dentials. Using registry keys, SOLIDserver allows to:
• Set the maximum number of failed connection attempts, from a same IP address, after which
these attempts are locked out. By default, it is set to 3.
949
Managing Users
• Set the authentication period during which the maximum number of failed connection attempts
is allowed. By default, it is set to 10 seconds.
• Set the lock out period during which connection attempts are not allowed. By default, it is set
to 30 seconds.
To edit the registry key to set the maximum number of failed connection attempts
1. Go the Administration tab homepage. If the homepage is not displayed, click on . The
homepage opens.
opens.
3. In the column Name, type in ipmserver.login.bad_login_retry_before_freeze and hit Enter.
The key is the only one listed.
4. In the column Value, click on the value set for the key. The wizard Registry database Edit
a value opens.
6. In the field Value, set the maximum number of failed connection attempts, from a same IP
address, after which these attempts are locked out.
7. Click on OK to commit your changes. The report opens and closes. The new value is dis-
played.
To edit the registry key to set the authentication period
homepage opens.
opens.
3. In the column Name, type in ipmserver.login.bad_login_test_window and hit Enter. The key
is the only one listed.
a value opens.
6. In the field Value, set the authentication period during which the maximum number of failed
connection attempts is allowed.
played.
To edit the registry key to set the lock out period
homepage opens.
opens.
3. In the column Name, type in ipmserver.login.bad_login_freeze_time and hit Enter. The key
is the only one listed.
a value opens.
950
Managing Users
6. In the field Value, set the number of seconds during which connection attempts are locked
out after the maximum number of failed connection attempts has been reached.
played.
To display the failed connections logs

3. In the drop-down list SOLIDserver, verify that the local appliance is selected. Only the host-
4. In the drop-down list Services, select auth. The page refreshes.
5. In the column Log, type in invalid and hit Enter. The repeatedly failed attempts to connect
are listed, as in the example below where the invalid user name is toto:
Feb 23 16:09:36 solid ipmserver[1226]: invalid login/password toto
Feb 23 16:09:37 solid ipmserver: Last message 'invalid login/passwo' repeated 2 times, suppressed
by syslog-ng on solid.intranet
Feb 23 16:09:37 solid httpd: SOLIDserver: too many connection attempts with invalid credentials.
Retry later.
Configuring User Sessions

SOLIDserver provides the possibility to set an automated session logout of any user if they do
not do anything on the server after a certain period of time.You can also redirect users after their
session expires or when they log out.
Configuring Users Login Session Time

By default, the session is set to 0, i.e. the user session does not end unless the user logs out.
You cannot set the login session to less than 1 minute.
To set up a time limit for a user login session
opens.
opens.
3. In the search engine column Name, type in www.login.session_timeout. Only this key is listed.
opens.
5. In the field Value, set the session time of your choice, in seconds. This value can be 0 or
anything above 60. By default, it is set to 0.
6. Click on OK to commit your changes. The report opens and closes. The new value is visible
in the list and now the user is automatically logged out if no actions are performed above
the number of seconds you just set.
951
Managing Users
Redirecting Users After They Log Out or Their Session Expires

By default, once a user session expires or after a log out, SOLIDserver login page appears and
they can reconnect. Now you have the possibility to redirect them toward the website of your
choice using its URL as value of the dedicated registry database entry. By Default, this key is
empty.
To redirect users at the end of their session
opens.
opens.
3. In the search engine column Name, type in logout.session.redirect.url. Only this key is listed.
opens.
5. In the field Value, type in the URL of your choice following the format http://<website-of-your-
choice>. By Default, the value is empty.
6. Click on OK to commit your changes. The report opens and closes. The new value is visible
in the list and now all users are automatically redirected to the website specified as value
once they log out.
Enabling or Disabling Users

By default when you add users, they are enabled. Disabling users prevents them from connecting
to SOLIDserver. It also allows not to delete a local user entirely as you can enable them again
at any time.
To enable/disable a user
opens.
2. Click on Users. The page User opens.
3. Tick the user(s) of your choice.
4. In the menu, select Edit > Status > Enable or Disable. The corresponding wizard opens.
5. Click on OK to commit your choice. The report opens and closes. The user(s) is marked OK
or Disabled in the column Status.
Generating User Reports

EfficientIP provides a report dedicated to users.
Table 72.1. Available user report

Page Report
Users Users rights in each group
952
Managing Users
Deleting Users
Deleting local users prevents them from connecting to SOLIDserver. As for users connecting
remotely, AD users for instance, deleting users does not prevent them from connecting to the
appliance, once the rule is enabled, users are created locally upon connection and placed in an
existing group of users if it name matches the name of the group they belong to in the Active
Directory.
To delete a local user
opens.
3. Tick the user(s) you want to delete.
5. Click on OK to commit the user deletion. The report opens and closes. The user(s) is no
longer listed.
953
Chapter 73. Managing Authentication
Rules
SOLIDserver provides remote authentications management to securely log in external users to
the GUI. From the page Authentication rules, you can set up the access for users whose creden-
tials are stored on Microsoft Active Directory, LDAP and/or RADIUS servers. To set up remote
authentication for SSH connections, refer to the appendix Using Remote Authentication for SSH
Connections to SOLIDserver.
To provide secure user connections, all remote authentications are challenged when a user
connects with their login and password. If several authentications rules are configured, the con-
nection process is the following:
1. The first authentication rule is used to authenticate the user. If it fails, SOLIDserver tries the
next authentication rule. Each configured authentication rule is tried and used, whether it relies
on AD, LDAP or RADIUS, until it is successful or all authentications fail.
2. Either the user is granted access, or all rules failed and the user access to the GUI is denied.
3. When the authentication succeeds, the user rights are based on the group they belong to in
the remote directory. SOLIDserver tries to match the local database entries with the remote
information specified in the rules. If matching names are found, they are used to allow or deny
user access to operations and resources in the GUI. If no local group name matches, the
connection is denied.
Group Admin
admin@mycompany.corp
support@mycompany.corp
...
Group B
LDAP server user01@mycompany.corp
john.doe@mycompany.corp
...
LDAP authentication
rule enabled
Group A
Group B
john.doe@mycompany.corp
Group C
Figure 73.1. The user connection process when an authentication rule is enabled
To remedy any issue you could have when setting up remote authentication, keep in mind
that you should always have at least one local admin user configured. Having a user in the
group admin allows to have access to SOLIDserver and intervene in case of authentication failures,
954
Managing Authentication Rules
if an unreachable remote directory or server, or even if a local group of users matching a remote
group has insufficient rights or resources.
You can add remote authentication rules, delete, disable or enable them again from the page
Authentication rules. Only the rules you add are displayed on the page. Keep in mind that these
rules are also listed to the page Rules that lists all SOLIDserver rules.
Browsing Authentication Rules

As far as rights management is concerned, the authentication rules are optional and to be used
only if you intend to allow authentication of remote users through AD, LDAP or RADIUS.
AUTHENTICATION
GROUP OF USER
USERS
RESOURCE
SERVICE
Figure 73.2. The authentication rule in the rights management hierarchy
By default, the list is empty.
Browsing the Authentication Rules Database

To display the list of authentication rules
opens.
3. In the breadcrumb, click on Authentication rules. The page Authentication rules opens.
To display an authentication rule properties page
opens.
4. At the end of the line of the rule of your choice, click on . The properties page opens.
Adding Authentication Rules

From the page Authentication rules you can add three rules dedicated to remote users authentic-
ation whether your authentication relies on Active Directory, LDAP or RADIUS. As we saw in the
introduction, if your users credentials are saved on several or all of these remote servers, you
can add several or all rules as SOLIDserver compare the user credentials to any identified remote
955
server configure when adding the rules to provide the secure authentication of the user or deny
it if the user is not found anywhere.
Keep in mind that thanks to this systematic check of all the remote authentication possible con-
figurations, you can add as many rules as you want. They are all checked against the user cre-
dentials. This allows you to set different configurations for LDAP, RADIUS or AD authentication
of the remote users.
Note that there is no order in which authentication rules are checked, therefore, it is important
to keep your authentication servers updated with the same data. If a user is in the group A on a
server and in the group B on another server, there is no mean to set a preference for one authen-
tication rule over the other.
Relying on Active Directory Authentication

You can add the rule AD authentication that configures the users authentication through a Microsoft
Active Directory server. Active Directory (AD) is a technology created by Microsoft that provides
a variety of network services, including LDAP like directory services and other network information.
SOLIDserver supports remote authentication with any AD running on Microsoft Window Server
2008, 2008 R2, 2012 R2 or 2016.
In order to use the AD authentication successfully, the following prerequisites must be met:
1. At least one group exists both on the AD server and in SOLIDserver database. They must
have exactly the same name and this name is case sensitive: so the name of the group in
SOLIDserver must respect the AD group name.
2. The user you use for testing the authentication has to be part of the group mentioned above.
To add the AD users authentication rule
opens.
4. In the menu, select Add > Authentication rule. The wizard Add a rule opens.
The field Module is already filled with Rights & delegation. The field Event is already filled
with External user login.
5. In the drop-down list Rule, select (000) AD authentication.
6. In the field Rule name, name the rule.
7. In the field Comment, you can add a comment regarding that rule.
9. Click on NEXT . The page Rule parameters opens. To only configure basic authentication,
refer to the step 10. If you want to configure the authentication in more details, refer to the
steps 10 and 11.
10. Configure the basic AD authentication parameters following the table below:
Table 73.1. Active Directory basic parameters

Field Description
AD server The IP address or hostname of the Active Directory server.
956
Field Description
AD server port The port of the Active Directory server. Leave it empty to use the default AD port.
Use secure LDAP Tick this box to use secure LDAP during the authentication challenge. SOLID-
a
server uses LDAP and SSL to connect to the AD server .
Domain of DC The domain of the Domain Controller. Fully Qualified Domain Name (FQDN) of
your AD, for instance mydomain.corp
Default user domain The default domain of the user who connects through AD. This domain is con-
catenated to the user name. For instance, the user login jdoe is concatenated
with mydomain.corp to produce jdoe@mydomain.corp. If you let this field empty,
you have to connect with jdoe@mydomain.corp. If you configure mydomain.corp
in this field then you only have to connect with jdoe.
a
Secure LDAP configuration relies on the TCP port 638. Make sure this port is open on your network.
11. Configure the advanced AD authentication parameters following the steps below:
a. Configure the basic parameters following the Active Directory basic parameters above.
b. Tick the box Expert mode. The remaining configuration fields appear.
c. Finish the configuration following the table below:
Table 73.2. Active Directory expert mode parameters

Field Description
Deny if not in a group Select Yes if you only want members of an AD group to be able to connect
to SOLIDserver. By default, No is selected. This field is optional.
Manage imbricated Tick this box if to allow SOLIDserver to look for members in sub-groups of
groups the specified top group on the AD server during the authentication challenge.

13. In the drop-down list Synchronize, you can choose to synchronize or not SOLIDserver
database with the AD database: this automatically puts users in the local group of users that
matches the AD group name they belong to. This grant them the permissions of said local
group.
If you select Yes, the box Expert mode appears. You can tick it to configure specific syn-
chronization parameters, described in the table below:
Table 73.3. Active Directory parameters for the groups synchronization

Field Description
AD group granted "admin" Type in the name of any group on the AD server. All the users of the specified
rights group are granted access to SOLIDserver with the same permissions as the
users of the group admin. These users are also listed as resource of the group
admin.
Login Specify an account to be used to browse AD attributes. If your AD is configured
in a very strict manner, standard users might not be able to browse their own
attributes. Filling this field enables SOLIDserver to retrieve the groups the user
belongs to using the account specified. This field is optional, as the AD user ac-
counts might have the sufficient privileges to browse their own attributes and
retrieve the groups it belongs to.
Password If you specified an account in the field Login above, type in its account password.
This field is compulsory if you specified a login.
957
Field Description
Base DN Type in the name of the top of the AD tree. The level specified is the starting
point of the search for a matching user account on the server.You can customize
this field in order to look in specific location(s) of the AD. This field is optional.
Use sAMAccountName You can decide to use or not the sAMAccountName field as user login. This
field as login parameter is used for pre-AD installation (basically NTDS) and accepts 8-char-
acters long login names instead of regular longer names. This field is optional.
14. Click on OK to commit your configuration. The report opens and closes. The rule is listed.
In the column Instance, the Rule name you chose is displayed.
Once the rule is added, AD users can connect to SOLIDserver. This connection automatically
creates the user and puts in the corresponding group if you chose to synchronize the groups.
Also, note that:
• The changes performed on the AD server are not immediately taken into account by SOLID-
server. To avoid waiting, you can delete the AD users you modified from the page Users, when
they connect again, SOLIDserver contacts the AD server and authenticates them with their
new parameters.
• If several email addresses are available for a same user, only the first non-empty value is taken
into account.
If some users connections fail, here below are some useful guidelines to follow.
How to troubleshoot a remote AD authentication
1. Log out of the system then try to logging in again. It should work, if not:
2. Check the Syslog page and look for any AD related information. Most of the time, the
problem is coming from:
a. The AD connection is not possible: you should see messages telling you the ldap_bind
was not possible.
b. The AD user credentials are not recognized as a member of any group SOLIDserver
knows.
Relying on LDAP Authentication

You can add the rule LDAP authentication that configures the users authentication through LDAP
(version 2 or 3). Lightweight Directory Access Protocol (LDAP) is an application protocol over
TCP/IP for querying and modifying directory services that might hold passwords, addresses,
groups, public encryption keys and other exchange-facilitating data.
To add the LDAP users authentication rule
opens.
958
5. From the list Rule, select (018) LDAP authentication.
10. Configure the rule parameters following the table below:
Table 73.4. LDAP parameters

Field Description
LDAP server Type in the IP address or hostname of the LDAP server. This field is man-
datory.
LDAP server port The port of the LDAP server. Leave it empty to use the default LDAP port.
Use secure LDAP Tick this box to use secure LDAP during the authentication challenge.
SOLIDserver uses LDAP and SSL to connect to the LDAP directory.
a
Use LDAP v3 Tick the box to use LDAP in version 3 .
Base DN Type in the top level of the LDAP directory tree is the base, as follows:
dc=example,dc=com. This field is mandatory.
Group attribute Type in the name of the attribute in LDAP that matches one or several
groups in SOLIDserver, for instance memberof. The names must be separ-
ated by a comma. This field is optional.
LDAP group granted "admin" Type in the name of any group on the LDAP server. All the users of the
rights specified group are granted access to SOLIDserver with the same permis-
sions as the users of the group admin. These users are also listed as re-
source of the group admin. This field is optional.
b
Login Type in the login of an account that has sufficient privileges to retrieve user
attributes during the authentication. If your LDAP standard users cannot
browse their attributes, they should not be able to connect to SOLIDserver
on their own. This field is optional.
Password Type in the password of the account specified in the field Login above. This
field is optional.
a
Not ticking this box means using LDAP in version 2.
b
It is based on the LDAP attribute uid.
11. Click on OK to commit the rule creation. The report opens and closes. The rule is now listed.
Once the rule is added, LDAP users can connect to SOLIDserver. This connection automatically
creates the user and puts in the corresponding group if you chose to synchronize the groups.
Also, note that:
• The changes performed on the LDAP server are not immediately taken into account by
SOLIDserver. To avoid waiting, you can delete the LDAP users you modified from the page
Users, when they connect again, SOLIDserver contacts the LDAP server and authenticates
them with their new parameters.
• If several email addresses are available for a same user, only the first non-empty value is taken
into account.
959
Relying on RADIUS Authentication

You can add the rule RADIUS authentication to configure the users authentication through any
RADIUS server. Remote Authentication Dial In User Service (RADIUS) is a networking protocol
that uses access servers to provide centralized access management to large networks.
Note that, when you using RADIUS authentication:
• A user with no access to RADIUS cannot access SOLIDserver either.

• The group name sent by RADIUS has to be exactly the same as the one configured in
SOLIDserver, including the letter case and potential accents. RADIUS return value can hold
multiple values, i.e. several groups, separated by a comma.
• RADIUS users are automatically added to SOLIDserver when connecting for the first time.
• Users attributes, such as group or email, are updated at each connection.
You can use FreeRADIUS or RADIUS for Cisco ACS with SOLIDserver. For more details refer
to the appendix Configuring RADIUS.
To add the RADIUS users authentication rule
opens.
5. In the list Rule, select (017) RADIUS authentication.
8. Click on NEXT . The page Rule filters.
9. Click on NEXT . The page Rule Parameters.
10. Configure the rule parameters following the table below:
Table 73.5. RADIUS authentication rule parameters

Field Description
RADIUS server IP address Type in the IPv4 address of the host server.
Type in the port number of the UDP port used to contact the
RADIUS server. If you type in the port 0, the library looks up the
RADIUS server port radius/udp or the radacct/udp service in the network services
database and use the port found there. By default, the RADIUS
server port used for authentication is 1812.
Type in your RADIUS password. This password is necessary to
RADIUS secret passphrase
grant SOLIDserver access to RADIUS.
Set up the timeout parameters. In other words, choose after how
many seconds you want your radius server to switch to timeout
RADIUS request timeout (seconds)
status if no reply is received past this period of time. By default,
the number of seconds is 3.
960
Field Description
Set the maximum number of requests to be sent before the
RADIUS max tries before giving up server stops trying to connect and switches to failure state. By
default, the number of retries is 3.
Type in the IP address that SOLIDserver needs to connect to
RADIUS NAS IP address
RADIUS.
11. Click on OK to commit the addition. The report opens and closes. The rule is now listed. In
the column Instance, the Rule name you chose is displayed.
Editing Authentication Rules

You might need to change the rules parameters. The procedure below details the process from
the page Authentication rules but you can also do it from the rule properties page Main properties
panel.
To edit a user authentication rule
opens.
5. Right-click over the Name or Instance of the rule you want to edit. The contextual menu
opens.
6. Click on . The wizard Edit a rule opens.
7. Edit the Rule name, Comment fields and any other fields and configurations according to
your needs. For more details, refer to each authentication rule addition procedure in the
Adding Authentication Rules section above.
8. Click on OK to commit your configuration. The report opens and closes. The rule is listed.
Enabling or Disabling Authentication Rules

Once added, the authentication rules are automatically enabled. You can disable and disable
them back as you please.
To enable/disable a user authentication rule
opens.
4. Tick the rule of your choice.
5. In the menu, select Edit > Enable or Disable. The corresponding wizard opens.
6. Click on OKto commit your changes. The report opens and closes. The rule is listed and
marked OK or Disabled in the column Status.
961
Deleting Authentication Rules

If you no longer need an authentication rule, you can delete it.
To delete a user authentication rule
opens.
4. Tick the rule of your choice.
6. Click on OK to commit your deletion. The report opens and closes. The rule is no longer listed.
962
Part XIII. Administration
The module Administration should be handled by an administrator as it allows to manage remote appliances
and monitor, maintain or upgrade SOLIDserver.
From its dashboard, or homepage, you can access the key pages.
Figure 224. The Administration dashboard
This part contains the following chapters:
• High Availability Management describes how to set up High Availability between two appliances.
• Remote Management of Other Appliances describes how to remotely manage other appliances and
configure their network and services or even upgrade them from the local managing appliance.
• Monitoring describes how to monitor SOLIDserver from the reports, alerts, logs, statistics and users'
sessions and performed operations to SNMP tools (profiles, monitoring details through the MIBs...).
• Maintenance describes how to maintain or troubleshoot SOLIDserver, manage local files, save/restore
backup files or shut down and rebooting the appliance.
• Upgrading describes how to upgrade SOLIDserver, some checks must be performed before upgrading.
Some pages and options of the module Administration are detailed in other parts:
• The part System Configuration details the pages Network configuration, Services configuration and Li-
censes.
• The part Rights Management details the pages Users, Groups and Authentication rules.
• The management of the page Key Ring is distributed as follows: Certificate is detailed in the section
Managing the HTTPS Certificate, DNSSEC in the chapter DNSSEC and GSS-TSIG in the chapter Imple-
menting Dynamic Update.
• The Key Ring sub-pages are detailed separately. Certificate is in the section Managing the HTTPS Certi-
ficate, DNSSEC in the chapter DNSSEC and GSS-TSIG in the chapter Implementing Dynamic Update.
• The part Customization details the GUI customization, Class Studio, Custom DB and Packager.
Chapter 74. High Availability
Management
High Availability (HA) is a system network design that ensures that your network continues to
work even if one or more of its components fail. This architecture provides integrated disaster
recovery management operations for transparent and efficient service continuity. It also prevents
you from losing any data if anything were to happen to your managing platform.
With SOLIDserver, High Availability implies that you connect together two appliances where one
local appliance is a Master and the other, a remote one, is a Hot Standby, i.e. a read-only backup
server replicating the content of the Master appliance database.
The Hot Standby replicates the Master database
Hot Standby
Master
Figure 74.1. High Availability representation
The Master and Hot Standby appliances work together to make sure that when the automatic
switch is enabled, if the Master crashes or encounters any problem, the Hot Standby can
replace it immediately and vice versa. Therefore, the Hot Standby must replicate the Master
database as often as possible.
The Replication Stopped
Master Hot Standby
The Hot Standby

Becomes the Master
Hot Standby Init Master recovered
The database replication starts again
Hot Standby Master
Figure 74.2. Switch mechanism if the replication stops
964
High Availability Management
Prerequisites
• You must have two SOLIDserver appliances.
• The HA configuration can only be configured from and with appliances using an IPv4 address.
• The appliances must be sharing the same version of SOLIDserver and architecture.
• The appliances must be set at the same time.
Specificities
• The appliances configured in High Availability share the same database but can have their
services and network configured separately. For more details, refer to the sections Managing
the Network Configuration of a Remote Appliance and Managing the Services Configuration
of a Remote Appliance.
• Once configured in High Availability, upgrading the appliances differs from the upgrade of an
independent appliance. For more details, refer to the chapter Upgrading.
Limitations
There are some limitations related to the High Availability configuration:
• The database High Availability is configurable only for two appliances.

• We strongly advise against displaying several HA configurations on one page All
SOLIDserver. If you add an appliance to this list, it means that you want to manage it.Therefore,
if you decide to add to your managing appliance two appliances configured in High Availability,
it means that you intend to manage them from the managing appliance. On the page All
SOLIDserver of the appliances in HA, the appliance Status changes from OK to Invalid creden-
tials because the local 'admin' management password overwrites the management password
locally set on the Master appliance of this other HA configuration.
• The HA does not support the configuration of a NAT between the two appliances. Both
appliances send their local IP address when they communicate, therefore the converted IP
address cannot be used in the HA communication. Configuring a NAT might even break the
HA configuration.
Browsing the High Availability Appliances Database

The High Availability has to be configured and managed from the page All SOLIDserver in the
Administration module. On this page are also listed the appliances managed remotely. For more
details, refer to the chapter Remote Management of Other Appliances.
To access the page All SOLIDserver
opens.
2. In the section System, click on Remote management. The page All SOLIDserver opens.
The appliances listed on the page do not have a properties page, all the information regarding
each one are displayed in the columns.
The HA architecture in SOLIDserver comes with three role-related key concepts: Standalone,
Master and Hot Standby; all detailed in the table below.
965
Table 74.1. The default columns on the page All SOLIDserver

Column Description
Name The appliance hostname.
Local Indicates which appliance you are connected to. Every appliance listed is either marked
Yes (the appliance you are operating on) or No (the remote appliances).
Manufacturer The appliance manufacturer. It can therefore tell you if you are working on or remotely
managing virtual appliances.
Product The appliance model. It indicates the type of appliance you are working with and its size
if it is not a virtual appliance (e.g. SOLIDserver-250).
Serial # The appliance serial number. If two appliances have the same name, you can differentiate
them using their serial number.
Version The version of SOLIDserver: current is the latest.
IP address The appliance IP address. The IP address of each appliance is used to access all the
appliances that you want to add to the page All SOLIDserver.
Master address The IP address of the Master appliance in the HA configuration. Master and Standalone
appliances display None in this column.
Role Master: an appliance running in association with a Hot Standby appliance. It has a HA
UID.
Master (hot standby init): an appliance that used to be the Master in the HA configuration
and is currently becoming the Hot Standby.
Hot Standby: an appliance replicating the content of the Master appliance database it is
associated with. It has the same HA UID as its master.
Hot Standby (init): a Hot Standby appliance is being enrolled again with the same Master
in case of replication failure.
Standalone: an appliance configured and running on its own, with no HA configuration.
This is the default role of any appliance.
Standalone (hot standby init): an appliance becoming the Hot Standby of a Master ap-
pliance. It is not be accessible for a few minutes, until the replication of the entire database
is complete. During this time, the Hot Standby database is erased and replaced with the
replication of the Master appliance database.
Master (recovered): a Hot Standby appliance set as a Master is marked as such during
the role switch, it is immediately operational.
System state The overall state of the appliance. It monitors and returns the information of the columns:
CPU load (5 min), Disk I/O load (%), Fans status, HDD space, LAGG status, Memory usage
(%), PSU status and RAID status. These columns' statuses are described separately in
the next table.
OK: the appliance overall state is normal. None of the monitored columns is alerting.
Unknown: one of the monitored columns returns no information.
Critical: one of the monitored columns is in critical state.
Warning: one of the monitored columns requires attention.
HA UID The key that identifies two appliances configured in High Availability.
Last write period The last time the Hot Standby replicated the Master database.
Time drift The difference, in seconds, between the Master NTP and the Hot Standby NTP. That drift
should not exceed a minute (60 in the column) as this could have consequences on the
DHCP failover replication.
Replication offset The difference, in kilobytes, between the Master database and the Hot Standby database.
As the replication is almost in real time, the difference should be minimal. A great value
in this column could indicate a network disruption. If the Replication offset in Unknown,
the remote SOLIDserver is in Timeout.
Status OK: the appliance is up and running.
Not configured: the local appliance has not been configured yet.
966
Column Description
Upgrading...: the Hot Standby appliance is being upgraded from the Master appliance.
Switching to Hot Standby: an appliance is switching to Hot Standby role.
Invalid credentials: the appliance has been switched to Standalone or when it is restored
and the password has been changed.
Managed (remote): an appliance is being managed remotely, i.e. listed on the page All
SOLIDserver of another appliance.
Timeout: the appliance is not responding.
Split-brain: two appliances are in Restricted mode due to a split-brain. For more details,
refer to the section Troubleshooting a Split-brain.
Replication stopped: the connection is lost between the appliances. For more details,
refer to the section If the Replication Takes a Long Time or Stopped.
In addition to the default columns, you can display the following columns to the listing template:
Table 74.2. All SOLIDserver page additional columns

Column Description
CPU load (5 min) The load of all the appliances' CPU cores, on an average of 5 minutes. You can monitor
the values in this column and set thresholds that return the status Warning or Critical in
the column System State thanks to two registry database entries:
• module.system.member_snmp_cpu_warn allows to return Warning in the column System

state, if its value is matched or exceeded. By default it is set to 100, you can edit its
value according to your needs.
• module.system.member_snmp_cpu_crit allows to return Critical in the column System
state, if its value is matched or exceeded. By default it is set to 150, you can edit its
Device OS version The appliance architecture, either amd64 or i386. i386 is only displayed for remotely
managed appliances in version prior to 6.0.x.
Disk I/O load (%) The load of the appliance disk I/O, in percent. You can monitor the values in this column
and set thresholds that return the status Warning or Critical in the column System State
thanks to two registry database entries:
• module.system.member_snmp_ios_warn allows to return Warning in the column System

state, if its value is matched or exceeded. By default it is set to 25 %, you can edit its
• module.system.member_snmp_ios_crit allows to return Critical in the column System
Fans status OK: the appliance fan(s) is/are up and running.

N/A: no information on the appliance fan(s) is not available.
Disabled: the appliance fan(s) is/are set to disabled.
Critical: at least one appliance fan returns an error (not running, on failure...).
Firmware date The software image release date.
HDD space The space used on the /data1 partition of the appliance, in percent. You can monitor the
values in this column and set thresholds that return the status Warning or Critical in the
column System State thanks to two registry database entries:
• module.system.member_snmp_hdd_warn allows to return Warning in the column System

967
Column Description
• module.system.member_snmp_hdd_crit allows to return Critical in the column System
LAGG status OK: the appliance LAGG interface(s) is/are up and running.
N/A: no information can be retrieved from the appliance LAGG interface(s).
Disabled: no LAGG interface is configured as active on the appliance.
Critical: at least one appliance LAGG interface is down.
Last write time The exact time of the last database replication.
Memory usage (%) The memory usage of the appliance, in percent.You can monitor the values in this column
and set thresholds that return the status Warning or Critical in the column System State
thanks to two registry database entries:
• module.system.member_snmp_mem_warn allows to return Warning in the column

System state, if its value is matched or exceeded. By default it is set to 98 %, you can
edit its value according to your needs.
• module.system.member_snmp_mem_crit allows to return Critical in the column System
Multi-status The multi-status of the appliance.

PSU status OK: the appliance power supply unit(s) is/are up and running.
N/A: no information can be retrieved from the power supply unit(s). For instance, on a
virtual appliance or if the appliance has only one PSU.
Disabled: no PSU redundancy is available on the appliance.
Critical: one of the appliances' power supply units is unplugged or defective.
RAID status The status of the RAID disk(s) of the physical appliances SDS-550, 1100, 2200, 3300 or
Blast.
OK: the appliance RAID disk(s) is/are up and running.
N/A: no information can be retrieved from the appliance RAID disk(s).
Disabled: no RAID disk is enabled on the appliance.
Critical: the appliance RAID disk(s) is/are enabled but is degraded or offline.
Remote time The time of the remote appliance(s) managed through the local appliance.
Time The appliance date and time.
Configuring SOLIDserver for High Availability Management

The HA configuration follows three steps:
1. Configuring locally your future Master appliance.

2. Adding the future Hot Standby to the page All SOLIDserver of the Master appliance.
3. Configuring the HA management, i.e. enrolling the Hot Standby.
Configuring your Master Appliance Locally

The Configure Local SOLIDserver option sets the grounds for the Master/Hot Standby configur-
ation: it basically assigns the IP address of the appliance you are working from as the address
of the Master appliance.
968
To configure locally the future Master appliance
opens.
In the column Local, your appliance is marked Yes. In the column Status, it is marked as
Not configured because the IP address is not configured yet.
3. In the menu, select Tools > Configure local SOLIDserver. The wizard Configure local
SOLIDserver opens.
4. In the drop-down list SOLIDserver IP address, select the IP address of the appliance.
5. Click onOK to commit the configuration. The report opens and closes. The page All
SOLIDserver is visible again. The local appliance details are now completed with the Name
(the hostname), serial number, version, IP address, Role (Standalone) and Status (OK).
Adding the Future Hot Standby

Once you configured your future Master appliance locally, you can add other appliances. These
appliances can be either listed to have an overview of all the appliances running on your network
or to configure the High Availability from the local Master appliance.
You can add as many appliances as you need on the page All SOLIDserver. However you can
only display one HA configuration, you cannot display several High Availability configuration
pairs on the page All SOLIDserver.
The list of appliances on the page can be used to provide an overview of all the SOLIDserver
appliances used on your network (their name, type, status, etc.) or for remote management pur-
poses. All the appliances of the page All SOLIDserver are also listed in the drop-down list
SOLIDserver of the pages Services configuration and Network configuration of the Master appli-
ance. This allows to manage their configuration remotely. For more details, refer to the chapter
Remote Management of Other Appliances.
To add the future Hot Standby on the page All SOLIDserver of the Master
1. Connect to the future Master appliance through its IP address or hostname.

opens.
4. In the menu, select Add > Remote SOLIDserver.The wizard Add/modify remote SOLIDserver
opens.
5. If you or your administrator created classes at the SOLIDserver (appliance) level, in the list
SOLISDserver (appliance) class, select a class or None. Click on NEXT . The next page of
the wizard appears.
969
6. In the field SOLIDserver IP address, fill in the IPv4 address of the appliance you want to add
to the list.
7. In the field 'admin' user password, type in the default SSH password (admin if you kept the
default SSH credentials) if it is not already entered.
8. Click on OK to commit the addition. The report opens and closes. The new appliance is listed
and marked Standalone in the column Role and Managed (remote) in the column Status.
Configuring the HA Management

The HA configuration has to be done from the future Master appliance, you cannot configure HA
management from the Hot Standby appliance. The HA configuration can be done on layer 2 or
3 or the network. For more details, refer to the section Frequently Asked Questions.
Keep in mind that for the configuration to be viable and effective the two appliances must:
• Be set at the same time. For more details, refer to the section Configuring the NTP Server.
• Have the same version of SOLIDserver.
• Have the same performance rate, to ensure a smooth transition. In the event of a switch, the
former Hot Standby has retrieved all the database information and can actually provide the
same performance and efficiency as the original Master.
• Have the same architecture (32 bits or 64 bits).
To configure High Availability between two appliances
1. Connect to the future Master appliance through its IP address.

opens.
4. Tick the appliance you want to set up as Hot Standby.
5. In the menu, select Edit > Enroll SOLIDserver as Hot Standby. The wizard Enroll SOLID-
server as Hot Standby opens.
6. Click on OK to commit the configuration. The Report opens and works for a while until the
Hot Standby appliance database is erased and replaced by the Master appliance database.
The appliance set as Hot Standby is unavailable for a while. Each appliance role is modified
according to the configuration, they both get the same HA UID.
Once the High Availability is configured:
1. The content of the page All SOLIDserver columns is modified.The Master appliance information
stays the same and is also listed on the local Hot Standby appliance, on the page All SOLID-
server.
970
2. The Hot Standby appliance is now in read-only mode. Every modification made on the Master
appliance is copied in the Hot Standby database almost in real-time and you can no longer
edit the remote appliance data locally. From the local All SOLIDserver page of the Hot Standby
appliance, the only operation available is switching the appliances role. For more details, refer
to the section Switching the HA Configuration.
3. The Hot Standby appliance replicates the content of the Master appliance database to provide
an efficient backup if it has to replace the current Master appliance.
• You should monitor the columns Time drift and Replication offset of the Master appliance
All SOLIDserver list, to make sure that the Hot Standby appliance properly replicates the
database. If at some point the replication stops, you can enroll again the Hot Standby appli-
ance following the procedure To configure High Availability between two appliances.
• You can, for instance, configure and enable the automatic switch so that, if the Hot Standby
has not replicated the Master database in the last 60 seconds, it should check the Master
status three times in a row, every 4 seconds. If there is no response (timeout, etc.), the Hot
Standby switches to Master.
Note that, since version 6.0.2.P3 the automatic switch is no longer enabled by default.
You can manually enabled it again following the procedure in the advanced options section
If the Network is Unreliable; that also provides information regarding the switch behavior(s)
that you can set.
To check if the automatic switch is enabled

opens.
3. In the search engine of the column Name, type in module.sys-
tem.max_hot_standby_time_skew. The key can still be present if you upgraded from a pre-
vious version where it was already set. To enable or disable the automatic switch, refer to
the section High Availability Advanced Options.
Updating the Database of Appliances in High Availability

At any time, you can update the database of appliances in High Availability to take into account
any new file on the Master that would not have been replicated yet onto the Hot Standby. We
strongly recommend using the option Update HA files database before manually switching the
appliances role to ensures that the database of the new Master is up-to-date. If you enabled the
automatic switch, the option is automatically launched before the switch. For more details, refer
To update the database of appliances in High Availability
1. From the Master appliance, go to the Administration tab. If the homepage is not displayed,
click on . The homepage opens.
971
3. In the menu, select Tools > Update HA files database. The report opens.
4. Click on OK to commit the modification. The report opens and closes. The page is visible
again and the column.
Monitoring Appliances in High Availability

For a viable High Availability configuration, you must make sure that both appliances are set at
the same time. The HA configuration dedicated logs can help you anticipate any problem.
Monitoring the Appliances Time and Date

To set up an efficient HA configuration, both appliances should be set at the same time. To ensure
there is no shortage of data on the Hot Standby appliance in case it needs to become a Master:
1. We strongly recommend that you configure the time and date of both the Master and
Hot Standby appliances through the NTP server. For more details, refer to the section
Configuring the NTP Server.
2. You can configure the alert Member clock drift that monitors the time drift between the Master
and the Hot Standby
Configuring the Alert that Monitors the Time Drift
The alert Member clock drift monitors the time difference between the management appliance,
or Master, and all the remote appliances it manages from the page All SOLIDserver: the alert
is triggered if the Hot Standby time or if any remote appliance time has drifted too much from the
management appliance time.
You can edit the alert definition settings to suit your needs. By default:
• The alert is based on a filter of the column Time drift. The filter is set with a 20 seconds threshold
as follows: > 20 || < -20. The alert is raised:
• If the absolute time difference between the remote (Hot Standby) and the management
(Master) appliances is higher than 20 seconds.
• If the absolute time difference between the remote and the management appliances is lower
than 20 seconds.
To edit the threshold, refer to the procedure To edit the threshold of the alert Member clock
drift.
• The time difference check is performed every 5 minutes. To edit the frequency, refer to the
procedure To edit the alert Member clock drift default frequency and recipients.
• The alert sends an email alert to the users of the group admin. If you did not configure the
users' email address properly, they are not notified. To edit the recipients, refer to the procedure
To edit the alert Member clock drift default frequency and recipients below.
To edit the threshold of the alert Member clock drift
1. Connect to the management appliance GUI.

opens.
972
3. In the menu, select Monitoring > Alerts. The page Alerts opens. Only the raised alerts are
displayed by default.
4. In the breadcrumb, click on Alerts Definition. The page Alerts Definition opens.
6. In the column Alert filter, click on Edit alert filters.You are redirected to the page All SOLID-
server, where the alert was created.
7. Above the menu, a red banner indicates you are in Alert edition mode.
8. In the search engine of the column Time drift, the default filter > 20 || < -20 is visible.
9. Edit the filter according to your needs.
10. On the right-end side of the menu, click on . The wizard Quit editing the alert filters opens.
11. Tick the box Save changes before quitting to save your new filter.
12. Click on OK to commit your changes. The report opens and closes. You are redirected back
to the page Alert definitions.
To edit the alert Member clock drift default frequency and recipients

opens.
5. At the end of the line of the Member clock drift, click on . The properties page opens.
6. In the panel Main properties, click on EDIT . The wizard Edit an alert definition opens.
7. Tick the box Expert mode.
8. To edit the alert check frequency:
a. Tick the box Edit scheduling. The schedule drop-down lists appear.
b. By default, only the drop-down list Minutes is set, with the value Every 5 minutes.
c. Select the values that suit your needs.
9. To edit the group of users receiving the alert or add recipients:
a. Make sure the box Send mail is checked.

b. In the drop-down list Mailing lists, select the group of users of your choice.
c. In the field Additional Mail, type in the email address of a user that does not belong to
the group selected. Click on ADD . The email address is moved to the Additional Mail
List. Repeat these actions for as many users as you need.
visible again.
973
Monitoring the HA Logs

SOLIDserver allows you to monitor the HA configuration through the page Syslog. That way, you
can know in detail what happened with your configuration: did the appliances switch? At what
time? etc.
To filter the page Syslog to only display the remote management logs
All the remote management and High Availability related logs respect the format: HA <event>.
opens.
3. In the drop-down list SOLIDserver, select the appliance for which you want to display the
logs.
4. In the drop-down list Service, select ipmserver.
5. Filter the list via the column Log:
a. Type in HA* in the column search engine and hit Enter on your keyboard.
b. Double-click in the column search engine to display the filter constructor: select contains
in the drop-down list and type in HA* in the field. Click on APPLY .
Only the remote management related logs, including high availability.
Switching the HA Configuration

Since version 6.0.2.P3, the switch is no longer automatic by default after you configured
the HA management. It must be enabled manually. For more details, refer to the section High
Availability Advanced Options.
When enabled, the switch is automatic if the Master, for any reason, is not accessible (timeout,
crash...). However, at any time you can switch the appliances role in the configuration and make
the Hot Standby appliance a Master.
The manual switch must be performed from the Hot Standby appliance as it is impossible
to manually make a Master change its role to Hot Standby.
To switch the appliances role in the HA configuration
1. Connect to your Hot Standby appliance. The message This SOLIDserver is a Hot Standby:
Database is in READ-ONLY mode is present on every page.
opens.
974
4. In the menu, select Tools > Manually switch local SOLIDserver to master. The report opens.
5. Click on CLOSE to commit the modification. The list All SOLIDserver opens again.
6. Click on REFRESH to monitor the changes on the page: the former Hot Standby appliance
Role is marked Master (recovered). The former Master appliance is marked Master (Hot
Standby init). For more details, refer to the table in the section Configuring the HA Manage-
ment. The Hot Standby appliance is unavailable until it has replicated the Master database.
Replacing Appliances in High Availability

At some point, you might need to replace one of the appliances configured in High Availability.
To prevent any loss of data, you must always replace the Hot Standby appliance.
There are two scenarios possible: you replace one appliance for which you have a backup or
you replace an appliance and no backup is available.
Replacing an Appliance With Backup

If you generated a backup of the appliance you need to replace, you must follow the steps below.
1. If the appliance that needs to be replaced is the Master, switch its role to Hot Standby.
For more details, refer to the section Switching the HA Configuration.
2. Disable the High Availability configuration from the Master appliance: delete the Hot Standby
from the page All SOLIDserver. The Hot Standby switches to Standalone. For more details,
refer to the section Disabling the HA Configuration.
3. Restore the backup on the Standalone appliance. For more details, refer to the procedure
To restore a backup file.
4. Switch the current Master to Standalone only once when the restoration of the backup on
the other appliance is complete, this ensures your database availability. You now have two
Standalone appliances: one with backup that becomes the Master, and one totally empty that
becomes the Hot Standby.
5. Configure the High Availability again:
• First, connect to the appliance where you restored the backup, the future Master appliance,
and add the future Hot Standby to the page All SOLIDserver. For more details, refer to the
section Adding the Future Hot Standby.
• Second, enroll the Hot Standby. For more details, refer to the procedure To configure High
Availability between two appliances in the section Configuring HA Management.
6. If you restored your backup directly on your Hot Standby, manually switch the appli-
ances' role. If you followed this procedure from step 2, your current Master used to be the
Hot Standby so you may need to switch their role back again. For more details, refer to the
section Switching the HA Configuration.
Replacing an Appliance Without Backup

The replacement of an appliance in HA with no backup must follow the steps below:
1. Put the appliance that needs to be replaced in Hot Standby role, if it is currently the
Master. For more details, refer to the section Switching the HA Configuration.
2. Disable the High Availability configuration. For more details, refer to the section Disabling
the HA Configuration.
975
3. Set the network and services configuration of the future Hot Standby appliance according
to your needs. For more details, refer to the sections Network Configuration and Services
Configuration.
We strongly recommend that you use an NTP server to set both appliances at the time.
4. Add the new appliance to the page All SOLIDserver of the Master appliance and enroll
it:
• First, you need to add the new appliance to the page All SOLIDserver of the Master appliance.
For more details, refer to the section Adding the Future Hot Standby
• Second, you need to enroll the new appliance as Hot Standby. For more details, refer to
the procedure To configure High Availability between two appliances.
5. Manually switch the configuration if the new appliance is supposed to be the Master in
the configuration. For more details, refer to the section Switching the HA Configuration.
Disabling the HA Configuration

At any time you can disable the HA configuration, that is to say break up the HA configuration
and stop the database replication.
To disable the configuration you must remove the Hot Standby from the page All SOLIDserver
of the Master appliance. Before deleting the Hot Standby, keep in mind that:
• Deleting the Hot Standby appliance from the list revokes its role and therefore stops the
replication and disables the HA configuration.
• It is impossible to delete the local appliance from this page. You can only revoke the Hot
Standby appliance role from the Master appliance.
• The Hot Standby database is erased.
• Deleting the Hot Standby changes the Master appliance HA UID for two reasons:
1. To prevent any other appliance from managing it as it would delete its database.
2. The HA UID can be used again during the next HA configuration with this appliance as a
Master.
If you want to disable the High Availability and keep the Hot Standby database intact, refer to the
section Disabling the HA Configuration Without Losing the Database.
To disable the High Availability configuration
3. Tick the Hot Standby appliance.
976
5. Click on OK to commit the deletion. The report opens and works for a while - the Hot Standby
database is saved before it is erased - and closes. The Hot Standby is no longer listed on
the page. The former Master appliance keeps a Master role.
Note that the former Hot Standby appliance is not accessible while it is reset.
Once the former Hot Standby has rebooted and is reachable:
• Connect to the Hot Standby via its IP address, log in using the credentials of a user belonging
to the group admin.
• The appliance is no longer in read-only mode but its database is empty.
• Configure the Internal module setup once again. For more details, refer to the section Defining
the Internal Module Setup.
• The All SOLIDserver list displays the following information:
1. The appliance itself (Local) is the only one listed, the former Master appliance is no longer
part of that list.
2. The appliance role is now Standalone.
3. The appliance needs to be configured locally again (Tools > Configure local SOLIDserver).
High Availability Advanced Options

Some registry database keys allow you to customize the High Availability switch and automatic
re-enrollment mechanisms.
If the Network is Unreliable

If your network is unreliable, you can monitor both appliances thanks to:
• The column Offset replication allows to monitor the Hot Standby database reliability.
• Some entries of the registry database, called keys, provide a better control over the switch of
the appliances.
Configuring these keys allows to avoid flapping and ensure that the switch occurs if and only if
there is a problem on the Master side. Configuring the registry database keys allows to:
Control the automatic switch

The key module.system.max_hot_standby_time_skew allows to control and potentially prevent
the automatic switch itself, based on the Last write period.
By default, its value is 3600 seconds, if the last write period is greater than an hour, the two
appliances cannot switch automatically. Since 6.0.2.P3, this key is disabled on fresh in-
stallations and the switch is no longer automatic by default, its value is -1. You can edit
the key to enable it again, after an upgrade from a previous version, it can still be enabled.
The key can be set with values between -1 and 2^31. Setting the key to 0 or -1 prevents the
automatic switch altogether, regardless of the values set for the keys described below.
Keep in mind that if you stop the automatic switch, if your appliances stop communicating
and the Hot Standby stopped replicating the Master database, you must configure the HA
again. For more details, refer to the section Disabling the HA Configuration Without Losing
the Database.
977
Set the maximum period of time a switch should take

The key module.system.init_hot_standby_timeout allows to control how long a switch should
take, whether you are enrolling an appliance or switching the roles.
By default, it is set to 1000 seconds, if the Hot Standby initialization stage has not evolved
after 16 minutes, the enrollment or switch stops and the appliance keeps it current role as
Standalone or Master.
Setting a high value for this key is useful if the Master database is very large or if your network
is not reliable.
Set the number of retries before switching
The key module.system.hot_standby_switch_retry allows to control the minimum number of
retries before automatically switching the appliances role.
By default, it is set to 3 attempts, if the Hot Standby appliance cannot connect to the Master
and check its role and status, it tries to get an answer 3 times in a row. If after 3 attempts
there is still no answer, it takes over the Master role.
Keep in mind that the retries check frequency is defined by the key module.sys-
tem.hot_standby_switch_sleep detailed below.
Set the check frequency between the retries
The key module.system.hot_standby_switch_sleep allows to set the retries check frequency.
By default, it is set to 4 seconds, if the Hot Standby does not get an answer from the Master,
it tries every 4 seconds n times (depending on the number of retries you set for the key
module.system.hot_standby_switch_retry).
Set a replication lag period before switching
The key module.system.hot_standby_max_replication_lag allows to set a lack of database
replication period before automatically switching the appliances role.
By default, it is set to 60 seconds, if the Hot Standby has not replicated the database in the
last 60 seconds, it tries to contact the Master appliance n times (n is defined by the key
module.system.hot_standby_switch_retry). If the Master is not responding, i.e. sending its
role and status, the Hot Standby switches to Master.
Prevent unexpected switches during network minor issue
Among other configurations, the registry database entries can be used to prevent unexpected
switches if the network experiences minor issues. To do so you should increase the switch
lag period (the value of the key module.system.hot_standby_max_replication_lag) and/or
the number of retries (the value of the key module.system.hot_standby_switch_retry). Keep
in mind that a large number of retries might overload the network.
To disable the automatic switch altogether, refer to the section detailing how to control the
automatic switch.
To configure the high availability switch behavior from the registry database
opens.
opens.
978
3. In the search engine of the column Name, type in the name the key of your choice. For more
details, refer to the high availability keys.
opens.
5. In the field Value, type in the value of your choice. For more details, refer to the high availab-
ility keys.
In the Event of a Network Disruption

At some point you might plan on disrupting the network or shutting it down (for potential repairs,
equipment changes, etc.), in this case, we strongly recommend that you disable the HA
configuration.
Indeed, in the event of a network disruption, voluntary or not, the appliances configured in HA
go in Timeout or switch their roles but might not successfully go through with it. In this case, when
the appliances start again you might have two Masters. The original Master keeps its role and
the Hot Standby switches to Master (recovered), with no Hot Standby configured and potentially
a case of split-brain. If it is the case, there is no accurate way of knowing which appliance should
become the Hot Standby. For more details, refer to the section Troubleshooting a Split-brain.
To prevent any loss of data, we suggest that you follow the procedure in the section Disabling
the HA Configuration. Once the network is back on, you must configure the HA again.
If the Replication Takes a Long Time or Stopped

A set of keys in the registry database allow to automatically re-enroll the Hot Standby, that is
to say replicate again the entire database of the Master.You can customize the triggers or disable
the functionality. The automatic re-enrollment applies if:
The database replication stopped

If the replication stopped because the Hot Standby is no longer connected, the Master
automatically re-enrolls it. On the page All SOLIDserver, the Hot Standby status is Replication
stopped.
The key module.system.auto_replication_repair is enabled by default. If you want to disable

the automatic re-enrollment, you must set the value of the key to 0.
The database replication is taking a long time
With a large Replication offset a switch could make you lose the latest changes. You can
monitor the offset and set a threshold to automatically re-enroll your Hot Standby.
• The key module.system.warning_replication_lag allows to set the maximum replication
offset before generating a warning message in the logs. By default, it is set to 10240 kB.
• The key module.system.max_replication_lag allows to set the maximum replication offset
before re-enrolling the Hot Standby. By default, it is set to 307200 kB. Note that if the
automatic re-enrollment is disabled, the offset is ignored.
To make sure that the Master does not try re-enrolling the Hot Standby indefinitely, it
automatically tries the re-enrollment a maximum of 3 times over 24 hours. If it does not
succeed, a message is displayed in the GUI and you need to troubleshoot the HA yourself.
For more details, refer to the section Troubleshooting the Messages.
979
• The key module.system.auto_replication_repair.threshold allows to set how long the

maximum replication offset can be exceeded before re-enrolling the Hot Standby. By default,
it is set to 60 times 10 seconds, i.e. if the module.system.max_replication_lag is exceeded
during 10 minutes or more, the re-enrollment is triggered.
Note that to be notified of any replication delay before the Hot Standby is automatically re-
enrolled, the value of the key module.system.warning_replication_lag should be lower than
the value of the key module.system.max_replication_lag.
To disable the automatic re-enrollment of the Hot Standby
opens.
opens.
3. In the search engine of the column Name, type in module.system.auto_replication_repair.
Only this key is listed.
opens.
5. In the field Value, type in 0 to disable it. The default value is 1.
Note that once the key is disabled, the key module.system.max_replication_lag is ignored.
To set the maximum replication offset before generating a log message
opens.
opens.
3. In the search engine of the column Name, type in module.system.warning_replication_lag.
Only this key is listed.
opens.
5. In the field Value, type in the value of your choice, in kB. The default value is 10240.
To set the maximum replication offset before re-enrollment
opens.
980
2. Make sure the key module.system.auto_replication_repair is enabled, set to 1. If it is disabled,

the automatic re-enrollment is not triggered.
opens.
4. In the search engine of the column Name, type in module.system.max_replication_lag. Only
this key is listed.
opens.
6. In the field Value, type in the value of your choice, in kB. The default value is 307200.
To set how long the maximum replication offset can be exceeded before
re-enrollment
opens.
2. Make sure the key module.system.auto_replication_repair is enabled, set to 1. If it is disabled,
the automatic re-enrollment is not triggered.
opens.
4. In the search engine of the column Name, type in module.system.auto_replication_re-
pair.threshold. Only this key is listed.
opens.
6. In the field Value, type in the value of your choice. The default value is 60 time 10 seconds,
i.e. 10 minutes.
Troubleshooting Solutions
You need to troubleshoot the HA configuration if there is a replication problem or if you have an
improper configuration. Keep in mind that the configuration is viable and effective only if the
two appliances:
• Are set at the same time. For more details, refer to the section Configuring the NTP Server.
• Have the same version of SOLIDserver.
• Have the same performance rate, to ensure a smooth transition. In the event of a switch, the
former Hot Standby has retrieved all the database information and can actually provide the
same performance and efficiency as the original Master.
• Have the same architecture (32 bits or 64 bits).
If you do not meet all the requirements listed above, warning messages are displayed on the Hot
Standby appliance GUI.
981
Troubleshooting the Messages

To help you monitor the High Availability configuration a set of red messages can be displayed
on all the pages of the appliances to inform or warn you.
This SOLIDserver is a Hot Standby: Database is in READ-ONLY mode.
• Appliance: Hot Standby.

• Problem: There is no configuration problem, this message indicates that you cannot edit the
Hot Standby appliance database locally, it automatically replicates the Master database.
• Solution: N/A. This message is informative.
This SOLIDserver is initializing the Master appliance database replication.
• Appliance: Hot Standby, when it is still in Hot Standby (init).

• Problem: There is no problem, the replication is starting. The Hot Standby database should
soon be in read-only.
• Solution: Wait until the replication is complete. This message is informative.
This SOLIDserver cannot automatically switch to Master: its database is out-of-date.
• Appliance: Master recovered.

• Problem: The replication offset is higher than the limit set in the key module.sys-
tem.max_hot_standby_time_skew. Therefore during the appliances switch, the Hot Standby
became Master recovered and the former Master never became Hot Standby.
• Solution: Disable the High Availability configuration following the split-brain Manual Resolution.
High Availability Configuration: impossible to reach the remote SOLIDserver.
• Appliance: Master.
• Problem: The Hot Standby is unreachable, so it does not replicate the Master database.
• Solution: Delete the Hot Standby from the page All SOLIDserver, add it to the list again and
enroll it following the procedure in the sections Adding the Future Hot Standby and Configuring
the HA Management.
The two SOLIDserver appliances you configured in High Availability have DIFFERENT
ARCHITECTURES. They must have the same architecture for the database replication to
work.
• Problem: The Master and Hot Standby appliances do not have the same architecture version,
therefore the database replication is impossible.
• Solution: Upgrade the Hot Standby appliance from the Master appliance: the Hot Standby is
automatically upgraded to the architecture version of the Master. For more details, refer to the
section Upgrading Appliances Managed Remotely in the chapter Remote Management of
Other Appliances.
The two SOLIDserver appliances you configured in High Availability have DIFFERENT
VERSIONS. To avoid configuration problems you should upgrade the Hot Standby from
the Master.
982
• Problem: The Master and Hot Standby appliances do not have the same version of SOLIDserver,
therefore the database replication may encounter some problems.
• Solution: Upgrade the Hot Standby appliance from the Master appliance: the Hot Standby is
automatically upgraded to the version of SOLIDserver of the Master. For more details, refer to
the section Upgrading Appliances Managed Remotely in the chapter Remote Management of
Other Appliances.
The information used to identify the local SOLIDserver has changed.
• Appliance: Master and Standalone.

1
• Problem: The manufacturer, product and/or serial number of the Master appliance have been
edited or you restored another appliance's backup. These three pieces of information are
needed to identify the appliance.
• Solution: Delete the unwanted remote appliances from the page All SOLIDserver and configure
the high availability again following the procedures in the sections Configuring SOLIDserver
for High Availability Management.
A case of SPLIT-BRAIN was detected: both SOLIDserver appliances configured in HA are

set as Master. As changes have been made through both servers, you are in Restricted
mode. To go back to a proper HA configuration you need to choose which SOLIDserver
should remain the Master: connect as an administrator to the Master and on the page All
SOLIDserver select Tools > Manually switch this SOLIDserver to master.
• Appliance: Master and Hot Standby.

• Problem: During the appliances switch, the Hot Standby became Master and the former Master
stayed Master as well.The automated detection could not resolve the situation. For more details,
refer to the section Troubleshooting a Split-brain.
• Solution: Disable the High Availability configuration following the split-brain Manual Resolution.
You are in Restricted mode. From the page All SOLIDserver you can go back to Normal
mode: either configure the local SOLIDserver or delete all the remote appliances.
• Appliance: Master and Hot Standby.

• Problem: Either your appliances are in split-brain, one of them is in timeout or the replication
stopped.
• Solution: Follow the troubleshooting solution of the other message displayed in the GUI. Each
problem has a specific solution.
The Hot Standby stopped database replication stopped.
• Problem: The Hot Standby can no longer replicate the Master database. If they switch, you
lose the latest changes performed on the Master appliance.
• Solution: Find the origin of the problem, you might need to disable the High Availability and
configure it again following the procedures in the sections Configuring SOLIDserver for High
Availability Management.
1
This information is displayed in the gadget System information of the Master appliance Home page.
983
Troubleshooting a Split-brain
The Split-brain is a very specific case that might occur when two appliances are configured in
High Availability. Once configured, both appliances share the same HA UID but in the event of
a network disruption they might end up sharing the same role instead of keeping the two roles
on which the configuration relies: one Master and one Hot Standby.
This HA configuration requires that the Master appliance database can be edited and that its Hot
Standby replicates it, in real time, to be ready for a potential switch of the configuration. With two
Masters, whether they are both Master or one is Master and the other is Master (recovered),
there is no backup and both appliances can potentially overwrite each other's changes.
To help you in the prevention of the Split-brain, SOLIDserver follows a set of checks, when the
appliances communicate once again:
1. SOLIDserver starts up in Restricted mode and runs in normal mode if and only if no HA conflicts
are detected.
2. SOLIDserver checks if both appliances share the same version. If not, a message is displayed
on every page of the appliance with the latest version.
3. SOLIDserver checks if both appliances share the same role.
If it turns out that both appliances are Master, there is set of resolutions that SOLIDserver tries
and executes on its own to avoid staying in Restricted mode.
Automated Detection
When a Master appliance detects that the other appliance is also a Master, SOLIDserver performs
three checks to try and avoid a case of split-brain:
1. If no appliance has been edited since the last synchronization: the last appliance that
switched to Master remains Master and enrolls the other appliance as Hot Standby.
2. If one appliance has been edited since the last synchronization: the last appliance that
was modified becomes Master and enrolls the other appliance as Hot Standby.
3. If both appliances have been edited since the last synchronization: SOLIDserver puts
them in Restricted mode with the status Split-brain, as specified in the red message displayed
on every page of both appliances. To configure the HA again, you have to execute a Manual
Resolution as detailed in the section below.
Manual Resolution
The manual resolution is only needed when the appliances in HA are in a case of split-brain that
puts them in Restricted mode, as specified in the red message displayed on every page of both
appliances. This mode implies two behaviors:
1. The synchronization between the appliances stopped, as if you had two Standalone appliances
with the same HA UID.
2. You can still edit the database of both appliances but no changes are actually pushed on the
physical server(s).
To go back to a viable configuration, you have two possibilities:
• Disable the High Availability and configure it again as described in the section Disabling the
HA Configuration Without Losing the Database.
984
• Force the configuration and choose which appliance becomes the Master as described in the
section Switching the HA Configuration.
Disabling the HA Configuration Without Losing the Database

In some cases, like in the event of a split-brain, you might want to disable the HA configuration
but keep both appliances database. In this case, you need to switch one appliance to Standalone.
Before switching an appliance to Standalone, keep in mind that:
1. You should only switch an appliance to Standalone if:

• Your appliances in High Availability are in Split-brain. In which case, you end up with two
Master appliances and need to reconfigure the HA. For more details, refer to the section
Troubleshooting a Split-brain.
• Your appliances in High Availability disconnected somehow and the automatic switch was
disabled using the registry key detailed in the section If the Network is Unreliable. In which
case, the replication stopped and you need to set it up again.
In any other case, disabling the configuration should be done using the standard procedure
detailed in the section Disabling the HA Configuration.
2. It is impossible to switch a Master appliance to Standalone if it has a Hot Standby.
3. The Hot Standby appliance must always be the first one to be switched to Standalone.
4. Switching an appliance to Standalone erases the database entirely whether the appliance is
a Hot Standby or a Master. So if you switch both appliances to Standalone, you erase your
entire database.
5. Switching an appliance to Standalone automatically saves a backup file for the appliance.
6. Switching an appliance to Standalone has to be done locally.You must connect to the appliance
via its IP address.
To disable HA configuration by putting the Hot Standby appliance in standalone
1. Connect to your Hot Standby appliance through its IP address.

opens.
4. In the menu, select Tools > Reset local SOLIDserver to standalone. The wizard Reset local
SOLIDserver to standalone opens.
5. Click on OK to commit the switch. The report opens and works for a while, a backup of the
database is saved before the appliance database is erased.
The appliance Role is now Standalone. During the switch, the appliance might be unavailable.
Once the former Hot Standby appliance has rebooted and is reachable:
985
• Connect to it via its IP address and log in using the credentials of a user belonging to the group
admin.
• Configure the Internal Module setup once again. For more details, refer to the section Defining
the Internal Module Setup.
• Make sure the appliance is a Standalone, either in the General information gadget of the appli-
ance home page or on the page All SOLIDserver directly.
• You can display or download its backup file from the page Backup parameters. For more details,
refer to the section Managing Backups and Restoring Configurations.
To reconfigure the high availability, you must:
1. Connect to the Master appliance using its IP address.

2. Go to the page All SOLIDserver and make sure the former Hot Standby appliance has:
• The Role Standalone.
• The status OK.
3. If the Standalone appliance status is OK, you must:
• Enroll it as the Hot Standby. For more details, refer to the procedure To configure High
Availability between two appliances.
4. If the Standalone appliance status is not OK, you must:
• Delete it from the page All SOLIDserver of the Master appliance. For more details, refer to
the procedure To disable the High Availability configuration.
• Add it to list the All SOLIDserver again. For more details, refer to the procedure To add the
future Hot Standby on the page All SOLIDserver of the Master.
• Enroll it as the Hot Standby. For more details, refer to the procedure To configure High
Availability between two appliances.
Frequently Asked Questions

1. Can I be warned of configuration problems?
Yes, you can set an alert on the page All SOLIDserver to be informed of any change via
email or SNMP trap. For more details regarding the alerts configuration, refer to the chapter
Managing Alerts.
For instance, filter the appliances through the Status column to detect a split-brain or any
status different from OK. If your configuration ends up in split-brain, refer to the section
Troubleshooting a Split-brain.
2. Can I set up the HA on any network layer?
The appliances can be configured on layer 2 or 3 of the network.
Layer 2 configuration: If the appliances are configured on layer 2, they belong to the same
LAN. Therefore you can set up a VIP interface that would allow you to access the current
Master appliance of the configuration through the IP address you set (the original master if
it is acting as a master, or the Hot Standby if the configuration was switched). For more details,
refer to the section Configuring a VIP in the chapter Network Configuration.
986
Layer 3 configuration: If the appliances are configured on layer 3, they do not belong to the
same LAN.The HA is still configurable and running perfectly through the routers that connect
them but it is impossible to set a VIP to access the Master appliance.
3. Can I customize the HA mechanism to suit my network?
Yes, if your network is unreliable or experiences frequent disruptions, your administrator can
follow the procedure of the section High Availability Advanced Options. It details the registry
database key that you can edit to modify the HA number of retries or configure automatic
switch parameters.
4. What can I do from the Hot Standby appliance?
You cannot edit the database as it is replicating the content of the Master database. However,
from the Hot Standby appliance you can:
• Switch the appliances roles and convert the Hot Standby in Master. For more details, refer
• Switch the Hot Standby to Standalone. This operation must be performed carefully as it
erases the database entirely and disables the High Availability configuration. This operation
is only recommended in the event of a split-brain. For more details, refer to the section
Disabling the HA Configuration Without Losing the Database
• Set up the Network configuration page according to your needs. This page is independent
from the database and can therefore be configured differently on the Master and Hot
Standby appliances. For more details, refer to the chapters Remote Management of Other
Appliances and Network Configuration.
• Set up the System configuration page according to your needs. This page is independent
from the database and can therefore be configured differently on the Master and Hot
Standby appliances. For more details, refer to the chapters Remote Management of Other
Appliances and Network Configuration.
• Save a backup of the appliance. For more details, refer to the section Managing Backups
and Restoring Configurations.
However, you cannot restore the backup of an appliance in High Availability. You need to
disable the High Availability, restore the backup and then configure the High Availability
again.
987
Chapter 75. Remote Management of
Other Appliances
With one SOLIDserver appliance you can remotely manage other SOLIDserver appliances. All
remote appliances are managed from the page All SOLIDserver. For more details regarding this
page, refer to the section Browsing the High Availability Appliances Database.
From one management appliance, you can add a large number of appliances and manage them.
For instance, you can manage all the options available on the pages Network configuration and
Services configuration, and turn on or off some services.
Prerequisites
• You must have at least two SOLIDserver appliances.
• The appliances remotely managed must be in software version 5.0.0.P0 or higher.
• The remote management can only be configured from and with appliances using an IPv4 ad-
dress.
In addition, we advise setting all the appliances at the same time to monitor in real time and we
recommend having a stable network to ease the communication between the appliances.
Specificities
• Once you manage appliances remotely, they are available in the drop-down list SOLIDserver
as follows: <hostname> (<IP address>).
If an appliance is not reachable, it is listed as follows: <hostname> (<IP address>) - Timeout.

• The remote management of appliances allows you to remotely upgrade other appliances. For
more details, refer to the chapter Upgrading.
Configuring SOLIDserver to Remotely Manage Other

Appliances
Before managing remote appliances, you have to configure your management appliance locally.
Configuring the Management Appliance

The management appliance configuration is a simple option that assigns an IP address to the
appliance on which you are currently working.
To configure locally SOLIDserver management appliance
opens.
Your appliance is listed and marked Yes in the column Local. It does not have an IP ad-
dress.
988
Remote Management of Other Appli-
ances
3. In the menu, select Tools > Configure local SOLIDserver. The wizard Configure local
SOLIDserver opens.
4. In the drop-down list SOLIDserver IP address, select the IP address of the appliance you
are currently configuring.
5. Click on OK to commit the configuration. The report opens and closes. The All SOLIDserver
page opens again. The local appliance details are now completed with the Name (the host-
name), serial number, version, IP address, Role (Standalone) and Status (OK).
From then on you simply need to add other appliances and remotely manage them from the list
All SOLIDserver and the pages Network configuration and Services configuration.
Configuring the Remote Management

Once you configured your local appliance, you can add other appliances. These appliances are
listed and you can remotely manage them and make your local appliance a centralized manage-
ment platform.
To add an appliance to the page All SOLIDserver
opens.
3. In the menu, select Add > Remote SOLIDserver.The wizard Add/modify remote SOLIDserver
opens.
4. In the field SOLIDserver IP address, fill in the IP address of the appliance you want to add
to the list.
5. In the field 'admin' user password, type in the default SSH password (admin if you kept the
default SSH credentials) if it is not already filled in.
6. If you want to monitor the remote appliance, tick the box SNMP parameters. The configuration
fields open:
Table 75.1. SNMP parameters used to monitor the remote appliance

Field Description
SNMP port The port used to retrieve the remote appliance statistics. By default, the
port 161 is used. If you changed the UDP port of your SNMP server, you
must use the same port. For more details, refer to the section Managing
the SNMP Service.
between 1s and 5s or set it to 10s. By default, it is set to 5.
7. Click on OK to commit the addition. The new appliance is listed and marked Standalone in
the Role column and Remote (managed) in the Status column.
989
ances
You can add as many appliances as you need. Once you added them, they are listed in the page
All SOLIDserver. To ease the remote management of both lists from the central management
appliance, they are also listed in the drop-down list of the pages Services configuration and
Network configuration .
The appliances managed remotely are still accessible. If you access locally a remote appliance,
on the page All SOLIDserver the status of the local appliance is not OK but Invalid credentials.
Theses credentials refer to the 'admin' user password of the managing appliance because it
manages remotely several one or more appliances with a single administrative password. If you
configure the remote appliance locally, the status Invalid credentials is displayed on the page All
SOLIDserver of the managing appliance: the last appliance that edits a service or the list takes
over the control.
Managing the Network Configuration of a Remote Appliance

Once you added an appliance to the page All SOLIDserver, you can remotely manage the network
configuration of other appliances.
To remotely manage another appliance network configuration
opens.
2. In the section System, click on Network. The page Network configuration opens.
3. In the drop-down list SOLIDserver located under the menu, select one of your remote appli-
ances. The page refreshes.
4. Click on any of the listed settings to modify the network configuration. For more details, refer
to the chapter Network Configuration.
Managing the Services Configuration of a Remote Appliance

Once you added an appliance to the page All SOLIDserver, you can remotely manage the services
configuration of other appliances as well.
Keep in mind that you can remotely modify all the services to the exception of one: the
source email address of the alert. The address noreply@efficientip.com that sends you the alert
notifications has to be modified locally.
To remotely manage another appliance services configuration
opens.
3. In the drop-down list SOLIDserver located under the menu, select one of your remote appli-
ances. The page refreshes.
4. Click on any of the listed servers to modify their service configuration. For more details, refer
to the chapter Services Configuration.
990
ances
Monitoring Remote Appliances

There are a few ways of monitoring events on the management and remote SOLIDserver appli-
ances:
1. Displaying remote management events on the page Syslog.

2. Displaying the remote appliances Statistics.
3. Configuring the time and date on both the management appliance and remote appliance(s)
and configuring the alert Member clock drift on the management appliance to be notified of
any time drift.
Monitoring the Remote Management Logs

SOLIDserver allows you to monitor all events from the page Syslog. That way, you can know in
detail what appliances you manage remotely, when the remote appliance was added, etc.
To filter the page Syslog to only display the remote management logs
opens.
3. In the drop-down list SOLIDserver, select the appliance for which you want to display the
logs.
4. In the drop-down list Service, select ipmserver.
5. Filter the list via the column Log:
a. Type in HA* in the column search engine and hit Enter on your keyboard.
b. Double-click in the column search engine to display the filter constructor: select contains
in the drop-down list and type in HA* in the field. Click on APPLY .
Only the remote management related logs, including high availability.
Monitoring the Remote Appliances Statistics

SOLIDserver allows you to monitor the page Statistics or remote appliances.
If your remote appliances are in version 6.0.1 or higher you can even generate the statistics reports
of remote appliances from the management appliance. For more details, refer to the section
Generating a Report.
To access the Statistics of a remote SOLIDserver
opens.
991
ances

3. Under the menu, in the drop-down list SOLIDserver, select the remote appliance of your
choice. The page refreshes to display the statistics of the appliance you selected.
You can only display the statistics of a remote appliance in version 6.0.1 or higher, appliances
in lower versions are listed as follows: <hostname> (<IP address>) - Not supported.
Monitoring the Local and Remote Appliances Time and Date

If the time and date of all your appliances are synchronized, the alert Member clock drift can be
help you monitor the time drift that may occur between the local management appliance and any
remote appliance managed from the page All SOLIDserver.
If you plan on enrolling a remote appliance as Hot Standby, we strongly recommend that you
configure the time and date of both the management appliance and future Hot Standby appliances
through the NTP server. For more details, refer to the section Configuring the NTP Server.
If you do not want to enroll any remote appliance as Hot Standby, the synchronization is optional,
without both the local and remote appliances set at the exact same time, is useless to configure
the alert Member clock drift; you might even disable it. For more details, refer to the section En-
abling or Disabling Alerts.
You can configure the alert to suit your needs. By default:
• The alert is based on a filter of the column Time drift. The filter is set with a 20 seconds threshold
as follows: > 20 || < -20. The alert is raised:
• If the absolute time difference between the remote and the management appliances is
higher than 20 seconds.
• If the absolute time difference between the remote and the management appliance is lower
than 20 seconds.
To edit this threshold, refer to the procedure To edit the threshold of the alert Member clock
drift below.
• The time difference check is performed every 5 minutes. To edit the frequency, refer to the
procedure To edit the alert Member clock drift default frequency and recipients below.
• The alert sends an email alert to the users of the group admin. If you did not configure the
users' email address properly, they are not notified. To edit the recipients, refer to the To edit
the alert Member clock drift default frequency and recipients below.
To edit the threshold of the alert Member clock drift

opens.
992
ances
6. In the column Alert filter, click on Edit alert filters.You are redirected to the page All SOLID-
server, where the alert was created.
8. In the search engine of the column Time drift, the default filter > 20 || < -20 is visible.
9. Edit the filter according to your needs.
to the page Alert definitions.
To edit the alert Member clock drift default frequency and recipients

opens.
5. At the end of the line of the Member clock drift, click on . The properties page opens.
7. Tick the box Expert mode.
8. To edit the alert check frequency:
a. Tick the box Edit scheduling. The schedule drop-down lists appear.
b. By default, only the drop-down list Minutes is set, with the value Every 5 minutes.
c. Select the values that suit your needs.
9. To edit the group of users receiving the alert or add recipients:
a. Make sure the box Send mail is checked.

b. In the drop-down list Mailing lists, select the group of users of your choice.
c. In the field Additional Mail, type in the email address of a user that does not belong to
the group selected. Click on ADD . The email address is moved to the Additional Mail
List. Repeat these actions for as many users as you need.
visible again.
Replacing an Appliance Managed Remotely

At some point, you might need to replace one of the appliances that you are remotely managing.
To successfully replace an appliance managed remotely you need to:
1. Remove the appliance from the page All SOLIDserver of the managing appliance
993
ances
For more details, refer to the section Removing Appliances Managed Remotely.
2. Add the new appliance to the page All SOLIDserver of the managing appliance
• First, you need to configure locally the new appliance. For more details, refer to the section
Configuring the Management Appliance.
• Second, you need to add the new appliance to the page All SOLIDserver of the managing
appliance. For more details, refer to the section Configuring the Remote Management.
Removing Appliances Managed Remotely

You can delete appliances from the page All SOLIDserver to stop managing them remotely. If
the appliance in question it is not part of a High Availability configuration, it does not have any
impact.
Keep in mind that it is impossible to delete the local appliance from the this list.
To delete an appliance from the page All SOLIDserver
3. Tick the appliance you want to stop managing and delete from the list. You can tick as many
as needed.
5. Click on OK to commit the deletion. The report opens and closes. The appliance is not listed
anymore.
994
Chapter 76. Monitoring
There are many ways of monitoring SOLIDserver, for administrators and standards users, from
the resources to the logs and SNMP profiles and more. This chapter gathers the following mon-
itoring possibilities:
• Managing Reports.
• Managing Alerts.
• Managing the Logs.
• Monitoring the Appliance Statistics.
• Tracking Sessions.
• Tracking Users.
• Managing SNMP Profiles.
• Monitoring Using SNMP.
• Displaying Netstat Data.
• Sizing the Database Tables.
Managing Reports
From the modules DHCP, DNS, NetChange and Administration you can generate a number of
reports to HTML or PDF format. These reports can be generated at a given time or scheduled.
All existing reports are detailed in the section Browsing the Reports Database.
To export your data, refer to the chapter Exporting Data.
Browsing the Reports Database

To list the reports
opens.
2. In the menu, select Monitoring > Reports. The Reports page opens.
To list the scheduled reports
opens.
3. In the menu, select Display > Scheduled reports. The Scheduled reports page opens.
DHCP Reports
You can generate advanced reports for DHCP servers and scopes.
995
Monitoring
DHCP Server Reports
All the DHCP server dedicated reports are available in v4 and v6 on the page All servers, on the
server properties page and on all the listing pages displaying the content of a specific server. To
generate these reports, refer to the section Generating a Report.
Clients Most Used OS
• Prerequisite: Selecting at least one server.

• Description: Contains a table, for each physical server selected, detailing the lease clients most
used OS for all the scopes of the server. It contains the OS name, the percentage of leases
that use it and the total number of leases that it corresponds to.
Server Data Exchanges

• Description: Contains charts detailing the physical servers data exchanges (Discover, Offer,
Request and Acknowledge) over the last 24 hours, last 7 days, last 30 days and last 12 months.
Server Options Comparison
• Prerequisite: Selecting at least two servers.

• Description: Compares one by one all the DHCP options configured on the selected servers.
For more details regarding DHCP options, refer to the chapter DHCP Options.
Server Usage Chart

• Description: Contains charts detailing the physical servers IP addressing management, number
of allocated leases, number of used statics, number of free IP addresses: over the last 24
hours, last 7 days, last 30 days and last 12 months.
Most Used Networks

• Description: Contains a table for each selected physical server detailing the most used scopes
and what they contain.
Server Usage Evolution Charts

• Description: Contains lease and request dedicated charts providing an overview of a server
usage evolution. The chart results are based on server usage a daily, monthly, semestrial and
yearly basis.
DHCP Scope Reports
All the DHCP scope dedicated reports are available in v4 and v6 on the page All scopes, on the
scope properties page and on all the listing pages displaying the content of a specific scope. To
generate these reports, refer to the section Generating a Report.
Clients Most Used OS
• Prerequisite: Selecting at least one DHCP server managing IPv4.
996
Monitoring
• Description: Contains a table, for each physical server scope selected, detailing the lease clients
most used OS. It contains the OS name, the percentage of leases that use it and the total
number of leases that it corresponds to.
Scopes Options Comparison
• Prerequisite: Selecting at least two scopes.

• Description: Compares one by one all the DHCP options configured on the selected scopes.
For more details regarding DHCP options, refer to the chapter DHCP Options.
Scopes Summary
• Prerequisite: Selecting at least one scope.

• Description: Provides detailed tables of the DHCP options activity and origin of the selected
scope(s). For instance, it indicates if the option was set at scope level or inherited from the
managing server.
DNS Reports
You can generate advanced reports for DNS servers, views and zones.
DNS Server Reports
All the DNS server dedicated reports are available on the page All servers, on the server properties
page and on all the listing pages displaying the content of a specific server. To generate these
reports, refer to the section Generating a Report.
A records without an IPv4 address or alias
• Prerequisite: Selecting at least one server configured with DNS to IPAM replication.
• Description: Contains the list of A records that are not associated to an IPv4 address or alias,
by server.
AAAA records without an IPv6 address or alias
• Description: Contains the list of AAAA records that are not associated to an IPv6 address or
alias, by server.
CNAME records without an alias
• Description: Contains the list of CNAME records that are not associated to an IPv4 or IPv6
alias, by server.
• Description: Contains the list of PTR records that are not associated to an IPv4 address, by
server.
997
Monitoring
• Description: Contains the list of PTR records that are not associated to an IPv6 address, by
server.
Route 53 Incompatibilities
• Prerequisite: Selecting at least one Amazon Route 53 server.

• Description: Contains a list of all the selected server options and configurations incompatible
with Amazon Route 53. No piece of information listed in the tables can ever be replicated on
the Amazon Route 53 server you are managing via SOLIDserver.
• Prerequisite: Selecting at least one Amazon Route 53 server.

• Description: Contains a list of all the NS records and their corresponding IP address of all the
zones of the server. It also indicates if they were pushed to the smart architecture, that is to
say replicated on all the servers managed by the smart.
Servers Configuration

• Description: Contains all the server configuration details divided into 4 tables: Settings (all the
options), ACLs (all the access control lists), Keys (all the DNS keys configured) and Groups
(all the group of users that have access to the server).
Hybrid DNS Engine Incompatibilities
• Prerequisite: Selecting at least one physical server.

• Description: Contains the list of all the options and configuration that make the server incom-
patible with Hybrid. For more details, refer to the section Generating the Hybrid Incompatibilities
Report.
Server Peak Hour
• Prerequisite: Selecting at least one server; except an Amazon Route 53 server. Cloud servers
cannot be monitored by this report.
• Description: Contains a table displaying the selected server peak hour over the last 24 hours.
It indicates the number of queries per second processed by the server at its busiest hour in
the last 24 hours.
Servers Configuration Comparison
• Prerequisite: Selecting at least two servers.

• Description: Contains tables that allow to compare the selected servers configurations: DNS
server parameters, DNS server ACLs and DNS server keys.
Query Rate per Server
• Description: Contains four charts representing the response to queries curve of the selected
server: over the last 24 hours, last 7 days, last 30 days and last 12 months.
Server Reply to Queries Charts
998
Monitoring
• Description: Contains four charts representing the four types of response to queries (success,
failure, inexistent RR set and Nxdomain) for the selected server: over the last 24 hours, last 7
days, last 30 days and last 12 months.
Server Usage Charts

• Description: Contains usage evolution charts for the selected server: queries over the past
week, last 6 months, last month and past year at the time of the generation of the report.
DNS View Reports
All the DNS view dedicated reports are available on the page All views, on the view properties
page and on all the listing pages displaying the content of a specific view. To generate these re-
ports, refer to the section Generating a Report.
View Statistics

• Description: Contains two tables for every selected view. The first table displays the number
of zones and indicates how many are Forward zones. The second table details all the zones
1
of the view with: their name, their type and the amount of known records they contain.
DNS Zone Reports
All the DNS zone dedicated reports are available on the page All zones, on the zone properties
page and on all the listing pages displaying the content of a specific zone. To generate these
reports, refer to the section Generating a Report.
• Prerequisite: Selecting at least one Amazon Route 53 zone.

• Description: Contains a list of all the NS records and their corresponding IP address for the
selected zone. It also indicates if they were pushed to the smart architecture, that is to say
replicated on all the servers managed by the smart.
Zones Missing RRs
• Prerequisite: Selecting at least one zone.

• Description: Contains a list of all the misconfigured records within the selected zones divided
into 5 tables: PTR records without A or AAAA, A or AAAA records without PTR, CNAME records
without A or AAAA, NS records without A or AAAA and MX records without A or AAAA.
Zone Statistics
• Prerequisite: Selecting at least one zone.

2
• Description: Contains tables listing all the selected zones: name, type and amount of known
records they contain. The report contains as many tables as there are managing servers among
the selected zones.
1
By known records, we mean all the record types that have ever been created or managed on the appliance.
2
By known records, we mean all the record types that have ever been created or managed on the appliance.
999
Monitoring
Zones Configuration Comparison
• Prerequisite: Selecting at least two zones.

• Description: Contains tables detailing the allow-transfer, allow-update, forward, masters and
notify parameters configuration for the selected zone(s). Each parameter value is listed with
the zone name it is configured for and the server it belongs to.
NetChange Reports
You can generate advanced reports for NetChange network devices.
NetChange Network Device Reports
All NetChange dedicated reports are available on the page All network devices, on the network
device properties page and on all the listing pages displaying the content of a specific network
device. To generate these reports, refer to the section Generating a Report.
Network Devices Properties
• Prerequisite: Selecting at least one device.

• Description: Contains basic information regarding the selected device(s): the Device name,
Device type, Ports usage (%) and Ports used.
NetChange/IPAM/DHCP data comparison
• Prerequisite: No need to select any device. The report automatically takes into account all the
devices.
• Description: Contains inconsistencies between the network devices managed via NetChange
and their use across the modules. All the inconsistencies found are listed in 5 tables: NetChange
devices not listed in the IPAM / DHCP ranges, IP addresses associated with a different MAC
address in the IPAM, MAC addresses associated with a different IP address in the IPAM, IP
addresses with a different MAC address in the DHCP leases list and MAC addresses with a
different IP address in the DHCP leases list. In each table, the objects concerned are detailed
through the columns IP address, MAC address, DNS name, IPAM MAC address and/or
Device/Slot/port.
Network devices summary
• Prerequisite: No need to select any device. The report automatically takes into account all the
devices.
• Description: Contains information regarding all the network devices you manage through
SOLIDserver divided into four sections: Summary that contains all the network devices dedicated
pie charts available by default on NetChange homepage, Network devices model by vendor
that contains charts displaying your devices vendors and models, Top 50 most used network
devices that contains a table listing the most used devices with the percent of port usage and
the total number of used ports and finally Top 50 most unused network devices that contains
a table listing the least used devices with the percent of port usage and the total number of
used ports.
Administration Reports
From the module Administration, you can generate advanced reports for the appliance statistics
and users.
1000
Monitoring
Appliance Statistics Reports
All the appliance statistics dedicated reports are available on the page Statistics. To generate
these reports, refer to the section Generating a Report.
Statistics chart
• Prerequisite: No selection required. However, only users of the group admin can access the
page.
• Description: Contains all the charts available on the page Statistics. Their content depends on
the time of the generation.
Network traffic
• Prerequisite: No selection required. However, only users of the group admin can access the
page.
• Description: Contains charts representing all the ingoing and outgoing traffic on your network
over the last 24 hours, last 7 days, last 30 days and last 12 months.
User Reports
A report allows to export all the permissions of a user from the page Users. To generate this report,
refer to the section Generating a Report.
Users rights in each group
• Prerequisite: Selection at least one user.

• Description: Contains a table displaying for the selected user(s) their User name, Group name,
Resources and User name. In other words, the group(s) of users they belong to, the objects
they have access to and the actions they can perform on these objects.
The report is empty for disabled users.
Generating a Report
From a set of listing and properties pages you can generate and download reports in PDF or
HTML format.
Keep in mind that if the report you are generating contains charts, choosing the HTML format
requires you to be connected to the appliance via its domain name when you open the report,
otherwise the charts are empty.
To generate a report from a listing page
1. Go to the page of your choice. All existing reports are detailed in the section Browsing the
Reports Database.
2. If necessary, tick the object(s) you want to generate the report for.
Note that from the page Statistics, in the drop-down list SOLIDserver, you can select your
local appliance or a remote one, only if the remote appliance is in version 6.0.1 or higher.
3
3. In the menu, select Report > <report-of-your-choice> . The corresponding wizard opens.
3
The reports dedicated to Compare DNS data with IPAM data and Amazon Route 53 are all listed in the submenu of the same name.
1001
Monitoring
4. In the list Report format, select an export format, either HTML or PDF. By default, HTML is
selected.
6. In the drop-down list Action, select Generate new data. If you already have generated a
report for the same object, the drop-down list allows to select and generate it again.
To generate a report from a properties page
Reports Database.
4
3. In the menu, select Report > <report-of-your-choice> . The corresponding wizard opens.
selected.
6. In the drop-down list Action, select Generate new data. If you already have generated a
report for the same object, the drop-down list allows to select and generate it again.
Scheduling a Report
The generation of reports can easily be scheduled for all types of reports through the same wizard
as for immediate generation.
To schedule the generation of a report
Reports Database.
2. If necessary, tick the object(s) you want to generate the report for.
3. In the menu, select Report > <report-of-your-choice>. The corresponding wizard opens.
selected.
Keep in mind that if the report you are generating contains charts, choosing the HTML format
requires you to be connected to the appliance via its domain name when you open the report,
otherwise the charts are empty.
4
The reports dedicated to Compare DNS data with IPAM data and Amazon Route 53 are all listed in the submenu of the same name.
1002
Monitoring
5. In the drop-down list Action, select Schedule the report. The page refreshes and displays
the scheduling fields.
6. Configure the export frequency or date and time of export using the table below.
Table 76.1. Scheduled report fields

Field Description
Day(s) of the week In this drop-down list, select a frequency (over the whole week or for a specific set of
days) or a specific day of the week. By default, Every day is selected.
Date of the month In this drop-down list, select a specific day of the month or a frequency (every day)
for the refresh. By default, Every day is selected.
Month In this drop-down list, select a specific month or Every month. By default, Every month
is selected.
Hour In this drop-down list, select a frequency (period of time), i.e. a set of hours or a spe-
cific hour of the day. By default, 20 is selected.
Minute In this drop-down list, select a moment (o'clock, quarter past, half past or quarter to).
By default, 00 is selected.
Name In this field, name the scheduled export in this field. By default, it is named after the
reports generation service. This field is required.
Rights as In this drop-down list, select a user, his/her rights and limitations are applied to the
report: only the items this user has access to are listed in the export.
7. Click on OK to commit the scheduling. The report opens and closes.
The scheduled report configuration is available on the page Scheduled reports, refer to the
procedure To list the scheduled reports.
For more details regarding scheduled reports refer to the section Managing Scheduled Reports
Configuration Files.
Downloading and Displaying Reports

From the page Reports, you can download PDF reports and open the HTML reports in a new
tab of your browser.
All the generated reports are listed on this page whether they were generated at a specific time
or scheduled.
To download a PDF report
opens.
3. In the column Format, filter the list through to display only PDF reports.
4. In the column Name, click on the report of your choice to download it to your computer.
1003
Monitoring
To open an HTML report
opens.
3. In the column Format, filter the list through to display only PDF reports.
4. In the column Name, click on the report of your choice to download it to your computer.
Managing Scheduled Reports Configuration Files

The Scheduled reports page gathers the configuration details of all the scheduled reports. It allows
you to disable and enable back a scheduling or delete it. Every time a report is generated, it is
listed on the Reports page. For more details, refer to the section Downloading and Displaying
Reports.
To enable/disable a scheduled report
opens.
4. All the scheduled reports are listed by name, report type and format.
5. Tick the scheduled report of your choice.
7. Click on OK to commit your choice. The report opens and closes. The scheduled report
configuration is now OK or Disabled.
To delete a scheduled report
opens.
4. All the scheduled reports are listed by name, report type and format.
5. Tick the scheduled report you want to delete.
6. In the menu, select Edit > Delete. The Delete wizard opens.
7. Click on OK to commit your choice. The report opens and closes. The scheduled report
configuration is no longer listed.
Managing Alerts
SOLIDserver offers a number of customization options that include the alert configuration from
any page. You can be notified of the changes of your choice (new value, status, etc.) either via
email or via an SNMP trap. Alerts provide an extra monitoring system.
1004
Monitoring
Prerequisites
• To properly set an SNMP trap on an alert, make sure the SNMP and SMTP servers are properly
configured. For more details, refer to the chapters Managing the SNMP Service and Configuring
the SMTP Relay.
• To properly set mail notifications on an alert, you need to specify a group of users or specific
mail addresses. Make sure the email addresses of the group members and/or those you spe-
cified in the wizard are valid as incorrect email addresses cannot receive alerts. Also, make
sure the groups you specify is configured with sufficient rights to assess the situation. For more
details, refer to the chapter Managing Users.
Browsing Alerts
The Administration module contains two pages dedicated to alerts. You cannot configure the
columns display on these pages.
• The page Alerts displays the details of all the alerts that have been raised: their priority, when
they were raised and released, their current state, etc.
• The page Alerts Definition contains all the alerts configured in SOLIDserver. It displays the
configuration details of each alert, provides a link to edit the alert filters and allows to enable/dis-
able each alert.
Browsing the Alerts Database
To display the page Alerts
opens.
3. To display all the alerts, whether they are acknowledged/dismissed or not, under the menu,
tick the box Display all alerts .
To display the page Alerts Definition
opens.
2. In the section Monitoring, click on Alerts. The page Alerts opens.
4. To display the alerts related to a specific alert definition, in the column Alert name, click on
the name of your choice. The page Alerts opens and displays only the alerts related to that
specific definition.
5. To display all the alerts, whether they are acknowledged/dismissed or not, under the menu,
tick the box Display all alerts .
To display an alert properties page
opens.
2. In the section Monitoring, click on Alerts. The page Alerts opens.
1005
Monitoring
3. To display the an alert properties page from the page Alerts:
• In the column Alert name, click on the of your choice. The properties page opens.
4. To display the an alert properties page from the page Alerts Definition:
a. In the breadcrumb, click on Alerts Definition. The page Alerts Definition opens.
b. At the end of the line of the alert name of your choice, click on . The properties page
opens.
Understanding the Columns on the page Alerts Definition
By default, the page Alerts Definition provides an overview of all the alerts created and their
configuration through six columns:
Table 76.2. The columns on the page Alerts Definition

Column Description
Alert Name The alert name.
Condition The trigger condition of the alert, 0 being the status or value that triggers the alert if met
(=), different (!=, <, >), etc.
Created on The alert creation date and time.
Scheduling The check frequency for the parameters that trigger the alert.
Alert filters The filters set on the page before creating the alert. Each alert provides the link to edit
these filters. For more details, refer to the section Editing the Alert Filters.
Status Released: once the alert is created it is Released on the page Alerts Definition.
Raised: once the configured parameters are met, the alert is Raised and is listed on the
page Alerts.
State The alert definition status, either Enabled or Disabled.
The alert properties page displays extra information that can be configured such as the severity,
priority, recipients of the email, etc.
Understanding the Columns on the page Alerts
By default, the page Alerts displays all the raised alerts and their details.
Keep in mind that, by default, only the raised alerts (that have not been either acknowledged or
have been manually set back to non acknowledged) are displayed on that page. To display all
the formerly raised alerts, refer to the procedure To display the page Alerts.
Table 76.3. The columns on the page Alerts

Column Description
Severity The alert severity that you set upon creation: Minor, Major, Crash or Block.
Module The name of the module where the alert was created.
Sub Module The name of the page within the module where the alert was created.
Alert Name The name given to the alert upon creation.
Priority The level of priority you set upon creation: Low, Normal, High, Urgent or Immediate.
Begin date The time and date when the alert went from released to raised, i.e. the moment the para-
meters set were met.
End date The time and date when the alert went from raised to released.
1006
Monitoring
Column Description
Starting since The period of time since the alert has been raised.
State Released: when the alert has reached its End date.
Raised: when the parameters set for the alert are met, the alert is raised.
Adding Alerts
From any page within SOLIDserver you can create alerts from the menu Preferences. Before
adding alerts you can filter the list to customize the trigger and create the alerts that suit your
needs. So if you decide to filter the page All zones via the column Status with !=OK and then add
an alert, the alert would be triggered when any zone listed changes status to a status different
from OK and send you an email and/or an SNMP trap depending on what you configure.
To add an alert
This procedure is an example, it sends an alert if any zone status changes to anything but OK.
1. Go to the page of your choice and filter the list according to your needs.
b. Click on DNS zones. The page All zones opens.
c. In the column Server, click on the name of the server of your choice to display the zones
it contains.
d. Double-click in the search engine of the column Status. The filter constructor appears.
e. In the drop-down list, select != (different from).
f. Among the statuses listed, tick OK. OK is now displayed in the field. A new line appears.
g. Click on APPLY . The list is now filtered and only the zones that have a status different
from OK are displayed.
2. In the menu, select Preferences > Add an Alert. The wizard Add an alert definition opens.
3. In the field Name, name the alert. By default, the alert is named after the module and page
from where you configure it, in our example DNS: Zones.
4. In the field Description, you can type in a description if needed.
5. In the section Expert mode, tick the box to display the expert configuration fields.
6. Through the fields Filter results and Value, you can configure the alert execution parameters.
Table 76.4. Alert execution configuration fields

Field Description
Filter results You can select != (different from), > (Greater than), < (Less than) or == (Equal to).
Any of these conditions affects the number typed in the field Value. By default, !=
(different from) is selected.
Value You can type in a number that corresponds to the threshold of your the filter you set
before adding the alert. By default, 0 is displayed.
For instance, if you do not want the alert to be triggered for less than 2 zones with a status
different from OK, you can select Greater than in the drop-down list Filter results and 2 in
the field Value.
1007
Monitoring
7. In the section Triggered by change, tick the box if you want your alert to match your filter
only by change. In the case of our example, if you do not tick the box and three zones already
correspond to the filter (they could be in delayed create, timeout...), the alert is triggered if,
at the next check, the zones are still not set to OK.
8. In the drop-down list Alert Priority, define the alert priority. It can be Low, Normal, High, Urgent
or Immediate.
9. In the drop-down list Alert Severity, define the alert severity. You can choose among Minor,
Major, Crash and Block.
10. In the drop-down list Alert Group Owner, select a group of users among the ones you created.
11. Tick the box Edit scheduling to display the related fields.
Table 76.5. Alert check scheduling parameters

Field Description
day of the week.
By default, the check is scheduled every 5 minutes of every hour, day and month.
12. Tick the box Send mail to display the related fields.
Table 76.6. Email notification configuration parameters

Field Description
Mailing lists Select a group of users among the ones created on the page Groups (Administration
module). Make sure that the email address of the users belonging to the selected
group is configured, otherwise they can never receive the alert.
Additional Mail Type in the email address of the recipient of the alert and click on ADD to move it to
the Additional Mail List. Repeat these actions from as many recipients as needed.
Additional Mail List In this list are displayed all the recipients of the alert email.
13. Tick the box SNMP Trap to display the related fields.
Table 76.7. SNMP trap configuration parameters

SNMP version Select the version of SNMP, either v2c or v3
SNMP Destination Type in the IP address of the network management platform.
SNMP Community Type in the community string that would act as a password to access the SNMP agent.
Raised alert SNMP Type in a custom OID to be sent when the alert is raised.
OID
Released alert SN- Type in a custom OID to be sent when the alert is released.
MP OID
14. Click on OK to commit the alert creation. It is now listed in the page Alerts Definition and
marked as Released.
1008
Monitoring
Editing Alerts
The alerts can be edited in two different ways:
1. You can edit the alert definition: rename it, change the check frequency, add or remove email
recipients, set or remove an SNMP trap...
2. You can edit the filters that were set on the page when the alert was created.
Editing an Alert Definition
At any time you can edit the properties of your alert.
To edit an alert definition
opens.
2. In the Monitoring section, click on Alerts. The page Alerts opens.
4. At the end of the line of the alert name of your choice, click on . The properties page opens.
6. Edit the alert according to your needs. For more details, refer to the steps 3 to 12 of the
procedure To add an alert.
visible again.
Editing an Alert Filters
In addition to editing an alert definition, you can edit the filter(s) it uses. This allows you to edit
the alert triggers if the initial alert settings no longer suit your needs.
To edit the filters of an alert
opens.
5. In the column Alert filter, click on Edit alert filters. You are redirected to the page where the
alert was created.
7. In the search engine of the filtered column(s), edit or remove the filter(s) according to your
needs.
8. Add filters based on new columns if relevant.
1009
Monitoring
If you do not tick the box, your changes are discarded.

to the page Alerts Definition.
Enabling or Disabling Alerts

If at some point you want an alert definition to stop raising alert instances, you can disable it.
When you want it to raise alert instances again, enable it again.
To enable/disable an alert
opens.
4. Tick the alert(s) of your choice.
6. Click on OK to commit the change. The report opens and closes. The page is visible again,
the alert definition is marked as Enabled or Disabled.
You can also click on Enabled or Disabled in the column State to, respectively, disable or enable
an alert.
Update an Alert State

At any time, you might want to check that you did not miss any alert. It is useful if you did not
configure an alert to trigger on change or if, on the contrary, you just configured it with a check
every 5 minutes.
The option Update alerts state now immediately checks if the selected alert is Raised or Released.
To force an alert definition check
opens.
4. Tick the alert(s) that you want to check.
5. In the menu, select Tools > Update alerts state now. The wizard Force alert trigger opens.
6. Click on OK to commit the check. The report opens and closes. The page is visible again.
To see if the alert is now raised, go to the Alerts page.
Acknowledging and Dismissing an Alert

Once an alert was raised, you can acknowledge it in order to make sure that next time it is raised
you actually only see the instances that matter and not old ones. The alert is then automatically
dismissed, meaning that it no longer appears on the page Alerts unless you tick the box Display
All Alerts.
1010
Monitoring
To acknowledge an alert
opens.
3. Tick the raised alert(s) that you want to acknowledge.
4. In the menu, select Edit > Acknowledge / Dismiss. The wizard Acknowledge / Dismiss an
alert opens.
again, the alert is no longer listed.
6. Under the menu, tick the box Display All Alerts to display all the previous instances.
Reinstate an Acknowledged Alert

Once an alert was raised, you can acknowledge it as described in the section above, which dismiss
it from the page Alerts. You can however reinstate it as non-acknowledged to display it again on
the page.
To stop acknowledging an alert
opens.
3. Tick the raised alert(s) that you want to reinstate.
4. In the menu, select Edit > Non Acknowledge. The wizard Non Acknowledge an Alert opens.
again, the alert is displayed even though the box Display All Alerts is unticked.
Deleting an Alert
For safety measures, you cannot delete an alert instance on its own. However, from the page
Alerts Definition, you can delete an alert completely i.e. delete its configuration details and the
instances of when it was raised.
To delete an alert
opens.
4. Tick the alert(s) that you want to delete.
5. In the menu, select Edit > Delete an Alert. The wizard Delete an alert opens.
6. Click on OK to commit the alert deletion. The report opens and closes. The alert is no longer
listed on the pages Alerts Definition and Alerts.
1011
Monitoring
Managing the Logs

Two pages allow to manage the logs: Logs Visualization, also called Syslog, allows to monitor
them; and Configuration of Network Logs, allows to redirect them.
Logs Visualization
In the module Administration, the page Syslog provides a list of the logs of all the services em-
bedded into SOLIDserver. You can locate a specific operation using the filters located under the
menu and/or the columns.
Note that you can display the logs of remote appliances from the management SOLIDserver. For
more details regarding remote management, refer to the chapter Remote Management of Other
Appliances.
To display the logs of your choice on the page Syslog
opens.
2. In the section Monitoring, click on the button Logs visualization. The page Syslog opens.
3. Under the menu:
a. The drop-down list SOLIDserver allows to select the SOLIDserver of your choice.
If you are not managing any remote appliance, the list only displays local.
If you are managing remote appliances, you can select the local appliance - listed using
its hostname - or a remote SOLIDserver - listed using its hostname and IP address as
such: hostname (IP address).
b. The drop-down list Services allows to select the service of your choice:
Table 76.8. The available Services

Service Description
named The DNS log messages.
dhcpd The DHCP log messages.
ipmserver The internal transactional engine log messages.
a
auth The authentication log messages .
messages All the other log messages queried.
a
They are only available for appliances in version 6.0.2 or higher.
If you have configured external storage of the User Tracking rule operations, you can
also have the service ipmserver-rules. For more details, refer to the section Forwarding
Rule Operations to Syslog.
c. The box Automatic refresh allows to automate the refresh of all the logs.
By default, the refresh is scheduled to be executed every 10 seconds. To change the

refresh frequency, refer to the procedure To change the automatic refresh frequency.
4. Two columns allow to filter and sort the logs according to your needs.
1012
Monitoring
Table 76.9. Syslog columns

Column Description
Time Displays the date and time when the service was executed. You can edit the time
format (local time or UTC-GMT) and the date format (mm/dd/yyyy or dd/mm/yyyy) via
the menu Preferences > My Account > Set Time/Date format.
Log Displays the log description.
At any time, you can change the Automatic refresh frequency from the registry database.
To change the automatic refresh frequency
opens.
opens.
3. In the filter Name, type in the syslog.refresh. The list is filtered and the registry key
www.system.syslog.refresh is listed.
4. In the column Value of that key, click on the value listed. The default value is 10. The wizard
Registry database Edit a value opens.
5. In the field Value, replace the current value with the value of your choice (in seconds).
6. Click on OK to commit your modification. The report opens and closes. The list is visible
again and now the automatic refresh occurs at the frequency you just configured.
Configuration of Network Logs

Users of the group admin can choose to redirect logs of several appliances toward a remote
syslog server to monitor them from one centralized point. This redirection can be configured to
send the logs of a particular service (ipmserver, named or dhcpd), above a particular severity
level. The syslog severity levels are listed in the table below:
Table 76.10. Syslog severity levels

Code Severity level Description
0 (maximum severity level) Emergency The system has completely crashed and is no longer function-
ing.
1 Alert The system is unstable and a crash is imminent. Action must
be taken immediately.
2 Critical Critical conditions. Should be corrected immediately.
3 Error Error conditions. Non-urgent failures that should be relayed
to administrators.
4 Warning Warning conditions. Indicates that an error is returned if no
action is taken.
5 Notice Unusual situation or significant event that is typically part of
normal day-to-day operations.
6 Information Normal operational messages - may be harvested for report-
ing, measuring throughput, etc - no action required.
7 (minimum severity level) * (Debug) Useful messages to developers for debugging, not useful
during operations.
1013
Monitoring
Selecting a log level automatically includes logs with a higher severity (i.e. with a smaller code
number). For instance, if you select Warning, the logs from levels 4 to 0 are redirected; leaving
aside the Debug, Information and Notice logs.
To add a syslog redirection
opens.
2. In the menu, select Monitoring > Configuration of Network Logs. The page Configuration
of Network Logs opens.
3. In the menu, select Add > Syslog configuration. The wizard Syslog configuration opens.
4. In the drop-down list Services, select the service (ipmserver, named or dhcpd) for which you
want to redirect the logs.
5. In the drop-down list Priority, set the redirection threshold through the logs severity levels.
For instance, if you select Warning, the logs from levels 4 to 0 are redirected; leaving aside
the Debug, Informational and Notice logs.
6. In the drop down-list Type, the Network value is selected by default.
7. In the field Target server, type in the IP address and port (e.g. 10.0.0.45:4432) of the Syslog
server you want the logs to be redirected to.
8. Click on OK to commit your logs redirection. The report opens and closes. The page Config-
uration of Network Logs is visible again and displays the list of logs redirections.
Monitoring the Appliance Statistics

The page Statistics provides charts dedicated to the appliance services traffic and state. Keep
in mind that:
• The system stores data during a year.

• The page allows to display the statistics of your local appliance and the statistics of remote
appliances, if they are in version 6.0.1 or higher. For more details regarding remote manage-
ment, refer to the chapter Remote Management of Other Appliances.
• Every chart displaying local data is a gadget in essence and can be displayed on any dashboard
using the dedicated pushpin. For more details, refer to the chapter Building Your Dashboards.
• You cannot use the statistics charts of a remote appliance as a gadget.
• You can export all the charts on the page, whether they display local or remote data, in specific
reports. For more details, refer to the section Appliance Statistics Reports below.
• Except for the panel Processes states, on each chart you can zoom in and out of the charts
or decide the period and data to display. For more details refer to the section Charts.
To access the page dedicated to SOLIDserver Statistics
opens.
1014
Monitoring
You can choose to display your local appliance statistics or the ones of a remote appliance.
To access the Statistics of a remote SOLIDserver
opens.
3. Under the menu, in the drop-down list SOLIDserver, select the remote appliance of your
choice. The page refreshes to display the statistics of the appliance you selected.
You can only display the statistics of a remote appliance in version 6.0.1 or higher, appliances
in lower versions are listed as follows: <hostname> (<IP address>) - Not supported.
Each chart on the page has a specific purpose:
Table 76.11. The charts of the page Statistics

a
Chart Description Unit of Measure-
ment
DNS traffic The rate of DNS requests sent and received. Bytes per second
DHCP traffic The rate of DHCP requests sent and received. Bytes per second
HTTP traffic The rate of HTTP requests sent and received. Bytes per second
SNMP traffic The rate of SNMP requests sent and received. Bytes per second
Database replication traffic The input and output exchanges during the database replica- Bytes per second
tion between two appliances set in a High Availability config-
uration.
Load average The load of all the system's CPUs on an average of 1, 5 and Bytes
15 min.
CPU per process The percentage of CPU used by each enabled service. Percent
Memory usage per process The memory usage of each enabled service. Bytes
I/Os per process The total data input and output of each process. IO per second
SQL queries The number of SQL queries made by the system. Queries per second
Threads The number of threads executed by the system. Threads per second
User sessions The number of users connected at any time. Connections count
Disk usage The disk usage. Percent
Processes state The state of all the services embedded into SOLIDserver: Checked every
either OK or down. The DNS and DHCP analytics are part of minute
the processes as well.
a
The name and IP address of the appliance can be displayed next to the chart name.
Generating Statistics Reports

EfficientIP provides statistics dedicated reports. The reports on inconsistencies might be empty
if the devices configuration is correct.
Table 76.12. Available Statistics reports

Page Report
a
Statistics Statistics chart
Network traffic
a
Only users of the group admin can access this page.
1015
Monitoring
Tracking Sessions
The page Session tracking allows to display the list of the users currently connected to SOLID-
server. The user connection is checked every 300 seconds.
To track the last user connected
opens.
2. In the section Monitoring, click on Session tracking. The page Session tracking opens.
3. You can filter columns in order to display more specific information if needed.
To track all the user connections
opens.
2. In the section Monitoring, click on Session tracking, a new page is displayed.
3. In the menu, click on Display > Log session list. The page Sessions logs opens.
4. You can filter columns in order to display more specific information if needed.
Tracking Users
The page User tracking provides a list of all the operations carried out by every user. The different
columns and filters on the page allow to track operations and who performed them. For more
details, refer to the sections Tracking Users Using the Filters and Tracking Users Using the
Columns.
You can also grant full access to the page to any group of users. For more details, refer to the
section Allowing Users to Display All the Operations Performed.
Finally, note that thanks to 3 registry database entries you can:
• Display the class parameters' name and value of the objects listed in the column Description.
For more details, refer to the section Using the Extended User Tracking Display.
• Save the operations performed by users in the file ipmserver.log, available on the page Syslog.
For more details, refer to the section Sending a Copy of User Operations to Syslog.
• Store the operations performed by rules in an external file, available on the page Syslog, to
decrease memory usage and only leave users actions on the page User Tracking. For more
details, refer to the section Forwarding Rule Operations to Syslog.
Tracking Users Using the Filters

The page provides two dedicated drop-down lists to filter the operations according to your needs:
1016
Monitoring
• Rule filter allows to include all, only or no operations carried out by rules. Note that a registry
key allows to store these rule operations in an external file to decrease memory usage. For
more details, refer to the section Forwarding Rule Operations to Syslog.
• Services allows to search specific operations related to DHCP, IPAM, DNS, Rule, Group, User,
System or Class.
You can carry out searches through the rules to include or exclude them in the result.
To track operations based on rules execution
opens.
2. In the section Monitoring, click on User tracking. The page User tracking opens.
3. Under the menu, in the drop-down list Rule filter, select the filter that suits your needs:
• No rules: the result excludes the executed rules. This filter is selected by default.
• All: the result includes the rules related operations.
• Only rules: the result includes only the rules related operations.
4. Click on REFRESH to execute the search.
You can carry out searches through the services, in addition or instead of the Rule filter.
To track operations based on service execution
opens.
2. In the section Monitoring, click on User tracking. The page User tracking opens.
3. Under the menu, in the drop-down list Services, select the service of your choice. For more
details, refer to the appendix User Tracking Services Filter.
Tracking Users Using the Columns

The page columns allow to sort and filter all the operations using four columns: Date, Service,
User and Description.
Searching for Users
The column User provides a search engine and filter constructor to find which user performed a
specific operation.
To track the operations carried out by a specific user
1. Go to the Administration tab homepage. In the section Monitoring, click on User tracking.
The page User tracking opens.
2. In the search engine of the column User, type in the name of the user(s) you want to track.
You can also double-click in the field to open the filter constructor and set a filter for several
users at once.
3. Click on REFRESH to display the corresponding user(s).
1017
Monitoring
Searching for Periods of Time
The column Date provides a search engine and filter constructor to find specific dates and periods
of time.
To track the operations carried out at a certain time
1. Go to the Administration tab homepage. In the section Monitoring, click on User tracking.
The page User tracking opens.
2. In the search engine of the column Date, type in the date or period of time that suits your
needs. For more details regarding the possible combinations in this field, refer to the table
Date related filtering operators.
3. Click on REFRESH to display the corresponding user(s).
Searching for Specific Data
The Description column provides a search engine that allows you to type in any data. It allows
you to look for a specific resource, if it has been added, edited or deleted the filter returns the
matching results. For instance, if you edited a subnet-type network name, this column includes
the subnet-type network start and end IP address, its former and new name, terminal configuration
and all its containers up the space. You can also look for a specific IP address to find out which
resources were managed by the user using the IP address.
To track operations carried out on a specific resource or from a specific IP address
1. Go to the Administration tab. In the section Monitoring, click on User tracking. The page
User tracking opens.
2. In the search engine of the column Description, type in the IP address or the name of the
resource of your choice.
Searching for Services
The column Service provides a search engine that allows you to type in any service name if you
do not want to use the filter drop-down list Services. The services naming convention is detailed
in the table of the appendix User Tracking Services Filter.
To track a specific service
1. Go to the Administration tab. In the section Monitoring, click on User tracking. The page
User tracking opens.
2. In the search engine of the column Service, type in the service of your choice.
Allowing Users to Display All the Operations Performed

By default, any user can access the page User Tracking and see all the changes they performed.
You can grant user access to see the changes performed by all the users, including ipmadmin,
if their group of users has the permission User Tracking Display: changes from all the users.
1018
Monitoring
To grant access to all the changes performed on the appliance to a group of users
opens.
5. In the panel Administration, click on EDIT . The wizard Edit group rights opens.
6. The Unauthorized services list displays the services that are not granted to the group. Select
User Tracking Display: changes from all the users and click on . The service is moved to
the list Authorized services.
7. Click on OK to commit the group permission addition. The report opens and closes. The
page refreshes. In the panel, the list Permissions displays the service.
Once the permission is granted, all the users of the group can see the operations performed by
anyone who logged in SOLIDserver on the page User tracking and in the panel Audit of the
properties page of an object.
Using the Extended User Tracking Display

You might want to display the class parameters details of your operations on the page User
Tracking, this is called the Extended User Tracking display. To do so, the administrators (ipmadmin
or any member of the group admin) can enable a registry database key dedicated to this display.
To add the extended user tracking display registry key
homepage opens.
opens.
3. In the column Name, type in usertracking.show.class.parameters and hit Enter. The key is
the only one listed.
4. In the column Value, click on 0. The wizard Registry database Edit a value opens.
6. In the field Value, delete the 0 and replace it with a 1. This value means the key is enabled.
7. Click on OK to commit your changes. The report opens and closes. In the column Value, a
1 is displayed.
Once usertracking.show.class.parameters is enabled, in the User Tracking Description columns

is displayed a new field: Class Parameters .
To display the class parameters details configured for the object you can:
• Put your mouse over Class Parameters, a pop-up window displays all the class parameters
details.
1019
Monitoring
• Click on Class Parameters, all the class parameters and their value is displayed on the descrip-
tion field along with all the other object details.
Sending a Copy of User Operations to Syslog

SOLIDserver allows you to save a copy of users activity in the file ipmserver.log, using a dedicated
registry key. This way, user operations are available both on the pages Syslog and User Tracking.
To send a copy of user operations to Syslog
1. Add the registry key to enable the external storage of user operations
a. Go the Administration tab homepage. If the homepage is not displayed, click on .

The homepage opens.
opens.
c. In the column Name, type in module.system.usertracking_use_syslog and hit Enter.
The key is the only one listed.
d. In the column Value, click on 0. The wizard Registry database Edit a value opens.
e. In the field Name, the key name is displayed in a read-only gray field.
f. In the field Value, delete the 0 and replace it with a 1. This value means the key is en-
abled.
g. Click on OK to commit your changes. The report opens and closes. In the column Value,
a 1 is displayed.
2. Display the user operations in Syslog
a. Go to the Administration homepage.

b. In the section Monitoring, click on Logs visualization. The page Syslog opens.
c. In the drop-down list SOLIDserver, verify that the local appliance is selected. Only the
hostname appears with no IP address.
d. In the drop-down list Services, select ipmserver. The page refreshes.
e. In the column Log, use the filter : IPMserver: . The user operations are listed as follows:
<hostname> <process_name>[<process_id>]: IPMserver: <service_name> <user_name>
<service_parameters>
Forwarding Rule Operations to Syslog

To decrease memory usage in the database, you can store the logs triggered by rules in the ex-
ternal file ipmserver-rules.log, either on the appliance or a remote server.
When the related registry database entry is enabled, note that:
• Any new operation triggered by a rule is no longer available on the page User Tracking but
Syslog.
• On the page User Tracking, the drop-down list Rule filter disappears.
1020
Monitoring
• The page User tracking displays all the previous logs independently of their source, whether
it was triggered by a rule or user action.
• If some bookmarks, alerts, top lists and/or charts were created based on these logs, they are
automatically deleted.
To forward rule operations to Syslog
1. Add the registry key to enable the external storage of rule operations

opens.
opens.
d. In the field Name, type in module.system.rules.logs_to_file.
e. In the field Value, type in 1. The default value is 0.
and the key is listed.
2. Set the redirection parameters

b. In the menu, select Monitoring > Configuration of Network Logs. The page Configura-
tion of Network Logs opens.
c. In the menu, select Add > Syslog configuration. The wizard Syslog configuration
opens.
d. In the drop-down list Services, select the service ipmserver-rules.
e. In the drop-down list Priority, select the value *.
f. In the field Target server, type in the IP address and port (e.g. 10.0.0.45:4432) of the
Syslog server you want the logs to be redirected to.
g. Click on OK to commit your logs redirection. The report opens and closes. The page
Configuration of Network Logs is visible again and displays the list of logs redirections.
3. Display the rule operations in Syslog

b. In the section Monitoring, click on Logs visualization. The page Syslog opens.
c. In the drop-down list SOLIDserver, verify that the local appliance is selected. Only the
hostname appears with no IP address.
d. In the drop-down list Services, select ipmserver-rules. The logs appear.
1021
Monitoring
Managing SNMP Profiles

SNMP profiles are used to collect SNMP data from hosts or other devices running an SNMP or
proxy SNMP agent. SNMP profiles allow you to monitor remotely DHCP and DNS services through
the SNMP protocols. For more details, refer to the section Managing the SNMP Service.
By default, SOLIDserver already provides 3 SNMP profiles (standard v1, standard v2c and
standard v3). To edit these profiles, refer to the section Editing an SNMP Profile.
Adding an SNMP Profile

To add an SNMP profile
opens.
2. In the menu, select System > SNMP profile configuration. The page SNMP profiles config-
uration opens.
3. In the panel Profiles, click on ADD . The wizard Add an SNMP profile opens.
4. In the field SNMP profile name, name the profile.
6. In the drop-down list SNMP version, select the SNMP version you want to use.
8. If you selected the v1 or v2c version of SNMP:
a. In the field Read community, type in the read-only community string that would act as
a password for this profile reading requests. For the preexisting profiles standard v1
and standard v2, the default value is public.
b. In the field Write community, you can type in a write community string that would act
as a password for this profile reading and writing requests. For the preexisting profiles
standard v1 and standard v2, the default value is private.
9. If you selected the v3 version of SNMP, fill in the Read access parameters and the Write
access parameters according to the table below:
Table 76.13. SNMP v3 profiles access parameters

Field Description
User name In this field, type in the user name. This field is required for read access parameters.
For the preexisting profile standard v3, the default value is default_ipm_user.
Authentication key In this field, type in a key to ensure the authentication of the source. This field is re-
quired for read access parameters. For the preexisting profile standard v3, the default
value is default_auth_key.
Authentication In this field, select the cryptographic hash function used for authentication: either MD5,
SHA or None. This field is required for read access parameters. For the preexisting
profile standard v3, the default value is MD5.
Privacy key In this field, if need be, type in the encryption key to prevent snooping from unauthorized
sources.
Privacy In this field, if need be, select the encryption type: either DES or None. For the
preexisting profile standard v3, the default value is DES.
1022
Monitoring
10. Click on OK to commit your creation. The page SNMP profiles configuration is visible again,
your profile is listed in the panel.
Editing an SNMP Profile

To edit an SNMP profile
opens.
2. In the menu, select System > SNMP profile configuration. The SNMP profiles configuration
page opens.
3. In the panel Profiles, select the SNMP profile configuration you want to edit.
4. Click on EDIT . The Edit an SNMP profile wizard opens.
6. In the drop-down list SNMP version, select the SNMP version you want to use.
8. If you are editing a profile in SNMP v1 or v2c: edit the Read community and/or field Write
community as needed.
9. If you are editing a profile in SNMP v3, edit the Read access parameters and Write access
parameters as needed.
10. Click on OK to commit your changes. The page SNMP profiles configuration is visible again.
Deleting an SNMP Profile

To delete an SNMP profile
opens.
2. In the menu, select System > SNMP profile configuration. The SNMP profiles configuration
page opens.
3. In the panel Profiles, select the SNMP profile configuration you want to delete.
4. Click on DELETE . The wizard opens.
5. Click on OK to commit your deletion. The page SNMP profiles configuration is visible again.
The profile has been removed from the SNMP profiles configuration list.
Monitoring Using SNMP

SNMP monitoring allows you to supervise SOLIDserver components and processes to ensure
they meet the expected performance and availability. Combined with an effective alerting system,
you can proactively intervene in case of malfunction to prevent an overall failure of the system
and maximize the end users experience. Indeed, by gathering and storing metrics about key
system health indicators, you can analyze and correlate information to trigger alerts and automatic
actions.
1023
Monitoring
These metrics are detailed in the Management Information Base, a IANA, IEEE and IETF managed
database, which formally describes the network objects you can monitor through SNMP. Network
objects - such as the status of a power supply - and their properties - such as their variable name
or value - are hierarchized through a suite of numbers called Object IDentifiers (OID). The MIB
extensions mentioned in this documentation are listed below:
• IDRAC-MIB
• UCD-SNMP-MIB
• HOST-RESOURCES-MIB
• IF-MIB
• EIP-STATS
• EIP-DNSGUARDIAN
5
The files .mib are available on our website . You can also get a tree overview of each MIB on
the website http://www.oidview.com.
This chapter provides a list of the most relevant SOLIDserver indicators you can monitor through
6
an external solution such as Nagios as well as some related plug-ins.
OIDs presented below can be followed by an asterisk '*'. They represent subsets, for which, the
default value of the first object can be 0 or 1. In the case of the OID
1.3.6.1.4.1.674.10892.5.4.600.12.1.5.1.*, if you have two power supply units, you can specify
1.3.6.1.4.1.674.10892.5.4.600.12.1.5.1.0 to retrieve the status of the first one or
1.3.6.1.4.1.674.10892.5.4.600.12.1.5.1.1 for the second.
Prerequisites
Each monitored SOLIDserver should be configured to allow the SNMP collector to retrieve the
SNMP information:
• From SOLIDserver, you must configure the SNMP agent with an access list using either com-
munity strings in SNMP v1/v2c, or authentication credentials in SNMP v3.
By default, a v1/v2c profile exists with the community string public. For more details, refer to
the section Managing the SNMP Service.
• From the SNMP collector's side, you must use SNMP v2c or v3 and configure the external
monitoring solution to ensure it can access SOLIDserver SNMP agent and retrieve the metrics
that you need.
Note that you can also configure SNMP traps.
Once your system is properly configured, you can set various SNMP alerts on SOLIDserver objects
to be notified of any unusual behavior. For more details, refer to the chapter Managing Alerts.
Monitoring the Hardware

Except for SDS-50, all EfficientIP hardware appliances embed a remote, out of band, management
controller called iDRAC. This controller must be configured properly when deploying SOLIDserver.
5
6
https://www.nagios.org
1024
Monitoring
It provides access to various SNMP OIDs describing the overall system state as detailed in the
IDRAC-MIB.
Note that the metrics in this section only apply to hardware appliances. They provide inform-
ation on physical hardware components to ensure they are perfectly running and maximize hosted
service availability. To monitor virtual and software SOLIDserver appliances, refer to the other
sections.
A Nagios compatible plug-in is available on Github: https://github.com/dangmocrang/check_idrac.
Power Unit
All the OIDs described in this section are part of the MIB extension IDRAC-MIB.
Table 76.14. Power unit

.1.3.6.1.4.1.674.10892.5.4.600.10.1.8
Variable name: powerUnitStatus Type: Integer
Description: The status of the power unit.
Expected values: ok (i.e. 3)
Power Redundancy
Table 76.15. Power redundancy

.1.3.6.1.4.1.674.10892.5.4.600.10.1.5
Variable name: powerUnitRedundancyStatus Type: Integer
Description: The redundancy status of the power unit.
Expected values: full or notRedundant (i.e. 3 or 6)
Power Supply
Table 76.16. Power supply

.1.3.6.1.4.1.674.10892.5.4.600.12.1.5.1.*
Variable name: powerSupplyStatus Type: Integer
Description: The status of the power supply.
Expected value: ok (i.e. 3)
.1.3.6.4.1.674.10892.5.4.600.12.1.9.1.*
Variable name: PowerSupplyInputVoltage Type: Integer
Description: The current power supply input in Volts.
CPU
Table 76.17. CPU

.1.3.6.1.4.1.674.10892.5.4.600.50.1.5.1.*
Variable name: ProcessorDeviceStatus Type: Integer
Description: The status of the CPU socket.
1025
Monitoring
Memory
Table 76.18. Memory

.1.3.6.1.4.1.674.10892.5.4.1100.50.1.5.1.*
Variable name: MemoryDeviceStatus Type: Integer
Description: The status of the memory slot.
Virtual Disk
Table 76.19. Virtual disk

.1.3.6.1.4.1.674.10892.5.5.1.20.140.1.1.4.*
Variable name: VirtualDiskState Type: Integer
Description: The status of the RAID Controller Status for the virtual disk.
Expected values: online (i.e. 3)
Physical Disk
Table 76.20. Physical disk

.1.3.6.1.4.1.674.10892.5.5.1.20.130.4.1.4.*
Variable name: PhysicalDiskState Type: Integer
Description: The status of the physical disk.
Expected values: online (i.e. 3)
Temperature
Table 76.21. Temperature

.1.3.6.1.4.1.674.10892.5.4.700.20.1.5.1.*
Variable name: TemperatureProbeStatus Type: Integer
Description: The status of the temperature probe.
.1.3.6.1.4.1.674.10892.5.4.700.20.1.6.1.*
Variable name: TemperatureProbeReading Type: Integer
Description: The current temperature in tenths of degrees Centigrade.
Fan
1026
Monitoring
Table 76.22. Fan

.1.3.6.1.4.1.674.10892.5.4.700.12.1.5.1.*
Variable name: CoolingDeviceStatus Type: Integer
Description: The status of the fan.
Monitoring the System

SOLIDserver relies on common SNMP embedded MIB extensions. Many plug-ins on GitHub,
7
developed for Centreon, are Nagios compatible and can be used with SOLIDserver :
• CPU load: loadaverage.pm

• Memory usage: memory.pm
• Swap usage: swap.pm
• Disk usage: check_disk_snmp.pl - Note that diskusage.pm plug-in is not compatible with
SOLIDserver embedded MIB.
• Network traffic: interfaces.pm
• Running processes: processcount.pm
These metrics should be graphed over time for troubleshooting purposes.
CPU Core Usage
All the OIDs described in this section are part of the MIB extension HOST-RESOURCES-MIB.
Table 76.23. CPU Core Usage Average 1 min

.1.3.6.1.2.1.25.3.3.1.2.*
Variable name: hrProcessorLoad Type: Integer
Description: The average percentage of time the CPU core was not idle over the last minute.
CPU(s) Load
All the OIDs described in this section are part of the MIB extension UCD-SNMP-MIB.
Table 76.24. CPU(s) Load Average 5 min

.1.3.6.1.4.1.2021.10.1.6.2.*
Variable name: laLoadInt Type: Integer
Description: The load of all the system's CPUs on an average of 5 min.
Expected values: Value should remain below the number of CPU cores
.1.3.6.1.4.1.2021.10.1.6.2
Variable name: CPUcount Type: Integer
Description: The number of CPU cores is equal to the number of entries returned by an snmpwalk command
on this OID.
Memory Usage
7
https://github.com/centreon/centreon-plugins
1027
Monitoring
Table 76.25. Memory usage

.1.3.6.1.4.1.2021.4.5.0
Variable name: memTotalReal Type: Integer
Description: The total amount of physical memory in bytes.
.1.3.6.1.4.1.2021.4.6.0
Variable name: memAvailReal Type: Integer
Description: The amount of physical available memory in bytes.
.1.3.6.1.4.1.2021.4.15.0
Variable name: memCached Type: Integer
Description: The amount of cached memory in bytes.
.1.3.6.1.4.1.2021.4.14.0
Variable name: memBuffer Type: Integer
Description: The amount of buffer memory in bytes.
Swap Usage
Table 76.26. Swap usage

.1.3.6.1.4.1.2021.4.3.0
Variable name: memTotalSwap Type: Integer
Description: The total amount of swap space in bytes.
.1.3.6.1.4.1.2021.4.4.0
Variable name: memAvailSwap Type: Integer
Description: The amount of swap space currently unused or available in bytes.
.1.3.6.1.4.1.2021.4.16
Variable name: memUsedSwapTXT Type: Integer
Description: The amount of swap space currently in use in bytes.
Disk IO
SOLIDserver is deployed on top of the physical RAID controller. In the ucdDiskIOMIB, diskIOTable
lists all available devices.
The RAID virtual drive should be identified by the following names: ad[0-9], ada[0-9], mfid[0-9].*.
Other listed devices should be ignored.
Any sudden and persistent increase in the metrics should be noticed.
Table 76.27. Disk IO

.1.3.6.1.4.1.2021.13.15.1.1.2.*
Variable name: diskIODevice Type: Octetstring
Description: The name of the device(s).
.1.3.6.1.4.1.2021.13.15.1.1.5.*
Variable name: diskIOReads Type: Integer
Description: The number of read accesses from the device(s) since boot.
.1.3.6.1.4.1.2021.13.15.1.1.6.*
1028
Monitoring
Variable name: diskIOWrites Type: Integer

Description: The number of write accesses to the device(s) since boot.
Disk Usage
Usage should remain under 80% for each mount point's total disk size entry, i.e. the system paths
/, /dev, /tmp, /var, /proc or /data1.
Any sudden and rapid increase in the metrics should be noticed.
Table 76.28. Disk usage

.1.3.6.1.2.1.25.2.3.1.3.*
Variable name: hrStorageDescr Type: Octetstring
Description: A description of the type and instance of the storage described by this entry.
.1.3.6.1.2.1.25.2.3.1.4.*
Variable name: hrStorageAllocationUnits Type: Integer
Description: The size of the data objects allocated from this pool in bytes. If this entry is monitoring sectors,
blocks, buffers, or packets, for example, this number will commonly be greater than one. Otherwise this
number will typically be one.
.1.3.6.1.2.1.25.2.3.1.5.*
Variable name: hrStorageSize Type: Integer
Description: The size of the storage represented by this entry, in units of hrStorageAllocationUnits. This
object is writable to allow remote configuration of the size of the storage area in the cases where such an
operation makes sense and is possible on the underlying system. For example, the amount of main memory
allocated to a buffer pool might be modified or the amount of disk space allocated to virtual memory might
be modified.
.1.3.6.1.2.1.25.2.3.1.6.*
Variable name: hrStorageUsed Type: Integer
Description: The amount of the storage represented by this entry that is allocated, in units of hrStorageAl-
locationUnits.
Network Traffic
Any NIC with ifAdminStatus set to up (i.e. 1) should also have an ifOperStatus set to up (i.e. 1).
Any sudden and rapid increase in the metrics of discard or error packet count should be noticed.
All the OIDs described in this section are part of the MIB extension IF-MIB.
Table 76.29. Network traffic

.1.3.6.1.2.1.2.2.1.7.*
Variable name: ifAdminStatus Type: Integer
Description: The NIC admin status, i.e. the desired state of the interface. The testing state (i.e. 3) indicates
that no operational packets can be passed.
Expected values: When the system initializes, all interfaces should be down (i.e. 2) until explicit notice
from the system to set it up (i.e. 1).
.1.3.6.1.2.1.2.2.1.8.*
Variable name: ifOperStatus Type: Integer
Description: The NIC operational status, i.e. the current operational state of the interface. The testing state
(i.e. 3) indicates that no operational packets can be passed.
1029
Monitoring
Expected values: Should be down (i.e. 2) if ifAdminStatus is down (i.e. 2). If ifAdminStatus is up (i.e. 1),
ifOperStatus should be up (i.e. 1) when the interface is ready to transmit or receive network traffic, and
dormant (i.e. 5) when the interface is waiting for external actions (such as a serial line waiting for an incoming
connection). The NIC remains down (i.e. 2) only if there is a fault that prevents it from being up (i.e. 1): it
should be in the notPresent (i.e. 6) state if the interface has missing, usually hardware, components.
.1.3.6.1.2.1.2.2.1.10.*
Variable name: ifInOctets Type: Integer
Description: The total traffic received through the interface, including framing characters, in bytes.
.1.3.6.1.2.1.2.2.1.16.*
Variable name: ifOutOctets Type: Integer
Description: The total traffic transmitted out of the interface, including framing characters, in bytes.
.1.3.6.1.2.1.2.2.1.13.*
Variable name: ifInDiscards Type: Integer
Description: The number of inbound packets which were chosen to be discarded even though no errors
had been detected to prevent their being deliverable to a higher-layer protocol. One possible reason for
discarding such a packet could be to free up buffer space.
.1.3.6.1.2.1.2.2.1.19.*
Variable name: ifOutDiscards Type: Integer
Description: The number of outbound packets which were chosen to be discarded even though no errors
had been detected to prevent their being transmitted. One possible reason for discarding such a packet
could be to free up buffer space.
.1.3.6.1.2.1.2.2.1.14.*
Variable name: ifInErrors Type: Integer
Description: The number of inbound packets that contained errors preventing them from being deliverable
to a higher-layer protocol. For character- oriented or fixed-length interfaces, the number of inbound trans-
mission units that contained errors preventing them from being deliverable to a higher-layer protocol.
.1.3.6.1.2.1.2.2.1.20.*
Variable name: ifOutErrors Type: Integer
Description: The number of outbound packets that could not be transmitted because of errors. For char-
acter-oriented or fixed-length interfaces, the number of outbound transmission units that could not be
transmitted because of errors.
Running Processes
SOLIDserver relies on several processes to operate:
• IPMServer, Postgres and HTTPd should always be running on the monitored SOLIDserver.
• DHCPd should be listed in the hrSWRunName table when running the DHCP service on the
monitored SOLIDserver.
• Named should be listed in the hrSWRunName table when running the DNS service on the
monitored SOLIDserver. Exception is made for the Hybrid DNS engine where Named (both
authoritative and recursive) can be replaced by NSD (authoritative) or Unbound (recursive).
Table 76.30. Running processes

.1.3.6.1.2.1.25.4.2.1.2.<PID>
Variable name: hrSWRunName Type: Octetstring
Description: The process name, i.e. a textual description of the process, including the manufacturer, revision,
and the name by which it is commonly known.
1030
Monitoring
.1.3.6.1.2.1.25.4.2.1.4.<PID>
Variable name: hrSWRunPath Type: Octetstring
Description: The process binary path, i.e. a description of the location on long-term storage, e.g. a disk
drive, from which the process was loaded.
Monitoring the DHCP Service

SOLIDserver relies on DHCPd to provide its DHCP service and metrics on the number of inform,
decline, release, request and discover messages received as well as ack, nack and offer answers
sent.
The EfficientIP proprietary MIB EIP-STATS references values as Integers, yet, they represent
counters. As in any counter, when the previous value is greater than the current one, this means
that the counter has either looped or has been reset.Therefore, itâ s necessary to interpret these
values properly:
• Value > 0 : correct value = Value

8 9
• Value < 0 : correct value = MAXSIGNEDINT + (1 + ABS(MINSIGNEDINT ) + value)
DHCP service
All the OIDs described in this section are part of the MIB extension EIP-STATS.
Table 76.31. DHCP service

.1.3.6.1.4.1.2440.1.3.2.22.1.2.3.97.99.107
Variable name: ack Type: Integer
Description: The number of ACK answers sent.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.4.110.97.99.107
Variable name: nack Type: Integer
Description: The number of NACK answers sent.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.5.111.102.102.101.114
Variable name: offer Type: Integer
Description: The number of OFFER answers sent.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.6.105.110.102.111.114.109
Variable name: inform Type: Integer
Description: The number of INFORM messages received.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.7.100.101.99.108.105.110.101
Variable name: decline Type: Integer
Description: The number of DECLINE messages received.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.7.114.101.108.101.97.115.101
Variable name: release Type: Integer
Description: The number of RELEASE messages received.
.1.3.6.1.4.1.2440.1.3.2.22.1.3.7.114.101.113.117.101.115.116
Variable name: request Type: Integer
8
MAX Signed INT = 2147483647
9
MIN Signed INT = -2147483648
1031
Monitoring
Description: The number of REQUEST messages received.

.1.3.6.1.4.1.2440.1.3.2.22.1.3.8.100.105.115.99.111.118.101.114
Variable name: discover Type: Integer
Description: The number of DISCOVER messages received.
Monitoring the DNS Service

SOLIDserver relies on BIND to provide its DNS service and metrics on the number of requests
over udp or tcp. The metrics also include IPv4 and IPv6 requests received by named or sent to
forwarder/authoritative servers as well as recursion.
The EfficientIP proprietary MIB EIP-STATS references values as Integers, yet, they represent
counters. As in any counter, when the previous value is greater than the current one, this means
that the counter has either looped or has been reset.Therefore, itâ s necessary to interpret these
values properly:
• Value > 0 : correct value = Value

10 11
• Value < 0 : correct value = MAXSIGNEDINT + (1 + ABS(MINSIGNEDINT ) + value)
General Name Server Statistics
Table 76.32. General name server statistics

.1.3.6.1.4.1.2440.1.4.2.3.1.3.3.117.100.112
Variable name: udp Type: Integer
Description: The number of queries received through UDP.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.3.116.99.112
Variable name: tcp Type: Integer
Description: The number of queries received through TCP.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.9.114.101.113.117.101.115.116.118.52
Variable name: requestv4 Type: Integer
Description: The number of queries received through IPv4.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.9.114.101.113.117.101.115.116.118.54
Variable name: requestv6 Type: Integer
Description: The number of queries received through IPv6.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.11.114.101.115.95.113.117.101.114.121.118.52
Variable name: res_queryv4 Type: Integer
Description: The number of queries sent to external forwarder or authoritative servers using IPv4 for res-
olution.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.11.114.101.115.95.113.117.101.114.121.118.54
Variable name: res_queryv6 Type: Integer
Description: The number of queries sent to external forwarder or authoritative servers using IPv6 for res-
olution.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.9.114.101.99.117.114.115.105.111.110
10
MAX Signed INT = 2147483647
11
MIN Signed INT = -2147483648
1032
Monitoring
Variable name: recursion Type: Integer

Description: The number of queries requiring recursion.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.10.114.101.99.117.114.115.101.114.101.106
Variable name: recurserej Type: Integer
Description: The number of rejected queries requiring recursion.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.9.100.117.112.108.105.99.97.116.101
Variable name: duplicate Type: Integer
Description: The number of duplicate queries received.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.100.114.111.112.112.101.100
Variable name: dropped Type: Integer
Description: The number of dropped queries.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.9.114.101.115.95.114.101.116.114.121
Variable name: res_retry Type: Integer
Description: The number of queries retried on external forwarder or authoritative servers.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.8.114.101.115.112.111.110.115.101
Variable name: response Type: Integer
Description: The number of responses sent.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.14.114.101.115.95.114.101.115.112.111.110.115.101.118.52
Variable name: res_responsev4 Type: Integer
Description: The number of responses from external forwarder or authoritative servers using IPv4.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.14.114.101.115.95.114.101.115.112.111.110.115.101.118.54
Variable name: res_responsev6 Type: Integer
Description: The number of responses from external forwarder or authoritative servers using IPv6.
DNS Resolution Queries Statistics
Table 76.33. DNS resolution queries statistics

.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.48
Variable name: res_queryrtt0 Type: Integer
Description: The number of recursive queries with latency < 10ms.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.49
Description: The number of recursive queries with latency >= 10ms & < 100ms.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.50
.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.51
.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.52
.1.3.6.1.4.1.2440.1.4.2.3.1.3.13.114.101.115.95.113.117.101.114.121.114.116.116.53
1033
Monitoring
Description: The number of recursive queries with latency >= 1600ms.
DNS Answers Statistics
Table 76.34. DNS answers statistics

.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.115.117.99.99.101.115.115
Variable name: success Type: Integer
Description: The number of queries completed successfully, returning the message NOERROR (RCODE:
0).
.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.102.111.114.109.101.114.114
Variable name: formerr Type: Integer
Description: The number of queries with a wrong format, returning the message FORMERR (RCODE: 1).
.1.3.6.1.4.1.2440.1.4.2.3.1.3.8.115.101.114.118.102.97.105.108
Variable name: servfail Type: Integer
Description: The number of queries the server failed to complete, returning the message SERVFAIL
(RCODE: 2).
.1.3.6.1.4.1.2440.1.4.2.3.1.3.8.110.120.100.111.109.97.105.110
Variable name: nxdomain Type: Integer
Description: The number of queries where the domain name does not exist, returning the message
NXDOMAIN (RCODE: 3).
.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.110.120.114.114.115.101.116
Variable name: nxrrset Type: Integer
Description: The number of queries for which the RR set should exist but does not, returning the message
NXRRSET (RCODE: 8).
.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.102.97.105.108.117.114.101
Variable name: failure Type: Integer
Description: The number of queries failed for which the device sent another RCODE.
DNS Transfer Requests Statistics
Table 76.35. DNS transfer requests statistics

.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.120.102.114.100.111.110.101
Variable name: xfrdone Type: Integer
Description: The number of transfer queries successfully completed.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.102.111.114.109.101.114.114
Variable name: xfrrej Type: Integer
Description: The number of transfer queries rejected.
DNSSEC Validation Statistics
Table 76.36. DNSSEC validation statistics

.1.3.6.1.4.1.2440.1.4.2.3.1.3.7.114.101.115.95.118.97.108
Variable name: res_val Type: Integer
1034
Monitoring
Description: The total number of DNSSEC validation attempts.

.1.3.6.1.4.1.2440.1.4.2.3.1.3.14.114.101.115.95.118.97.108.115.117.99.99.101.115.115
Variable name: res_valsuccess Type: Integer
Description: The total number of DNSSEC validation successfully completed.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.17.114.101.115.95.118.97.108.110.101.103.115.117.99.99.101.115
Variable name: res_valnegsuccess Type: Integer
Description: The total number of DNSSEC NX validation successfully completed.
.1.3.6.1.4.1.2440.1.4.2.3.1.3.11.114.101.115.95.118.97.108.102.97.105.108
Variable name: res_valfail Type: Integer
Description: The total number of DNSSEC validation failures.
Monitoring DNS Guardian

DNS Guardian provides advanced security through real time DNS traffic analysis and various
SNMP metrics relative to the cache, clients, queries, answers, protection modes, filters and network
traffic in general. For more details, refer to the chapter DNS Guardian.
Cache Size
All the OIDs described in this section are part of the MIB extension EIP-DNSGUARDIAN.
Table 76.37. Cache size

.1.3.6.1.4.1.2440.1.11.2.4.5.0
Variable name: eipDNSGuardianStatCacheSize Type: Counter
Description: The total number of entries in the cache.
Client Size
Table 76.38. Client size

.1.3.6.1.4.1.2440.1.11.2.4.45.0
Variable name: eipDNSGuardianStatClientsSize Type: Counter
Description: The total number of tracked client IP addresses.
Cache Statistics
All the OIDs described in this section are part of the MIB extension EIP-DNSGUARDIAN
Table 76.39. Cache statistics

.1.3.6.1.4.1.2440.1.11.2.4.3.0
Variable name: eipDNSGuardianStatCacheHit Type: Counter
Description: The total number of cache hits (including hits in Quarantine and Rescue modes).
.1.3.6.1.4.1.2440.1.11.2.4.4.0
Variable name: eipDNSGuardianStatCacheMiss Type: Counter
Description: The total number of cache misses (including misses in Quarantine and Rescue modes).
.1.3.6.1.4.1.2440.1.11.2.4.10.0
Variable name: eipDNSGuardianStatCacheMissExist Type: Counter
1035
Monitoring
Description: The total number of queries that did not hit the cache because the related entry has expired.
.1.3.6.1.4.1.2440.1.11.2.4.11.0
Variable name: eipDNSGuardianStatCacheMissNotExist Type: Counter
Description: The total number of queries that did not hit the cache because the related entry doesn't exist.
Quarantine Mode Cache Statistics
Table 76.40. Quarantine mode cache statistics

.1.3.6.1.4.1.2440.1.11.2.4.37.0
Variable name: eipDNSGuardianStatCacheHitQuarantine Type: Counter
Description: The total number of cache hits in Quarantine mode.
.1.3.6.1.4.1.2440.1.11.2.4.34.0
Variable name: eipDNSGuardianStatCacheMissQuarantine Type: Counter
Description: The total number of cache misses in Quarantine mode.
.1.3.6.1.4.1.2440.1.11.2.4.35.0
Variable name: eipDNSGuardianStatCacheMissExistQuarantine Type: Counter
Description: The total number of queries that did not hit the cache because the related entry has expired
in Quarantine mode.
.1.3.6.1.4.1.2440.1.11.2.4.36.0
Variable name: eipDNSGuardianStatCacheMissNotExistQuarantine Type: Counter
Description: The total number of queries that did not hit the cache because the related entry doesn't exist
in Quarantine mode.
Rescue Mode Cache Statistics
Table 76.41. Rescue mode cache statistics

.1.3.6.1.4.1.2440.1.11.2.4.43.0
Variable name: eipDNSGuardianStatCacheHitRescue Type: Counter
Description: The total number of cache hits in Rescue mode.
.1.3.6.1.4.1.2440.1.11.2.4.40.0
Variable name: eipDNSGuardianStatCacheMissRescue Type: Counter
Description: The total number of cache misses in Rescue mode.
.1.3.6.1.4.1.2440.1.11.2.4.41.0
Variable name: eipDNSGuardianStatCacheMissExistRescue Type: Counter
Description: The total number of queries that did not hit the cache because the related entry has expired
in Rescue mode.
.1.3.6.1.4.1.2440.1.11.2.4.42.0
Variable name: eipDNSGuardianStatCacheMissNotExistRescue Type: Counter
Description: The total number of queries that did not hit the cache because the related entry doesn't exist
in Rescue mode.
Filters Statistics
1036
Monitoring
Table 76.42. Filters statistics

.1.3.6.1.4.1.2440.1.11.2.4.47.0
Variable name: eipDNSGuardianStatRatelimitedQuery Type: Counter
Description:The number of queries per second dropped because source clients have reached the configured
query limit rate of 100 queries/s.
.1.3.6.1.4.1.2440.1.11.2.4.44.0
Variable name: eipDNSGuardianStatBlockedQuery Type: Counter
Description: The number of queries per second that have been blocked by the Guardian once the blocked
mode has been triggered by related sources.
.1.3.6.1.4.1.2440.1.11.2.4.2[0-9]{2,2}.0
Variable name: N/A Type: Counter
Description: the number of entries related to each of the 64 configurable triggers available.
Invalid Queries Statistics
Table 76.43. Invalid queries statistics

.1.3.6.1.4.1.2440.1.11.2.4.14.0
Variable name: eipDNSGuardianStatRecvInvalidDNSPacket Type: Counter
Description: The number of total invalid queries dropped.
.1.3.6.1.4.1.2440.1.11.2.4.15.0
Variable name: eipDNSGuardianStatRecvInvalidDNSByte Type: Counter
Description: The total traffic of invalid queries dropped in bytes.
DNS Traffic Statistics
Table 76.44. DNS traffic statistics

.1.3.6.1.4.1.2440.1.11.2.4.8.0
Variable name: eipDNSGuardianStatRecvDNSPacket Type: Counter
Description: The total number of received queries.
.1.3.6.1.4.1.2440.1.11.2.4.6.0
Variable name: eipDNSGuardianStatSendDNSPacket Type: Counter
Description: The total number of sent queries.
.1.3.6.1.4.1.2440.1.11.2.4.9.0
Variable name: eipDNSGuardianStatRecvDNSByte Type: Counter
Description: The total incoming traffic in bytes.
.1.3.6.1.4.1.2440.1.11.2.4.7.0
Variable name: eipDNSGuardianStatSendDNSByte Type: Counter
Description: The total outgoing traffic in bytes.
.1.3.6.1.4.1.2440.1.11.2.4.0.0
Variable name: eipDNSGuardianGlobalStat Type: Counter
Description: The average observed IPv4 fragments size in bytes.
1037
Monitoring
DNS Resolution Queries Statistics
Table 76.45. DNS resolution queries statistics

.1.3.6.1.4.1.2440.1.11.2.4.48.0
Variable name: eipDNSGuardianStatRTT10 Type: Counter
Description: The number of queries with latency < 10ms.
.1.3.6.1.4.1.2440.1.11.2.4.49.0
Description: The number of queries with latency >= 10ms & < 100ms.
.1.3.6.1.4.1.2440.1.11.2.4.50.0
.1.3.6.1.4.1.2440.1.11.2.4.51.0
Description: The number of queries with latency >= 500ms & < 800m.
.1.3.6.1.4.1.2440.1.11.2.4.52.0
Description: The number of queries with latency >= 800ms & < 1600ms.
.1.3.6.1.4.1.2440.1.11.2.4.53.0
Variable name: eipDNSGuardianStatRTTMax Type: Counter
Description: The number of queries with latency >= 1600ms.
DNS Answers Statistics
Table 76.46. DNS answers statistics

.1.3.6.1.4.1.2440.1.11.2.4.101.0
Variable name: eipDNSGuardianStatReplyNOERROR Type: Counter
Description: The number of successful queries, returning the message NOERROR (RCODE: 0).
.1.3.6.1.4.1.2440.1.11.2.4.102.0
Variable name: eipDNSGuardianStatReplyFORMERR Type: Counter
Description: The number of queries with a wrong format, returning the message FORMERR (RCODE: 1).
.1.3.6.1.4.1.2440.1.11.2.4.103.0
Variable name: eipDNSGuardianStatReplySERVFAIL Type: Counter
Description: The number of queries the server failed to complete, returning the message SERVFAIL
(RCODE: 2).
.1.3.6.1.4.1.2440.1.11.2.4.104.0
Variable name: eipDNSGuardianStatReplyNXDOMAIN Type: Counter
Description: The number of queries where the domain name does not exist, returning the message
NXDOMAIN (RCODE: 3).
.1.3.6.1.4.1.2440.1.11.2.4.105.0
Variable name: eipDNSGuardianStatReplyNOTIMP Type: Counter
Description: The number of queries for which the server did not implement the function, returning the
message NOTIMP (RCODE: 4).
1038
Monitoring
.1.3.6.1.4.1.2440.1.11.2.4.106.0
Variable name: eipDNSGuardianStatReplyREFUSED Type: Counter
Description: The number of queries the server refused to answer, returning the message REFUSED
(RCODE: 5).
.1.3.6.1.4.1.2440.1.11.2.4.107.0
Variable name: eipDNSGuardianStatReplyYXDOMAIN Type: Counter
Description: The number of queries for which the name exists when it should not, returning the message
YXDOMAIN (RCODE: 6).
.1.3.6.1.4.1.2440.1.11.2.4.108.0
Variable name: eipDNSGuardianStatReplyYXRRSET Type: Counter
Description: The number of queries for which the RR set exists when it should not, returning the message
YXRRSET (RCODE: 7).
.1.3.6.1.4.1.2440.1.11.2.4.109.0
Variable name: eipDNSGuardianStatReplyNXRRSET Type: Counter
Description: The number of queries for which the RR set should exist but does not, returning the message
NXRRSET (RCODE: 8).
.1.3.6.1.4.1.2440.1.11.2.4.120.0
Variable name: eipDNSGuardianStatReplyNOTAUTH Type: Counter
Description: The number of queries for which the server is not authoritative for the zone, returning the
message NOTAUTH (RCODE: 9).
.1.3.6.1.4.1.2440.1.11.2.4.121.0
Variable name: eipDNSGuardianStatReplyNOTZONE Type: Counter
Description: The number of queries for which the name is not in the zone, returning the message NOTZONE
(RCODE: 10).
Displaying Netstat Data

SOLIDserver provides a page listing Netstat data. This tool allows to display the open TCP and
UDP ports to monitor active connections on the management appliance.
To access the page Netstat
opens.
2. In the menu, select System > Expert > Netstat. The page Netstat opens.
This page contains several columns:
Table 76.47. Netstat columns

Column Description
Protocol The protocol name, TCP or UDP.
Local address The local appliance IP addresses. That is to say any IP addresses configured for your
physical interfaces - for more details, refer to the chapter Network Configuration - and the
loopback IP address.
Local port The number of the local appliance port through which the connection is made. If the port
is not yet established, an asterisk (*) is displayed.
Foreign address The IP address and port number of the remote computer to which the socket is connected.
1039
Monitoring
Column Description
Foreign port The number of the remote appliance port through which the connection is made. If the
port is not yet established, an asterisk (*) is displayed.
State The state of the TCP connection. It can be:
LISTEN. The socket is listening for incoming connections.
ESTABLISHED. The socket has an established connection.
SYN_SENT. The socket is actively trying to establish a connection.
TIME_WAIT. The socket is waiting after close to handle packets still in the network.
Sizing the Database Tables

SOLIDserver provides a page that lists the size of all the tables in the database. This list gives
you all the information in one glance as it includes the Table name, Total size (including the index),
Table size and Tuple size columns to even provide you with the size of the data and tuples they
contain.
To access the page Database tables size
opens.
2. In the menu, select System > Expert > Database tables size. The page Database tables
size opens.
Vacuuming the Database

By default, SOLIDserver enables the rule 180 that vacuums the database every night at 4 a.m.
This rule is configured to defragment the databases and reclaim storage occupied by dead tuples
to increase performances of the processes related to users queries.
Users of the group admin can edit the rule to change the database vacuuming frequency. You
should only edit this rule if a member of an EfficientIP technical team specifically asked
for it.
To edit the rule 180 that defragments SOLIDserver database
opens.
4. At the end of the rule line, click on . The properties page opens.
5. In the panel Main properties, click on EDIT .
6. In the fields Module, Event, Rule and Description are details the rule properties.
7. In the field Rule name, you can edit the name of the rule. It is displayed in the column Instance
on the page Rules.
1040
Monitoring
Set the schedule parameters:
Table 76.48. Scheduled rules parameters

Field Description

11. In the field Max. wasted space (MB), type in the maximum size of wasted space beyond
which a database table is vacuumed. By default, it is set to 200.
12. Click on OK to commit yours changes. The report opens and closes. The changes are dis-
played.
1041
Chapter 77. Maintenance
SOLIDserver needs to be properly maintained over time to run smoothly and reach its maximum
performance. This chapter details the different pages and options that allow administrators to
manage local files, troubleshoot SOLIDserver or even enable the Maintenance mode to work
without interferences on their infrastructures.
This chapter gathers the following maintenance possibilities:
• Managing Files from the Local Files Listing.

• Using the Maintenance Mode
• Updating the Macros and Rules
• Clearing the Appliance Cache
• Troubleshooting
• Managing Backups and Restoring Configurations
• Shutting Down and Rebooting
Managing Files from the Local Files Listing

The page Local files listing allows users of the group admin to manage all types of files uploaded
or stored locally on the appliance.
All the files are separated among 6 subpages: Local, TFTP, Logs, Config files, Custom images
and Custom WSDL. From each of these pages, you can upload, download and delete local files.
For more details, refer to the section Managing Local Files below.
Browsing the Local Files Listing Database

From the page Local Files Listing, you can display any local files subpage that suits your needs.
To display the pages of the Local Files listing
opens.
2. In the menu, select Maintenance > Local Files listing. The page Local files listing opens.
By default, the list Local is displayed.
3. Under the menu, tick the radio button Local, TFTP, Logs, Config files, Custom images or
Custom WSDL. The page opens.
All subpages, except Custom WSDL, share a common set of columns but contains specific files.
Table 77.1. Columns on the page Local files listing

Column Description
Name The entry name and extension if relevant. It is underlined as you can display a directory content
or download a file.
Type Indicates if the entry listed in a File or Directory.
Mode The entry permissions.
1042
Maintenance
Column Description
Owner The entry owner i.e. the user logged when the entry was generated.
Group The file or directory group.
Size The file or directory size in B, kB or MB.
Last Modified The month, day, date and time of the last update of the entry or its upload date.
The Page Local
It displays all the files stored locally in the appliance, including:
• The scheduled exports configured from the menu Export > Report. Their extension depends
on the chosen export file: .csv, .html, .xml, .xls or .pdf. For more details, refer to the chapter
Exporting Data.
• The reports generated from the GUI. Their extension depend on the chosen file format: either
.html or .pdf.
• The file sysaudit.log that stores in real time all the appliance system information (memory
use, partition, netstats, etc). To download this file, refer to the section Downloading Files below.
• The network devices captures. The captures extension is .pcap. For more details, refer to
the section Making a Network Device Snapshot.
• The corrupted configuration files that triggered a Locked synchronization. For more details,
refer to the DNS section The Status Locked Synchronization or the DHCP section The Status
Locked Synchronization .
• The troubleshooting dump files generated from the Administration homepage. The dump
extension is .tar. For more details, refer to the section Troubleshooting Dump.
The Page TFTP
This list displays all the files uploaded locally, available for download, and the files uploaded re-
motely via TFTP. For more details, refer to the section Managing the TFTP Upload Authorizations.
The Page Logs
It displays all the appliance log files in alphabetical order. To browse their content, go to the Logs
visualization page. For more details, refer to the section Logs Visualization.
The Page Config files
It displays all the servers configuration files generated from the Services configuration page. For
more details, refer to the section Downloading the DNS/DHCP/DHCPv6 Configuration File.
The Page Custom images
It displays all the images that you uploaded to customize SOLIDserver login and home pages.
For more details, refer to the section Uploading an Image to SOLIDserver.
The Page Custom WSDL
It displays all the WSDL files available for web services management via SOAP on the appliance.
The page contains a specific set of columns:
1043
Maintenance
Table 77.2. Custom WSDL Columns

Column Description
Name The entry name. Clicking on the name opens the list of services configured in the file.
Endpoint The chosen Endpoint set for the WSDL file.
Creation date The file creation time and date.
Dump date The file dump time and date.
Status The file status: Dumped, Modified since dump, IP doesn't exist or Dumping in progress.
Clicking on a WSDL file allows to display all the services it contains. For more details, refer to
the section Managing WSDL Files.
Managing Local Files

From all the pages of the Local Files Listing you can download and delete files. You can only
upload files from the pages Local, TFTP and Custom images.
The page Custom WSDL contains a set of specific options detailed in the section Managing
WSDL Files.
Uploading Files
From the pages Local, TFTP and Custom images you can upload files. This upload updates the
appliance local database from the GUI.
To upload a file to the page Local files listing
opens.
2. In the menu, select Maintenance > Local files listing. The Local files listing page opens
filtered through the radio button Local under the menu.
3. Under the menu, tick the radio button Local, TFTP or Custom images. The page opens.
4. In the menu, select Tools > Upload file. The wizard Import a file opens.
5. Click on BROWSE to select the file to upload from your local file system.
6. Click on OK to commit the import. The report opens and closes. The file has been imported
to the Local files listing.
Downloading Files
Any file listed on the Local Files Listing can be downloaded to your local computer from the GUI.
To download a file from the page Local files listing
opens.
1044
Maintenance
3. Under the menu, tick the radio button of your choice. The page opens.
4. In the column Name, filter the list if need be.
1
5. Click on the name of the file of your choice to download it .
Deleting Files
From any page of the Local files Listing you can delete files from the appliance local database.
To delete a file from the page Local files listing
opens.
3. Under the menu, tick the radio button of your choice. The page opens.
5. Tick the file(s) you want to delete.
6. In the menu, select Edit > Delete file(s). The wizard Delete file opens.
7. Click on OK to commit the deletion. The report opens and closes. The file is no longer listed.
Managing WSDL Files

The Web Services Description Language files are used to call services with SOAP.
By default a full WSDL file that includes all the services is available (https://<ip_address>/inter-
faces/wsdl_eip_full.wsdl). Keep in mind that using it drastically reduces the performances of the
application you develop to execute the services. Therefore, we recommend creating your own
files to only contain the information relevant to the required services.
You can create as many WSDL files as you need, they are locally saved in the directory ht-
tps://<SOLIDserver-ip-address>/interfaces/custom_wsdl/ . Once created, you must include the
files location in your source code to call the services they contain, and preferably make sure to
copy and store your custom files locally on the SOAP client to reduce the latency of instantiating
the SOAP object
You can add, edit, dump and delete WSDL files from the page Custom WSDL of the Local files
listing.
Adding a Custom WSDL File
You can create WSDL files that contain as many services as you need. The addition wizard
provides an auto-completion field that recognizes the services' name. Once created:
• WSDL files are automatically dumped, you can call the services listed in the WSDL file no
matter what programming language you use.
• WSDL files are saved locally in the directory custom_wsdl in the format <WSDL-file-name>.wsdl.
1
Depending on your browser, you might download the file right away or be offered the possibility to open the file or save it.
1045
Maintenance
To add a custom WSDL file through SOLIDserver GUI
opens.
3. Under the menu, tick the radio button Custom WSDL. The page opens.
4. In the menu, select Add > WSDL File. The wizard Add a custom WSDL file opens.
5. In the field WSDL file name, name the file without extension, it is automatically in the format
<file-name>.wsdl .
6. In the drop-down list WSDL EndPoint, select the EndPoint of your choice. It can be your
SOLIDserver Hostname or IP address.
7. In the field Service name, type in the first letters of a service. The auto-completion provides
a list of all the services matching what you specified.
8. Select the service of your choice and click on ADD . The service name is moved to the list
Selected services.
9. Repeat these actions for as many services as you want.
• To update an entry: select the service in the list Selected services, edit the service name
in the field Service name, and click on UPDATE . The new service name replaces the former
one.
• To delete an entry: select the service in the list Selected services and click on DELETE .
10. Click on OK to commit the creation. The report opens and closes. The file is listed on the
page and saved in the directory custom_wsdl. To display the list of services it contains refer
to the next procedure.
11. To use the services listed in the WSDL file, you must integrate the file location to your source
code using its absolute address within SOLIDserver database: https://<ip_address>/inter-
faces/custom_wsdl/<your-WSDL-file-name>.wsdl.
The services that you configured in the file are all listed on a dedicated page.
To display the content of a WSDL file
opens.
4. Click on the name of the WSDL file of your choice. A new page appears and displays all the
services that the file contains in the column Service name.
5. To go back to the page Custom WSDL tick the radio button Custom WSDL. The page opens..
1046
Maintenance
Editing and Dumping a Custom WSDL File
At any point you can edit the content of a WSDL file, that is to say add or remove services. Keep
in mind that editing a WSDL file requires dumping it again.
Adding Services to an Existing Custom WSDL File
You can add as many services as you want to an existing custom WSDL file. After adding services,
you must dump the WSDL file to take into account the changes.
To add services to a custom WSDL file
opens.
4. Click on the Name of the file you want to edit. The list of services it contains opens.
5. In the menu, select Add > Service. The wizard Add a service opens.
6. In the field Service name, type in the first letters of a service. The auto-completion provides
a list of all the services matching what you specified.
7. Select the service of your choice and click on ADD . The service name is moved to the list
Selected services. Repeat these actions for as many services as you want.
• To update an entry: select the service in the list Selected services, edit the service name
in the field Service name, and click on UPDATE . The new service name replaces the former
one.
• To delete an entry: select the service in the list Selected services and click on DELETE .
8. If you want to dump the WSDL file upon edition:
a. Tick the box Dump WSDL file(s). The field WSDL Endpoint appears.
b. In the drop-down list WSDL EndPoint, you can edit the WSDL file EndPoint. By default,
the current Endpoint is selected.
9. Click on OK to commit your changes. The report opens and closes. The new services are
listed.
If you ticked the box Dump WSDL file(s), the file's Status is Dumped so the file is updated
and can be used immediately. Otherwise, it is marked Modified since dump, and you need
to dump the file to take into account your changes, for more details refer to the section
Dumping an Edited Custom WSDL File.
To go back to the page Custom WSDL tick the radio button Custom WSDL. The page opens..
1047
Maintenance
Removing Services from an Existing Custom WSDL File
You can remove one or several services from an existing WSDL file. After removing services,
you must dump the WSDL file to take into account the changes.
To remove services from a custom WSDL file
opens.
4. Click on the Name of the file you want to edit. The list of services it contains opens.
5. Tick the service(s) you want to delete.
6. In the menu, select Edit > Delete a service from a WSDL file. The wizard Delete service
opens.
7. If you want to dump the WSDL file upon edition:
8. Click on OK to commit your changes. The report opens and closes. The services are no
longer listed.
If you ticked the box Dump WSDL file(s), the file's Status is Dumped so the file is updated
and can be used immediately. Otherwise, it is marked Modified since dump, and you need
to dump the file to take into account your changes, for more details refer to the section
Dumping an Edited Custom WSDL File.
To go back to the page Custom WSDL tick the radio button Custom WSDL. The page opens..
Dumping an Edited Custom WSDL File
If you edited a WSDL file without dumping it again in the edition wizard, you can dump its content,
or change its Endpoint if need be, from the menu on the page Custom WSDL.
To dump a custom WSDL file
opens.
5. Tick the file(s) you want to dump.
1048
Maintenance
6. In the menu, select Tools > Dump WSDL File(s). The wizard Dump WSDL file(s) opens.
7. If you want to change the EndPoint:
8. Click on OK to commit your configuration. The report opens and closes. The files are marked
as Dumped in the column Status. If you edited the EndPoint, its new value is visible in the
column Endpoint.
Deleting a Custom WSDL File
At any time, you can delete a custom WSDL file that you no longer use.
To delete a custom WSDL file
opens.
4. Tick the file(s) you want to delete.
5. In the menu, select Edit >Delete file(s). The wizard Delete file opens.
6. Click on OK to commit the deletion. The report opens and closes. The file is no longer listed.
Downloading a Custom WSDL File
At any time, you can download a WSDL file. To download your file, you must dump it on the page
Local and download it from there.
To download a custom WSDL file
opens.
5. Tick the file(s) you want to dump.
6. Dump the file on the page Local:
a. In the menu, select Tools > Dump in Local Files Listing. The wizard opens and closes.
b. The file is now listed in the page Local of the Local Files Listing.
1049
Maintenance
7. Download the file:
a. Under the menu, tick the radio button Local. The page opens.
b. In the list, the WSDL is listed as follows: <WSDL-file-name>.tar .
2
c. In the column Name, click on the file to download it .
Using the Maintenance Mode

The Maintenance mode allows members of the group admin to disconnect non-admin users from
SOLIDserver during maintenance work. Enabling the Maintenance mode can be useful when
reorganizing the network infrastructure or modifying services configuration as users intervention
may affect the administrators actions.
Keep in mind that:
• Enabling the maintenance mode does not interrupt network services.

• In maintenance mode, the users that do not belong to the group admin are disconnected and/or
cannot log in. Once the mode is disabled, them can connect again.
• Users of the group admin that are connected when the mode is enabled have a red banner
message is displayed on every page of SOLIDserver to inform them that the mode is on.
To enable/disable the maintenance mode
opens.
2. In the menu, select System > Expert > Maintenance Mode. The wizard opens.
3. Click on OK to enable or disable the Maintenance mode. The report opens and closes. The
Administration tab homepage is visible again.
Updating the Macros and Rules

When you add new macros and rules, usually for customization purposes, SOLIDserver must to
take into account the files that describe them. Therefore, users of the group admin might have
to register the new macros and rules into the system. This operation is usually supervised by the
EfficientIP support team.
To update the macros and rules
opens.
2. In the menu, select System > Expert > Register new macros/rules. The wizard Register all
the latest macros and rules opens.
3. Click on OK to commit the update. The report opens and closes. The Administration tab
homepage is visible again.
2
Depending on your browser, you might download the file right away or be offered the possibility to open the file or save it.
1050
Maintenance
Clearing the Appliance Cache

In case of changes in SOLIDserver code, for instance when a hotfix was provided, users of the
group admin may have to reload the file system cache. This operation is usually supervised by
the EfficientIP support team.
To clear SOLIDserver's cache
opens.
2. In the menu, select System > Expert > Clear SOLIDserver cache. The wizard Clear SOLID-
server cache opens.
3. Click on OK to commit the clearing of the cache. The report opens and closes. The Admin-
istration tab homepage is visible again. Any internal modification of the code has been taken
into account.
Troubleshooting
Troubleshooting is a logical and systematic search for the source of a problem. It is needed to
develop and maintain complex systems where symptoms can have many possible causes.
Before Troubleshooting
There is set of simple checks that might help you avoid troubleshooting. These checks are often
overlooked in times of functional problems when they should be an administrator reflex.
1. Make sure that the appliance and the objects it manages are set at the same time. If they
are not, set the appliance time.
Typically, if your appliances and the servers it manages are not the same time, you can en-
counter management problems: the DHCP should be the first impacted with the leases and
then the DNS, especially if you set time check keys for the zones. We recommend that you
set the appliance following the procedure To set your appliance time zone and/or date format
and/or check the Configuring the NTP Server configuration. We strongly advise against setting
the time through CLI because it might make SOLIDserver crash, disrupt your services, trigger
errors in the logs... If you do it anyway, restart SOLIDserver to make sure that all the services
impacted by the time change are restarted and all set at the same time.
2. Make sure there is no Multi-Management of your DNS and DHCP physical servers.
Through the smart architectures, you can manage the servers of your choice so make sure
you did not add and manage twice the same server in two different smart architectures. Every
minute the smart architecture checks that its configuration is pushed to the physical server, if
not it pushes it again. So if one physical server is managed through two different architectures
every minute a configuration is pushed and then overwritten by the other smart architecture.
Troubleshooting Guidelines
Determining what might be the causes of a dysfunction is often a process of elimination.
Troubleshooting also requires confirmation that the solution restores the system to its working
state.
1051
Maintenance
The following guidelines give a generic overview of troubleshooting, and since each case is dif-
ferent, you might need to vary your approach to the problem.
How to troubleshoot your system
1. Confirm the presence of a backup in case of service interruption. You might need the
backup file to restore the previous stable version of your system. However, restoration
overwrites the changes made between the time of the backup and the time of the crash, so
this would be the very last resort. For more details, refer to the section Managing Backups
and Restoring Configurations.
2. Isolate the malfunctioning behavior to pinpoint what services or components are affected.
3. Inspect the status indicators that can highlight a dysfunction.
4. Inspect connections to any attached devices and check their power sources.
5. Review the network and services configuration. For more details, refer to the part System
Configuration.
6. Check if the issue is not due to the customer background, i.e. the customer's use of the
services, operating system, network topology components and levels of software that were
running when the incident occurred.
7. Check the product logs. Do not hesitate to check the DNS logs, DHCP logs, PostgreSQL
logs, the management logs as well as the system logs. For more details, refer to the section
Logs Visualization.
8. Check the system logs. Do not hesitate to check the sysaudit.log file, available on the
Local Files Listing page. For more details, refer to the section Managing Files from the Local
Files Listing.
9. Use the troubleshooting tools described in the section below.
10. Check for any improvement until the complete restoration of the system after every
step in the troubleshooting process.
If the problem remains, do not hesitate to contact the support team with all the information you
have collected. The set of files needed include: the network capture file, the troubleshooting dump
file and the last system backup.
Troubleshooting Tools
SOLIDserver provides users of the group admin with two ways of analyzing the system in case
of a crash:
• The Network Capture, that indicates the DHCP or DNS traffic on a given duration.
• The Troubleshooting Dump, that allows to retrieve key debug information.
Both methods are complementary.
Network Capture
The network capture tool allows to capture packets on a given duration, i.e. the actions made
through the appliance interface(s), to analyze DHCP and DNS traffic. When you run this utility,
the archive file containing all the traffic information should be available in the directory listing
module in the .pcap format.
1052
Maintenance
To perform a network capture
opens.
2. In the menu, select Tools > Network capture. The Perform a network capture wizard opens.
3. In the drop-down list Predefined, you can select one of three options described in the table
below:
Table 77.3. Available options in the field Predefined

Option Description
Custom Select this option to scan both the DNS and DHCP traffic. Custom is selected by default.
DHCP traffic Select this option to scan the DHCP traffic. The field Port is automatically filled with 67.
DNS traffic Select this option to scan the DNS traffic. The field Port is automatically filled with 53.
4. In the drop-down list Interface, select the interface for which you want to capture packets.
It can either be DEFAULT_INTERFACE or the DHCP_INTERFACE.
5. In the field Port, you can specify the port for which you want to capture packets.
6. In the field IP address, you can specify the IP address for which you want to capture packets.
7. In the drop-down list Protocol, you can specify the protocol, either udp, tcp or both (Any).
8. In the drop-down list Duration, you can specify the duration of the capture, either 10s, 30s,
1mn, 2mn or 5mn.
9. Click on OK to perform the network capture you just configured. The report opens and closes.
The Administration homepage is visible again.
The .pcap file containing all the traffic information is available on the Local files listing page ac-
cessible through the menu Maintenance>Local files listing on the Administration homepage.
Troubleshooting Dump
The troubleshooting dump is a file containing DNS, DHCP and system debug data. Dumping
troubleshooting details generates a .tbz archive file containing all the debug information. This file
is available on the page Local files listing.
To generate and download the troubleshooting dump file
1. Generate the troubleshooting dump

homepage opens.
b. In the menu, select Tools > Troubleshooting dump. The wizard Troubleshooting dump
opens.
c. Tick the box(es) Retrieve DNS information, Retrieve DHCP information and/or Retrieve
system information. The information ticked is included in the generated file.
d. Click on OK to complete the operation. The report opens and works for a while before
closing. The Administration homepage is visible again..
1053
Maintenance
2. Download the file
a. In the menu, select Maintenance > Local files listing. The page opens.
b. Filter the column Name with the keyword DEBUG to only list troubleshooting dump files.
If a DEBUG file does not have the extension .tbz, it means it is not fully generated yet.
c. Click on the name of the file of your choice to download it.
Managing Backups and Restoring Configurations

EfficientIP recommends that you regularly backup SOLIDserver. In order to help you perform
this maintenance operation, SOLIDserver includes automatic backup and version management
mechanism. The backup process can either be scheduled or triggered on demand.
The backup files are stored on the appliance itself, but you can also decide to store the backup
files on a remote FTP server or SFTP server. For ease of use and to prevent confusion, binaries,
system and log files are not included in the backup stored on the appliance. Still, they can be
restored separately, either when you reinstall SOLIDserver or when you update the system.
DNS, DHCP and System logs can be included in the backup created on the remote archive.
Note that, when you save a backup of DNS zones managed via a smart architecture, you can
later chose to restore them while keeping the latest version of the records they contain. You can
also discard the latest changes and restore the records as saved in the backup file.
SOLIDserver automatically generates a new backup before each upgrade to allow reverting
back its data and configuration.
Browsing the Backup Database

To display the list of backup files
opens.
2. In the section Maintenance, click on Backup / Restore management. The page Backup
parameters opens.
The page contains two panels:
Local backup files

This panel contains:
• The list of the backup files available on the appliance.
• The field Hour of backup (SOLIDserver system time): the time of the daily backup.
• The field Retention duration: the number of days beyond which a backup is automatically
deleted from the local database.
Remote archive
If the remote archiving in enabled, this panel contains the fields:
• Remote server: the address or hostname of the remote server storing the backup files.
1054
Maintenance
• Remote port: the port number used on the remote server that communicates with
SOLIDserver.
• Remote directory: the directory on the remote server where the backup files are stored.
• Remote login: the login used to connect to the remote FTP server.
• Mode: the protocol and mode used to connect to the remote server, either Active FTP,
Passive FTP or SFTP.
• Log DNS: indicates if the DNS logs are included in the remote backup (yes) or not (no).
• Log DHCP: indicates if the DHCP logs are included in the remote backup (yes) or not (no).
• System Log: indicates if the System logs are included in the remote backup (yes) or not
(no).
• Retention duration: the number of days beyond which a backup is automatically deleted
from the remote server.
Creating an Instant Backup

You can create an instant backup of the whole system configuration on demand. An image of
the system is generated and stored on the appliance. Each image can be then used to store the
configuration of a SOLIDserver, which allows you to reload a previous backup in case of a revert
back procedure.
Keep in mind that creating an instant backup during the enrollment of a Hot Standby appliance
in High Availability may trigger an error.
To create an instant backup
opens.
parameters opens.
3. In the menu, select Tools > Create instant backup.The wizard Create instant backup opens.
4. Tick the box Exclude all the reports if you want to exclude all generated HTML and PDF
reports and only save the database, configuration and certification files.
5. Click on OK to commit the backup generation. The report opens and works for a while. Once
the backup is generated, it is listed in the panel Local backup file and named solid-<host-
name>-<year><month><day>- <hour><minutes>.gz.
Once generated, you can download your backup if need be. For more details, refer to the section
Downloading a Backup File.
Editing the Backup Settings

By default, SOLIDserver is configured to generate a backup of its database and network config-
uration every night at 2 a.m. This backup process can be edited to match your own schedule: it
can run at a different hour, store the backup file for a limited time or, on the contrary, an unlimited
number of days...
Editing the backup settings can maximize the disk space of your appliance if you schedule a
backup rotation: the automatic deletion of obsolete backup files.
1055
Maintenance
To schedule a daily backup
opens.
parameters opens.
3. In the menu, select Edit > Local backup files. The wizard Archive backup parameters opens.
4. In the drop-down list Hour of backup (SOLIDserver system time), select at what time you
want to generate the daily backup. By default, it set to 1:00.
5. You can tick the box Exclude all the notifications if you do not want to save the operation
notifications in the daily backup file.These notifications are all listed in the window Notifications
located left of the field Global search.
To set a backup rotation
opens.
parameters opens.
3. In the menu, select Edit > Local backup files or in the panel Local backup files, click on
EDIT . The wizard Archive backup parameters opens.
4. In the drop-down list Retention, select the number of days beyond which a backup should
be automatically deleted.
Archiving the Backup Files on an FTP or SFTP server

You can archive a copy of SOLIDserver backup files on a remote server, FTP or SFTP.
During the configuration of the remote server, you can decide to include the DNS, DHCP and
System logs or even specify a number of days beyond which they should be automatically deleted
from the server. Note that:
• You can archive backups on an FTP server - via Active FTP or Passive FTP - or an SFTP
server. We strongly recommend using SFTP which is far more secure than FTP as it uses an
SSH key instead of a password.
• You can specify the port configured on the remote server. On SFTP servers, usually the same
port than SSH is used.
• If no remote archive is configured, the panel Remote archive contains the message Remote
archive is disabled.
To configure the remote FTP archive
1056
Maintenance
opens.
parameters opens.
3. In the panel Remote archive, click on EDIT . The wizard Archive server parameters opens.
4. Tick the box Enable remote archive, the wizard refreshes and displays the remote archive
configuration parameters. By default, the box is unticked.
5. Configure the remote archive parameters according to your needs:
Table 77.4. Backup archiving parameters

Field Description
Remote server The IP address or the host name of the FTP or SFTP server.
Remote port The port used to communicate with the server. If no port is used, the port 21 is used
for FTP and the port 22 for SFTP.
Remote directory The directory where the backup files should be stored.
Mode The protocol and mode used to archive the files: Active FTP, Passive FTP or SFTP.
Remote login The login of the account used to connect to the FTP or SFTP server.
Remote password The password of the account used to connect to the FTP server. No password is re-
quired for SFTP.
DNS
Tick the box DNS, DHCP and/or System if you want to save the corresponding logs
DHCP
on the remote server.
System
Retention Select the number of days, from 4 days to Unlimited, beyond which a backup should
be automatically deleted from the FTP server. By default, 4 days is selected.
the panel Remote archive displays the FTP or SFTP server parameters you just configured.
7. If you selected SFTP, the panel SSH local key displays the SSH public key used. You must
COPY it and paste in on the SFTP server to secure the communication with SOLIDserver.
To disable the remote FTP archive
opens.
parameters opens.
3. In the panel Remote archive, click on EDIT . The wizard Archive server parameters opens.
4. Untick the box Enable remote archive, the wizard refreshes. It is now empty.
the panel Remote archive contains the message Remote archive is disabled.
Downloading a Backup File

At any time administrators can download a backup file.
1057
Maintenance
To download a backup file
opens.
parameters opens.
3. In the panel Local backup file, select the backup file of your choice.
4. You can click on DOWNLOAD to save the file locally, this automatically closes the wizard. The
page Backup parameters is visible again.
Uploading a Backup File

At any time administrators can upload a backup file located outside SOLIDserver to the local
SOLIDserver file system from the GUI.
To upload a backup file
opens.
parameters opens.
3. In the menu, select Tools > Upload a backup file. The wizard Upload SOLIDserver backup
opens.
4. Click on BROWSE to select the image to upload from your local file system.
5. Click on OK to commit your upload. The backup file is now listed in the panel Local backup
files.
Restoring a Configuration
You can restore a database and configuration through SOLIDserver GUI. Before doing so, keep
in mind that:
• You need the backup file name and version number.That's why each new backup generates
an increment number that concatenates the date and hour as follows: solid-<hostname>-
<year><month><day>-<hour><minutes>.gz.
If the backup file you need is not listed, upload it as detailed in the section Uploading a Backup
File.
• You can only restore a backup created with SOLIDserver version 5.0.4 and higher. Backup
files in prior versions cannot be restored.
• The backup file contains the appliance data and configuration as they were set at the time
of the backup generation. During the restoration, you can choose to include both or only the
data:
• The appliance data includes objects from all modules including the ones of the Local Files
Listing as well as all the rules, notifications and reports, unless you excluded them when you
saved the backup.
1058
Maintenance
• The appliance configuration includes the network configuration (hostname, DNS resolver,
firewall configuration, default gateways, default/static route configuration) and services
configuration (services status, xfer account settings, SNMP communities).
• The records belonging to a smart architecture have a dedicated restoration option. If
your backup file includes zones belonging to a physical server managed via a smart architecture,
you can decide to:
• Overwrite their content with the one saved in the backup file. In this case, you loose all the
latest changes (records added or deleted) between the time of the backup and the time of
the restoration.
• Keep their current content if they are present in the backup file.
In both cases, all the zones that are not part of the backup file, as well as their records, are
lost during the restoration.
• You cannot restore a backup on an appliance set in High Availability. You need to disable
the High Availability, restore the backup on a Standalone appliance and then configure the
High Availability again. For more details, refer to the section Replacing an Appliance With
Backup.
To restore a backup file
opens.
parameters opens.
3. In the panel Local backup files, select the backup file you want to restore.
4. Click on RESTORE . The wizard Restore a backup file opens.
3
5. Tick the box Restore the system configuration to restore the backup system configuration .
Otherwise, the backup data is restored but the current system configuration of the appliance
is kept.
6. Tick the box Overwrite DNS records managed via a smart architecture to restore the records
database as saved during the backup. If you do not tick the box, the restored zones keep
the current version of the records they contain if they are managed via a smart architecture.
In both cases, a restoration includes all and only the zones present in the backup file.
7. Click on OK to commit your restoration.
Shutting Down and Rebooting

When you reboot or shut down an appliance, SOLIDserver transfers file system cache to disk,
stops all running processes and then reboots or halts (shutdown).
Note that once SOLIDserver operating system is stopped, the power supplies are automatically
turned off.
3
Tick the box if you are restoring a backup using an NSD or Unbound Hybrid server.
1059
Maintenance
Rebooting SOLIDserver
There are two ways of rebooting SOLIDserver safely, from the GUI and via CLI.
Note that only users with sufficient rights can reboot SOLIDserver.
Rebooting SOLIDserver From the GUI
Only users with sufficient rights can reboot any appliance from the GUI.
To reboot the system from the GUI

2. In the menu, select Maintenance > Reboot the system. The wizard Reboot opens.
Rebooting SOLIDserver Through CLI
Only users with sufficient rights can reboot any appliance through CLI using its IP address,
hostname or a serial port.
To reboot the system from the CLI
1. Connect to SOLIDserver CLI via a shell session or a port console.

2. Once you are connected, the page WELCOME TO SOLIDSERVER opens.
3. Log in using the credentials admin/admin. The Main menu appears.
4. Hit the key P key to select P Power Management.
5. Hit the key Enter, the page Power Management opens.
6. Hit R to select R Reboot SOLIDserver.
Figure 77.1. Power management
Hit Enter, the confirmation window opens.

1060
Maintenance
Figure 77.2. Reboot confirmation and final message
Hit Enter to reboot SOLIDserver software.
Shutting Down SOLIDserver

SOLIDserver is designed to operate continuously, so under normal circumstances, you do not
need to turn it off or shut it down. However, if you have to turn off SOLIDserver, you can use the
GUI, CLI or the hardware appliances itself, but this last method should only be used as a last
resort.
Prerequisites
• Only users with sufficient rights can shut down SOLIDserver software.
• Before shutting down a remote SOLIDserver hardware appliance, keep in mind that you must
have physical access to it power it back with the the button . You must plug in again SDS-
50 appliances to start them back.
Shutting Down SOLIDserver From the GUI
Any SOLIDserver appliance can be shut down from the GUI, granted that the user has sufficient
rights.
To shut down SOLIDserver from the GUI
1. Make sure you meet the Prerequisites.

3. In the menu, select Maintenance > Shutdown the system.
4. The wizard Shutdown opens.
Shutting Down SOLIDserver Through CLI
Any SOLIDserver appliance can be shut down through CLI using its IP address, hostname or a
serial port.
To shut down SOLIDserver from the CLI

2. Connect to SOLIDserver CLI via a shell session or a port console.
3. Log in using the credentials admin/admin. The Main menu appears.
4. Hit the key P to select P Power Management.
1061
Maintenance
Hit the key Enter, the page Power Management opens.

5. Hit S to select S Shutdown SOLIDserver.
Figure 77.4. Power management
Hit Enter, the confirmation window opens.

Figure 77.5. Shutdown confirmation
Hit Enter to shutdown SOLIDserver software.
Shutting Down SOLIDserver From the Hardware Itself
Any SOLIDserver hardware appliance can be shut down for the hardware itself, shutting down
the hardware appliance also shuts down the software.
Note that shutting down SOLIDserver directly from the hardware should be done carefully to
avoid an abrupt shutdown. It should only be done as a last resort if you cannot do it from the GUI
or through CLI.
To shut down SOLIDserver from the hardware itself

2. From the front panel of the appliance, quickly press and release the power button .
Note that a long press of the button, stops the appliance abruptly and may trigger errors.
The appliance would stop without properly transferring files or stopping the processes as
expected.
For SDS-50 appliances, you must unplug the appliance and plug it again.
1062
Maintenance
3. The appliance stops automatically after synchronizing its buffer on the disk.
1063
Chapter 78. Upgrading
This chapter details the procedures to successfully upgrade SOLIDserver 6.0.2 to a higher
patch. To upgrade SOLIDserver from a previous minor or major version, refer to SOLIDserv-
1
er_Upgrade_to_Version_6.0.2.pdf available on our website .
The process can take a while as the appliance:
1. Generates and saves a backup of the database at the time of the upgrade before rebooting.
2. Upgrades the appliance version and database schema before rebooting a second time.
Prerequisites
1. Have an Internet connection and your credentials ready to download the SOLIDserver
2
version that suits your needs on our website .
2. If you installed hot-fixes, they are deleted during the upgrade. The upgrade wizard retrieves
a list of all installed hot-fixes that you can download.
Note that hot-fixes are only detected locally. When you upgrade a remote SOLIDserver from
the Management appliance, hot-fixes are deleted but the list of files is not available.
3. Keep the upgrade file as is. You cannot rename SOLIDserver upgrade files, otherwise the
upgrade may fail.
4. Follow the proper upgrade procedure.
• If you want to upgrade an appliance, either managing remote appliances or not, refer to the
section Upgrading an Appliance.
• If you want to upgrade appliances configured in High Availability, refer to the section Upgrad-
ing Appliances in High Availability.
• If you want to upgrade appliances managed remotely, refer to the section Upgrading Appli-
ances Managed Remotely.
5. Save the backup file generated during the upgrade. All backup files are automatically deleted
after the number of days defined in the Retention duration you set. If for any reason you need
to troubleshoot the upgrade beyond that period, you will need the latest backup. For more
details regarding troubleshooting, refer to the section Troubleshooting the Upgrade below.
For more details regarding the backup retention time, refer the section Managing Backups and
Restoring Configurations.
Upgrading an Appliance
If you meet the Prerequisites, you can upgrade SOLIDserver to a higher patch.
Note that:
1
2
1064
Upgrading
• Once the appliance is upgraded, the page Services configuration might display different statuses:
any service that was stopped restarts when SOLIDserver reboots. Only disabled services are
not started after an upgrade.
• If an error occurs during the upgrade, refer to the section Troubleshooting the Upgrade of a
Standalone or Remote Appliance.
• If you are upgrading an appliance in High Availability or managed remotely, refer to the section
Upgrading Appliances in High Availability or Upgrading Appliances Managed Remotely.
To upgrade a standalone or management appliance
1. Download SOLIDserver image:
a. Use your client account credentials to connect to the download portal: http:\\downloads.ef-
ficientip.com.
b. Download the file solidserver-<architecture>-<version> that suits your needs. It must
be higher than the version you want to upgrade.
2. Upgrade the appliance:
a. Connect to the appliance GUI.

b. Go to the Administration tab. If the homepage is not displayed, click on . The
homepage opens.
c. In the section Maintenance, click on Upgrade. The wizard Upgrade SOLIDserver opens.
d. Click on BROWSE to select the file containing the upgrade image.The name of the selected
file is displayed in the field File name once retrieved .
e. Click on NEXT . The next page of the wizard opens.
If you installed hot-fixes and/or customized SOLIDserver, all related files may be listed
under Modified files and/or Customization files on the page. For more details, refer to
the Prerequisites.
You can click on DOWNLOAD FULL REPORT to retrieve both lists. To upgrade, click on NEXT .
The last page of the wizard opens.
f. Click on UPGRADE to start the upgrade.
After a while, the connection is automatically interrupted as the appliance shuts down
and reboots. Do not interrupt the process. Once the appliance GUI is reachable again,
it displays the restart progression. When the login fields appear, you can connect to the
appliance.
3. Save the backup generated during the upgrade:

homepage opens.
b. In the section Maintenance, click on Backup / Restore management. The page Backup
parameters opens.
c. In the panel Local backup file, select the latest backup file. It is named solid-<hostname>-
<year><month><day>- <hour><minutes>.gz.
1065
Upgrading
d. You can click on DOWNLOAD to save the file locally. Once the file is downloaded, the
Upgrading Appliances in High Availability

In addition to the basic upgrade Prerequisites, you must comply with the following High Availab-
ility prerequisites:
1. High Availability must be set properly.
One appliance should be the Master and the other one the Hot Standby; they both share the
same HA UID and the same version. When connecting locally to the page All SOLIDserver
of each appliance, the Master status is OK and the Hot Standby status is Managed (re-
mote) . Plus, there is little to no Time drift between them.
Figure 78.1. Master Appliance Centralized Management page
Figure 78.2. Hot Standby Appliance Centralized Management page
2. The automatic re-enrollment option must be disabled.
This avoids errors that might occur if the upgrade takes too long and the Master appliance
tries to re-enroll the Hot Standby. Once fully upgraded, you can enable the option as it was
by default.
Note that:
• Since version 6.0.2.P3, the automatic switch between Master and Hot Standby is disabled by
default. You can enable it manually after setting up the High Availability if need be.
• Once the appliances are upgraded, the page Services configuration might display different
statuses: any service that was stopped is started when SOLIDserver reboots. Only disabled
services are not started after an upgrade.
• If an error occurs during the upgrade, refer to the section Troubleshooting the Upgrade of Ap-
pliances in High Availability.
• If you are not upgrading an appliance in High Availability, refer to the section Upgrading an
Appliance or Upgrading Appliances Managed Remotely.
You can upgrade appliances in High Availability in two different ways:
1066
Upgrading
1. Upgrade both appliances at once from the Master appliance. For more details, refer to
the section Upgrading Both Appliances at Once.
2. Upgrade the appliances one after the other, starting with the Hot Standby appliance.
For more details, refer to the section Upgrading One Appliance at a Time.
Upgrading Both Appliances at Once

You can upgrade both appliances in High Availability at once from the Master appliance. This
process ensures that:
1. The Hot Standby appliance is upgraded first. As the upgrade requires to stop and restart
an appliance that would imply switching the appliances role, if the Hot Standby is upgraded
first, the Master appliance database is still available and no switch is required.
2. The Master appliance is upgraded once the Hot Standby upgrade is complete. Once the
Hot Standby is upgraded, the Master appliance can be stopped and restarted and no switch
is performed.
In High Availability, upgrading both appliances at once must follow this order because upgrading
an appliance stops and restarts it. This process ensures that the appliances do not switch roles
and that the database is available even during the upgrade.
Therefore, from the Master appliance you can safely upgrade both appliances as detailed in the
procedure below.
Note that, since version 6.0.2.P3, the automatic switch between Master and Hot Standby is dis-
abled by default. You can enable it manually after setting up the High Availability if need be.
To upgrade both HA appliances at once
1. Make sure the appliances meet the High Availability prerequisites

ficientip.com.
3. Update the HA files database from the Master:
a. Connect to the Master appliance GUI.

homepage opens.
c. In the section System, click on Remote management.The page All SOLIDserver opens.
The appliances listed on the page do not have a properties page, all the information
regarding each one are displayed in the columns.
d. In the menu, select Tools > Update HA files database. The report opens.
e. Click on OK to commit the modification. The report opens and closes. The page is visible
again.
1067
Upgrading
4. Disable the automatic re-enrollment from the Master:

homepage opens.
c. In the menu, select System > Expert > Registry database. The page Registry database
opens.
d. Filter the column Name with the keyword module.system.auto_replication_repair to
display the entry.
e. In the column Value, if the entry is set to 0, the automatic re-enrollment is already dis-
abled. Go straight to step 5 to upgrade the appliances.
f. In the column Value, if the entry is not set to 0, click on said value. The related wizard
opens.
g. In the field Value, specify 0.
h. Click on the button OK . The wizard reloads and closes.
5. Upgrade both appliances from the Master:

homepage opens.
the Prerequisites.
appliance.
6. Make sure both appliances are upgraded:

homepage opens.
1068
Upgrading
d. Note the information displayed in the column Version, it should match the one on the
Hot Standby appliance.
e. Connect to the Hot Standby appliance GUI and repeat steps b to d to make sure both
appliances have the same version of SOLIDserver. If they do not, refer to the section
Troubleshooting the Upgrade of Appliances in High Availability.
7. Save the backup generated during the upgrade from both appliances:

homepage opens.
c. In the section Maintenance, click on Backup / Restore management. The page Backup
parameters opens.
d. In the panel Local backup file, select the latest backup file. It is named solid-<hostname>-
e. You can click on DOWNLOAD to save the file locally. Once the file is downloaded, the
f. Connect to the Hot Standby appliance GUI and repeat the steps b to e if you set a
specific network/services configuration.
8. Enable the automatic re-enrollment from the Master:

homepage opens.
opens.
display the entry.
e. In the column Value, click on 0. The related wizard Registry database Edit a value
opens.
f. In the field Value, specify 1. It is the value by default.
g. Click on the button OK . The wizard reloads and closes.
9. Enable the automatic switch from the Master, if need be:
Since version 6.0.2.P3, the automatic switch is disabled by default but you can enable it.

homepage opens.
opens.
d. Filter the column Name with the keyword module.system.max_hot_standby_time_skew.
The key can still be present if you upgraded from a previous version where it was already
set.
1069
Upgrading
i. If the key is listed, click on the related value in the column Value. The wizard Re-
gistry database Edit a value opens.
ii. If the key is not listed, in the menu, select Add > Registry item. The wizard Registry
database Add an item opens.
e. If you are adding the key, in the field Name, type in module.sys-
tem.max_hot_standby_time_skew.
f. In the field Value, type in the value of your choice. The default value is set to 3600
seconds. As long as the time time drift between the appliances is under this limit, the
role switch is automatic. Above this limit, the appliances can no longer switch roles
automatically. Setting the value to -1 or 0 prevents the switch completely.
g. Click on OK to commit your changes. The report opens and closes. The page refreshes
Upgrading One Appliance at a Time

Even if the upgrade is automated by default, you can still upgrade an appliance after the other.
To ensure that the database is available throughout the upgrades, you must:
1. Upgrade the Hot Standby appliance. The Hot Standby must be upgraded first to make sure
the Master database is available.
2. Upgrade the Master appliance. Once the Hot Standby appliance upgrade is complete, you
can upgrade the Master. This avoids a switch and ensures the database availability.
Note that, since version 6.0.2.P3, the automatic switch between Master and Hot Standby is dis-
abled by default. You can enable it manually after setting up the High Availability if need be.
To upgrade one HA appliance at a time
1. Make sure the appliances meet the High Availability prerequisites

ficientip.com.
3. Update the HA files database from the Master:

homepage opens.
d. In the menu, select Tools > Update HA files database. The report opens.
1070
Upgrading
e. Click on OK to commit the modification. The report opens and closes. The page is visible
again.
4. Disable the automatic re-enrollment from the Master:

homepage opens.
opens.
display the entry.
e. In the column Value, if the entry is set to 0, the automatic re-enrollment is already dis-
abled. Go straight to step 5 to upgrade the appliances.
f. In the column Value, if the entry is not set to 0, click on said value. The related wizard
opens.
g. In the field Value, specify 0.
h. Click on the button OK . The wizard reloads and closes.
5. Upgrade the appliances one after the other:
a. Connect to the Hot Standby appliance GUI.

homepage opens.
the Prerequisites.
appliance.
g. Connect to the Master appliance GUI and repeat steps b to f to upgrade it. During the
upgrade, the Master appliance switches roles with the Hot Standby.
6. Make sure both appliances are upgraded:
1071
Upgrading

homepage opens.
d. Note the information displayed in the column Version, it should match the one on the
Hot Standby appliance.
e. Connect to the Hot Standby appliance GUI and repeat steps b to d to make sure both
appliances have the same version of SOLIDserver. If they do not, refer to the section
Troubleshooting the Upgrade of Appliances in High Availability.
7. Save the backup generated during the upgrade from both appliances:

homepage opens.
parameters opens.
f. Connect to the Hot Standby appliance GUI and repeat the steps b to e if you set a
specific network/services configuration.
8. Enable the automatic re-enrollment from the Master:

homepage opens.
opens.
display the entry.
e. In the column Value, click on 0. The related wizard Registry database Edit a value
opens.
f. In the field Value, specify 1. It is the value by default.
g. Click on the button OK . The wizard reloads and closes.
9. Enable the automatic switch from the Master, if need be:
Since version 6.0.2.P3, the automatic switch is disabled by default but you can enable it.

homepage opens.
1072
Upgrading
opens.
d. Filter the column Name with the keyword module.system.max_hot_standby_time_skew.
The key can still be present if you upgraded from a previous version where it was already
set.
i. If the key is listed, click on the related value in the column Value. The wizard Re-
gistry database Edit a value opens.
ii. If the key is not listed, in the menu, select Add > Registry item. The wizard Registry
database Add an item opens.
e. If you are adding the key, in the field Name, type in module.sys-
tem.max_hot_standby_time_skew.
f. In the field Value, type in the value of your choice. The default value is set to 3600
seconds. As long as the time time drift between the appliances is under this limit, the
role switch is automatic. Above this limit, the appliances can no longer switch roles
automatically. Setting the value to -1 or 0 prevents the switch completely.
g. Click on OK to commit your changes. The report opens and closes. The page refreshes
Upgrading Appliances Managed Remotely

If you meet the Prerequisites, you can upgrade SOLIDserver appliances managed remotely to
a higher patch.
To upgrade a remote appliance, the management appliance should already be upgraded.

When you upgrade remote appliances, SOLIDserver automatically upgrades the remote appliance
to match the version and architecture of the management appliance. For more details regarding
how to upgrade your management appliance version, refer to the section Upgrading an Appliance.
Note that:
• Once appliances are upgraded, the page Services configuration might display different statuses:
any service that was stopped is started when SOLIDserver reboots. Only disabled services
are not started after an upgrade.
• If an error occurs during the upgrade, refer to the section Troubleshooting the Upgrade of a
Standalone or Remote Appliance.
• If you are not upgrading an appliance managed remotely, refer to the sections Upgrading an
Appliance or Upgrading Appliances in High Availability.
To upgrade one or several remote appliances
1. Make sure the appliances meet the Remote Management Prerequisites

2. Check the version of your management appliance:
a. Connect to the management appliance GUI.

b. On the Home page, the gadget System Information indicates the appliance version
and architecture. Once upgraded, the remote appliance(s) should match this version.
1073
Upgrading
3. Upgrade the remote appliance(s) from the management appliance:
a. Connect to the management appliance GUI.

homepage opens.
d. Tick the appliance(s) you want to upgrade.
e. In the menu, select Edit > Upgrade remote SOLIDserver. The wizard Upgrade selected
remote appliances opens.
f. Click on OK to start the upgrade. The report opens and works until the selected appli-
ance(s) version matches the version of the management appliance.The wizard eventually
closes. The appliance(s) are not accessible for a few minutes.
4. Save the backup generated during the upgrade from the remote appliance(s):
a. Connect to the remote appliance appliance GUI.

homepage opens.
parameters opens.
f. Repeat steps a to e for each remote appliance you upgraded.
Troubleshooting the Upgrade

To troubleshoot an upgrade you can rollback to the version previously installed:
1. Connect to the appliance via CLI.

2. Execute the command that rolls back the installation and restores the backup saved right before
the upgrade.
3. Wait for the appliance to reboot.
4. If need be, contact your reseller's support team to successfully upgrade the appliance and
help you correct your database and upgrade.
The procedure is the same for standalone and remote appliances. For more details, refer to the
section Troubleshooting the Upgrade of a Standalone or Remote Appliance. To troubleshoot an
appliance configured in High Availability refer to the section Troubleshooting the Upgrade of
Appliances in High Availability.
1074
Upgrading
If both appliances in High Availability were upgraded to two different versions, you can downgrade
each appliance locally via CLI, starting with the Master appliance. For more details, refer to the
section If Both HA Appliances were Upgraded to Different Versions.
Troubleshooting the Upgrade of a Standalone or Remote Appliance

If the appliance was upgraded to the desired version but not properly, whether its is remotely
managed or not, you can roll back via CLI. This restores the appliance version and database as
they were before the upgrade. To troubleshoot an appliance configured in High Availability refer
to the section Troubleshooting the Upgrade of Appliances in High Availability.
Note that you need the backup file, generated during the upgrade, to be stored locally on the
appliance.
To rollback the upgrade of a standalone or remote appliance
1. Make sure your backup file is stored on the appliance:
a. Connect to the appliance GUI.

b. On the Home page, in the gadget System information, check the Version currently in-
stalled on the appliance.
c. Go to the Administration tab. If the homepage is not displayed, click on . The
homepage opens.
d. In the menu, select Maintenance > Backup parameters. The page Backup parameters
opens.
e. In the panel Local backup file, make sure the backup generated during the upgrade to
the desired version is listed.
If the backup file is not listed, in the menu select Tools > Upload a backup file. Browse
your computer to find it and click on OK to make sure it is listed on the panel.
2. Roll back the appliance:
a. Using a terminal emulator, open a shell session to connect to the appliance CLI you are
troubleshooting using its IP address or hostname.
b. Log in using the credentials admin/admin. The CLI Main menu appears.
c. Hit the key T to select T Tools and hit the key Enter. The page Tools opens.
d. The line S Start a shell is selected, hit Enter. The terminal closes.
1075
Upgrading
e. To use root permissions, execute the following command:

% su
Hit Enter. The % changes to a #.

f. Execute the rollback command:
# /usr/local/nessy2/script/rollback_upgrade.sh
The menu SOLIDserver rollback opens.

g. In the menu Choose backup to restore to <previous-version>-<architecture>, use the
arrows of your keyboard to highlight the backup file that suits your needs.
Note that only the backup files saved when the previous version was installed are listed,
so if you upgraded a few days ago, none of the backup files saved between the upgrade
and the rollback are listed.
h. Once the backup file of your choice is highlighted, click on Enter. The page WARNING
ROLLBACK WILL RESTORE A BACKUP opens.
i. Hit the key Y to highlight the line ( ) Y CONFIRM ROLLBACK. Press the key Space to
select this option, the * indicates the line is selected: (*) Y CONFIRM ROLLBACK.
j. Hit Enter to confirm.
appliance.
Troubleshooting the Upgrade of Appliances in High Availability

If both appliances were upgraded to the desired version but not properly, you can roll back
via CLI starting with the Master appliance. This restores the appliances version and database as
they were before the upgrade. To troubleshoot an appliance not configured in High Availability,
refer to the section Troubleshooting the Upgrade of a Standalone or Remote Appliance.
If both appliances were correctly upgraded to the desired version but the High Availability config-
uration was broken, you only need to reconfigure it. For more details, refer to the section Config-
uring the HA Management.
If both appliances were upgraded to two different versions, you cannot roll back but you can
downgrade the appliances separately. For more details, refer to the section If Both HA Appliances
were Upgraded to Different Versions.
Note that:
• You need the to disable High Availability, if it is enabled, before rolling back.
• You need the backup file, generated during the upgrade, to be stored locally on each appliance.
To rollback the upgrade of HA appliances
1. Make sure your backup file is stored on both appliances:
1076
Upgrading

homepage opens.
opens.
f. Connect to the Hot Standby appliance GUI and repeat the steps b to e.
2. Make sure the High Availability is properly disabled:

homepage opens.
If the High Availability configuration is already disabled, i.e. all appliances have a Stan-
dalone role, go to step 2.
d. Tick the Hot Standby appliance.
e. In the menu, select Edit > Delete. The wizard Delete opens.
f. Click on OK to commit the deletion. The report opens and works for a while - the Hot
Standby database is saved before it is erased - and closes. The Hot Standby is no
longer listed on the page. The former Master appliance keeps a Master role.
3. Rollback the appliances:
a. Using a terminal emulator, open a shell session to connect to the Master appliance CLI
you are troubleshooting using its IP address or hostname.
c. Hit the key T to select T Tools and hit the key Enter. The page Tools opens.
1077
Upgrading
d. The line S Start a shell is selected, hit Enter. The terminal closes.
e. To use root permissions, execute the following command:
% su
Hit Enter. The % changes to a #.

f. Execute the rollback command:
# /usr/local/nessy2/script/rollback_upgrade.sh
The menu SOLIDserver rollback opens.

g. In the menu Choose backup to restore to <previous-version>-<architecture>, use the
arrows of your keyboard to highlight the backup file that suits your needs.
Note that only the backup files saved when the previous version was installed are listed,
so if you upgraded a few days ago, none of the backup files saved between the upgrade
and the rollback are listed.
h. Once the backup file of your choice is highlighted, click on Enter. The page WARNING
ROLLBACK WILL RESTORE A BACKUP opens.
i. Hit the key Y to highlight the line ( ) Y CONFIRM ROLLBACK. Press the key Space to
select this option, the * indicates the line is selected: (*) Y CONFIRM ROLLBACK.
j. Hit Enter to confirm.
appliance.
k. Connect to the Hot Standby appliance CLI and repeat the steps b to j.
After the rollback, you might want or need to re-enroll the appliances to make sure there is no
replication delay. For more details, refer to the section High Availability Advanced Options.
If Both HA Appliances were Upgraded to Different Versions
If both appliances in High Availability were upgraded to two different versions, a message
under the menu prompts you to downgrade your software version. You can downgrade each
appliance locally via CLI, starting with the Master appliance. The roll back is only available for
Standalone and remote appliances. For more details, refer to the sections Troubleshooting the
Upgrade of a Standalone or Remote Appliance.
Note that:
• You need the backup file, generated during the upgrade, to be stored locally on each appliance.
• You need the to disable High Availability, if it is enabled, before downgrading both appliances
separately.
• You need the SOLIDserver image in the version installed before the upgrade. With your client
credentials, you can download it on our website.
To downgrade HA appliances upgraded to different versions
1078
Upgrading
ficientip.com.
b. Download the file solidserver-<architecture>-<version> in the version that was installed
on the appliance before the upgrade to the desired version.
2. Make sure your backup file is stored on both appliances:

homepage opens.
opens.
f. Connect to the Hot Standby appliance GUI and repeat the steps b to e.
3. Make sure the High Availability is properly disabled:

homepage opens.
If the High Availability configuration is already disabled, i.e. all appliances have a Stan-
dalone role, go to step 2.
d. Tick the Hot Standby appliance.
e. In the menu, select Edit > Delete. The wizard Delete opens.
f. Click on OK to commit the deletion. The report opens and works for a while - the Hot
Standby database is saved before it is erased - and closes. The Hot Standby is no
longer listed on the page. The former Master appliance keeps a Master role.
4. Downgrade both appliances separately:
a. Connect to the future Master appliance GUI.

homepage opens.
1079
Upgrading
the Prerequisites.
appliance.
g. Connect to the future Hot Standby appliance CLI and repeat the steps b to f.
5. Restore the backup of SOLIDserver on the appliance(s) from the CLI:
a. Using a terminal emulator, open a shell session to connect to the Master appliance CLI
using its IP address or hostname.
If the connection cannot be established, it means that SOLIDserver did not finish
downgrading. Wait and open another shell session.
c. Hit the key B to select B Backup Management and hit the key Enter. The page Backup
Management opens.
d. Select R Restore backup and hit Enter. The page Backup files opens.
e. Using the digit keys, select the backup file generated before the unsuccessful upgrade.
f. Hit Enter to select it. The message Do you also want to restore the configuration of
the system? appears.
g. The answer Yes is selected. Hit Enter to select it.
The message Do you really want to restore <backup-file-name>? Your server will
automatically be rebooted to complete the process if you continue appears and the
answer Yes is selected
h. Hit Enter to confirm.
1080
Upgrading
appliance.
i. Connect to the Hot Standby appliance CLI and repeat steps b to i if you want to restore
the network/services configuration of the future Hot Standby appliance.
Note that, if you do not need to restore the network/services configuration of your Hot
Standby appliance, you can restore only the Master appliance.
6. Enroll the Hot Standby again:

homepage opens.
d. In the menu, select Add > Remote SOLIDserver. The wizard Add/Modify remote
SOLIDserver appears.
e. In the field SOLIDserver IP address, specify the IPv4 address of the appliance you want
to add to the list.
f. If the field 'admin' user password is empty, type in the SSH password, i.e. the default
one (admin) or the one you set if you changed it.
g. Click on OK to commit the addition. The report opens and closes. The new appliance
is listed and marked Standalone in the column Role and Managed (remote) in the column
Status.
h. Tick the future Hot Standby.
i. In the menu, select Edit > Enroll SOLIDserver as Hot Standby. The wizard Enroll
SOLIDserver as Hot Standby opens.
j. Click on OK to commit the configuration. The report opens and works for a while, until
the Hot Standby appliance database is erased and replaced by the Master appliance
database. The appliance set as Hot Standby is unavailable for a while. Each appliance
role is modified according to the configuration, they both get the same HA UID.
7. Contact your reseller's support team to successfully upgrade to version that suits your
needs and help you correct your database and upgrade.
After the rollback, you might want or need to re-enroll the appliances to make sure there is no
replication delay. For more details, refer to the section High Availability Advanced Options.
1081
Part XIV. Customization
There are many ways of customizing SOLIDserver to suit your needs from the GUI to the data you manage.
You can customize the GUI following the chapters:
• Customizing the GUI details how to specify the text of your choice in the home page Welcome banner,
or include images on the Home page or the login page.
• Managing Smart Folders details how to set up a tree-like display of your data for the modules IPAM,
DHCP, DNS, NetChange and Device Manager using Smart Folders in the Tree View. This completely
virtual organization of the objects can help you simplify deep organizations.
• Managing IPAM and DHCP IPv6 Labels details how to create and use IPv6 labels above the IPv6 addresses
of your IPAM and DHCP entries and differentiate containers more easily.
You can also customize your databases even further following the chapters:
• Configuring Classes details how administrators can manage classes to configure custom properties for
your resources and tailor your database.
• Custom DB details how to create databases tailored to your needs. They can, for instance, be used when
to ease the configuration of your classes.
• Managing Customization Packages details how to install packages to import customized functionalities
from an archive file.
Chapter 79. Customizing the GUI
You can customize SOLIDserver GUI with images on the pages Home and Login, edit the welcome
banner message or even edit the fields' name to suit your needs.
Customizing SOLIDserver Login Page With an Image

SOLIDserver provides the possibility to display an image on the appliance Login page: you can
either display it over the logo of the login window or as a background.
At any time, this image can be changed or removed. Only users of the group admin can perform
these changes.
To customize the login page with an image you need to:
1. Upload the image to the local files listing;

2. Specify the image name as the value of the dedicated registry database item.
Uploading an Image to SOLIDserver

You can upload any image to SOLIDserver database. Keep in mind that uploading images with
a transparent background allows to fully integrate them to SOLIDserver graphical interface.
The login page image maximum size is 373x74 pixels. You can also upload a thumbnail of 45
pixels in height to be displayed in the upper left corner of the login banner.
To upload an image to customize SOLIDserver
opens.
3. Under the menu, tick the bullet Custom images. The sub-page Custom images opens.
4. In the menu, select Tools > Upload file. The wizard Import a file opens, you can only upload
one file at a time.
5. Click on BROWSE to look for the image of your choice on your computer.
6. In this new window, find the image you want to upload and select it.
7. Click on Open. The window closes and the wizard is visible again. In the field File name, the
name of the selected image is displayed.
8. Click on OK . The report wizard opens and closes. The image is listed.
You can upload as many images as you need to the page Local files listing, follow the procedure
above for each one of them.
Displaying an Image on SOLIDserver Login Window

Once you uploaded the image you want to display as new logo on the login page, you have to
set its name as the value of the appropriate entry of the registry database.
1083
Customizing the GUI
To display an image in the appliance login page window
opens.
opens.
3. Filter the column Name with the keyword logo.generic. The list displays the entry www.dis-
play.login_page.logo.generic.
4. In the column Value, click on <empty>. The wizard Registry database Edit a value opens.
5. In the field Value, type in the name of the image you want to display (name.extension). If
you have not uploaded it yet to the page Custom images of the Local files listing, refer to
the procedure To upload an image to customize SOLIDserver.
6. Click on OK to commit your choice. The specified image replaces the default SOLIDserver
logo. To see it open SOLIDserver in a different browser or log out.
If you want to display a different image on the Login page, edit the value of the entry www.dis-
play.login_page.logo.generic with the full name of an image you already uploaded to the Local
files listing.
Displaying an Image on SOLIDserver Login Page Background

Once you uploaded the image you want to display as background of the appliance login page to
the page Local files listing, you have to set its name as the value of the appropriate entry of the
registry database.
To display an image as the background of the appliance login page
opens.
opens.
3. Filter the column Name with the keyword bg.generic. The list displays the entry www.dis-
play.login_page.bg.generic.
4. In the column Value, click on <empty>. The wizard Registry database Edit a value opens.
5. In the field Value, type in the name of the image you want to display (name.extension). If
you have not uploaded it yet to the page Custom images of the Local files listing, refer to
the procedure To upload an image to customize SOLIDserver.
6. Click on OK to commit your choice. The specified image is displayed as background of
SOLIDserver login page. To see it open SOLIDserver in a different browser or log out.
If you want to display a different image on the Login page, edit the value of the entry www.dis-
play.login_page.bg.generic with the full name of an image you already uploaded to the page
Local files listing.
1084
Customizing the GUI
Removing Custom Images from SOLIDserver Login Page

The registry database also allows to remove the image from the login page. You must edit the
relevant item and empty its value.
To remove an image from the appliance login page
opens.
opens.
3. Filter the column Name with the keyword generic. The list displays the entries www.display.lo-
gin_page.logo.generic (the logo) and www.display.login_page.bg.generic (the background
image).
4. In the column Value of the entry of your choice, click on <image-name>. The wizard Registry
database Edit a value opens.
5. In the field Value, empty the field.
6. Click on OK to commit your choice. The image is removed from SOLIDserver login page.
To make sure of it, open SOLIDserver in a different browser or log out.
Customizing SOLIDserver Home Page Welcome Banner

SOLIDserver Home page contains a welcome banner that can be edited to suit your needs: you
can customize it with an image, change the message or even hide the banner altogether.
Only users of the group admin can edit the welcome banner.
Editing SOLIDserver Welcome Banner Title

By default, SOLIDserver Home page contains a welcome banner containing the message Welcome
to SOLIDserver, you can edit it if you want.
To edit the welcome banner title
1. Click on the tab efficient iP to open the appliance page Home.

2. In the right corner of the welcome banner, click on . The wizard Editing the welcome
banner opens.
3. In the field Title, replace the current message with the one of your choice.
4. Click on OK to commit the title edition. The report opens and closes. The Home page re-
freshes, the new message is visible.
Displaying an Image on SOLIDserver Welcome Banner

It is possible to add an image next to the title in the welcome banner. The size of this image does
not matter as it is automatically resized to fit in the welcome banner.
1085
Customizing the GUI
To display an image on the appliance Home page

banner opens.
3. Click on BROWSE to look for the image of your choice on your computer.
4. In this new window, find the image you want to upload and select it.
5. Click on Open. The window closes and the wizard is visible again. In the field File name, the
name of the selected image is displayed.
6. Click on OK to commit your image selection. The report opens and closes. The Home page
refreshes, the image is visible on the appliance welcome banner.
If you want to display a different image in the welcome banner, follow the procedure and select
another image.
Keep in mind that the selected image(s) is saved on the page Local files listing and listed on the
sub-page Custom images. For more details, refer to the section Managing Files from the Local
Files Listing.
Removing the Image from SOLIDserver Welcome Banner

At any time, the image displayed in the welcome banner can be removed.
To remove the image displayed on the appliance Home page

banner opens.
3. Tick the box Remove the image from the banner.
4. Click on OK to commit your choice. The report opens and closes. The Home page refreshes,
the image is no longer visible.
Hiding SOLIDserver Welcome Banner

You can remove the welcome banner from the appliance Home page. In fact you are hiding it, a
dedicated entry in the registry database is added to hide the banner.
To hide the welcome banner

2. In the right corner of the welcome banner, click on x. The wizard Hiding the welcome banner
opens.
3. Click on OK to commit your choice. The report opens and closes. The Home page refreshes,
the banner is no longer visible.
1086
Customizing the GUI
Displaying SOLIDserver Welcome Banner Again

To display the welcome banner on the Home page again, you need to delete the entry of the re-
gistry database that hides the banner.
To display the welcome banner again
opens.
opens.
3. Filter the column Name with the keyword panel.home. The list displays the entry pan-
el.home.welcome.delete .
4. Tick the entry panel.home.welcome.delete .
6. Click on OK to commit your deletion. The page refreshes, the item is no longer listed.
7. Click on the tab efficient iP to open the appliance page Home. The banner is visible again.
Customizing the Interface Names and Fields

The Administration module provides a page dedicated to administrators that allows them to
customize the interface labels, that is the default name of some fields and menus. To be precise,
this page allows you to rename: fields name, menus name and pages and columns title. From
Language editor, you can add entries to replace existing labels in the GUI.
There are two exceptions:
• You cannot edit the title of the Language editor page itself.
• You cannot rename the Home page welcome banner title using this page. For more details,
refer to the section Customizing SOLIDserver Home Page Welcome Banner.
Besides, keep in mind that the interface label customization applies to the language you
chose to manage SOLIDserver with. The label of the English interface field that you add to
Language editor with a Spanish new name, is not edited.
To add a customized label
1. From any page or wizard within SOLIDserver, copy the name of a field, page, column or
menu that you want to replace with your label.
opens.
4. In the menu, select Add > Entry. The wizard opens.
5. In the field Key, paste the value you want to replace. We recommend that you copy/paste
the label name because Language editor is case sensitive.
6. If your appliance is displayed in English, in the field English, type in the new label value.
1087
Customizing the GUI
7. Click on OK to commit your creation. The entry is listed. Go back to the page where you
copied the label to see the new name.
To delete a customized label
opens.
3. In the column Key, click on the label name. The wizard opens.
4. Empty all the fields.
5. Click on OK to commit your deletion. The entry is no longer listed. Go to the page the label
is displayed on: it now displays the standard label.
To edit a customized label
opens.
3. In the column Key, click on the label name. The wizard opens.
a. In the field Key, you can edit the label itself. This edits a different field, column or page,
or nothing at all if it does not correspond to anything in the GUI.
b. If your appliance is displayed in English, in the field English, you can edit the label.
4. Click on OK to commit your changes. The entry is listed. Go to the page the label is displayed
on: it now displays the edited label in the corresponding language.
1088
Chapter 80. Managing Smart Folders
Smart folders is one the many customization opportunities provided by SOLIDserver. They allow
to organize your items differently than on the listing pages. Smart Folders can be created, deleted,
edited and/or shared with other users.
A smart folder is a database view that helps you organize data into a tree-like hierarchy. You can
make a smart folder out of any list of items within the IPAM, DHCP, DNS, NetChange and Device
Manager modules. This organization can have as many levels as you need and is composed of
columns and/or meta-data (class parameters). Remember that this display is completely virtual
and does not affect in any way your data.
Like the gadgets, smart folders can either be personal or shared with other users. For more details,
refer to the section Sharing Smart Folders.
Browsing Smart Folders

All the smart folders are listed in the Tree View and can be managed from the page My Smart
Folders.
From this page you can manage edit, delete or share your smart folders. Note that smart folders
do not have a properties page as all the information is displayed on the page.
To display the smart folders in the Tree view

2. Click on the section Smart Folders. The list of smart folders opens.
In the Tree view, the smart folder hierarchy respects the following:
• The levels within the smart folder hierarchy are preceded by a folder icon.
• Each level of the smart folder hierarchy has dedicated folder color. The display is indented
from one level to the other.
• Each level name is followed by a number between brackets: it indicates the number of items
it contains, either other sub-levels or the resources.
• The lowest level of the hierarchy is preceded by the resource icon on its management page
(All <resource>).
• If a level does not appear in the Tree view, it means there is no data to display.
• If a level is called N/A, it represents a level not relevant to the resource. For instance, if you
create a smart folder from the page All addresses and include a level "pool name", if some IP
addresses are not managed by a pool, they are listed under N/A.
To display the list of smart folders
1. From any page within SOLIDserver, in the menu select Preferences > My Smart Folders.
2. The page My Smart Folders opens.
Table 80.1. Columns on the page My Smart Folders

Column Description
My Smart Folders All the smart folders created.
1089
Managing Smart Folders
Column Description
All users The smart folder visibility. Yes indicates that the smart folder is shared with the other users.
No indicates that only the User who created it can see it.
User The name of the user who created the smart folder(s) listed.
Type The page where the smart folder was created, listed as follows: <module>:<page>.
Hierarchy The smart folder hierarchy.
Adding Smart Folders

Smart Folders can be added, i.e. created, from any listing page within the modules IPAM, DHCP,
DNS, NetChange and Device Manager. They allow to organize into a customized hierarchy the
data displayed. Do not hesitate to filter the data at your convenience to visualize a tree displaying
only the pieces of information of your choice.
To add a smart folder

2. Filter the data if needed.
3. In the menu, select Preferences > Add a Smart Folder. The wizard Add a Smart Folder
opens.
4. In the field Smart Folder Name, name your Smart Folder.
5. Select the content of your smart folder:
a. In the drop-down list Hierarchy, select a column or a class parameter.

b. Click on . The selected value is moved to the list Selected items in the hierarchy.
c. Repeat these steps for as many columns and class parameters as needed.
6. Organize the hierarchy of your smart folder. The order impacts the final display of the Smart
Folder.
a. In the list Selected items in the hierarchy, select a value and move it using the buttons
and .
b. To remove a value, select it in the list and click on . It moved back to the list Hierarchy.
7. Tick the box Visible to the other users if you want to share your Smart Folder with the other
users.
8. Click on OK to commit your creation. The report opens and closes. The page is visible again.
Once created, the smart folder is listed in the Tree view. If you do not see it use the button.
Editing Smart Folders

Smart folders can be edited at any time from the smart folder list. You can edit every column
through this procedure, except the User column.
1090
To edit a smart folder
1. From anywhere in SOLIDserver, using the menu, select Preferences > My Smart folders.
My Smart Folders page opens.
2. Right-click over the name of the smart folder you want to edit. The contextual menu opens.
3. Click on . The wizard Edit a Smart Folder opens.
4. In the field Smart Folder Name, change the name if need be.
5. Add more columns and/or class parameters if need be:
a. In the drop-down list Hierarchy, select a column or a class parameter.

b. Click on . The selected value is moved to the list Selected items in the hierarchy.
c. Repeat these steps for as many columns and class parameters as needed.
6. Edit the hierarchy of your smart folder if need be:
a. In the list Selected items in the hierarchy, select a value and move it using the buttons
and .
b. To remove a value, select it in the list and click on . It moved back to the list Hierarchy.
7. Tick the box Visible to the other users if you want to share your Smart Folder with the other
users. You can untick it as well.
8. Click on OK to commit your edition. The report opens and closes. The page is visible again.
Your changes are displayed on the page My Smart Folders and in the Tree view.
Once edited, the smart folder new configuration can be displayed in the Tree view. Click on
to refresh the display.
Sharing Smart Folders

For each smart folder created you have the possibility to share it with other users or make it ac-
cessible only to you. There are two ways to do so, you can either choose to share the smart
folder when creating it - for more details, refer to the part Adding Smart Folders -, or you can
choose to share or hide it from the smart folders list.
To make a smart folder visible to all users
2. In the list, tick the Smart folder you want to share. Filter the Smart Folders if need be.
3. In the menu, select Edit > Visible to all users > Yes. The wizard Smart Folder visibility
opens.
4. Click on OK to commit your choice. The report opens and closes. The page My Smart Folders
is visible again. In the column All Users, the Smart Folder is marked Yes.
The same procedure allows you to make a Smart Folder visible only to you.
1091
To make a smart folder visible only to you
The Smart Folder page opens.
2. In the list, tick the Smart folder you want to make visible only to you. Filter the Smart Folders
if need be.
3. In the menu, select Edit > Visible to all users > No.The wizard Smart Folder visibility opens.
4. Click on OK to commit your choice. The report opens and closes. The page My Smart Folders
is visible again. In the column All Users, the Smart Folder is marked No.
Deleting Smart Folders

Smart Folders can be deleted from the smart folder list. You can delete one or several smart
folders at a time.
To delete a smart folder
2. In the list, select the Smart Folder you want to delete. Filter the Smart Folders if need be.
4. Click on OK to commit the deletion. The report opens and closes. The page My Smart Folders
is visible again. The selected Smart Folder(s) is no longer listed.
1092
Chapter 81. Managing IPAM and DHCP
IPv6 Labels
SOLIDserver introduced the labels, along with the IPv6 addresses management, to provide a
visual aid that allows to display the letters and colors of your choice above certain part of IPv6
address.
The labels allow to gather at a glance IP addresses belonging to a common container in the IPAM
and DHCP modules.
Figure 81.1. Example of a geographical distribution of labels in the IPAM
In the example above, you can see that the labels are named after the block-type and subnet-
type networks and colored to reflect the hierarchy. Also, the label goes above, and therefore
hides, the address configured whether it is a full IP address or part of an address.
Limitations
• When configuring a label, you must type in the uncompressed version of the IP address. For
instance, to create a label for a network starting with the address 12:: , you must specify 0012::
• If you have common network start addresses among several spaces or networks, they all have
the same label (see the labels Canberra and Management in the example above).
Adding Labels
The labels are all managed from the same wizard, accessible in the menu Settings. You can add
as many labels as you need on the following pages:
• In the IPAM, labels can be managed on the IPv6 pages: All networks, All pools and All ad-
dresses.
• In the DHCP, labels can be managed on the IPv6 pages: All scopes, All ranges, All leases and
All statics.
To add a label
1. Depending on your needs:
1093
Managing IPAM and DHCP IPv6
Labels
From the breadcrumb, open the page All networks, All pools or All addresses.
b. Go to the DHCP tab. If the homepage is not displayed, click on .The homepage opens.
From the breadcrumb, open the page All scopes, All ranges, All leases or All statics.
3. In the menu, select Settings > Configure IPv6 labels. The wizard Configure IPv6 labels
opens.
4. In the field IPv6, type in or paste the uncompressed address you want to label, or part of it.
5. In the field Label Name, type in the label name of maximum 3 characters, letters or numbers.
The label is visible in the Preview.

6. Under the field Choose a color, click on the color of your choice.
The color is visible in the Preview.

7. Click on ADD . The label is moved to the List of labels. Repeat these steps for as many labels
as you need.
8. Click on OK to commit your creation. The list is visible again.
Once created, the labels need to be displayed manually. For more details, refer to the section
Displaying or Hiding Labels.
Displaying or Hiding Labels

Once you created labels, you can choose to display or hide them.
To display/hide the labels
2. On the right-end side of the menu, make sure V6 is selected.

3. To display the label, in the menu select Display > Use IPv6 labels. The configured labels
are visible.
4. To hide the label, in the menu select Display > Do not use IPv6 labels. The configured labels
or no longer displayed.
Editing Labels
You can edit existing labels directly in their creation wizard.
1094
Managing IPAM and DHCP IPv6
Labels
To edit a label

opens.
4. In the field List of labels, select the label you want to edit.
5. Edit the label IPv6, Label Name and/or Color.
6. Click on UPDATE to save the changes. The label is no longer listed in the field. Repeat these
steps for as many labels as you need.
7. Click on OK to commit your edition and close the wizard. The list is visible again.
Keep in mind that the labels need to be displayed manually. For more details, refer to the section
Displaying or Hiding Labels.
Deleting Labels
Like for the edition, you can delete existing labels directly in their creation wizard.
To delete a label

opens.
4. In the field List of labels, select the label you want to delete. You can only delete labels one
at a time.
5. Click on DELETE . The label is no longer listed in the field. Repeat these steps for as many
labels as you need.
6. Click on OK to commit your changes and close the wizard. The list is visible again.
1095
Chapter 82. Configuring Classes
Classes allow to create properties and behaviors that apply only to the resources of your choice,
they allow to tailor databases to their needs.
From the page Class Studio, users of the group admin can create, edit, rename and duplicate
classes: they can also move them from one directory to the other or even from one resource to
the other.
Figure 82.1. The page Class Studio
Before configuring classes, keep in mind that:
1. The class is a container. All classes are listed on the page Class Studio. For more details,
refer to the section Managing Classes.
2. The class's content is managed independently. All the parameters of a class, its class ob-
jects, are configured in a dedicated wizard. For more details, refer to the section Configuring
the Classes' Content.
When a class is selected, its parameters are available for configuration in the addition/edition
wizard of the resource. If the class is created empty, the wizard is unchanged.
Within SOLIDserver, you can apply existing classes to resources from their addition/edition wizard.
There are 3 types of classes:
• Default is a class associated by default with every type of resource. These classes are auto-
matically applied to a resource in the addition and edition wizard and set the object's advanced
properties. For more details, refer to the chapter Managing Advanced Properties.
You cannot delete or edit default classes.

• Global is a class associated by default with every type of resources as well. These classes
are automatically applied to a resource in the addition and edition wizard and set the resource's
Meta-Data, the user defined fields of your choice.
You can edit but not delete global classes. For more details, refer to the section Editing Classes.
• Customized classes are all the classes you create from the page Class Studio. These classes
must be manually selected and applied to resources in their addition and edition wizard. The
wizard automatically detects that a custom class is enabled for the type of resource and provides,
before anything else, the list <resource> class, where you select the class of your choice or
None.
You can manage (add, edit, delete...) customized classes. For more details, refer to the section
Managing Classes.
1096
Configuring Classes
Note that customized classes can be set as resource of groups of users. If users have man-
agement permissions over objects configured with a customized class but the class is not
among their resources, they cannot display or edit the class parameters and they clear the
value of all the class parameters when they edit a resource. For more details regarding user
resources, refer to the section Assigning Resources to a Group.
Applying an enabled class may change the fields available in the addition/edition wizard of the
resource. In the example below, an administrator configured a network class called location in-
cluding an input field labeled City. When editing the network internal, a user selected this class,
and can now specify that the network is located in the City of Chicago.
Figure 82.2. Example of an input class object labeled "City"
Note that applied classes can also be used to set automatic templates to display specific columns
on a page based on the class applied to the container of the resources listed. For more details
Browsing Class Studio Database

In the module Administration, the page Class Studio allows to display all existing classes and
their content.
The classes are all listed on the page, while their content must be listed and managed from a
dedicated wizard.
Browsing Classes
To display the list of classes
opens.
1097
Configuring Classes
By default, Class Studio displays as many global and default classes as there are resources
within SOLIDserver. The page columns are described in the table below:
Table 82.1. Class Studio columns

Column Description
Name The class name. It might be set to default, global, or defined by the user in the case of customized
classes. Only customized classes can be renamed.
Directory The directory in which the class is located. A directory can only be created upon addition of a
class. Still, a class can be moved from one directory to another at any given time.
Module The module of the resource for which the class is set. A class can only be moved from a module
to another when not in use.
Type The type of resource for which the class is set (DHCP groups, DNS servers, etc.). A class can
only be moved from a type of resource to another when not in use.
Template The class template configuration: it is either a template or not. Its value can be yes or no. For
more details, refer to the chapter Managing IPAM Templates.
Last modified The time and date of the last modification made on the class.
Status The class activation: Enabled or Disabled. When disabled, a class is neither applied nor listed
among the class available when adding or editing the resource it could apply to.
To display a class properties page
opens.
3. At the end of the line of the class of your choice, click on . The properties page opens.
Browsing Class Objects

The classes configuration is available in a pop-up window that allows to add and edit the class
objects of the class. To edit classes, your browser must allow pop-up windows.
This pop-up window, named Class Editor, opens when you click any class name on the page
Class Studio. It is divided vertically to display: on the left a creation panel and on the right the
list of class objects. You can sort these objects using the drop-down list.
Figure 82.3. The pop-up window Class Editor
1098
Configuring Classes
This section of the window displays the class objects' Label as it appears in the wizard.
The gray fields display the Name of the class object.
The icon allows to delete the class objects.
The gray section of class editor displays the available class objects.
The drop-down list allows to filter the class object types.
To open Class Editor from Class Studio
opens.
3. In the column Name, click on the class you want to edit. The pop-up window Class Editor
(<hostname>/<user>) opens. The class name is displayed at the end of the URL field as
such: <class-name>.class .
Class Editor allows to edit any of your own classes and the class global of any resource.
Managing Classes
From Class Studio, you can add, edit, rename, duplicate, move, stop using and/or delete classes.
Once created you can apply classes to the type of resource they were configured for.
Keep in mind that two types of class are available by default but their management is more limited:
• Default classes: you cannot edit or delete any default class. However, you can choose the
advanced properties you want to use, for more details refer to the chapter Managing Advanced
Properties.
• Global classes: you can edit each global class from the menu Settings > Meta-data but you
cannot delete them. For more details, refer to the section Editing Classes below.
In this section, we only discuss the classes themselves, to configure their content, i.e. the class
objects that tailor them to your needs, refer to the section Configuring the Classes' Content.
You can create and manage classes for the following resources, the columns correspond to the
drop-down lists available in the class addition wizard.
Table 82.2. Resources that can be configured with a class

Module Type
Administration SOLIDserver (appliance).
DHCP Servers, scopes, ranges, groups and statics both in IPv4 and IPv6.
DNS Servers, views and zones.
Device Manager Devices and Ports & interfaces.
IPAM Spaces, networks, pools and addresses both in IPv4 and IPv6.
NetChange Network devices and ports.
Rights & delegation Groups and users. The groups of users are managed from the module Administration.
SPX Autnums. The Autnums are managed from the module IPAM.
1099
Configuring Classes
Module Type
VLAN manager VLAN domains and ranges.
VRF VRFs. The VRFs are managed from the module IPAM.
Workflow Requests. The resource Requests only applies to outgoing requests.
Adding Classes
You can create specific customized classes to be applied individually and manually to your re-
sources when you add or edit them.
Note that you can also edit the global classes but this would automatically affect all the resources
the class is set for. For more details, refer to the section Editing Classes.
To add a class
1. Go to the Administration tab and open Class Studio.

2. In the menu, select Add > Class. The wizard Add a new class wizard.
3. Fill in the following fields:
Table 82.3. Class addition parameters

Field Description
Filename Name your class. The name cannot contain any special characters. This field is
mandatory.
Sub directory You can fill in the directory where you want to save your class. If it does not exist, it
is created. On the wizards class selection page, classes placed in a directory are
displayed as such: <directory>/<class>. This field is optional.
Module Select the module of your choice. This field is mandatory.
Type Select the resource of your choice. This field is mandatory.
Enable class Tick this box if you want to enable the class upon creation. If a class is not enabled,
it is ignored in the database and not listed in the addition/edition wizard of the resource
it applies to. This field is optional as you can enable it later on, For more details, refer
to the section Enabling or Disabling Classes.
4. Click on OK to commit your creation. The report opens and closes. The class is listed.
Once you added a class, keep in mind that:
• A class is empty by default, whether it is a global or a customized one. Once created, you
can click on the name of a class name to add and configure its class objects through Class
Editor. For more details, refer to the section Configuring the Classes' Content.
• A class must be enabled to be used. If a customized class is not enabled, it is not available
in the addition and edition wizards of the resource. For more details, refer to the section Applying
Classes.
Only global classes are enabled by default and can be edited and automatically integrated to
the wizards of the resources they are set for.
1100
Configuring Classes
Applying Classes
Once at least one customized class is created and enabled, the addition and edition wizard of
the resource they apply to displays a dedicated page <resource> class where you can select a
class.
Figure 82.4. The page Network class in an addition/edition wizard
To apply a class
1. Go to the page All <resources> of a resource for which you enabled a class.
3. On the page <resource> class, you can select in the list <resource> class one of the following
options:
Table 82.4. Class selection options

Field Description
<class-name> Select a class to load it, and the class objects it contains, in the wizard. Classes be-
longing to a directory are listed as follows: <directory>/<class-name> .
No class or None When adding or editing a resource, this option allows to configure the resource without
any customized class.
In the IPAM, when adding a network or an IP address, selecting this option allows to
filter the list of parent networks and select only the networks configured without any
customized class. If it is not listed, it means that all the parent networks are configured
with a class.
All In the IPAM, when adding a network or an IP address, selecting this option allows to
include all the parent networks as potential container, whether they are configured
with or without a customized class.
4. Click on NEXT to load the class option and complete your addition/edition.
1101
Configuring Classes
5. Click on OK to commit your operation. The report opens and closes.
Editing Classes
You can edit the content of a customized class at any time, that is to say edit the class objects
it contains or edit their order.
To edit a class
1. Make sure your browser allows pop-up windows.

5. Edit the class object according to your needs following the procedure that suits your needs
in the section Adding Class Objects.
6. Click on OK to commit your configuration. The object is updated in the creation panel.
Keep in mind that you can also edit the configuration of the class global of a specific resource
directly from its management page All <resources>.
To edit the class global of a resource from its management page
opens.
2. Click on of the resource of your choice. The page opens.
3. In the menu, select Settings > Meta-data. Class Editor opens and displays the class objects
of the class global of the chosen resource.
Renaming Classes
A customized class can be renamed at any time from its properties page. Renaming a class does
not affect the class objects it contains. Once a class has been renamed, it is updated on the
properties page of the concerned resources.
To rename a class

3. At the end of the line of the class of your choice, click on . The properties page opens.
4. In the menu, select Edit > Rename. The wizard Rename class opens.
1102
Configuring Classes
5. In the field Old, the current class name is displayed.

6. In the field New Name, type in the new name for the class.
7. Click on OK to commit your changes. The class new name is displayed in the panel and
modified in the list.
Duplicating Classes
SOLIDserver allows to duplicate customized classes. These duplicates can then be edited and
renamed to manage them more easily, for instance you might need to apply them to other types
of resource or even move them.
Duplicating classes can be useful since object values set for a resource are automatically inherited
by the resources it contains. For instance, if the value "Chicago" is set for a block-type network
through an input field "city", it is automatically inherited by the subnet-type networks it contains
if said subnet-type network also has an input field named "city".
To duplicate a class

2. Tick the class(es) you want to duplicate.
3. In the menu, select Edit > Duplicate. The wizard Duplicate class opens.
4. Click on OK to commit your configuration. The duplicated class is listed and named as such:
copy_<original class name>.
Moving Classes
In contrast with the default and global classes that are hard linked to the resources they are set
for, customized classes can be moved from a directory to another or even from a type of resource
to another. For instance, a class created for DNS servers can be moved and made available for
a completely different type of resource, like the DHCP ranges.
To move a class

2. Tick the class(es) you want to move.
3. In the menu, select Edit > Move. The wizard Move class wizard.
4. In the field Sub-directory, type in a directory if need be. It can be a new directory for the
class or an existing one.
5. In the drop-down list Module, select a module for the class. It can be the same one or a new
one.
6. In the drop-down list Type, select a resource to which the class should be applied. It can be
the same one or a new one.
7. Click on OK to commit your changes. The report opens and closes. The data is updated in
the list.
1103
Configuring Classes
Changing or Stop Using Classes

At any time, you can decide not to use a particular class on the resource of your choice. For in-
stance, you might decide not to use a class that you want to delete or need to use another class
for a particular resource.
As classes must not be used at all in SOLIDserver to be deleted, the following procedure might
come in handy. Keep in mind that the columns layout on the page can help you find the resources
using a class. For more details, refer to the section Customizing the List Layout.
To change or stop using a class on a specific resource
opens.
2. Click on of the resource of your choice. The page opens.
3. At the end of the line of the resource of your choice, click on . The properties page opens.
4. In the panel Main properties, click on EDIT . The related edition wizard opens.
5. Click on NEXT until you reach the page <Resource> class of the wizard.
6. In the list <Resource> class, select None or a class different from the one you intend to delete.
7. Click on NEXT until you reach the last page of the wizard.
8. Click on OK to commit your changes. The report opens and closes. The class has been
dissociated from the resource.
Enabling or Disabling Classes

Upon addition, a customized class can either be enabled straight away or left disabled.
Since deleting classes may result in unwanted complications, disabling classes allows to store
them, rather than deleting them, for future use.
Keep in mind that the default and global classes cannot be disabled and are automatically applied
on the resources they are set for.
To enable/disable a class

2. Tick the class(es) of your choice.
3. In the menu, select Edit > Enable class or Disable class. The wizard opens.
The class is marked as Enabled or Disabled in the column Status.
Deleting Classes
Only customized classes can be deleted. Keep in mind that:
1104
Configuring Classes
• You can delete customized classes if and only if they are not used by any resource within
SOLIDserver. Therefore, you might need to stop using the class before deleting it. For more
details, refer to the section Changing or Stop Using Classes.
• Deleting a class deletes the class objects it contained and displayed on the resources properties
page. You might simply want To enable/disable a class and enable it later to use it again.
To delete a class

2. Tick the class(es) you want to delete.
3. In the menu, select Edit > Delete. The wizard Delete class.
4. Click on OK to commit your deletion.The report opens and closes.The class has been deleted
is no longer listed.
Configuring the Classes' Content

Users of the group admin can configure the classes, in other words set the class objects that
define what the class does when it is applied to an object. Once set, a class customizes the re-
source's addition and edition wizards with extra pages, comments, boxes, lists, input fields... that
can be prefilled with a value retrieved automatically or set manually.
As every new class is empty, it does not bring any changes to the resource it applies to. You
need to add class objects within a class to configure its behavior. They can be added to global
and customized classes via Class Editor. For more details, refer to the section Browsing the
Class Objects. Keep in mind that:
• Customized classes only affect the addition/edition wizard of a resource if they are enabled.
Whereas global classes automatically affect them.
• The object values set for a resource are automatically inherited by the objects it contains. For
instance, if the value Chicago is set for a block-type network through an input field city, it is
automatically inherited by the subnet-type networks it contains if said subnet-type network also
has an input field named city.
• To configure classes, your browser must allow pop-up windows.
For each class, Class Editor includes a large library of class objects (formerly WDOM objects)
gathered in groups. These groups can be selected one by one in the drop-down list:
Most used objects

Contains the most frequently used class objects, no matter what module or resources the
classes can apply to:
Class object Description

Input Displays an input field that allows users to add data on one line.
Select Displays a drop-down list that allows users to add data from a list of manually set
or automatically retrieved values. These values can come from a CSV file, a service
list or a custom DB.
Comment Displays a Notice, Warning or Information message that contain the text of your
choice.
1105
Configuring Classes

Text area Displays a large input field that allows users to add data on several lines, it can
contain up to 3600 characters.
Horizontal separator Displays a colored line, either red, green or blue, that allows to separate and organize
the class fields according to your needs.
Jump to page Splits the wizard in several pages, it therefore adds a button NEXT at the bottom of
the page.
IP address management
Contains class objects dedicated to IPAM classes:

Hide IP alias Allows to hide the alias request page when assigning an IP address. For more details,
Network gateway Allows to set a positive or negative offset to automatically configure the gateway
from an IP address when adding or editing a terminal network.
Force prefix Allows to force a prefix on a network.
DHCP management
Contains class objects dedicated to DHCP classes:

Select DHCP server Displays a drop-down list containing all the existing DHCP servers.
Select DHCP scope Displays a drop-down list containing all the existing DHCP scopes.
Select DHCP range Displays a drop-down list containing all the existing DHCP ranges.
Select DHCP static Displays a drop-down list containing all the existing DHCP statics.
DHCP options Displays a large set of DHCP options. For more details, refer to the appendix DHCP
Options.
DNS management
Contains class objects dedicated to DNS classes:

Select DNS server Displays a drop-down list containing all the existing DNS servers.
Select DNS zone Displays a drop-down list containing all the existing DNS zones.
Select DNS domain Displays a drop-down list containing all the existing DNS domains.
All Objects
Contains all the available class objects, including the ones describes above.The remaining
class objects are the following ones:

Select class Displays a drop-down list containing the existing classes for a specific resource.
Autocompletion Displays an input field that can be configured to provide suggestions or automatic
data completion through predefined values.
Checkbox Displays a customizable checkbox, or box.
DHCP shared network Displays a drop-down list containing all the existing scopes used as shared networks.
Counter Displays an incremental counter.
Force class Forces a class on every resource of a container.
1106
Configuring Classes

Force VLSM Allows to force the VLSM status of all subnet-type networks created to non-terminal.
This class object can be applied to spaces and networks (block-type and subnet-
type).
Hidden data Allows to hide one of your class objects when configuring a class. The value of the
field is set for the resource but not displayed in the addition and edition wizards.
Icon Allows to associate an icon to a class. This icon appears next to the class name in
the column Class.
Include class Allows to embed another class objects to your class.
Multiple input Displays a list under a field Input where you can store the values specified.
Multiple select Displays a drop-down list and a text area to select and store multiple values at the
same time. These can be fixed values or value automatically imported from a CSV
file, a service list or a custom DB.
Object name Sets some naming convention rules for a resource (E.g. Network name = <country>-
<network_number>).
Pre-defined variable Predefined variables can be seen as full-fledged class objects with only one value
and purpose.
Time stamp Displays a field containing the date and time of the creation of the resource.
Upload file Displays a button and a field that allows uploading a files stored on a local computer
to the tmp folder of the appliance.
Owner Displays a field containing the name of the user who created the resource.
Note that you can display on any listing page a column matching each of your customized classes
to order and filter the list based on the classes or class parameters applied on certain resources.
For more details, refer to the section Customizing the List Layout.
Adding Class Objects

You can as many class object as you want to your classes. Note that any class object can be
added to any class, but some are designed for specific resources.
Input
The class object Input allows to display an input field in the wizard that users can fill with a data
string.
Note that an Input is different from a Multiple input. For more details, refer to the section Multiple
input.
To add an input field

4. In the class objects list, click on Input . The wizard Input opens.
5. In the field Name, type in the name of the class object in SOLIDserver database.
You can use hexadecimal characters and underscores "_", but no spaces. To prevent GUI
conflicts, avoid names that are already used within the appliance such as: site, mac-addr,
gateway, vlan, domain, user, port, password...
1107
Configuring Classes
6. In the field Label, type in the class object name displayed in the GUI. Only this name is seen
by the user in the wizards.
7. You can tick the box Required, to make the class object configuration compulsory in the
resource addition and edition wizards.
8. In the field Input field maximum length, type in the maximum number of characters, including
spaces, that users can type in the field. By default, the maximum field length is 64.
9. In the drop-down list Expert mode, you can select Yes to further configure the class object:
a. You can tick the box Not editable to prevent users from editing the class object's value.
If you tick the box, the object appears in gray in the addition and edition wizards.
b. You can tick the box Translate the label if you want the Label to be translated when
users set the GUI in another language. If you tick the box, the label translation must be
available on the page Language editor. For more details refer to the section Customizing
the Interface Names and Fields.
c. In the field Constructor, you can type in the value of other class objects of the class
and use them as variables to automatically overwrite the Name of the field with the data
of your choice in the wizard.
For example, you could type in %v{<value1>}, %v{<value2>} where <value#> is the
value of an existing class object in the class. If <value1> is a city and <value2> is a
state, the field Name would be replaced with Chicago, Illinois in the wizard.
d. In the drop-down list Predefined format, you can select a format for the Name to be
valid. It can either be an IP address (v4), IP address (v6), Text, Unsigned integer, Signed
Integer, Domain name, FQDN Host, MAC address or Email address.
e. In the field Default value, you can type in a default value for the field if no data is spe-
cified. The value you specify is by default displayed in the wizard and users can edit it.
f. In the field Regex match, you can type in a regular expression that checks the syntax
of the value specified in the field. For more details, refer to the section Class Studio
Syntax.
g. In the drop-down list Inheritance property, you can configure the inheritance behavior
of the value of the class object:
Value Description
None The property is not set, this is the default value. Users can set it to Inherit or Set.
Inherit The property is forced to Inherit. Users cannot change it to None or Set.
Set The property is forced to Set. Users cannot change it to None or Inherit.
For more details regarding the inheritance property, refer to the chapter Inheritance and
Propagation.
h. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
None The property is not set, this is selected by default. Users can set it to Propagate or
Restrict.
Propagate The property is forced to Propagate. Users cannot change it to None or Restrict.
Restrict The property is forced to Restrict. Users cannot change it to None or Propagate.
1108
Configuring Classes
For more details regarding the propagation property, refer to the chapter Inheritance
and Propagation.
i. In the field Show if..., you can condition the display of the class object in the wizard in
the form of an "if" statement, like $object_value > 0 or $city=="Washington'", that allows
to only display the class object if your condition is matched. Note that the condition can
only be taken into account if the value of the class object has already been saved in the
wizard, either via inheritance or because it is located after a Jump to page.
You can set multiple conditions but they must be separated by boolean connectors.
You can close Class Editor or keep adding other class objects to the same class.
Select
The class object Select allows to display a drop-down list in the wizard. The data listed can be:
• Fixed values added to the list directly from the wizard

• CSV values retrieved from a CSV file
• Service list values picked from the SOLIDserver services. All services and parameters are
1
described in the API reference guide on our website .
• Custom DB values retrieved directly from your custom databases. We strongly recommend
using this type rather than a CSV file. For more details, refer to the chapter Custom DB.
Note that a Select is different from a Multiple select. For more details, refer to the section Multiple
select.
To add a select drop-down list using fixed values

4. In the class objects list, click on Select . The wizard Select wizard.
8. In the drop-down list Select type, select Fixed values. The wizard refreshes.
1
1109
Configuring Classes
a. You can tick the box Translate the label if you want the Label to be translated when
b. You can tick the box Have none label if you want to include the value None to the drop-
down list.
c. You can tick the box Reload on change if you want to reload the wizard page when a
value is selected in the drop-down list.
d. In the drop-down list Inheritance property, you can configure the inheritance behavior
Value Description
Propagation.
e. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
Restrict.
and Propagation.
f. In the field Show if..., you can condition the display of the class object in the wizard in
g. In the field Default value, you can type in a default value for the field if no data is spe-

11. In the field Key, type in the object name as it should be saved in SOLIDserver database
(string of characters: _a-z0-9 only). To prevent GUI conflicts, avoid names that are already
used in the code such as: site, mac-addr, gateway, vlan, domain, user, port, password...
The field Label/Key autopopulates.
12. In the field Label, type in the word string, corresponding to the key, as it should be displayed
in the list. The field Label/Key autopopulates following the format <Label>#<Key>.
13. Click on . The value is moved to the list Options.
1110
Configuring Classes
14. Repeat these actions for as many values as needed. You can use to remove one by one
values from the list, or and to reorganize them.
To add a select drop-down list using a CSV file

8. In the drop-down list Select type, select CSV values. The wizard refreshes.
down list.
Value Description
Propagation.
1111
Configuring Classes
Value Description
Restrict.
and Propagation.

11. In the field CSV file, type in the complete path of the file stored in the appliance.
12. In the field Value column, type in the number of the column in the CSV file containing the
values to retrieve.
13. In the field Label column, type in the number of the column in the CSV file containing the
labels corresponding to the values to retrieve.
14. In the field Filter column, type in the number of the column used to match certain rows.
15. Click on . The value is moved to the list Filter.You can use to remove one by one values
from the list, or and to reorganize them.
To add a select drop-down list using service list values

1112
Configuring Classes
8. In the drop-down list Select type, select Service list values or Manual. The wizard refreshes.
down list.
Value Description
Propagation.
Value Description
Restrict.
and Propagation.

11. In the field Services, start typing in the name of the service to call. The matching services
are listed, select the one that suits your needs.
12. In the field Key, type in the name of the input parameter corresponding to the values to re-
trieve.
1113
Configuring Classes
13. In the field Label, type in the name of the input parameter corresponding to the labels asso-
ciated to these values.
14. In the field Where, type in an SQL condition to filter the retrieved values if need be.
15. In the field Order by, type in an SQL condition to sort the results if need be.
16. In the field Limit, type in the maximum number of results to display.
17. In the field Tags, type in an SQL condition to filter the retrieved class parameters if need be.
You might need assistance from Efficient IP support team to fill in this field.
To add a select drop-down list using Custom DB values

8. In the drop-down list Select type, select Custom DB. The wizard refreshes.
down list.
Value Description
1114
Configuring Classes
Propagation.
Value Description
Restrict.
and Propagation.

11. In the field Custom DB name, type in the name of the Custom DB of your choice. For more
details on SOLIDserver Custom DB, refer to the chapter Custom DB.The field autocompletes.
12. In the drop-down list Key column, select the column from the Custom DB containing the
objects names as they should be saved in SOLIDserver database (string of characters: _a-
z0-9 only). To prevent GUI conflicts, avoid names that are already used in the code such
as: site, mac-addr, gateway, vlan, domain, user, port, password...
13. In the drop-down list Label column, select the column from the Custom DB containing the
values as they should be displayed in the list.
Comment
The class object Comment allows to display an information, notice or warning message in the
wizard among the class objects of a class. The Comment is always placed after the wizard's
standard fields.
To add a comment

1115
Configuring Classes
4. In the class objects list, click on Comment . The wizard Comment wizard.
5. In the field Comment, type in the message you want to display in the wizard.
6. In the drop-down list Style, select the information type of comment. It can either be the
content of the Comment field in a gray area (None), a Notice or a Warning.
Value Description
None The message is a comment displayed in a gray area.
Notice The message is informational and displayed in a blue area entitled INFO.
Warning The message is a warning displayed in an orange area entitled WARNING.
In the field Show if..., you can condition the display of the class object in the wizard in the
form of an "if" statement, like $object_value > 0 or $city=="Washington'", that allows to only
display the class object if your condition is matched. Note that the condition can only be
taken into account if the value of the class object has already been saved in the wizard,
either via inheritance or because it is located after a Jump to page.
in the creation panel. The selected comment style is displayed in the panel.
Text area
The class object Text area allows to display a large input area that users can fill with up to 3900
characters.
To add a text area

4. In the class objects list, click on Text area . The wizard Text area wizard.
a. In the field Rows, you can specify the number of rows to display in the text area.
1116
Configuring Classes
b. You can tick the box Translate the label if you want the Label to be translated when
c. In the drop-down list Inheritance property, you can configure the inheritance behavior
Value Description
Propagation.
d. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
Restrict.
and Propagation.
e. In the field Show if..., you can condition the display of the class object in the wizard in
Horizontal separator
The class object Horizontal separator allows to display a line to structure and divide the class
objects in the wizard.
In the creation panel, the Horizontal separator is represented as a straight line.
To add a horizontal separator

1117
Configuring Classes
4. In the class objects list, click on Horizontal separator . The wizard Horizontal separator opens.
Jump to page
The class object Jump to page allows to display class objects on the new page of the wizard,
you can name this page and include a message above the class objects if you want.
In the creation panel, the Jump to page is represented as a dotted line. Any class object located
after the Jump to page is moved to a new page, users have to click on NEXT to display them.
To add a page to a wizard

4. In the class objects list, click on Jump to page . The wizard Jump to page opens.
5. In the field Title, you can name the page of the wizard you are adding.
6. In the field Comment, you can type in a message that is displayed in a gray area under the
page title.
You can tick the box Translate the label if you want the Title to be translated when users
set the GUI in another language. If you tick the box, the label translation must be available
on the page Language editor. For more details refer to the section Customizing the Interface
Names and Fields.
9. In the drop-down list Image, you can select a predefined image to place on the new page.
10. In the field Show if..., you can condition the display of the class object in the wizard in the
1118
Configuring Classes
Hide IP alias
The class object Hide IP alias can be set on a container to skip the alias request dedicated page
when assigning an IP address. For more details, refer to the section Configuring and Managing
IP Address Aliases.
This object can also be set as the Pre-defined variable, it corresponds to HIDE_IP_ALIAS.
To hide the IP alias dedicated page in the IP address addition wizard

4. In the class objects drop-down list, select IP address management. The list refreshes.
5. In the class objects list, click on Hide IP alias . The wizard Hide IP alias opens.
6. In the field Name, HIDE_IP_ALIAS is displayed. You cannot edit it.
7. In the field Value, true is displayed. The class object is enabled.
Network gateway
The class object Network gateway allows to specify the offset for the gateway address of all ter-
minal networks and displays the address in a dedicated input in the wizard.
Network Gateway overwrites the offset calculated by the advanced property Gateway offset. For
more details, refer to the section Network Advanced Properties.
To configure a specific gateway offset

1119
Configuring Classes
5. In the class objects list, click on Network gateway . The wizard Network gateway opens.
6. In the field Name, gateway is displayed. It is the default name of the class object in SOLID-
server database, you can edit it if you want.
7. In the field Label, Gateway displayed. It is the default name of the field in the wizard, you
can edit it if you want.
8. In the field Gateway offset, type in the positive or negative offset to automatically configure
the gateway from the terminal network IP address. By default, SOLIDserver sets the default
gateway offset to -1.
Force prefix
The class object Force prefix allows to force a specific prefix on a network and can be applied
on the subnet-type network itself or on the block-type network or space it is belongs to.
Note that there are some special cases:
• Forcing a prefix on a preexisting subnet-type network may cause an error.

• Forcing a prefix on a non-terminal subnet-type network only applies to the network itself, it
does not apply to the terminal network it contains.
This object can also be set as the Pre-defined variable, it corresponds to FORCE_SUBNET_PRE-
FIX.
To force a prefix on a network

5. In the class objects list, click on Force prefix . The wizard Force prefix opens.
6. In the field Name, FORCE_SUBNET_PREFIX is displayed. You cannot edit it.
7. In the drop-down list Network level, select a value between 0 (block-type networks) and 15
(subnet-type networks). This value sets the level in a networks organization where the prefix
is forced.
8. In the field Value, type in the prefix you want to force for the resource. By default, it is set to
24.
1120
Configuring Classes
Select DHCP server
The class object Select DHCP server allows to display a drop-down list containing all the DHCP
servers in the wizard.
To add a drop-down list containing all the DHCP servers

4. In the class objects drop-down list, select DHCP management. The list refreshes.
5. In the class objects list, click on Select DHCP server . The wizard Select DHCP server opens.
a. In the drop-down list Inheritance property, you can configure the inheritance behavior
Value Description
Propagation.
b. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
Restrict.
1121
Configuring Classes
Value Description
and Propagation.
c. In the field Show if..., you can condition the display of the class object in the wizard in
Select DHCP scope
The class object Select DHCP scope allows to display a drop-down list containing all the DHCP
scopes in the wizard.
To add a drop-down list containing all the DHCP scopes

5. In the class objects list, click on Select DHCP scope . The wizard Select DHCP scope opens.
Value Description
1122
Configuring Classes
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
Select DHCP range
The class object Select DHCP range allows to display a drop-down list containing all the DHCP
ranges in the wizard.
To add a drop-down list containing all the DHCP ranges

5. In the class objects list, click on Select DHCP range . The wizard Select DHCP range opens.
1123
Configuring Classes
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
Select DHCP static
The class object Select DHCP static allows to display a drop-down list containing all the DHCP
statics in the wizard.
To add a drop-down list containing all the DHCP statics

1124
Configuring Classes
5. In the class objects list, click on Select DHCP static . The wizard Select DHCP static opens.
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
DHCP options
The class object DHCP options allows to include the DHCP options configuration fields in the
wizard of a resource at the server, group, scope, range and statics level. It allows to configure
1125
Configuring Classes
DHCP options directly upon addition and edition rather than from their properties page. For more
details regarding the options, refer to the appendix DHCP Options.
To embed additional DHCP options

5. In the class objects list, click on DHCP options . The wizard DHCP options opens.
Select DNS server
The class object Select DNS server allows to display a drop-down list containing all the DNS
servers in the wizard.
To add a drop-down list containing all the DNS servers

4. In the class objects drop-down list, select DNS management. The list refreshes.
5. In the class objects list, click on Select DNS server . The wizard Select DNS server opens.
1126
Configuring Classes
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
Select DNS zone
The class object Select DNS zone allows to display a drop-down list containing all the DNS zones
in the wizard.
To add a drop-down list containing all the DNS zones

5. In the class objects list, click on Select DNS zone . The wizard Select DNS zone opens.
1127
Configuring Classes
9. In the field Show if..., you can condition the display of the class object in the wizard in the
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
Select DNS domain
The class object Select DNS domain allows to display a drop-down list containing all the domains,
or DNS Master Name zones, in the wizard.
To add a drop-down list containing all the DNS domains
1128
Configuring Classes

5. In the class objects list, click on Select DNS zone . The wizard Select DNS zone opens.
a. In the field Name, domain is displayed by default. You can set a different name used in
SOLIDserver database.
You can use hexadecimal characters and underscores "_", but no spaces. To prevent
GUI conflicts, avoid names that are already used within the appliance such as: site,
mac-addr, gateway, vlan, domain, user, port, password...
b. In the field Label, Domain name is displayed.You can set a different name for the object
that will be displayed in the GUI. Only this name is seen by the user in the wizards.
c. Set the value of the field Order by, type in a value to filter the selected domain by a key.
This key must respect the format: dz.{your_value}.
d. You can tick the box Required, to make the class object configuration compulsory in
the resource addition and edition wizards.
e. You can tick the box Have none label if you want to include the value None to the drop-
down list.
f. You can tick the box Reload on change if you want to reload the wizard page when a
g. In the drop-down list Inheritance property, you can configure the inheritance behavior
Value Description
Propagation.
h. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
Restrict.
and Propagation.
1129
Configuring Classes
Select class
The class object Select class allows to include a drop-down list containing existing classes in the
wizard. Only classes configured to some resources can be retrieved in this list.
To add a select class drop-down list

4. In the class objects drop-down list, select All Objects. The list refreshes.
5. In the class objects list, click on Select class . The wizard Select class wizard.
8. In the drop-down list Type, select the resource to which apply the classes you want to display:
Space, Network, Pool, Address, DNS server, DNS zone, DHCP server, DHCP scope, DHCP
range, DHCP static, User or Group.
b. You can tick the box Required, to make the class object configuration compulsory in
Value Description
Propagation.
1130
Configuring Classes
Value Description
Restrict.
and Propagation.
Autocompletion
The class object Autocompletion allows to display an autocompletion input field in the wizard. In
other words, a field that provides a drop-down list returning only values that match the characters
that users type in.
Under the field, a button SEARCH allows to retrieve the best matches. The available values in the
drop-down list depend on your configuration and can be based on from a service list or a custom
DB. For more details, refer to the chapter Custom DB.
• SOLIDserver services. All services and parameters are described in the API reference guide
2
on our website .
• A custom database.
To add an autocompletion input field using services

5. In the class objects list, click on Autocompletion . The wizard Autocompletion opens.
2
1131
Configuring Classes
9. In the drop-down list Select type, select Manual.
12. In the field Service name, type in the name of the listing service to call, for example ip_sub-
net_list.
13. In the field Parameter name, type in the name of the input parameter that should be used to
pass the searched value. By default, it is WHERE.
14. In the field Search condition, type in a search condition, i.e. a variable, to display in the
Autocompletion drop-down list followed by like '%#%' . In our example, you can type in
subnet_name like '%#%' to format the display of all the IPv4 subnet-type networks name.
You can also filter the list by replacing the hash symbol (#) by a specific matching value.
15. In the field Parameter name for reverse search, type in the input parameter name, used to
do reverse searches. Indeed, if a user chose a network name for instance, the system only
has its ID. With this parameter you can pass the ID of the object instead of a string-like
parameter. By default, the parameter name is WHERE.
16. In the field Reverse search condition, type in a second variable to associate with the one
to display in the drop-down list, in our example subnet_id='#' .You can also filter the list by
replacing the hash symbol (#) by a specific matching value.
17. In the field Key, type in the key of the second variable, in our example subnet_id .
18. In the field Display format, type in the value that corresponds to the final display of the data
in the autocompletion drop-down list. You can format this value with as many variables
(preceded by $) or literal symbols as needed. For instance, the $subnet_name (in
$block_name > $site_name) - id = $subnet_id value displays the selected networks in the
following format: subnet_name (in block_name > site_name) - id = subnet_id.
19. Tick the box Allow non-matching values if you want to allow the input field to accept values
that are not part of the database.
20. Tick the box Automatic accept if you want the field to provide a list of matching Custom DB
entries when the user types in values.
To add an autocompletion input field using a custom DB
1132
Configuring Classes

5. In the class objects list, click on Autocompletion . The wizard Autocompletion opens.
9. In the drop-down list Select type, select Custom DB.
12. In the field Custom DB name, type in the name of the Custom DB from which you want to
retrieve the data to display. The wizard refreshes.
13. In the drop-down list Key column, select the column containing the values to display.
14. In the drop-down list Label column, select the column containing the labels associated to
the values to display.
15. Tick the box Allow non-matching values if you want to allow the input field to accept values
that are not part of the database.
16. Tick the box Automatic accept if you want the field to provide a list of matching Custom DB
entries when the user types in values.
Checkbox
The class object Checkbox allows to insert a box in a wizard. This box is configured thanks to
two values: true, when the box is ticked and false, when it is left unticked.You can use checkboxes
alone or in combination with other class objects and parameters to validate complex regular ex-
pressions.
1133
Configuring Classes
To add a checkbox

5. In the class objects list, click on Checkbox . The wizard Checkbox opens.
8. In the field "TRUE" value, type in the value you want to set for your box when it is ticked
(value yes or 1).
9. In the field "FALSE" value, type in the value you want to set for your box when it is not ticked
(value no or 0).
b. In the drop-down list Inheritance property, you can configure the inheritance behavior
Value Description
Propagation.
c. In the drop-down list Propagation property, you can configure the propagation behavior
Value Description
Restrict.
and Propagation.
1134
Configuring Classes
d. In the field Show if..., you can condition the display of the class object in the wizard in
DHCP shared network
The class object DHCP shared network allows to display a drop-down list containing all the scopes
that can be used as shared networks in the wizard.
To associate a shared network with a resource

5. In the class objects list, click on DHCP shared network . The wizard DHCP shared network wizard.
Value Description
Propagation.
1135
Configuring Classes
Value Description
Restrict.
and Propagation.
Counter
The class object Counter allows to display a read-only field in the wizard which value increments
to count the number of times the class was applied to a resource.
To add a counter

5. In the class objects list, click on Counter . The wizard Counter wizard.
8. You can tick the box Padding to display all the digits of the counter, including the zeros.
9. In the field Number of digits, you can type in the number of digits for your counter.
10. In the field Min value, you can type in the counter start value. It appears when the page is
accessed for the first time.
11. In the field Max value, you can type in the maximum value you want to set for your counter.
1136
Configuring Classes
Force class
This class object Force class allows to force existing classes on IPAM resources of a lower level.
If configured in a class applying to spaces, it can for instance, force classes on the networks,
pools or IP addresses it contains. Note that:
• The classes you force on lower level resources must be configured and enabled
• You can force several classes on the same resource, so make sure they do not have conflicting
object names.
To force a class on a lower level

3. Filter the list.
4. Make sure the class you want to force on a lower level was not set at the lowest level of the
module hierarchy.
7. In the class objects list, click on Force class . The wizard Force class wizard.
8. In the drop-down list Type, select one of the lower levels of objects displayed according to
your needs. The wizard refreshes.
If you are forcing a class on IPAM objects, selecting Networks displays the drop-down list
Network level. In that list you can select a level between 0 (block-type networks) and 15
(subnet-type networks). This value sets the level in a networks organization where the class
is forced.
9. In the list Class, double-click on the class you want to force. The class is moved to the list
Classes.
a. You can tick the box Required, to make the class object configuration compulsory in
b. Click on NEXT . The last page of the wizard opens.
1137
Configuring Classes
Force VLSM
The class object Force VLSM is used to force a value for the box Terminal network in the subnet-
type networks addition wizard. When applied on a space or a block-type network, this value is
set by default for all the networks they might contain. In this case, the box no longer appears in
the subnet-type network addition wizard. Forcing a subnet-type network to be non-terminal enables
the VLSM since it allows to create it to contain other subnet-type networks. For more details,
refer to the chapter Using VLSM to Manage Your IPAM Network.
This object can also be set as the Pre-defined variable, it corresponds to NO_VLSM_SUBNET.
To force VLSM on a subnet-type network

5. In the class objects list, click on Force VLSM . The wizard Force VLSM wizard.
6. Tick the box Force non-terminal networks creation if you want the class to force terminal
networks to be non-terminal networks upon creation and edition. In other words, the class
automatically unticks the box Terminal network when adding/editing subnet-type networks.
If set at space level or on a block-type network, the box is not displayed or left unticked.
a. Select in the list Space, one of your an existing spaces. In a space-based VLSM organ-
ization where two sub-spaces are at the same level, this allows to favor the space you
select and create the delegation within that space.
b. Click on . The space in moved to the list Spaces. Only the spaces listed are available
in the list VLSM space at the end of the wizard creating a blo-ck-type network in a child
space, when a terminal network is created in a parent space.
1138
Configuring Classes
Hidden data
The class object Hidden data allows to associate a resource with customizable data, not displayed
in the wizard. It allows to set a class object that does not require any configuration from the user
or to hide another class object of the class.
This non-displayed data string could be used as a hidden signature for a class or to populate
other fields if you configure with Expert mode field Constructor.
You can also configure the class object to force a value and overwrite a preexisting content, for
instance if its value is inherited from a parent. Note that all class object values, inherited or
overwritten, are visible on the properties pages of the resource configured with the class.
To add hidden data

5. In the class objects list, click on Hidden data . The wizard Hidden data wizard.
6. In the field Name, type in the name of another class object. Once the Hidden data is fully
configured, the class object should no longer be displayed in the wizard.
a. In the field Constructor, you can type in the value of other class objects of the class
and use them as variables to automatically overwrite the Name of the field with the data
of your choice in the wizard.
For example, you could type in %v{<value1>}, %v{<value2>} where <value#> is the
value of an existing class object in the class. If <value1> is a city and <value2> is a
state, the field Name would be replaced with Chicago, Illinois in the wizard.
b. In the field Show if..., you can condition the display of the class object in the wizard in
c. In the field Value to force, type in the value of your choice for the field. It overwrites any
existing content.
Icon
The class object Icon allows to display an image next to the name of a class applied to Device
Manager devices, in the column Class.
1139
Configuring Classes
Before configuring an Icon for a device class, you must upload it to the page Custom images.
For more details, refer to the section Uploading an Image to SOLIDserver.
To associate an icon with a device class

3. Filter the columns Module and Type to display Device Manager and Device.
6. In the class objects list, click on Icon . The wizard Icon opens.
7. In the field Icon path, type in the complete path of the icon: /img/customImg/<uploaded-im-
age.extension>.
9. To display the icon next to the class name, you must go to the Device Manager tab, on the
page All devices, and display the column Device class name. For more details refer to the
section Customizing the List Layout.
Include class
The class object Include class allows to embed another class and the objects it contains. That
way, a class X including a class Y that already includes a class Z, encompasses the objects of
all three classes.
To include a class

5. In the class objects list, click on Include class . The wizard Include class opens.
6. In the drop-down list Module, select the module associated to the class you want to include.
7. In the drop-down list Type, select the type of resources associated to the class you want to
include.
8. In the drop-down list Class name, select the class you want to include.
1140
Configuring Classes
Multiple input
The class object Multiple input allows to associate an Input with a list that displays and stores
the values of the specified in input. All the values specified in the input field can be added to the
list thanks to the button ADD located next to the input field.
The Multiple input must always be placed right under the Input it is associated with in the class
creation panel.
Note that the Multiple input relies on the Input to be configured, but they are two different class
objects. For more details, refer to the section Select.
To add a multiple input field

5. Make sure an Input is available, without one you cannot configure a Multiple Input. For more
details, refer to the section Input.
6. In the class objects list, click on Multiple input . The wizard Multiple input wizard.
10. In the field Input object name, type in the name of the Input class object used to populate
the multiple input list.
11. If you set the Expert mode to Yes, you can:
Value Description
1141
Configuring Classes
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
13. Make sure the multiple input is located right under the input field. To reorder the list, refer to
the section Organizing Class Objects.
Once the Multiple input is configured, the wizard displays a button ADD between the input field
specified in the Input object name and the multiple input list itself. This allows to add the value
you specify in the field to the list.
Multiple select
The class object Multiple select allows to display two lists in the wizard to select and store multiple
values at the same time. The first list provides the button , to move one by one the selected
values in the second list. The data listed can be:
• Fixed values added to the list directly from the wizard.

• CSV values retrieved from a CSV file.
• Service list values picked from the SOLIDserver services. All services and parameters are
3
described in the API reference guide on our website . Note that this type of data can help you
display custom databases in the wizard.
Note that a Multiple select is different from a Select. For more details, refer to the section Select.
3
1142
Configuring Classes
To add a multiple select drop-down list using fixed values

5. In the class objects list, click on Multiple select . The wizard Multiple select wizard.
7. In the field Label, type in the class object name displayed in the wizards. This name is used
for both lists. Only this name is seen by the user.
9. In the drop-down list Select type, select Fixed values. The wizard refreshes.
10. In the field Key, type in an object name for the database using only the string of characters
4
_a-z0-9 . The label Label/Key displays the Key.
11. In the field Label, type in the label of the the key that is displayed in the list. The field La-
bel/Key autopopulates as follows: <Key>#<Label>.
12. Click on . The value is moved to the list Options.
13. Repeat these actions for as many values as needed. You can use to remove one by one
values from the list, or and to reorganize them.
a. You can tick the box Have none label if you want to include the value None to the drop-
down list.
b. In the field Default value, you can type in a default value for the field if no data is spe-
Value Description
Propagation.
4
To prevent GUI conflicts, avoid names that are already used in SOLIDserver database like site, mac-addr, gateway, vlan, domain,
user, port, password...
1143
Configuring Classes
Value Description
Restrict.
and Propagation.
To add a multiple select drop-down list using CSV values

9. In the drop-down list Select type, select CSV values. The wizard refreshes.
10. In the field CSV file, type in the complete path of the file stored in the appliance.
11. In the field Value column, type in the number of the column in the CSV file containing the
values to retrieve.
12. In the field Label column, type in the number of the column in the CSV file containing the
labels corresponding to the values to retrieve.
13. In the field Filter column, type in the number of the column used to match certain rows.
14. Click on . The value is moved to the list Filter. You can use to remove the values from
the list one by one, or and to reorganize them.
1144
Configuring Classes
down list.
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
To add a multiple select drop-down list using services

1145
Configuring Classes
9. In the drop-down list Select type, select Service list values. The wizard refreshes.
10. In the field Services, start typing in the name of the service to call. The matching services
are listed, select the one that suits your needs.
11. In the field Key, type in the object name as it should be saved in SOLIDserver database
(string of characters: _a-z0-9 only). To prevent GUI conflicts, avoid names that are already
used in the code such as: site, mac-addr, gateway, vlan, domain, user, port, password...
12. In the field Label, type in the name of the input parameter corresponding to the labels asso-
ciated to these values.
13. In the field Where, type in an SQL condition to filter the retrieved values if need be.
14. In the field Order by, type in an SQL condition to sort the results if need be.
down list.
Value Description
Propagation.
Value Description
Restrict.
and Propagation.
1146
Configuring Classes
Object name
The class object Object name allows to build an automatic naming rule for a resource, such as
%v{city}-%v{store code} where city and store code are the names of objects belonging to the
same class. By convention, an Objectname and the class objects used to build it should be placed
in the first page of the wizard.
To name a resource automatically

5. In the class objects list, click on Objectname . The wizard Objectname opens.
6. You can tick the box Not editable to prevent users from editing the class object's value. If
you tick the box, the object appears in gray in the addition and edition wizards.
7. In the field Constructor, you can type in the value of other class objects of the class and use
them as variables to automatically overwrite the Name of the field with the data of your choice
in the wizard.
For example, you could type in %v{<value1>}, %v{<value2>} where <value#> is the value
of an existing class object in the class. If <value1> is a city and <value2> is a state, the field
Name would be replaced with Chicago, Illinois in the wizard.
1147
Configuring Classes
Pre-defined variable
The class object Pre-defined variable allows to force some behaviors and configuration choices
in the wizard. The pre-defined variables available can be applied to the user rights and to the
modules: IPAM, DHCP, DNS, Device Manager and Workflow.
Each pre-defined variable must be configured via the field Value that can accept specific values
or 1 to be activated. To understand the purpose of each variable, refer to the appendix Class
Studio Pre-defined Variables.
To insert a pre-defined variable

5. In the class objects list, click on Pre-defined variable . The wizard Pre-defined variable opens.
6. Configure the variable, following the details in the appendix Class Studio Predefined Variables.
a. In the drop-down list Name, select the predefined variable of your choice.
b. In the field Value, type in the value that suits your needs.
Time stamp
The class object Time stamp allows to include the exact time and date of creation of a resource
in a dedicated field of the wizard.
Note that if you edit a resource that was not configured with this class object, the time stamp
matches the moment you apply the class and not its actual creation date and time.
To add a field Time stamp

1148
Configuring Classes
5. In the class objects list, click on Time stamp . The wizard Time stamp wizard.
Upload file
The class object Upload file allows to include an upload tool in the wizard. It displays a field File
name and a button BROWSE that opens a window and allows to upload any file to SOLIDserver
database. Keep in mind that:
• Uploaded files cannot exceed 300 MB.

• Uploaded files are stored temporarily in the /tmp folder of the appliance and deleted shortly
after. The upload tool can therefore be used to import CSV files or other types of files to be
processed straight away by other class objects.
To add a field Upload file

5. In the class objects list, click on Upload file . The wizard Upload file wizard.
1149
Configuring Classes
Owner
The class object Owner allows to display the name of the user who added the resources, no
matter who edits it later.
To add a field Owner

5. In the class objects list, click on Owner . The wizard Owner wizard.
Editing Class Objects

Class objects can be edited at any time even if the class they belong to is already in use.
Keep in mind that renaming an object already used by a resource will delete all the class
data it is associated with. It can only be retrieved by renaming the object back, before filling
any new class data through the newly edited object.
To edit a class object

opens.
1150
Configuring Classes
5. In the creation panel, click on the gray box displaying the name of the class object to edit.
The corresponding object class wizard opens.
Organizing Class Objects

The way user defined fields are displayed on the Add/Edit wizards of a resource depends on the
organization of the class objects when configuring the class. SOLIDserver simplifies this process
by allowing members of the admin group to drag & drop the objects of their choice.
Keep in mind that a Multiple select can only be effective if placed underneath an Input.
To organize class objects

opens.
5. In the creation panel, drag and drop the class objects to change their display order once the
class is used on a resource.
Deleting Class Objects

At any time, you can remove a class object from a class. Keep in mind that deleting a class object
removes the related user defined fields and data form all the resources wizards it is applied to.
To delete a class object

opens.
5. In the creation panel, click on next to the class object you want to delete. The wizard
opens.
6. Click on OK to commit your deletion. The object is no longer listed in the creation panel.
1151
Configuring Classes
Class Studio Syntax

Class Studio is a powerful tool to help members of the admin group in provisioning SOLIDserver
through classes that act as automated rules. Configuring these classes requires knowledge of
the regular expression (regex) syntax. Regex being as powerful as complex, this section presents
only the basic information to help you configure simple class parameters. For more details regard-
ing regular expressions, you can visit the websites http://www.regular-expressions.info and ht-
tp://regexlib.com.
Basic Regular Expressions

regex stands for "regular expression". Regular expressions are used by the administrator to en-
force the format of the data input in the user defined fields. For instance, it can be used to set a
maximum string length, allow only alpha characters a-z or A-Z or numbers in the range [1-99].
For instance, in the following example of regex: ^[a-zA-Z]{1, 10}$
^ means "begin matching at start of string"
[a-zA-Z] means "match lower case and upper case letters a-z"
{1,25} means "match the previous item (the letters which format was explained in the previous
line) 1 to 25 times"
$ means "only match if cursor is at end of string"
Basic regular expression symbols are described in the table below:
Table 82.5. Basic regex symbols

Symbol Description
. Matches any single character. If put between bracket, the dot symbol matches a literal dot. For example,
a.c matches "abc", etc., but [a.c] matches only "a", ".", or "c".
[] A bracket expression. Matches a single symbol contained within the brackets. For example, [abc]
matches "a", "b", or "c". [a-z] specifies a range matching any lowercase letter from "a" to "z". These
forms can be mixed: [abcx-z] matches "a", "b", "c", "x", "y", or "z", as does [a-cx-z]. The - symbol is
treated as a literal symbol if it is the last or the first (after the ^) symbol within the brackets: [abc-], [-
abc]. Note that backslash escapes are not allowed. The ] symbol can be included in a bracket expres-
sion if it is the first (after the ^) symbol: []abc].
[^ ] Matches a single symbol that is not contained within the brackets. For example, [^abc] matches any
symbol other than "a", "b", or "c". [^a-z] matches any single symbol that is not a lowercase letter from
"a" to "z". Likewise, literal symbols and ranges can be mixed.
^ Matches the starting position within the string. In line-based tools, it matches the starting position of
any line.
$ Matches the ending position of the string or the position just before a string-ending newline. In line-
based tools, it matches the ending position of any line.
() Defines a marked subexpression.
* Matches the preceding element zero or more times. For example, ab*c matches "ac", "abc", "abbbc",
etc. [xyz]* matches "", "x", "y", "z", "zx", "zyx", "xyzzy", and so on. (ab)* matches "", "ab", "abab",
"ababab", and so on.
1152
Configuring Classes
Defining a Class as a Group Resource

Adding a customized class as one of the resources of a specific group allows the users of that
group to apply the class as long as they have the corresponding rights and delegations granted.
Granting access to a class as a resource also grants access to its class parameters, so users
can configure them when they add or edit the objects configured with the class. If a group does
not have a customized class in its resources, editing objects configured with it empties the value
of all the class parameters. For more details, refer to the section Assigning Resources to a Group
in the chapter Managing Groups.
1153
Chapter 83. Configuring Custom
Databases
You can create custom databases from the page Custom DB. These databases are directly
embedded in SOLIDserver and can contain a maximum of 10 pieces of information, columns,
named Label #.
By default, a custom DB named Vendor is already installed.This database is used by SOLIDserver

in order to link MAC address and the Vendor of the Ethernet card together. It cannot be modified.
This is an example of what a custom DB could be.
Keep in mind that the custom databases can come in handy when configuring classes with
parameters like select, multiple select or autocompletion for instance. For more details, refer to
the chapter Configuring Classes.
Browsing Custom DB
Custom DB is divided into two pages: one displaying the databases themselves and the other
displaying the data of each custom database.
Browsing Custom DB Database

To display the list of custom databases
opens.
2. In the section Customization, click on Custom DB. The Custom database listing page opens.
By default, the custom DB database contains the database Vendor.
To display a custom database properties page
opens.
3. At the end of the line of the custom database of your choice, click on . The properties page
opens.
On the properties page, the panel Main properties displays the Custom database name, Type,
Description and labels it contains.
Browsing Custom Data

To display the list of custom data
opens.
3. In the breadcrumb, click on Custom data. The page Custom data opens.
1154
Configuring Custom Databases
To display the custom data of a specific custom DB
opens.
3. In the column Name, click on the name of the custom database of your choice. The page
Custom data opens, it only displays the data of the custom database you chose.
To display a custom data entry properties page
opens.
3. At the end of the line of the entry of the custom data of your choice, click on .The properties
page opens.
On the properties page, the panel Main properties displays the name of the Custom database
it contains to and its defined labels and their value.
Adding a Custom DB
To add a custom DB

2. In the menu, select Customization > Custom DB. The page Custom database opens.
3. In the menu, select Add > Custom database. The wizard Create a custom DB opens.
4. Fill in each field as describe below:
Table 83.1. CustomDB creation parameters

Field Description
Database name Choose a name for the custom DB you are creating. This field is required.
Type Define the database type.
Description Describe the database. This field is optional.
Label 1 to Label 10 Name the columns of your custom database.
5. Click on OK to commit the database creation.
Editing a Custom DB
At any time you can edit a custom database. However, keep in mind that:
• You should not rename a database with an already used name.

• The default custom database Vendor is the only one in Read-only. It cannot be edited.
To edit a custom DB

2. In the menu, select Customization > Custom DB. The page Custom database opens.
1155
3. In the column Name, put your mouse over the name of the database you want to edit. Click
on . The wizard Edit custom database opens.
4. Edit each field according to your needs following the table below:
Table 83.2. CustomDB parameters

Field Description
Name Choose a name for the custom DB you are editing. This field is required.
Type Define the database type.
Description Describe the database. This field is optional.
Label 1 to Label 10 Name the columns of your custom database.
5. Click on OK to commit your changes. The wizard refreshes and closes. The changes are
Deleting a Custom DB
To delete a custom DB

3. In the list, tick the custom database that you want to delete.
4. In the menu, select Edit > Delete. The wizard opens.
5. Click on OK to remove the selected custom DB.
Configuring a Custom DB with Custom Data

Once a custom database is created, it is empty and you must add custom data.
Once your database contains everything you need, you can use it within classes and apply it to
the resource that suits your needs. For more details, refer to the chapter Configuring Classes.
Adding Data in a Custom DB

From the page Custom data, you can add entries to existing custom databases.
You can also import custom data from a CSV file. For more details, refer to the section Importing
Custom Data.
To add a custom data entry from the page Custom data

3. In the breadcrumb, click on Custom data. The page Custom data opens.
4. In the menu, select Add > Custom data. The wizard Add custom data opens.
5. In the drop-down list Database, select the custom database of your choice.
1156
7. Fill in the fields according to your needs, all 10 fields are optional. The fields can either have
the default name Value 1... Value 10 or have the name (label) that was set for custom
database.
8. Click on OK to add the new entry to the current custom data list.
To add a custom data entry in a specific custom DB

3. In the list, click on the name of the custom database of your choice. The page Custom data
opens.
4. In the menu, select Add > Custom data. The wizard Add custom data opens.
5. Fill in the fields according to your needs, all 10 fields are optional. The fields can either have
the default name Value 1... Value 10 or have the name (label) that was set for custom
database.
6. Click on OK to add the new entry to the current custom data list.
Editing the Data of a Custom DB

You can edit the content of a custom DB. However, like for the custom DB, you should not rename
data with a name already used.
To edit custom data

3. In the column Name, click on the custom database of your choice.The page Custom database
opens.
4. In the column Name, put your mouse over the data you want to edit. Click on . The wizard
opens.
5. Edit the value of the fields according to your needs.
6. Click on OK to commit your changes. The wizard refreshes and closes. The changes are
Deleting Data From a Custom DB

To remove data from a custom DB

3. In the column Name, click on the custom database of your choice.The page Custom database
opens.
4. Tick the custom data entries that you want to remove.
5. In the menu, select Edit > Delete. The wizard opens.
6. Click on OK to remove the selected entries.
1157
Chapter 84. Managing Customization
Packages
From the Administration module, you can import archive files, or packages, containing a set of
customized functionalities from the page Packager.
Once imported and uploaded, installing these packages can affect interfaces, databases, system
files, etc. depending on what they contain. These functionalities can take the form of classes,
services (also called macros), reports or rules.
Packager is composed of two pages: All Packages and All package files. From the page All
Packages, you can import or create, install, uninstall and delete your packages. The page All
package files simply provides the content of the packages.
Packager reuses the principle of the module of the same name in 3.0.1, however, it uses different
services. Therefore, packages created or used in previous versions of SOLIDserver cannot be
used with the current version.
Browsing the Packages Database

The packages and their content are displayed on two different pages. The packages management
options are only available on the page All packages.
To display the list of packages
opens.
2. In the section Customization, click on Packager. The page All packages opens.
The page All packages contains seven columns: Name, Description, Version, Vendor, Creation
time, Install time and Status. You cannot edit the page listing template.
To display all the information in one panel, open the package properties page.
To display a package properties page
opens.
3. At the end of the line of the package of your choice, click on . The server properties pages
opens.
The packages content is listed on the page All package files.
To display the list of package files
opens.
1158
Managing Customization Packages
3. In the breadcrumb, click on All package files. The page All package files opens.
To display the package files of a specific package
opens.
3. Click on the name of the package of your choice. The page All package files of the selected
package opens.
The page All package files contains five columns: filename, Directory, Type, Package version
and Version. You cannot edit the page listing template.
Uploading Packages
From the page All packages, you can upload your own packages in a .tar archive file.
Keep in mind that:
• Uploading a package simply stores it locally on the appliance. Once uploaded, you need to
install it to push the files it contains. For more details, refer to the section Installing Packages.
• Each package has a unique name, version and content, so you cannot upload a package if it
is already listed on the page unless the version or name differs. If at least one of the files it
contains is already installed, you cannot install your package.
• Packages from previous versions of SOLIDserver are not compatible and therefore not suppor-
ted.
To upload a package
opens.
3. In the menu, select Add > Upload package. The wizard Upload a package opens.
4. Click on BROWSE to search for the .tar file to import. A window opens to help you browse
through folders.
5. Double-click on the needed file. The window closes and the file is visible in the field File
name of the wizard.
6. Click on OK to commit the upload. The report opens and closes. The page All Packages is
visible again. The package is listed but it is not installed yet.
Creating Packages
If you want you can create your own packages from the page All packages. In this case, you can
configure it with existing rules, services, reports and classes.
Keep in mind that:
• Creating a package does not install it. Once created, you need to install it to push the files it
contains. For more details, refer to the section Installing Packages.
1159
• Each package has a unique name, version and content, so you cannot upload a package if it
is already listed on the page unless the version or name differs. If at least one of the files it
contains is already installed, you cannot install your package.
• You cannot include system files to your package. If you include any of SOLIDserver system
files during the creation, you cannot install the package.
To create a package
opens.
3. In the menu, select Tools > Expert > Create a package. The wizard Create a package opens.
4. Configure the package details:
a. In the field Package name, name the package.

b. In the field Version, type in a version for your package following the format <num-
ber>.<number> .
c. In the field Description, you can describe the package.
d. In the field Vendor, you can type in a vendor name.
5. Click on NEXT to configure the package content. The page Package files selection opens.
6. You can add classes to your package:
a. In the drop-down list Files type, select Class.

b. In the drop-down list Module, select the module of your choice. It can be Administration,
DHCP, DNS, Device Manager, IPAM, NetChange, Rights & delegation, SPX, VLAN
Manager, VRF or Workflow.
c. In the drop-down list Type, select the object the class applies to within the module.
d. In the drop-down list Available files, select an existing class. If it belongs to a specific
directory, it is listed as follows: <directory-name>/<class-name>. For more details re-
garding classes, refer to the chapter Configuring Classes.
e. Once you selected the class that suits your needs, click on ADD . The class is moved to
the list Selected files. You can add as many classes as needed.
7. You can add services to your package:
a. In the drop-down list Files type, select Macro.

c. In the drop-down list Available files, select the service of your choice.
d. Once you selected the service that suits your needs, click on ADD . The service is moved
to the list Selected files. You can add as many services as needed.
8. You can add reports to your package:
a. In the drop-down list Files type, select Report.
1160
b. In the drop-down list Available files, select the report of your choice. For more details
regarding the reports refer to the chapter Managing Reports.
c. Once you selected the report that suits your needs, click on ADD . The report is moved
to the list Selected files. You can add as many reports as needed.
9. You can add rules to your package:
a. In the drop-down list Files type, select Rule.

c. In the drop-down list Available files, select an existing rule applying to the selected
module.
d. Once you selected the rule that suits your needs, click on ADD . The rule is moved to the
list Selected files. You can add as many rules as needed.
10. In the drop-down list Selected files are listed all the classes, services, reports and rules that
the package contains.
To remove an entry, select it the list and click on DELETE .
11. Click on OK to commit the package creation with all the files listed in the Selected files field.
The report opens and closes. The page All Packages is visible again. The package is listed
but it is not installed yet.
Editing Packages
You cannot edit a package. If one of your packages contains files that you no longer require or
if it misses files, you need to replace it.
1. Uninstall the useless package.

2. Upload the package that replaces it or create another package. To make sure you do not forget
any file, you can look at the list All package files of the package you want to replace.
3. Delete the useless package.
4. Install the new package.
Installing Packages
Installing a package pushes its files to the relevant parts of the appliances. When uploading or
creating a package, it is simply listed in the GUI. If you do not install it, the files it contains are
simply stored locally but not used.
Keep in mind that:
• You cannot install a package containing SOLIDserver system files.

• You cannot install a package if it contains one or several files that were already installed with
another package.
• Once you installed a package, you cannot delete it, you must uninstall it before being able to
delete it.
1161
To install a package
opens.
3. Tick the package(s) you want to install.
4. In the menu, select Edit > Install. The wizard Install a package opens.
5. Click on OK to commit the package installation. The report opens and works until all the files
are pushed.The page is visible again. In the column Status the package is marked installed.
Uninstalling Packages
Uninstalling a package allows to revert all the changes that the files it contains were performing.
It also allows to delete a package: you cannot delete a package if it is installed, i.e. used.
To uninstall a package
opens.
3. Tick the package(s) you want to uninstall.
4. In the menu, select Edit > Uninstall. The wizard Uninstall a package opens.
In the column Status the package is marked uninstalled.
Downloading Packages
At any time you can download a package, whether it is installed or not. Keep in mind that you
can only download one package at a time.
To download a package
opens.
3. Tick the package you want to download.
4. In the menu, select Edit > Download. The wizard Downloading a package opens.
5. Click on OK to commit your choice. The report opens, the package is now stored in an archive
.tar file on the Local files listing page (Administration tab homepage > Maintenance > Local
files listing). If you do not want to download the file on your computer, go to step 7.
6. Click on DOWNLOAD to save the package locally.
7. Click on CLOSE . The wizard closes and the page All packages is visible again.
1162
Deleting Packages
Once you no longer need a package, you can delete it as long as it is no longer used. This means
that if the package you want to delete is currently installed, you need to uninstall it before following
the procedure below. For more details, refer to the section Uninstalling Packages.
To delete a package
opens.
3. Tick the package(s) you want to delete.
5. Click on OK to commit the package deletion. The report opens and closes. The package is
no longer listed.
1163
Appendix A. Matrices of Network Flows
Table of Contents
SOLIDserver ............................................................................................................... 1165
IPAM .......................................................................................................................... 1166
DHCP ......................................................................................................................... 1167
DNS ........................................................................................................................... 1168
NetChange ................................................................................................................. 1170
Remote Management .................................................................................................. 1171
This appendix maps out the networks flows that you must open to manage your SOLIDserver
appliance or remotely manage servers.
Each flow is detailed in tables indicating its: Source IP, Port, Destination IP, Port, Protocol,
Service used and some Notes, when relevant.
The columns Source IP and Destination IP may contain the following key words:
Source/Destination Description
administrator The computer belonging to a user with administrative rights.
DHCP server Any DHCP server, the flow must be opened for all servers.
DHCP backup A server managed in a SOLIDserver smart architecture that has a backup role
in your failover configuration.
DHCP master A server managed in a SOLIDserver smart architecture that has a master role
in your failover configuration.
DNS server Any DNS server, the flow must be opened for all servers.
HSM Your Hardware Security Module.
iDRAC The integrated Dell Remote Access Controller for hardware appliances SDS-
260 to SDS-Blast Series.
Kerberos servers Your Kerberos authentication server.
MS DHCP A Microsoft DHCP server managed from SOLIDserver.
MS DNS A Microsoft DNS server managed from SOLIDserver.
Network device All the routers, switches and/or firewalls which information you want to retrieve.
They must be managed in the module NetChange.
RFS The Remote File System of your HSM.
SOLIDserver Any SOLIDserver appliance.
SOLIDserver Hot Standby A SOLIDserver appliance configured in High availability which role is Hot
Standby.
As the Hot Standby can be switched to Master, the matrices flows on both HA
appliances should be configured the same.
SOLIDserver Management A SOLIDserver appliance managing another SOLIDserver or any external
server or service.
SOLIDserver Master A SOLIDserver appliance configured in High availability which role is Master.
The matrices flows on both the Master and Hot Standby appliances should be
configured the same.
1164
Matrices of Network Flows
SOLIDserver
Basic Configuration
Source IP Port Destination IP Port Protocol Service Notes
administrator any SOLIDserver 80 TCP HTTP Graphic User Interface (GUI)
administrator any SOLIDserver 443 TCP HTTPS Graphic User Interface (GUI)
administrator any SOLIDserver 22 TCP SSH Command Line Interface (CLI)
SOLIDserver any DNS server 53 UDP DNS DNS resolution, DDNS update
SOLIDserver any DNS server 53 TCP DNS DNS resolution, DNS zone transfer
SOLIDserver any NTP server 123 UDP NTP Time synchronization
SOLIDserver any FTP server 21 TCP FTP Remote archive on an FTP or SFTP
SOLIDserver any SFTP server 22 TCP SFTP server
External Authentication
SOLIDserver any LDAP/AD 389 TCP LDAP LDAP or AD authentication
SOLIDserver any LDAPS/AD 636 TCP LDAPS LDAPS or AD authentication
SOLIDserver any RADIUS 1812 UDP RADIUS RADIUS authentication
TFTP and NTP Services

TFTP client any SOLIDserver 69 UDP TFTP File transfer
NTP client any SOLIDserver 123 UDP NTP NTP server
Monitoring and Logging

Monitoring
any SOLIDserver 161 UDP SNMP
server SNMP pooling
SOLIDserver any SOLIDserver 161 UDP SNMP
Monitoring
SOLIDserver any 162 UDP SNMP SNMP trap
server
SOLIDserver any Log server 514 UDP Syslog Syslog export
iDRAC
administrator any iDRAC 22 TCP SSH iDRAC SSH
administrator any iDRAC 80 TCP HTTP iDRAC GUI
administrator any iDRAC 443 TCP HTTPS iDRAC GUI
administrator any iDRAC 5900 TCP VNC Virtual Console
1165
IPAM
SPX
RIPE

SOLIDserver any RIPE database 43 TCP WHOIS Retrieve RIPE data (Whois)
SOLIDserver any RIPE database 80 TCP WHOIS Send data to the RIPE (Whois)
SOLIDserver any SMTP server 25 TCP SMTP
Send data to the RIPE via a mail server
SOLIDserver any POP server 110 TCP POP
SOLIDserver any RIPE database 443 TCP HTTPS/POST Send data to the RIPE directly
APNIC

APNIC data-
SOLIDserver any 43 TCP WHOIS Retrieve APNIC data (Whois)
base
APNIC data-
SOLIDserver any 80 TCP WHOIS Send data to the APNIC (Whois)
base
SOLIDserver any SMTP server 25 TCP SMTP Send data to the APNIC via a mail
SOLIDserver any POP server 110 TCP POP server
APNIC data-
SOLIDserver any 443 TCP HTTPS/POST Send data to the APNIC directly
base
1166
DHCP
EfficientIP DHCP Servers
SOLIDserver Required to manage an EfficientIP DH-
any DHCP server 443 TCP HTTPS
Management CP server on a SOLIDserver appliance
Failover channel port on the backup
DHCP master any DHCP backup 647 TCP Failover
server
Failover channel port on the master
DHCP backup any DHCP master 847 TCP Failover
server
DHCP client 68 DHCP server 67 UDP DHCP Required by the service DHCP
DHCP server 67 DHCP client 68 UDP DHCP Required by the service DHCP
DHCP client 546 DHCP server 547 UDP DHCP Required by the service DHCPv6
DHCP server 547 DHCP client 546 UDP DHCP Required by the service DHCPv6
Broadcast ad- Required by the DHCP protocol on the
DHCP client 68 67 UDP DHCP
dress local segment
a
DHCP server - any - ICMP ICMP Only if the option ping-check is enabled
a
For more details, refer to the section Preventing IP Address Duplication.
Microsoft Windows Agentless DHCP Servers

SOLIDserver Microsoft Remote Procedure Calls
any MS DHCP 135 TCP MSRPC
Management (MSRPC)
DHCP client 68 MS DHCP 67 UDP DHCP Required by the service DHCP
MS DHCP 67 DHCP client 68 UDP DHCP Required by the service DHCP
Broadcast ad- Required by the DHCP protocol on the
DHCP client 68 67 UDP DHCP
dress local segment
Linux Packages
Prerequisite before configuring a Linux Package: configuring DHCP network flows as detailed
in the section EfficientIP DHCP Servers.

SOLIDserver Required to manage the DHCP server
any DHCP server 443 TCP HTTPS
Management on Linux packages
DHCP Statistics
SOLIDserver SNMP v1, v2c and v3 to retrieve the
any DHCP server 161 UDP SNMP
Management server statistics
1167
DNS
EfficientIP DNS Servers
SOLIDserver Required to manage an EfficientIP DNS
any DNS server 443 TCP HTTPS
Management server on a SOLIDserver appliance
SOLIDserver DNS resolution, DDNS update, DNS
any DNS server 53 UDP/TCP DNS
Management zone transfer
DNS resolution, DDNS update, DNS
DNS server any DNS server 53 UDP/TCP DNS
zone transfer
SOLIDserver a
DNS server 53 2053 UDP DNS DNS notify (optional)
Management
a
The port number 2053 is used to send notify from the DNS server to the management platform. This notify can be con-
figured to speed up the RR upload on DNS zone change. Keep in mind that not all the DNS engines support this func-
tionality, for instance Microsoft DNS engines do not support it.
Microsoft Windows Agentless DNS Servers

SOLIDserver Microsoft Remote Procedure Calls
any MS DNS 135 TCP MSRPC
Management (MSRPC)
any MS DNS 53 UDP/TCP DNS
MS DNS any MS DNS 53 UDP/TCP DNS DNS resolution, DNS zone transfer
Amazon Route 53 Servers

SOLIDserver Required to manage a Route 53 DNS
any AWS Route 53 443 TCP HTTPS
Management server on Amazon Web Service (AWS)
any AWS Route 53 53 UDP/TCP DNS
Linux Packages
Prerequisite before configuring a Linux Package: configuring the DNS network flows as detailed
in the section EfficientIP DNS Servers.

SOLIDserver Required to manage the DNS server on
any DNS server 443 TCP HTTPS
Management Linux packages
DNS Statistics
SNMP v1,v2c or v3 to retrieve the stat-
SOLIDserver
any DNS server 161 UDP SNMP istics of DNS servers on SOLIDserver
Management
appliances or Linux Packages
1168
GSS-TSIG
SOLIDserver Kerberos serv-
any 88 Protocol Kerberos Kerberos authentication
Management ers
Routing Protocols for Anycast

Router's IP(s) any SOLIDserver 179 TCP BGP
Router's IP(s) - 224.0.0.0/24 - OSPF OSPF
SOLIDserver - 224.0.0.0/24 - OSPF OSPF
- - - - - IS-IS
Guardian Cache Sharing

Via Unicast

<port
set Guardian cache sharing, via the port of
SOLIDserver any SOLIDserver UDP Cache Sharing
by your choice
user>
Via Multicast

Local Net-
- 224.0.0.0/24 - IGMP IGMP
work(s) IGMP
SOLIDserver - 224.0.0.0/24 - IGMP IGMP
HSM
DNS server any HSM 9004 UDP/TCP Thales HSM Required for DNSSEC signing with HSM
HSM any RFS 9004 TCP RFS
DNS server any RFS 9004 TCP RFS
1169
NetChange
Network
NetChange any 161 UDP SNMP SNMP v1, v2c, v3
device
NetChange any DNS server 53 UDP DNS DNS resolution
Network
NetChange any 22 TCP SSH
device
Save the configuration
Network
NetChange any 23 TCP SNMP
device
1170
Remote Management
High Availability
SOLIDserver SOLIDserver
any 443 TCP HTTPS
Hot Standby Master
Health check
any 443 TCP HTTPS
Master Hot Standby
any 5432 TCP PostgreSQL
Hot Standby Master
Replication
any 5432 TCP PostgreSQL
Master Hot Standby
Remote Management of Other Appliances

SOLIDserver Management of remote SOLIDserver
any SOLIDserver 443 TCP HTTPS
Management appliances
1171
Appendix B. Multi-Status Messages
Table of Contents
DHCP Multi-Status Messages ...................................................................................... 1172
DNS Multi-Status Messages ......................................................................................... 1172
This appendix provides a list of messages returned in the column Multi-status. For more details,
refer to the section Understanding the Column Multi-Status.
DHCP Multi-Status Messages

Code Level Message
60000 Multistatus 60000: Communications-interrupted.
60001 Multistatus 60001: Partner-down.
60002 Multistatus 60002: Recovering.
60003 Multistatus 60003: Starting up.
60004 Multistatus 60004: Server management via SNMP can only be in read-only. We recommend to
update to SSL.
60005 Multistatus 60005: This server type is no longer supported. To manage a Microsoft server, create
a "Microsoft DHCP" server.
DNS Multi-Status Messages

Code Level Message
61000 Multistatus 61000: Zone type incompatible with Hybrid.
61001 Multistatus 61001: Hybrid servers cannot manage authoritative and recursive zones.
61002 Multistatus 61002: Hybrid does not support forward on authoritative servers.
61003 Multistatus 61003: Hybrid does not support forwarders on authoritative servers.
61004 Multistatus 61004: Hybrid server with authoritative zones cannot be recursive.
61005 Multistatus 61005: RR type incompatible with Hybrid.
61006 Multistatus 61006: Server type incompatible with Hybrid.
61007 Multistatus 61007: TSIG keys not supported on Hybrid recursive servers.
61008 Multistatus 61008: Hybrid servers do not support views.
61009 Multistatus 61009: Hybrid does not support forwarding configuration on authoritative servers.
61010 Multistatus 61010: Zone type incompatible with Route 53.
61011 Multistatus 61011: RR type incompatible with Route 53.
61012 Multistatus 61012: Route 53 servers do not support views.
61013 Multistatus 61013: At least one character in the value of the record is not supported by Route
53 servers.
61014 Multistatus 61014: Only TLD zones are replicated on Route 53 servers.
61015 Multistatus 61015: Maximum number of AWS zones reached.
61016 Multistatus 61016: Maximum number of RRset per AWS zone reached.
61017 Multistatus 61017: Maximum number of records per RRset per AWS zone reached.
1172
Multi-Status Messages
Code Level Message

61018 Multistatus 61018: This RPZ zone cannot be replicated on one of the physical servers of the
smart.
61019 Multistatus 61019: The syntax of the BIND include file is incorrect.
61020 Multistatus 61020: RRL is not supported on this version of BIND.
61021 Multistatus 61021: RRL is not supported on this DNS server.
61022 Multistatus 61022: The zone name does not comply with AWS format.
61023 Multistatus 61023: The server has no GSS-TSIG key.
61024 Multistatus 61024: Server management via SNMP can only be in read-only. We recommend to
update to SSL.
61025 Multistatus 61025: This server type is no longer supported. To manage a Microsoft server, create
a "Microsoft DNS" server.
61026 Multistatus 61026: The zone has records configured with geolocation routing policy. You cannot
edit or delete it from our GUI.
61027 Multistatus 61027: The zone has records configured with routing policy or health check option.
You cannot edit or delete it from our GUI.
1173
Appendix C. Default Gadgets
SOLIDserver offers gadgets by default in the Gadgets Library. Among them, 12 are displayed
by default on the dashboards NetChange Device Manager and Home, the main dashboard.
Table C.1. The default gadgets in the Gadgets Library

Gadget Description
Alerts Displayed No.
Type Top list.
Description The 10 latest raised alerts. Click on the alert name to go to the page
Alerts. For more details, refer to the chapter Managing Alerts.
All networks Displayed No.
Type Quick Search.
Description A search engine gadget to find networks in the IPAM. The data
entered in the fields automatically create filters on the page All net-
works through the columns Name and Address.
DHCP ranges Displayed No.
Type Top list.
Description A list of the 10 first DHCP ranges sorted by address with the server
they belong to, their occupation rate and status.
DHCP Servers Displayed No.
Type Top list.
Description A list of the 10 first DHCP servers sorted by name with their type,
protocol, synchronization status and status.
DNS RR type Displayed No.
Type Chart.
Description A pie chart representing the managed records repartition per type.
DNS Servers Displayed No.
Type Top list.
Description The 10 first DNS servers sorted by name with their IP address,
synchronization status and status.
Alerts on ports/interfaces Displayed On Device Manager homepage.
reconciliation drift
Type Top list.
Description The 5 first port and/or interfaces in Device Manager that have a
Drift in the Reconciliation column of the page All ports & interfaces.
For more details, refer to the section Tracking Changes on the Page
General information Displayed On the Main dashboard.
Type Descriptive.
Description A gadget gathering the appliance configuration information: running
services, hostname, IP address(es), default gateway(s), HA role
and status. For more details, refer to the chapter High Availability
Management.
Number of NetChange Displayed On NetChange homepage.
ports per device Type Chart.
Description A pie chart representing NetChange ports repartition per network
device.
1174
Default Gadgets
Gadget Description
NetChange network Displayed On NetChange homepage.
devices vendor Type Chart.
Description A pie chart representing NetChange network devices repartition per
vendor.
NetChange active ports Displayed On NetChange homepage.
speed (bps)
Type Chart.
Description A pie chart representing NetChange Active ports repartition per
speed. The Inactive and Disabled ports are not represented.
NetChange port status Displayed On NetChange homepage.
Type Chart.
Description A pie chart representing NetChange ports repartition per status.
Number of interfaces used Displayed On Device Manager homepage.
per device Type Chart.
Description A pie chart representing Device Manager used ports repartition per
device.
Number of ports used per Displayed On Device Manager homepage.
device Type Chart.
Description A pie chart representing Device Manager used interfaces repartition
per device.
Number of RIPE assigned Displayed No.
networks allocated per year Type Chart.
Description A pie chart representing the RIPE assigned networks repartition
per year.
Sum of allocated RIPE as- Displayed No.
signed networks size per Type Chart.
year
Description A pie chart representing the RIPE allocated networks repartition
per size over the years.
Shortcuts Displayed On the Main dashboard.
Type Shortcut.
Description A gadget containing shortcuts toward the IPAM, DNS and DHCP
most commonly used pages.
Networks Displayed No.
Type Top list.
Description The 10 first networks sorted by start IP address with their start ad-
dress and prefix, name, proportion of used IP addresses and status.
System Information Displayed On the Main dashboard.
Type Descriptive.
Description A gadget gathering the appliance basic information: user connected,
version, time and date, license type and expiration, manufacturer
and product.
My account preferences & Displayed On the Main dashboard.
configuration Type Shortcut.
Description A gadget gathering user dedicated shortcuts, toward the Gadgets
Library and the wizard Change Language.
SOLIDserver Configuration Displayed On the Main dashboard.
Checklist Type Configuration.
Description A gadget gathering appliance configuration shortcuts.
1175
Appendix D. SPX
Table of Contents
Prerequisites ............................................................................................................... 1176
Enabling the SPX Classes ........................................................................................... 1176
Enabling the SPX Rules ............................................................................................... 1177
Managing your RIPE Network With SOLIDserver ........................................................... 1177
The Service Provider eXtension (SPX) is a module that can be integrated to the IPAM through
a dedicated license option. It can assist Local Internet Registry (LIR) declarations as it allows to
manage the complete life cycle of the IP address networks allocated to you by a Regional Internet
Registry (RIR) member.
From SOLIDserver GUI, you can manage your networks that were allocated to you by the RIPE
(Réseaux IP Européens).
Prerequisites
To properly use the SPX module you must:
1. Purchase the SPX license option.
To make sure you do have this license option, the administrator can go to the Administration
homepage and in the menu select System > Licenses. In the panel Activation keys, all the li-
cense options are listed: SPX must be listed.
2. Configure SOLIDserver to match your network organization:
a. Enabling the dedicated classes.
b. Enabling the dedicated rules.
c. Providing your RIR network details to SOLIDserver and then add or import the relevant
data (users, ranges of IP addresses...).
3. Edit the assigned networks in the GUI: the license automatically sends your information to the
relevant RIR member.
No matter what RIR you depend on, there is only one wizard to configure SOLIDserver. Once
SPX is properly set and matches your network, only assigned networks can be added and edited:
their containers are managed by the RIR itself. Whenever you add or edit assigned networks
through the GUI, an email is sent to your RIR.
Enabling the SPX Classes

To properly configure SOLIDserver to manage RIR networks, you need to enable the default
SPX classes provided. Even though their default name contains the keyword RIPE in the GUI,
they allow to add extra fields and options that assist you into managing RIPE networks.
1176
SPX
To enable SPX classes
opens.
3. In the search engine of the column Directory, type in SPX. Only the default SPX classes
are listed.
4. Next to the column Name tick the box: all the classes of the directory are selected.
5. In the menu, select Edit > Enable class. The wizard Enable class opens.
The classes are marked as Enabled in the column Status.
Enabling the SPX Rules

Once the SPX classes are enabled, you must enable the default SPX rules. They all belong to
the RIPE module in the GUI.
These rules are designed to automate the communication with the RIPE: send your changes and
receive the RIPE answers.
To enable SPX rules
opens.
3. In the search engine of the column Module, type in RIPE. The SPX rules are listed.
4. Next to the column Name tick the box: all the classes of the module are selected.
The rules are marked as OK in the column Status.
Managing your RIPE Network With SOLIDserver

Once you enabled the required rules and classes, you must configure SOLIDserver to:
1. Configure SOLIDserver to retrieve RIPE organization details and send out the changes per-
formed in the GUI.
2. Import your network details (allocated networks, assigned networks, users) to have a complete
overview from the GUI.
3. Manage your network from the GUI: edit, create and delete persons, assigned networks, aut-
nums...
1
SOLIDserver supports Provider Aggregatable and Provider Independent addresses . You can
import or add them using dedicated classes available for allocated networks and assigned net-
works.
1
For more details, refer to http://www.ripe.net/lir-services/member-support/info/faqs/isp-related-questions/pa-pi.
1177
SPX
The procedures of this section describe the fields configured in the default RIPE classes. If your
administrator configured specific RIPE classes, there might be extra fields that are not detailed
in this guide.
Configuring the Connection to the RIPE

To configure SOLIDserver with your RIPE details, a configuration wizard is available on the IPAM
homepage.
It allows you provide your RIPE organization details and set up management preferences using
SOLIDserver classes. These classes apply to IPv4 and IPv6 allocated networks, IPv4 and IPv6
assigned networks, autnums and finally users. So before you start the configuration make sure
that:
• You have all your RIPE network details: maintainer, organization, registry identifier, adminis-
trator contact (admin-c) and user contact (person).
• Your RIPE classes and rules are enabled. If you did not enable the RIPE classes, you cannot
finish the configuration.
Keep in mind that this configuration wizard allows to configure your RIPE database as well as
your TEST database, if you have one.
To configure SOLIDserver with your RIPE details
2. In the menu, select Tools > SPX configuration. The wizard SPX configuration opens.
3. Configure your RIPE settings:
a. In the drop-down list Source, select RIPE.

b. In the field Comment, type in a comment regarding the organization.
c. In the field Maintainer, type in your RIPE maintainer full name. This information is con-
tained in the mntner fields and reused in the field mnt-by of the assigned networks you
manage.
d. In the field Password, type in your RIPE password. It is used to authenticate the database
updates.
e. In the drop-down list Source, select RIPE to configure your official RIPE database or
TEST to configure the RIPE test database.
f. In the field NCC REGID, type in your registry identifier. It was provided to you by the
RIPE, if not, you should contact them to obtain it.
g. In the field From (email), type in the source email address displayed on the emails sent
to the RIPE.
h. In the field Notify (email), type in the email address of the person notified of any change
made in the RIPE database.
i. In the field Changed (email), type in the email address displayed in the field "changed"
of the assigned network description in the RIPE database. It can be a generic email
address or the email address of a person.
j. In the field AW validation (email), type in the email of the person notified if you exceed
the number of IP addresses of your Assigned Window. This person has to be able to
1178
SPX
perform the appropriate procedures if your new assigned networks exceed the allocated
range of addresses.
k. In the field AW size, type in the number of IP addresses allocated to you by the RIPE
via the Assigned Window .
l. In the drop-down list Update method, select POST or EMAIL. POST is selected by default
and is a service based method to notify the RIPE of any changes . If you select EMAIL,
three fields appear. They allow you to configure an email based changes notification
process:
i. In the field Update pop3 mailbox, type in the pop3 address of your mail server.
ii. In the field Update mailbox login, type in the login of the specified mail server.
iii. In the field Update mailbox password, type in the password of the specified mail
server.
m. If you selected the POST update method, the Expert mode drop-down list allows you
to set up a proxy server to communicate changes to the RIPE. By default, No is selected.
If you do not want to set up a proxy, go straight to step 4.
To configure a proxy, select Yes. Five fields appear:
i. In the field Whois RIR host, type in the full name of the proxy server.
ii. In the field Whois port, type in the number of the Whois RIR host port used to
transmit information to the RIPE. Port 80 is generally used.
iii. In the field RIR Update host, type in the name of the RIPE server receiving your
updates.
iv. In the field RIR update URL, type in the URL of the RIPE server receiving your up-
dates.
v. In the field Email used for the update, type in the email address used as source
when notifying the RIPE of any updates.
4. Once all the fields are filled, click on ADD . The details are moved to the Maintainer list and
displayed as follows: Source: <selected-source> - Maintainer : <maintainer-name>.
5. Repeat these steps for as many maintainers as needed.
6. On the page RIPE Allocated Network classes configuration, configure the class(es) for your
RIPE allocated networks:
a. In the drop-down list Allocated network class, select one of your classes or the default
2
class SPX/RIPE_Block .
b. In the drop-down list Allocated network PI class, select one of your classes or the default
class SPX/RIPE_PI_block.
c. Click on NEXT . The next page opens.
7. On the page Ripe Assigned network classes configuration, configure the class(es) for your
RIPE assigned networks:
2
All the classes name can be preceded by a / if they belong to a specific directory, following the format: <directory-name>/<class-
name>. In this case, the default class RIPE_Block belongs to the directory SPX.
1179
SPX
a. In the drop-down list Assigned network class, select one of your classes or a default
class: SPX/RIPE_PI_subnet or SPX/RIPE_subnet.
b. The selected class is moved to the field New Assigned network class.
c. Click on ADD to confirm its selection. The class is moved to the List of RIPE assigned
networks.
d. Repeat these actions for as many classes as needed.
8. On the page RIPE Allocated Networks (v6) classes configuration, configure the class(es)
for your IPv6 RIPE allocated networks:
a. In the drop-down list Allocated network class (v6), select one of your classes or the
default class SPX/RIPE_Block.
b. Click on NEXT . The next page opens.
9. On the page RIPE Assigned Networks (v6) classes configuration, you can configure the
class(es) for your IPv6 RIPE assigned networks:
a. In the drop-down list Assigned network class (v6), select one of your classes or the
default class SPX/RIPE_subnet.
b. The selected class is moved to the field New Assigned network class (v6).
c. Click on ADD to confirm its selection. The class is moved to the List of RIPE assigned
networks (v6).
10. On the page RIPE aut-nums classes configuration, you can configure the class(es) for your
autnums:
a. In the drop-down list New autnum class, select one of your classes or the default class
SPX/RIPE.
b. The selected class is moved to the field New AutNum class.
c. Click on ADD to confirm its selection. The class is moved to the List of RIPE AutNum.
11. On the page RIPE users classes configuration, you can configure the class(es) for your
RIPE users:
a. In the drop-down list New user class, select one of your classes or the default class
SPX/RIPE_person.
b. The selected class is moved to the field New user class.
c. Click on ADD to confirm its selection. The class is moved to the List of RIPE users.
1180
SPX
At any time, you can edit these settings or add new maintainers. For more details, refer to the
section Editing the Connection to the RIPE.
Importing Your Network Objects

From SOLIDserver GUI, you can import existing:
• allocated networks,
• assigned networks,
• IPv6 assigned networks,
• persons,
• aut-nums and policies.
From the GUI, you can import existing allocated networks, assigned networks (IPv4 and IPv6),
aut-nums and persons. Once imported, you can edit them or their content through the GUI.
Keep in mind that the allocated networks can only be imported. You can then edit their content
through assigned networks and person additions, editions and deletions.
Once you imported your network objects, editing the content of your assigned networks follows
the same procedures as regular assigned networks. For more details, refer to the chapters
Managing Pools and Managing IP Addresses.
Importing RIPE Allocated Networks
Once your configuration with the RIPE is complete, you can import the allocated networks that
the RIPE allocated you.
Following the IPAM hierarchy, your allocated network(s) must belong to a space.
During the import, the option (box) Use the "ripe.db.inetnum" file stored in the Local files listing
allows you to use the "ripe.db.inetnum" file if you uploaded it to the Local files listing before per-
forming the import. It allows to work with the file content rather than connecting to the RIPE using
an Internet connection to obtain the assigned network details.
To import an IPv4 RIPE allocated network
4. In the menu, select Add > Import > RIPE allocated networks. The wizard Importing RIPE
allocated networks opens.
5. You can tick the box Use the "ripe.db.inetnum" file stored in the Local files listing if you
want.
6. In the drop-down list Maintainer, select the maintainer of your choice.
7. In the drop-down list Target space, select the space of your choice. If you are importing from
the page All networks of a specific space, it is already selected.
8. In the drop-down list PA allocated network class, you can choose a class if you manage an
allocated network of Provider Aggregatable IP addresses.
1181
SPX
9. In the drop-down list PI allocated network class, you can choose a class if you manage an
allocated network of Provider Independent IP addresses.
10. Click on OK to commit your import. The report opens and closes, the page refreshes. The
allocated network is listed.
To import an IPv6 RIPE allocated networks
4. In the menu, select Add > Import > RIPE allocated networks (v6). The wizard Importing
IPv6 RIPE allocated networks opens.
want.
7. In the drop-down list Target space, select the space of your choice. If you are importing from
the page All networks of a specific space, it is already selected.
8. In the drop-down list PA allocated network class, you can choose a class if you manage an
allocated network of Provider Aggregatable IPv6 addresses.
9. In the drop-down list PI allocated network class, you can choose a class if you manage an
allocated network of Provider Independent IPv6 addresses.
allocated network is listed.
Importing RIPE Assigned Networks
Once your configuration with the RIPE is complete and you have imported your allocated networks
in a space, you can import your existing assigned networks if you have any. The RIPE assigned
networks correspond to the assigned networks in the IPAM hierarchy.
During the import, the option (box) Use the "ripe.db.inetnum" file stored in the Local files listing
allows you to use the "ripe.db.inetnum" file if you uploaded it to the Local files listing before per-
forming the import. It allows to work with the file content rather than connecting to the RIPE using
an Internet connection to obtain the assigned network details.
To import IPv4 RIPE assigned networks
4. In the menu, select Add > Import > RIPE assigned networks. The wizard Importing RIPE
assigned networks opens.
want.
7. In the drop-down list Destination space, select the space of your choice. If you are importing
from the page All networks of a specific space, it is already selected.
1182
SPX
8. In the drop-down list PA Assigned network class, you can choose a class if you manage
assigned networks of Provider Aggregatable IP addresses.
9. In the drop-down list PI Assigned network class, you can choose a class if you manage
assigned networks of Provider Independent IP addresses.
assigned networks are listed.
To import IPv6 RIPE assigned networks
4. In the menu, select Add > Import > RIPE assigned networks (v6). The wizard Importing
IPv6 RIPE assigned networks opens.
want.
7. In the drop-down list Destination space, select the space of your choice. If you are importing
from the page All networks of a specific space, it is already selected.
8. In the drop-down list PA Assigned network class, you can choose a class if you manage
assigned networks of Provider Aggregatable IPv6 addresses.
9. In the drop-down list PI Assigned network class, you can choose a class if you manage
assigned networks of Provider Independent IPv6 addresses.
assigned networks are listed.
Once you imported your assigned networks, you can edit them from the GUI. Any change is sent
to the RIPE using the update method that you selected during the maintainer configuration (post
or email).
You can also add assigned networks from the GUI. These new objects are also communicated
to the RIPE. For more details, refer to the section Adding New RIPE Assigned Networks.
Importing RIPE Persons
You can import existing RIPE persons on the Users page. In the GUI, they are managed listed
like the other users. The main goal of importing RIPE persons is to edit them from the GUI, any
change is sent to the RIPE following the update method you selected when configuring the
maintainer.
You can create a group for your RIPE persons to gather them but, unlike standard users managed
via the appliance, there is no need to grant them specific rights.
The RIPE persons listed on the Users page do not have access to the appliance if you do not
grant them rights (through the group they belong to) or configure credentials for them.
To import RIPE persons
opens.
1183
SPX

3. In the menu, select Add > Import > RIPE persons. The wizard Importing RIPE persons
(users) opens.
RIPE persons are listed among the users.
Importing RIPE Aut-nums and AS Policies
You can import Autonomous System numbers (aut-nums) on the AS numbers page.
Importing of AS numbers also imports AS routing policies. The routing policy is described by
enumerating all neighboring AS number with which routing information is exchanged, they are
all listed in the page All policies. For each neighbor, the routing policy is described in terms of
exactly what is being sent (announced) and allowed (accepted). That way, each aut-num contains
policies that describes what can be implemented and enforced locally by said AS number.
Keep in mind the page All policies is accessible from the page All AS numbers. You can access
it through the breadcrumb.
To import RIPE aut-nums
opens.
3. In the menu, select Add > Import > RIPE aut-nums. The wizard Importing RIPE aut-nums
(AS numbers) opens.
5. In the drop-down list Class name, you can select a class to apply to the aut-nums you are
importing.
aut-nums are listed.
7. In the column AutNum name, click on the name of the aut-num of your choice. The page All
policies displays the policies of this AS number.
Adding RIPE Objects

From SOLIDserver GUI, you can add:
• IPv4 and IPv6 assigned networks,

• persons,
• aut-nums and their policies.
You cannot add RIPE allocated networks, you can only import existing ones and edit their content.
RIPE objects addition is assisted by dedicated classes that the administrator should enable
in Class Studio, all these classes belong to the Directory SPX.
Any addition sends a request to the RIPE that is confirmed or denied. The status of that request
can be displayed in a dedicated column on the All networks and Users pages.
1184
SPX
Once you added the network objects of your choice, editing the content of your assigned networks
follows the same procedures as regular assigned networks. For more details, refer to the chapters
Managing Pools and Managing IP Addresses.
Adding New RIPE Assigned Networks
Using dedicated classes, the ones that come with the appliance or some that you created, you
can add RIPE assigned networks, using the same addition wizard as standard assigned networks.
Keep in mind that you must provide the RIPE users that manage your network to SOLIDserver.
So before creating an assigned network, you must have a user in charge of managing it
in the RIPE database. If the assigned network managing person already exists in the RIPE,
there is no need to create it in the GUI, you can import it.
Once you added an assigned network via the GUI, you have to wait for the RIPE confirmation.
To make sure the assigned network addition was confirmed, you can display the column Waiting
state. For more details, refer to the section Customizing the List Layout.
To add a RIPE assigned network
5. On the page Space selection, select the space of your choice. Click on NEXT . The page
Network class opens.
6. In the list Network class, select the RIPE Assigned network class of your choice. Click on
NEXT . The page Network Size opens.
7. Select a Size, Prefix or Netmask. The two other fields are edited accordingly.
9. In the list Network address, select a start address.
10. Click on NEXT . The page Add an IPv4 network opens.
11. Configure the assigned network:
a. The Address and Prefix fields are displayed in read-only as they correspond to the cri-
teria previously set.
b. In the section Terminal network, the box is ticked.
c. In the field Gateway, the gateway is displayed. Its IP address corresponds to the default
gateway offset configured. You can edit it if need be.
d. In the drop-down list Number of pools, you can select a value between 1 and 5, depend-
ing on the number of pools you want to create in the assigned network. Once you selec-
ted a value, you need to set the Size and Type of each pool.
e. In the drop-down list Advanced properties, Default is selected by default. If you want
to set particular behaviors for the assigned network, select All. New fields appear. For
more details, refer to the section Configuring IPAM Advanced Properties in the chapter
f. At the bottom of the wizard, in the field Inetnum, the assigned network start and end
address are displayed in read-only.
1185
SPX
g. In the field Net name, name the assigned network. The field automatically displays
capital letters. The value entered in also displayed in the field Network name.
h. In the field Description, type in a description for the assigned network.
i. In the drop-down list Country, you can select the country where the organization is
located.
12. Click on NEXT . The next page opens and allows you to set up a notify mail:
a. In the field Notify mail, you can type in the email address of the person notified of any
change made on the assigned network you are creating.
b. Click on ADD . The address is moved to the list Notify.
c. In the field Remarks, you can type in a comment regarding the assigned network.
13. Click on NEXT . The page Contacts opens.
a. Specify the assigned network technical contacts (tech-c):
i. In the field Nic handle / Person, type in the user's Nic handle or name (as displayed
in the RIPE person field).
ii. Click on SEARCH to retrieve their details.
iii. Click on ADD . The contact is moved to the field Technical contacts.
b. Specify the assigned network administrative contacts (admin-c):
iii. Click on ADD . The contact is moved to the field Administrative contacts.
14. Click on OK to commit your creation. The report opens and closes. The assigned network
is listed, its state is Creating. Until its status is not OK, the RIPE has not confirmed the
addition. Have a look in the column Waiting state for more details regarding the addition
confirmation.
If the assigned network status stays in wait_mail_add, refer to the section Making Sure the RIPE
Received Your Changes.
If the assigned network status stays in wait_aw_confirm, refer to the section Validating a New
Assignment Window.
To add a RIPE IPv6 assigned network
5. In the list Choose a space, select the space of your choice. Click on NEXT . The page Network
class opens.
1186
SPX
6. In the list Network class, select the RIPE Assigned network class of your choice. Click on
NEXT . The page Network Size opens.
7. In the drop-down list Prefix, select the value of your choice.

9. In the drop-down list Network address (v6), select a start address.
10. Click on NEXT . The page Add an IPv6 network page opens.
11. Configure the IPv6 assigned network:
a. The Address and Prefix fields are displayed in read-only as they correspond to the cri-
teria previously set.
b. In the section Terminal network, the box is ticked.
c. In the field Gateway, the gateway is displayed. Its IP address corresponds to the default
gateway offset configured. You can edit it if need be.
d. In the drop-down list Number of pools, you can select a value between 1 and 5, depend-
ing on the number of pools you want to create in the assigned network. Once you selec-
ted a value, you need to set the Size and Type of each pool.
e. In the drop-down list Advanced properties, Default is selected by default. If you want
to set particular behaviors for the IPv6 assigned network, select All. New fields appear.
For more details, refer to the section Configuring IPAM Advanced Properties in the
chapter Managing Advanced Properties.
f. At the bottom of the wizard, in the field Ine6tnum, the IPv6 assigned network start address
and prefix are displayed.
g. In the field Net name, name the assigned network. The field automatically displays
capital letters. The value entered in also displayed in the field Network name.
h. In the field Description, type in a description for the assigned network.
i. In the drop-down list Country, you can select the country where the organization is
located.
12. Click on NEXT . The next page opens and allows you to set up a notify mail:
a. In the field Notify mail, you can type in the email address of the person notified of any
change made on the IPv6 assigned network you are creating.
b. Click on . The address is moved to the list Notify.
c. In the field Remarks, you can type in a comment regarding the assigned network.
a. Specify the assigned network technical contacts (tech-c):
b. Specify the assigned network administrative contacts (admin-c):
1187
SPX
14. Click on OK to commit your creation. The report opens and closes. The assigned network
is listed, its state is Creating. Until its status is not OK, the RIPE has not confirmed the
addition. Have a look in the column Waiting state for more details regarding the addition
confirmation.
If the IPv6 assigned network status stays in wait_mail_add, refer to the section Making Sure the
RIPE Received Your Changes.
Adding New RIPE Persons
From the page Users, you can add RIPE persons.
Once you added a person via the GUI, you have to wait for the RIPE confirmation. To make sure
the person addition was confirmed, you can display the column Waiting. For more details, refer
to the section Customizing the List Layout.
To add a RIPE person
opens.
3. In the menu, select Add > User. The wizard Add a user opens.
4. In the list User class, select the class RIPE_person .
5. Click on NEXT . The page Add a user opens.
6. You can either configure the RIPE person with RIPE dedicated fields (Step 7) or add extra
details for your management through the GUI (Step 8).
7. Configuring the person RIPE details:
a. In the field Usr login, an identifier is automatically incremented. You can edit it if need
be.
b. In the field Address, type in the person mailing address to fill in the RIPE field address.
c. In the field Phone, type in the person phone number following the format: +<country
code> <area code> <phone number>.
d. In the field Fax, you can type in a fax number following the same format as the field
Phone.
e. In the field Email, type in the user email address.
f. In the field Remark, you can type in a comment regarding the person.
g. In the field Notify, you can type in the email address of the person notified of any changes
made on the details of the person you are creating.
h. In the drop-down list Maintainer, select your maintainer.
8. Configure extra details for the RIPE person following the steps below.
1188
SPX
a. In the field First name, type in the person first name.

b. In the field Last name, type in the person last name.
c. In the field Pseudonym, the user last and first name are automatically displayed. You
can replace them by a shortname or shorter name if you want.
9. Click on OK to commit the creation. The report opens and closes. The user is listed, its state
is Creating. Until its status is not OK, the RIPE has not confirmed the addition. Have a
look in the column Waiting state for more details regarding the addition confirmation.
If the person status stays in wait_mail_add, refer to the section Making Sure the RIPE Received
Your Changes.
Adding New RIPE Aut-nums
From the page All numbers, you can add AS numbers (aut-num). This addition is also notified to
the RIPE.
To add a RIPE aut-num
2. Click on AS numbers. The page All AS numbers opens.
3. In the menu, select Add > AS numbers. The wizard opens.
4. In the list Autnum class, select the RIPE class of your choice.
5. Click on NEXT . The page Add an AS Number opens.
6. Configure the AS number:
a. In the field AutNum name, the AS number full name is displayed once you filled in the
AS Number field as follows: AS<AS-number>.
b. In the field AS Number, type in the number of your choice.This number must be available,
composed of 10 digits at the most and lower that 4294967295. The value entered
automatically completes the field AutNum name.
c. In the field AS name, you can name the AS number.
d. In the field Description, you can type in a description.
e. In the drop-down list Maintainer, select your maintainer.
a. Specify the AS number technical contacts (tech-c):
b. Specify the AS number administrative contacts (admin-c):
1189
SPX

8. Click on OK to commit the creation. The report opens and closes. The user is listed, its state
is Creating. Until its status is not OK, the RIPE has not confirmed the addition. Have a
look in the column Waiting state for more details regarding the addition confirmation.
Editing RIPE Objects

From SOLIDserver GUI, you can edit:
• IPV4 and IPv6 assigned networks,

• persons,
• aut-nums and their policies.
You cannot edit RIPE allocated networks.
Any object edition sends a request to the RIPE that is confirmed or denied. The status of that
request can be displayed in a dedicated column on the page All networks and Users.
Editing the content of your assigned networks, their pools and IP addresses, follows the same
procedures as regular assigned networks. For more details, refer to the chapters Managing Pools
and Managing IP Addresses.
Editing RIPE Assigned Networks
RIPE assigned networks can be edited in IPv4 and IPv6. Any changes are sent to the RIPE and
the notify mail person configured for the assigned network.
Once you edited an assigned network via the GUI, you have to wait for the RIPE confirmation.
To make sure the assigned network edition was confirmed, you can display the column Waiting
To edit a RIPE assigned network from its properties page
4. At the end of the line of the assigned network of your choice, click on .The assigned network
6. In the list Assigned network class, select a different class or None.
7. Click on NEXT . The page Edit an IPv4 Network or Edit an IPv6 Network opens.
8. Edit the field Net name, Description and/or Country, according to your needs.
9. Click on NEXT . The next page open.
10. Edit the list of notification email addresses and Remarks field according to your needs:
1190
SPX
a. Add a new email address if need be. In the field Notify mail, type in the new email ad-
dress. Click on to move the address in the list Notify. In the field Remarks, you can
type in a comment regarding the assigned network to fill the RIPE field remarks.
b. Remove an address from the list Notify. Select the address you want to delete and click
on . The address is no longer listed.
c. In the field Remarks, you can edit the comment regarding the assigned network.

12. You can edit the lists Technical contacts and Administrative contacts of assigned network:
find new persons in the field Nic handle / Person and ADD them. Or select a person in the
list and DELETE it.
in the panel.
14. Go to the page All network to see the assigned network state and make sure it was confirmed
by the RIPE. Until its status is not OK, the RIPE has not confirmed the edition. Have a
look in the column Waiting state for more details regarding the edition confirmation.
If the assigned network status stays in wait_mail_add, refer to the section Making Sure the RIPE
If the assigned network status stays in wait_aw_confirm, refer to the section Validating a New
Assignment Window.
Editing RIPE Persons
RIPE persons can be edited from the Users page. Any changes are sent to the RIPE and the
email address of the Notify field if it was set during the person creation.
Once you edited a person via the GUI, you have to wait for the RIPE confirmation. To make sure
the assigned network edition was confirmed, you can display the column Waiting. For more details,
refer to the section Customizing the List Layout.
To edit a RIPE person
opens.
5. In the list User class, edit the class if need be.
6. Click on NEXT . The page Edit a user opens.
7. Edit the user information according to your needs. For more details, refer to the procedure
To add a RIPE person.
9. Go back to the Users list to see the person state and make sure it was confirmed by the
RIPE. Until its status is not OK, the RIPE has not confirmed the edition. Have a look in
the column Waiting for more details regarding the edition confirmation.
1191
SPX
If the person status stays in wait_mail_add, refer to the section Making Sure the RIPE Received
Your Changes.
Editing RIPE Aut-nums
There are two ways of editing an AS number by:
1. Editing its details of an AS number: AS name, Description, Maintainer and Contact information
but you cannot edit the Autnum full name.
2. Editing its content of an AS number: delete some of its policies.
To edit a RIPE aut-num
3. At the end of the line of the AS number of your choice, click on . The properties pages
opens.
5. In the list Autnum class, edit the class if need be.
6. Click on NEXT . The page Edit an AS Number opens.
7. Edit the AS number configuration via the fields AS name, Description and Maintainer,
9. Edit the contact details according to your needs.
10. Click on OK to commit the changes. The report opens and closes. The changes are listed
in the panel.
To edit the policies of a RIPE aut-num
3. In the column AutNum name, click on the name of the aut-num of your choice. The page All
policies opens.
4. Tick the policy(ies) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The policies are no longer
listed.
Deleting RIPE Objects

You can delete RIPE IPv4 and Ipv6 assigned networks and persons from SOLIDserver GUI.
Keep in mind that you can delete allocated networks, but this deletion does not affect your RIPE
database. It deletes the allocated network from the list and you no longer manage it via SOLID-
server.
Any object edition sends a request to the RIPE that is confirmed or denied. The status of that
request can be displayed in a dedicated column on the pages All networks and Users.
1192
SPX
Deleting RIPE Allocated Networks
You can delete RIPE allocated networks from SOLIDserver is no longer want to manage them
from the GUI. Deleting a RIPE allocated network from SOLIDserver does not delete it from
your RIPE database.
To stop managing a RIPE allocated network via SOLIDserver
4. Tick the allocated network(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The selected allocated
networks are no longer listed, they might be replaced by Orphan Networks. This deletion
does not delete the allocated network from your RIPE database.
Deleting RIPE Assigned Networks
From the page All networks, you can delete IPv4 and IPv6 assigned networks from your database.
Once you deleted an assigned network via the GUI, you have to wait for the RIPE confirmation.
To make sure the assigned network deletion was confirmed, you can display the column Waiting
To delete a RIPE assigned network
4. Tick the assigned network(s) you want to delete.
6. Click on OK to commit the deletion. The report opens and closes. The assigned network
state is Deleting until the RIPE confirms its deletion. Have a look in the column Waiting
state for more details regarding the deletion confirmation.
If you had used addresses within the assigned network, they are placed in an Orphan address
and listed among your assigned networks. They are simply displayed in the GUI but no longer
used within your RIPE database as the whole assigned network was deleted.
If the assigned network status stays in wait_mail_del, refer to the section Making Sure the RIPE
Deleting RIPE Persons
RIPE persons can be deleted from the Users page. This deletion request is sent to the RIPE and
the email address of the Notify field if it was set during the person creation.
Once you deleted a person via the GUI, you have to wait for the RIPE confirmation. To make
sure the assigned network edition was confirmed, you can display the column Waiting. For more
details, refer to the section Customizing the List Layout.
1193
SPX
Before deleting a person, make sure that the assigned networks they were managing are
already managed by someone else: edit the assigned networks concerned Contacts details.
For more details, refer to the section Editing RIPE Assigned Networks.
To edit a RIPE person
opens.
5. Click on OK to commit the deletion. The report opens and closes. The user state is Deleting
until the RIPE confirms its deletion. Have a look in the column Waiting state for more details
regarding the deletion confirmation.
If the person status stays in wait_mail_del, refer to the section Making Sure the RIPE Received
Your Changes.
Deleting RIPE Aut-nums
You can delete AS numbers, it also deletes the policies it contains.
If you want to delete the policies of an AS number refer to the section Editing RIPE Aut-nums.
To delete a RIPE aut-num
5. Click on OK to commit the deletion. The report opens and closes. The user state is Deleting
until the RIPE confirms its deletion.
Making Sure the RIPE Received Your Changes

If assigned networks or persons you added, edited or deleted have the status wait_mail_add,
wait_mail_del or must_send_mail, you need to use the option Register again.
This option resends your assigned network or person information to the RIPE via POST or EMAIL,
To register again newly added or edited RIPE assigned networks
3. On the right-end side of the menu, click on V4 or on V6 .
4. Tick the assigned network(s) that have the status wait_mail_add, wait_mail_del or
must_send_mail.
1194
SPX
5. In the menu, select Edit > RIPE > Register again. The wizard Assigned network Register
again opens.
6. Click on OK to commit your choice. The report opens and closes. The assigned network
Status evolves until it is OK. Have a look in the column Waiting state for more details re-
garding the RIPE confirmation.
To register again newly added or edited RIPE assigned networks
opens.
3. Tick the person(s) that have the status wait_mail_add or wait_mail_del.
4. In the menu, select Edit > Register again. The wizard Person Register again opens.
5. Click on OK to commit your choice. The report opens and closes. The assigned network
Status evolves until it is OK. Have a look in the column Waiting state for more details re-
garding the RIPE confirmation.
Validating a New Assignment Window

When you add or edit an assigned network through SOLIDserver, you can purposely exceed the
Assignment Window declared during your RIPE configuration. By exceeding, we mean:
• Configuring an assigned network which starts and/or end address exceeds the range of IP
addresses available in the allocated network.
• Allocating an assigned network to a user even if this allocation exceeds the total number of IP
addresses you are allowed to allocate. This sum takes into account the total number of IP ad-
dresses in your Assignment Window over the last 12 months. For more details, refer to the
prerogatives in the section 7.0 Assignment Window in the document RIPE-599, available at
http://www.ripe.net/ripe/docs/ripe-599#Assignment-Window.
In both cases, the assigned networks are marked wait_aw_confirm. Keep in mind that if you do
exceed the AW, you need to:
1. Follow the appropriate RIPE procedures to be able to extend your Assignment Window.
2. Once your request is approved by the RIPE, you can use the option Validate AW in the GUI.
If your request is denied, you should delete the assigned network. For more details, refer to the
section Deleting RIPE Assigned Networks.
To confirm the new AW in the GUI
4. Tick the assigned network(s) marked wait_aw_confirm and approved by the RIPE.
5. In the menu, select Edit > RIPE > Validate AW. The wizard Assignment Window validation
opens.
6. Click on OK to commit your configuration.The report opens and closes.The page All networks
is visible again. Have a look in the columns Waiting state and Status to monitor the evolution.
1195
SPX
Editing the Connection to the RIPE

Once your configuration with SOLIDserver is done, you can always edit its details or the class
associated with your maintainer from the wizard SPX configuration.
Keep in mind that you should not edit the maintainer name, registry identifier or AW size if
you already imported your allocated networks.
To edit the RIPE maintainer configuration details
3. At the bottom of the page in the Maintainer list, click on the maintainer you want to edit. The
configuration current values are displayed in the each field.
4. Change the value of the field(s) of your choice. For more details regarding the fields, refer
to the procedure To configure SOLIDserver with your RIPE details.
5. Click on UPDATE . The Maintainer list is edited according to your changes. Only the Source
and Maintainer name are displayed on this list.
6. Click on NEXT . The page RIPE Allocated Network class configuration opens.
7. Click on NEXT . The page Ripe Assigned network class configuration opens.
8. Click on NEXT . The page RIPE Allocated Network (v6) class configuration opens.
9. Click on NEXT . The page RIPE assigned network (v6) class configuration opens.
10. Click on NEXT . The page Ripe autnum class configuration opens.
11. Click on NEXT . The page Ripe user class configuration opens.
12. Click on OK to commit your changes. The report opens and closes, the page refreshes.
To delete a RIPE maintainer
3. At the bottom of the page in the Maintainer list, click on the maintainer you want to delete.
The configuration current values are displayed in the each field.
4. Click on DELETE . The maintainer is no longer in the Maintainer list.
To edit the classes associated with a RIPE maintainer
1196
SPX
3. At the bottom of the page in the Maintainer list, click on the maintainer which classes you
want to edit. The configuration current values are displayed in the each field.
5. You can select a different class in the drop-down lists Network class and Allocated network
PI class.
7. You can edit the list of classes in the List of RIPE assigned networks: select a class in the
drop-down list Assigned network class and ADD it. Or select a class in the List and DELETE
it.
9. You can select a different class in the drop-down list Network class (v6).
11. You can edit the list of classes in the List of RIPE assigned networks (v6): select a class in
the drop-down list Assigned network class (v6) and ADD it. Or select a class in the List and
DELETE it.
13. You can edit the list of classes in the List of RIPE AutNum: select a class in the drop-down
list New autnum class and ADD it. Or select a class in the List and DELETE it.
15. You can edit the list of classes in the List of RIPE users: select a class in the drop-down list
New user class and ADD it. Or select a class in the List and DELETE it.
1197
Appendix E. DHCP Options
Table of Contents
Basic Options .............................................................................................................. 1198
Server Parameters ...................................................................................................... 1199
Lease Information Options ........................................................................................... 1200
WINS/NetBIOS Options ............................................................................................... 1200
Host IP Options ........................................................................................................... 1200
Interface Options ......................................................................................................... 1201
Servers Options .......................................................................................................... 1202
BOOTP Compatibility Options ...................................................................................... 1203
DHCP Packet Fields Options ........................................................................................ 1204
Microsoft DHCP Client Options .................................................................................... 1205
NetWare Client Options ............................................................................................... 1205
NIS/NISplus Options .................................................................................................... 1206
Miscellaneous ............................................................................................................. 1207
Vendor MSFT Options ................................................................................................. 1207
Vendor Nwip Options ................................................................................................... 1207
This appendix describes all the DHCP options that you can configure from the wizard Configure
DHCP options at server, group, scope range and static level.
From either level, the wizard is accessible from the resource properties page, via the button EDIT
of the panel DHCP options.
The options are distributed following the Option category of the wizard.
Basic Options
Table E.1. Basic DHCP options
Name Code Value type Description
broadcast address 28 IP address Specifies the broadcast address for the interface
subnet.
domain name 15 text (name) Domain name the client uses when resolving name
via DNS.
domain-name-servers 6 list of IP addresses List of Domain Name Servers (DNS) available for this
client These servers are listed by order of preference.
host name 12 text (name) Client host name.
routers 3 list of IP addresses List of routers for client subnet. These servers are
listed by order of preference.
Authoritative N/A boolean Allocation and checking of IP addresses according to
the network segment where the DHCP client is con-
nected.
Default lease time N/A duration (in seconds) Default lease duration.
Max lease time N/A duration (in seconds) Maximum lease duration (unavailable for BOOTP
lease).
Min lease time N/A duration (in seconds) Minimum lease duration.
1198
DHCP Options

Ping check N/A boolean Permit to check by an ICMP request if the target ad-
dress is not used.
Ping time out N/A duration (in seconds) Maximum timeout answer for a ping from the DHCP
server.
Vendor option space N/A text Define specific option space used for encapsulated
options.
Site option space N/A text (name) Permit to specify from which option space the site-
local options are taken. The site-local options are the
ones with an option code between 224 and 254.
Subnet mask 1 IP address The subnet mask of the connected interface.
Server Parameters
These options concern the technical parameters on the server side.
Table E.2. Available server parameters

Authoritative N/A boolean Allocation and checking of IP addresses according to
the network segment where the DHCP client is con-
nected.
leasequery N/A boolean Permit to specify if the server should respond to DH-
CPLEASEQUERY packets sent by CMTSs, i.e. send
back lease information (creation/expiration date...).
Ping check N/A boolean Permit to check by an ICMP request if the target ad-
dress is not used.
Ping timeout N/A duration (in seconds) Maximum timeout answer for a ping from the DHCP
server.
Storm detection check re- N/A number Specifies the number of requests that have to be re-
quest ceived in order to trigger the MAC address black list-
ing. Only MAC addresses associated with an IP ad-
dress are taken in account in the black list. It means
that the clients have to make a DHCP request first
with an IP address.This has to be used in conjunction
with 'storm detection check sec' as well as 'Storm
detection ignore sec' parameters. The value has to
be between 1 and 65535.
Storm detection check sec N/A duration (in seconds) Specifies the period during which the system allows
requests. It then checks if it has more than X requests
in this time lap, then if it is over, it blacklists the MAC
for X seconds. It has to be used in conjunction with
'storm detection check request' as well as 'Storm de-
tection ignore sec' parameters. The value has to be
between 1 and 65535.
Storm detection check ig- N/A duration (in seconds) Number of seconds during which any DHCP request
nore sec from the blacklisted device should be ignored. Has to
be used in conjunction with 'storm detection check
request' as well as 'Storm detection check sec' para-
meters. The value has to be between 1 and 65535.
1199
DHCP Options
Lease Information Options

These options concern the technical mechanisms on the client side of SOLIDserver DHCP protocol.
Table E.3. Lease information options

dhcp-renewal-time 58 duration (in seconds) Time interval from address assignment until the client
transitions to the RENEWING state.
dhcp-rebinding-time 59 duration (in seconds) Time interval from address assignment until the client
transitions to the REBINDING state.
WINS/NetBIOS Options
Table E.4. WINS/NetBIOS options
netbios-name-servers 44 list of IP addresses List of WINS servers or of Net-BIOS name servers
(NBMS). These servers are sorted by order of prefer-
ence.
For more details, refer to RFC1001 available on IETF

website at http://tools.ietf.org/html/rfc1001 and to
RFC1002 at http://tools.ietf.org/html/rfc1002.
netbios-dd-server 45 list of IP addresses List of NetBIOS datagram distribution servers (NBDD),
defined by RFC1001 and RFC1002. These servers
are sorted by order of preference.
netbios-node-type 46 number Type of NetBIOS knot described in RFC1001 and
RFC1002. The value is represented by a numerical
code: 1 for B-node, 2 for P-node, 4 for M-node, 8 for
H-node.
netbios-scope 47 text (name) Netbios-scope name value of NetBIOS scope spe-
cified in RFC1001 and RFC1002.
Host IP Options
Table E.5. Host IP options
Default-ip-ttl 23 duration (in seconds) Default lifetime that the client must use to send a da-
tagram on the network. Valid values between 1 and
255.
Ip-forwarding 19 boolean This option specifies whether the client should config-
ure its IP layer for packets forwarding.

website at http://tools.ietf.org/html/rfc1533.
Max-dgram-reassembly 22 number Maximum size of datagram which the client must
prepare to assemble.
non-local-source-routing 20 boolean Allow the source-routing forwarding if the next-hop is
on a different physical interface from that crossed by
the datagram.

path-mtu-aging-timeout 24 second Aging time for the Path MTU Discovery defined for
the client.
1200
DHCP Options

path-mtu-plateau-table 25 list of numbers List of MTU sizes for the PMTU RFC1191. MTU sizes
are prioritized by the order and do not have to be
lower than 68.
policy-filter 21 2 IP addresses Specifies the filtering policy for the non-local-source-
routing. These filters are defined by a list of destina-
tion and netmask IP address couplets which specify
the destination of entering routes. Any "routedsource"
datagram not figuring in the list of filters is destroyed.
Subnet selection 118 IP address The DHCP server determines the subnet from which
the request originated.

Interface Options
Table E.6. Interface options
All-subnets-local 27 boolean Specifies if the IP interface must demand that all
subnets with which it communicates use the same
MTU as that used by the physical interface.
Arp-cache-timeout 35 duration (in seconds) This option specifies the timeout in seconds for ARP
cache entries.
Auto configure 116 boolean This option code is used to ask whether, and be noti-
fied if, auto-configuration should be disabled on the
local subnet.
Broadcast-address 28 IP address Specifies the broadcast address for the interface's
subnet.
Classless static route 121 list of IP addresses This option allows to use the routers used by the IP
protocol to set up a packet transmission path between
two IP hosts (one source and one destination host)
through the router IP address, listed in the routing
table.
This option obsoletes the Static Route option (option

33).
For more details, refer to the RFC3442 available on

IETF website at http://tools.ietf.org/html/rfc3442.
Default-tcp-ttl 37 duration (in seconds) This option specifies the default TTL that the client
should use when sending TCP segments.
Ieee802-3-encapsulation 36 boolean Specifies if the client must use Ethernet Version 2
encapsulation or IEEE 802.3 on its interface if it is
ethernet.
Interface-mtu 26 number Size of MTU to use for this interface, it should be at
least 68 bytes.
Mask-supplier 30 boolean Specifies if the interface must declare its netmask
during an ICMP echo.
Perform-mask-discovery 29 boolean Specifies if, for this interface, the client should attempt
an ICMP discovery to find its net-mask. Note that us-
ing this parameter is not recommended, as the first
response received is taken into account and may be
incorrect.
1201
DHCP Options

Router-discovery 31 boolean Specifies if, for this interface, the client should solicit
routers by the "Router Discovery" mechanism.

Router-solicitation-ad- 32 IP address Specifies the address by which, for this interface, the
dress client must emit its solicitation requests to the routers.
Static-routes 33 2 IP addresses In the route interface's cache, the first entry in the list
is the destination address and the second is the
router's address. The default route (0.0.0.0) is not
tolerated here.
This option was introduced in RFC2132 but was ob-

soleted by the Classless Static Route Option (option
121).
Subnet-mask 1 IP address The subnet mask for the network segment to which
the client is connected.
Tcp-keepalive garbage 39 boolean Specifies if the client must send a garbage byte with
a keepalive message.
Tcp-keepalive-interval 38 duration (in seconds) The time to wait before sending a keep alive message
on a TCP connection.
Trailer-encapsulation 34 boolean Specifies if the client must negotiate the use of trailers
with ARP.

Servers Options
Table E.7. Server options
Cookie-servers 8 list of IP addresses Lists the cookie servers available for this client. These
servers are listed by order of preference.

Finger-servers 73 list of IP addresses List of Finger servers. These servers are sorted by
order of preference.
Font-servers 48 list of IP addresses Lists the system-X Windows font servers available
for this client. These servers are sorted by order of
preference.
Ien116-name-servers 5 list of IP addresses IEN 116 name servers list for this client. These serv-
ers must be sorted by preference order.
Impress-server 10 list of IP addresses Lists the Imagen Impress servers available for this
client. These servers are listed by order of preference.
Irc-servers 74 list of IP addresses List of Internet Relay Chat server.
Log-servers 7 list of IP addresses Lists the UDP log servers (MIT-LCS syslog), available
for this client. These servers are listed by order of
preference.
Lpr-servers 9 list of IP addresses Lists the printer servers available for this client. These
servers are listed by order of preference.

1202
DHCP Options

Mobile-ip-home-agent 68 list of IP addresses List the mobile IP home agent.
Nis-servers 41 list of IP addresses Lists the IP of NIS servers available for the client. The
servers can be sorted by order of preference.
Nis-plus-servers 65 list of IP addresses Lists the IP addresses of NIS+ servers available for
the client. The servers can be sorted by order of
preference.
Ntp-servers 42 list of IP addresses Lists the NTP news servers. These servers are sorted
by order of preference.
Nntp-servers 71 list of IP addresses Lists the NNTP news servers. These servers are
sorted by order of preference.
Pop3-servers 70 list of IP addresses Lists the POP3 message servers. These servers are
Resource-location-servers 11 list of IP addresses Lists the resource servers available for this client.
These servers are listed by order of preference.

Smtp-servers 69 list of IP addresses Lists the SMTP message servers. These servers are
Streettalk directory assist- 76 list of IP addresses Lists the IP addresses in order of preference for STDA
ance server servers available to the client.
Street-talk-servers 75 list of IP addresses Lists the StreetTalk servers. These servers are sorted
by order of preference.
Tftp-server-name 66 list of IP addresses Name of the TFTP server to use when the Sname
field is used to carry Options.
www-servers 72 list of IP addresses Lists the WEB servers.
X-display-manager 49 list of IP addresses Lists the X Window XDM system servers. These
servers are sorted by order of preference.
BOOTP Compatibility Options

Table E.8. BOOTP compatibility options
Boot-size 13 number Length in block of 512 bytes of the boot image file for
this client.
Boot-filename 67 number Name of the boot file to use when the File field is used
to carry options.
Cookie-servers 8 list of IP addresses List the Cookie servers available. These servers are

Domain-name-servers 6 list of IP addresses Lists the domain name servers (DNS), available for
this client. These servers are listed by order of prefer-
ence.
Extensions-path 18 path Name of the file containing additional options to be
interpreted. The format is described in RFC2132.

Impress-server 10 list of IP addresses Lists the Imagen Impress servers available for this
client. These servers are listed by order of preference.
1203
DHCP Options

Merit-dump 14 path Path of file in which the client must copy the memory
image in the event of a crash. This path is constituted
by a set of NVT ASCII characters.
Resource-location-servers 11 list of IP addresses Lists the resource servers available for this client.
These servers are listed by order of preference.

Root-path 17 path Path of the disk route for this client. This path is con-
stituted by a set of NVT ASCII characters.
Filename N/A file name Name of the boot file to use when the field is used to
carry options.
Next-server N/A IP address This option allows to specify the IP address of the
server from which the initial boot file (specified in the
filename statement) has to be loaded. Server-name
should be a numeric IP address. If no next-server
parameter applies to a given client, the DHCP server's
IP address is used. Some clients prefer to receive the
server name in the server-name option.
Server-name N/A text (name) this statement can be used to inform the client of the
name of the server from which it is booting. This name
should be the same as the one provided to the client.
Swap-server 16 IP address Swap server.
Time-offset 2 duration (in seconds) Time offset from UTC (Coordinated Universal Time).
Time-servers 4 IP address Time server available for this DHCP client.
DHCP Packet Fields Options

Table E.9. Packet fields options
DHCP client identifier 61 text For client that want uses the different identifier, DHCP
defines the client identifier option. This option tells the
server to use the value in the option to identify the
client, rather than using the client MAC address.
DHCP parameter request 55 list of numbers Used by a DHCP client to request specific option type
list values from the DHCP server. Each option type is
requested and listed by a number value containing a
valid or recognized DHCP option code for the server.
Dhcp-rebinding-time 59 duration (in seconds) Specifies the time interval from address assignment
until the client transitions to the REBINDING state.
Dhcp-renewal-time 58 duration (in seconds) Specifies the time interval from address assignment
until the client transitions to the RENEWING state.
Dhcp-server-identifier 54 IP address The identifier is the IP address of the selected server.
User-class 77 text Information on the client class.
Vendor-class-identifier 60 text This option is used by DHCP clients to optionally
identify the vendor type and configuration of a DHCP
client.
Vendor-encapsulated-op- 63 provided by the vendor This option allows to use encapsulated options
tions provided by your vendor. The option can contain a
single vendor-specific value or one (or more) vendor-
specific sub-options. The configuration set for each
vendor is saved in a class. All the vendor classes are
1204
DHCP Options

kept separately in the DHCP server configuration and
trigger a unique response for each vendor.
Microsoft DHCP Client Options

Table E.10. Microsoft DHCP client options
dhcp-lease-time 51 duration (in seconds) This option is used in a client request (DHCPDISCOV-
ER or DHCPREQUEST) to allow the client to request
a lease time for the IP address.
dhcp-rebinding-time 59 duration (in seconds) Specifies the time interval from address assignment
until the client transitions to the REBINDING state.
dhcp-renewal-time 58 duration (in seconds) Specifies the time interval from address assignment
until the client transitions to the RENEWING state.
dhcp-server-identifier 54 address The identifier is the IP address of the selected server.
domain name 15 name Specifies the domain name that client should use
when resolving hostnames via the Domain Name
System.
domain-name-servers 6 list of IP addresses Specifies a list of Domain Name System name servers
available to the client. Servers should be listed in or-
der of preference.
Domain search list 135 list of domains In some circumstances, it is useful for the DHCP client
to be configured with the domain search list. Note that
Microsoft Windows 200x, XP do not support a list of
domain search.
netbios-name-servers 44 list of IP addresses List of Net-BIOS name servers (NBMS). These serv-
ers are sorted by order of preference.

website at http://tools.ietf.org/html/rfc1001 and to
RFC1002 at http://tools.ietf.org/html/rfc1002.
netbios-node-type 46 hexadecimal The NetBIOS node type option allows NetBIOS over
TCP/IP clients which are configurable to be configured
as described in RFC1001 and RFC1002. Available
values are: 0x1 = B-node; 0x2 = P-node; 0x4 = M-
node; 0x8 = H-node
netbios-scope 47 name Specifies the NetBIOS over TCP/IP scope parameter
for the client as specified in RFC1001 and RFC1002.
Routers 3 list of IP addresses Specifies a list of IP addresses for routers on the cli-
ent's subnet. Routers should be listed in order of
preference.
WWW proxy server 252 URL This option is used to automatically configure proxy
settings for the client's browser. Type in the URL of
the server that stores the information.
NetWare Client Options

Table E.11. NetWare client options
Nds-context 87 text Specifies the initial NDS context the client should use.
1205
DHCP Options

Nds-servers 85 IP address Specifies one or more NDS servers for the client to
contact for access to the NDS database. Servers
should be listed in order of preference.
Nds-tree-name 86 name Specifies the initial NDS context the client should use.
Nwip-domain 62 name This option code is used to convey the NetWare/IP
domain name used by the NetWare/IP product.
Slp-directory-agent 78 address IP Specifies the location of one or more SLP Directory
Agents.
Slp-service-scope 79 scope Indicates the scopes that a SLP Agent is configured
to use.
NIS/NISplus Options
Table E.12. NIS/NISplus options
Nis-domain 40 name Specifies the name of the client's NIS domain. The
domain is formatted as a character string consisting
of characters from the NVT ASCII character set.
Nis-servers 41 list of IP addresses Lists the IP of NIS servers available for the client. The
servers can be sorted by order of preference.
Nis-plus-domain 64 name Specifies the name of the client's NIS+ domain. The
domain is formatted as a character string consisting
of characters from the NVT ASCII character set.
Nis-plus-servers 65 list of IP addresses Specifies a list of IP addresses indicating NIS+ servers
available to the client. Servers should be listed in or-
der of preference.
Autoretries 8 provided by the vendor This option specifies a list of Quote of the Day servers
available to the client. The servers SHOULD be listed
in order of preference.
Autoretry secs 9 provided by the vendor This option specifies a list of LPR servers available
to the client. The servers SHOULD be listed in order
of preference.
Nearest nwip server 7 provided by the vendor This option specifies a list of MIT-LCS UDP servers
Nsq broadcast 5 provided by the vendor This option specifies a list of Name servers available
of preference.
Nwip 1 1 10 provided by the vendor This option specifies a list of Imagen Impress servers
Preferred dss 6 provided by the vendor This option specifies a list of DNS servers available
of preference.
Primary dss 11 provided by the vendor This option specifies a list of RLP servers available
of preference.
1206
DHCP Options
Miscellaneous
Table E.13. Other DHCP options
Domain search 119 list of domains DNS domain search list.

IETF website at https://tools.ietf.org/html/rfc3397.
Name service search 117 Name Service Search.
Vendor MSFT Options

Table E.14. Vendor MSFT options
Default routers TTL 3 list of IP addresses This option specifies a list of 32 bit IP addresses for
routers on the client's subnet. The routers SHOULD
be listed in order of preference.
Disable netbios 1 provided by the vendor The subnet mask for the network segment to which
the client is connected.
Release on shutdown 2 provided by the vendor This option specifies the offset of the client's subnet
in seconds from Coordinated Universal Time (UTC).
Vendor Nwip Options

Table E.15. Vendor Nwip options
Autoretries 8 provided by the vendor This option specifies a list of Quote of the Day servers
Autoretry secs 9 provided by the vendor This option specifies a list of LPR servers available
of preference.
Nearest nwip server 7 provided by the vendor This option specifies a list of MIT-LCS UDP servers
Nsq broadcast 5 provided by the vendor This option specifies a list of Name servers available
of preference.
Nwip 1 1 10 provided by the vendor This option specifies a list of Imagen Impress servers
Preferred dss 6 provided by the vendor This option specifies a list of DNS servers available
of preference.
Primary dss 11 provided by the vendor This option specifies a list of RLP servers available
of preference.
1207
Appendix F. MAC Address Types
References
This appendix lists all the MAC address types used in SOLIDserver that you can display on the
page DHCP All statics both in IPv4 and IPv6. There is a set of 31 different types of MAC addresses
that you can specify when adding or editing DHCP statics. Each type corresponds to a protocol
that has been assigned a reference number defined in the IANA Address Resolution Protocol
(ARP). In the GUI, this reference adds an extra byte at the beginning of the MAC addresses listed
in the column MAC address on the page All statics. Typically, the MAC addresses listed in this
column look as follows: <1_byte_MAC_type_reference>:<6_bytes_MAC_address>.
The different types of MAC addresses can be listed separately from the MAC address itself using
the DHCP static MAC type column. This column displays two columns: the column MAC type
that displays the MAC type code (except for Ethernet that is listed in full letters) and the column
MAC address that displays the MAC address in its traditional format.
Note that every reference is listed in hexadecimal form in the wizard. Therefore, the ARP
parameter 10 (for Autonet) is listed as 0a and so forth.
Table F.1. Supported MAC address types references

MAC type Reference
Unknown You can use any hexadecimal reference number, as long as it is not already
listed below.
Ethernet 01
Experimental ethernet 02
Amateur radio AX25 03
Proteon ProNET Token Ring 04
Chaos 05
Token Ring 06
ARCNET 07
FDDI 08
Lanstar 09
Autonet 0a
LocalTalk 0b
LocalNet 0c
Ultralink 0d
SMDS 0e
Frame Relay 0f
ATM 15
HDLC 11
Fibre Channel 12
Serial Line 14
MIL-STD-188-220 16
Metricom 17
IEEE 1394.1995 18
MAPOS 19
1208
MAC Address Types References
MAC type Reference

Twin Axial 1a
EUI-64 1b
HIPARP 1c
IP/ARP over ISO 7816-3 1d
ARPSec 1e
IPSec tunnel 1f
InfiniBand 20
1209
Appendix G. DNS Resource Records
Related Fields
This appendix provides a record per record description of the different fields to configure when
adding a resource record to a master zone. For more details regarding each record, refer to the
section Adding Resource Records.
To add a resource record to a zone
3. In the column Zone, click on the name of the zone of your choice to display its records.
5. In the drop-down list RR type, select the record of your choice.
6. Set the RR Name and TTL according to your needs.
7. Configure the record fields following the table DNS resources records configuration fields.
Note that all the records supported are not supported by all DNS servers. For more details, refer
to the section Adding Resource Records.
Table G.1. DNS resources records configuration fields

RR type Related field(s) Description
A IP address The IPv4 Address of the host.
AAAA IPv6 address The IPv6 Address of the host.
AFSDB Preference The version of AFS service used: 1 (AFS version 3.0) or 2 (OSF
DCE/NCA version).
AFS server The AFS hostname.
CAA Flags An integer, between 0 and 255, that influences the interpretation of
the record. 0 means that the record is not critical.
Property identifier The CAA record tag, including but not limited to:
issue authorizes a single certificate authority to issue a certificate
of any type for the hostname.
issuewild authorizes a single certificate authority to issue a wildcard
certificate for the hostname.
iodef specifies the URL to which a certificate authority may report
policy violations.
Value The domain of the CA associated with the tag or a URL, depending
on the tag specified in the Property identifier.
CERT Type An integer 0 and 65535 that specifies the type of certificate where
1 is PKIX, 2 is SPKI, 3 is PGP, 4 is IPKIX, 5 is ISPKI, 6 is IPGP, 7
is ACPKIX, 8 is IACPKIX, 253 is URI and 254 is OID.
Key tag The certificate's key tag, a 16-bit value computed for the key embed-
ded in the certificate.
Algorithm The public key's cryptographic algorithm.
Certificate or CRL The certificate, encoded in base-64 format.
1210
DNS Resource Records Related
Fields

The record CERT is described in RFC 4398 available at https://tools.ietf.org/html/rfc4398.
CNAME Hostname The hostname.
DHCID Key The encoded DHCP client identifier (DUID) in a binary format, en-
coded in base-64.
For more details, refer to the section 3 of RFC 4701, available at ht-
tps://tools.ietf.org/html/rfc4701#section-3.
DNAME Domain The name of a subdomain of the zone.
HINFO CPU Select the CPU description in the drop-down list. If yours is not listed,
type it in the field and let the default value in the list (Other).
OS Select the OS in the drop-down list. If yours is not listed, type it in
the field and let the default value in the list (Other).
MINFO Responsible email The email address of the administrator of the mail list.
Error email The email address that should receive the error messages regarding
the mail list.
MX Preference An integer, between 0 and 65535, that defines which server has
priority if there are several records in the zone. The lowest the value
has the priority over the other server(s).
Mail server The mail server hostname.
The accepted configuration of MX and NS records is detailed in the section 10.3 of RFC
2181, available at http://tools.ietf.org/html/rfc2181.
NAPTR Order An integer, between 0 and 65535, that defines which RR has priority
if there are several NAPTR records in the zone. The lowest the
value has the priority over the other record(s).
Preference An integer, between 0 and 65535, that defines which RR has priority
if there are several NAPTR records have the same order in the
zone. The lowest the value has the priority over the other record(s).
Flags The string that corresponds to the action you want your client applic-
ation to perform. The flag specified impacts the data expected in
the field Services, Regex and/or Replace.
Services The services parameters to which applies the action specified in
the field Flags. You must respect your client application syntax.
Regex The string that contains a substitution expression matching the
format <delimit ereg delimit substitution delimit flag> to which applies
the action specified the field Flags.
Replace An FQDN domain name to which applies the action specified the
field Flags. You can specify no domain name if you type in . (dot)
in the field.
The record NAPTR is described in RFC 3403, available at http://tools.ietf.org/html/rfc3403.
NS DNS server The DNS server hostname.
The accepted configuration of MX and NS records is detailed in the section 10.3 of RFC
2181, available at http://tools.ietf.org/html/rfc2181.
NSAP Name The NSAP address of the end system. It should start with 0x and
not exceed 255 hexadecimal characters separated by dots.
The NSAP RR is described in the RFC 1706, available at http://tools.ietf.org/html/rfc1706.
OPENPGPKEY Key The OpenPGP public key, without the last line. The last line is pre-
ceded by the character =.
The record OPENPGPKEY is described in RFC 7629, available at ht-
tps://tools.ietf.org/html/rfc7929.
PTR Localization The hostname that should be returned when the address is queried.
1211
Fields

SSHFP Algorithm An integer that identifies the algorithm used by the Public Key: 1
(RSA), 2 (DSA), 3 (ECDSA) or 4 (Ed25519).
Type An integer that identifies the type of fingerprint used: 1 (SHA-1) or
2 (SHA-256).
Fingerprint An hexadecimal string representing the hash result.
SRV Priority An integer, between 0 and 65535, that defines which server has
priority if there are several SRV records in the zone. The lowest the
value has the priority over the other server(s).
Weight An integer, between 0 and 65535, that defines the server weight.
If two SRV records have the same priority, the weight defines which
one is more used. The field gives priority to the SRV RR with the
greatest weight value: the greater the value is, the more the server
is solicited. If you type in 0, there is no weighting.
Ports The port number that delivers the service to the target.
Target The hostname of the server delivering the service.
TXT Text The description of your choice (max. 255 characters including
spaces).
TLSA Certificate Usage The association data provided to match the certificate presented in
the TLS handshake. It is identified via an integer, between 0 and
255, among them:
1 specifies an end entity certificate, or the public key the certificate.
It must be matched with the end entity certificate given by the
server in TLS.
2 specifies a certificate, or the public key the certificate. It must be
used as the Trust anchor when validating the end entity certificate
given by the server in TLS.
3 specifies a certificate, or the public key the certificate. It must
match the end entity certificate given by the server in TLS.
Selector The part of the TLS certificate that the server presents to compare
with the association data, where 0 is the Full certificate and 1 is the
SubjectPublicKeyInfo.
Matching Type The way the association data is presented, where 0 is the Exact
match on selected content, 1 is an SHA-256 hash of selected content
and 2 is an SHA-512 hash of selected content.
Certificate Associ- The certificate association data to be matched. The expected value
ation Date in the field is a string of hexadecimal characters, it can include
spaces.
The record TLSA is described in RFC 6698, available at https://tools.ietf.org/html/rfc6698.
URI Priority An integer, between 0 and 65535, that defines which target URI
has priority if there are several URI records in the zone. The lowest
value has the priority over the other URI.
Weight An integer, between 0 and 65535, that defines the target URI weight.
If two URI records have the same priority, the weight defines which
one is more used. The field gives priority to the URI record with the
greatest weight value: the greater the value is, the more the URI is
solicited. If you type in 0, there is no weighting.
Target The targeted URI, specified using the syntax described in the
RFC3986.
The record URI is described in RFC 3986, available at http://tools.ietf.org/html/rfc3986.
WKS IP address The IPv4 Address of the host that contains the services listed in the
Services field.
Protocol The protocol that suites your needs.
1212
Fields

Services The list of needed services.
DNSSEC records
CDNSKEY Flags The zone key flag.
Protocol The protocol value.
Key The public key material.
The records CDNSKEY is described in RFC 7344, available at ht-
tp://tools.ietf.org/html/rfc7344.
CDS Key Tag The key tag of the DS record of the zone used in the delegation.
Key Algorithm The algorithm key of the DS record of the zone used in the delega-
tion.
Digest Type The digest type of the DS record of the zone used in the delegation.
Digest The digest of the DS record of the zone used in the delegation.
The records CDS is described in RFC 7344, available at http://tools.ietf.org/html/rfc7344.
DNSKEY Flags The zone key flag.
Protocol The protocol value.
Key The public key material.
DS Key Tag The child zone DS key tag.
Key Algorithm The child zone DS algorithm key.
Digest Type The child zone DS digest type.
Digest The child zone DS digest.
1213
DNS IPAM DHCP
DHCP properties DNS properties IPAM properties
DNS IPAM properties DHCP
SPACE DHCP cluster: failover-dhcp1.mycorp.com DNS server: ns1.mycorp.com Push leases
SERVER Update IPAM: yes SERVER
America Update DNS: yes to IPAM: yes
ns1.mycorp.com dhcp1.mycorp.com
DHCP properties DNS properties

VIEW NETWORK Use Address and Prefix Default domain: lab.mycorp.com
BLOCK USA as shared network: yes DNS server for reverse zone: ns1.mycorp.com
intranet 10.6.0.0/15 DNS view for reverse zone: intranet
NEW NEW SCOPE

REVERSE NEW NETWORK SUBNET NEW NETWORK SUBNET Name: New York IPAM properties
NETWORK IPAM properties
ZONE ZONE ZONE 10.6.0.0/24 Gateway offset: -1 Name: New York 10.6.0.0/24 SCOPE Use client name
Name: Name: New York SUBNET 10.6.0.0/24 DHCP option (FQDN): yes
0.6.10.in-addr.arpa Routers: 10.6.0.254
lab.mycorp.com
DHCP properties NEW POOL NEW RANGE

POOL Create DHCP range: yes Name: Manhattan Name: NEW
1214
10.6.0.1-10.6.0.50 10.6.0.1-10.6.0.50 RANGE
NEW RECORD
Type: A NEW IP ADDRESS NEW LEASE
IP address: NEW IP ADDRESS Address: 10.6.0.42 NEW
Address: 10.6.0.42 ADDRESS Address: 10.6.0.42. MAC: ab:ba:12:34:ab:ba
RECORD 10.6.0.42 MAC: ab:ba:12:34:ab:ba Name: client.mycorp.com LEASE
Name: client.mycorp.com
Name: Name: client.mycorp.com
client.mycorp.com
DHCP properties NEW IP ADDRESS

Create DHCP static Address: 10.6.0.100 NEW
NEW
ADDRESS STATIC
MAC address: be:ef:00:00:be:ef STATIC
DNS properties 10.6.0.100
be:ef:00:00:be:ef IPAM advanced properties
Enable the automatic construction of the IP Push leases to IPAM: yes
address hostname: shortname.domain Use client name (FQDN): yes
NEW
DHCP advanced properties
RECORD IP ADDRESS ADDRESS DHCP cluster: failover-dhcp1.mycorp.com
Figure H.1. All the advanced properties

NEW RECORD IP Address: Use Address and Prefix as shared network: yes
Type: A 10.6.0.142 Create DHCP range: yes
IP: 10.6.0.142. RR name: pc2 DNS advanced properties
Name: DHCP advanced properties DNS server: ns1.mycorp.com
Complete name: pc2.lab.mycorp.com pc2.lab.mycorp.com DHCP cluster: failover-dhcp1.mycorp.com Default domain: lab.mycorp.com
Use Address and Prefix as shared network: yes DNS server for reverse zone: ns1.mycorp.com
Create DHCP range: yes DNS view for reverse zone: intranet
IPAM advanced properties Create DHCP static: yes Update DNS: yes
Update IPAM: yes DNS advanced properties
DNS server: ns1.mycorp.com IPAM advanced properties
Default domain: lab.mycorp.com Gateway offset: -1
DNS server for reverse zone: ns1.mycorp.com
DNS view for reverse zone: intranet
Enable the automatic construction...: yes
Update DNS: yes
IPAM advanced properties
Gateway offset: -1
Appendix H. Advanced Properties
Appendix I. User Tracking Services Filter
This appendix provides a list of the available filters of the drop-down list Services on the page
User Tracking. For more details regarding this page, refer to the section Tracking Users.
Table I.1. The available filters of the drop-down list Services

Service Description
DHCP All the DHCP services
DHCP server All the DHCP server related operations
Add: DHCP servers All the DHCP server additions and editions
Add: DHCPv6 servers All the DHCPv6 server additions and editions
Delete: DHCP servers All the DHCP server deletions
Delete: DHCPv6 servers All the DHCP server deletions
DHCP scope All the DHCP scope related operations
Add: DHCP scopes All the DHCP scope additions and editions
Add: DHCPv6 scopes All the DHCPv6 scope additions and editions
Delete: DHCP scopes All the DHCP scope deletions
Delete: DHCPv6 scopes All the DHCPv6 scope deletions
DHCP range All the DHCP range related operations
Add: DHCP ranges All the DHCP range additions and editions
Add: DHCPv6 ranges All the DHCPv6 range additions and editions
Delete: DHCP ranges All the DHCP range deletions
Delete: DHCPv6 ranges All the DHCPv6 range deletions
DHCP static All the DHCP static related operations
Add: DHCP static All the DHCP static additions and editions
Add: DHCPv6 static All the DHCPv6 static additions and editions
Delete: DHCP statics All the DHCP static deletions
Delete: DHCPv6 statics All the DHCPv6 static deletions
DHCP option All the DHCP option related operations
Add: DHCP options All the DHCP option additions and editions
Add: DHCPv6 options All the DHCPv6 option additions and editions
Delete: DHCP options All the DHCP option deletions
Delete: DHCPv6 options All the DHCPv6 option deletions
IPAM All the IPAM services
Space All the IP space related operations
Add: spaces All the IP space additions and editions
Delete: spaces All the IP space deletions
Network All the network related operations
Add: IPv4 networks All the IPv4 network additions and editions
Add: IPv6 networks All the IPv6 network additions and editions
Delete: IPv4 networks All the IPv4 network deletions
Delete: IPv6 networks All the IPv6 network deletions
Pool All the pool related operations
Add: IPv4 pools All the IPv4 pool additions and editions
1215
User Tracking Services Filter
Service Description
Add: IPv6 pools All the IPv6 pool additions and editions
Delete: IPv4 pools All the IPv4 pool deletions
Delete: IPv6 pools All the IPv6 pool deletions
Address All the IP address related operations
Add: IPv4 addresses All the IPv4 address additions and editions
Add: IPv6 addresses All the IPv6 address additions and editions
Delete: IPv4 addresses All the IPv4 address deletions
Delete: IPv6 addresses All the IPv6 address deletions
Alias All the aliases related operations
Add: aliases to IPv4 addresses All the IPv4 alias additions and editions
Add: aliases to IPv6 addresses All the IPv6 alias additions and editions
Delete: Pv4 addresses aliases All the IPv4 alias deletions
Delete: IPv6 addresses aliases All the IPv6 alias deletions
DNS All the DNS services
DNS server All the DNS server related operations
Add: DNS servers All the DNS server additions and editions
Delete: DNS servers All the DNS server deletions
DNS zone All the DNS zone related operations
Add: DNS zones All the DNS zone additions and editions
Delete: DNS zones All the DNS zone deletions
DNS RR All the DNS record related operations
Add: DNS RRs All the DNS record additions and editions
Delete: DNS RRs All the DNS record deletions
NetChange All the NetChange related operations
Network device All the network device related operations
Add: network devices All the network device additions
Edit: network devices All the network device editions
Delete: network devices All the network device deletions
Edit: ports properties All the port property editions
VLAN All the VLAN related operations
Add: VLANs All the VLAN additions
Delete: VLANs All the VLAN deletions
Add: a VLAN to a port All the additions of VLAN to a port
Delete: a VLAN from a port All the deletions of VLAN from a port
Rule All the rule related operations
Add: rules All the rule additions and editions
Delete: rules All the rule deletions
Group All the group of users related operations
Add: groups All the group of users additions and editions
Delete: groups All the group deletions
Users Add: user as group resource All the additions of users as resource of a group
Users Remove: user from group resource All the deletions of users from the resources of a group
User All the users related operations
1216
User Tracking Services Filter
Service Description
Users Add: users All the user additions and editions
Users Delete: users All the user deletions
System All the system related operations
Install: Packages All the operations related to package installation
Uninstall: Packages All the operations related to package uninstallation
Generate: SSL certificates All the operations related to SSL certificates generation
Delete: files uploaded to Local Files Listing All the operations related to the deletion of files uploaded to Local
Files Listing
Upload: files to Local Files Listing All the operations related to the upload of files to Local Files Listing
Edit: Remote archive All the remote archive editions
Class All the Class Studio related operations
Add: classes All the class additions and editions
Delete: classes All the class deletions
Gadgets All the gadgets related operations
Add: gadgets to dashboards All the additions of gadgets to dashboards
Delete: gadgets from dashboards All the deletions of gadgets from dashboards
Bookmarks All the bookmarks related operations
Add: bookmarks All the bookmark additions and editions
Delete: bookmarks All the bookmark deletions
Alert Definition All the alert definition related operations
Add: alert definitions All the alert definition additions and editions
Delete: alert definitions All the alert definition deletions
Workflow All the workflow related operations
Add: requests All the request additions and editions
Delete: requests All the request deletions
1217
Appendix J. Class Studio Pre-defined
Variables
This appendix provides a list of the available Class Studio pre-defined variables. For more details
regarding the addition details, refer to the Configuring Classes section Pre-defined variable.
Table J.1. Predefined Variables Classes

Name The variable must be used in
USER_SOURCE_TYPE Rights & delegation user classes.
USER_HIDE_PARAM Rights & delegation user classes.
IP_MANDATORY_MAC_ADDR IPAM address and address (v6) classes.
IP_NOT_EDITABLE_MAC_ADDR IPAM address and address (v6) classes.
DHCP_STATIC_NOT_EDITABLE_MAC_ADDR DHCP static and DHCPv6 static classes.
WORKFLOW_REQUEST_HIDE_ACTION Workflow request classes.
WORKFLOW_REQUEST_HIDE_ATTACH_TO Workflow request classes.
WORKFLOW_ADD_TICKET_SPACE IPAM space classes.
WORKFLOW_ADD_TICKET_BLOCK IPAM block-type network classes, IPv4 only.
WORKFLOW_ADD_TICKET_SUBNET IPAM subnet-type network classes, IPv4 only.
WORKFLOW_ADD_TICKET_POOL IPAM pool classes, IPv4 only.
WORKFLOW_ADD_TICKET_ADDRESS IPAM address classes, IPv4 only.
WORKFLOW_ADD_TICKET_DNSZONE DNS zones classes.
FORCE_SUBNET_PREFIX IPAM subnet-type network classes, in IPv4 and IPv6.
HIDE_IP_ALIAS IPAM address classes, in IPv4 and IPv6.
HOSTDEV_IS_SWITCH Device Manage device classes.
NO_SPACE_FATHER_VLSM IPAM space classes.
NO_VLSM_SUBNET IPAM subnet-type network classes, in IPv4 and IPv6.
BLOCK_TYPE IPAM block-type network classes, IPv4 only.
To properly configure the pre-defined variables value and understand the purpose of each one
of them, follow the description below.
USER_SOURCE_TYPE
This variable allows to specify the user source.
Value: local, param, pam or rule.

USER_HIDE_PARAM
This variable allows to create users using only a login (through the field usr login). On the
user addition wizard, the Password, Confirm password, Email, Login URL and field Maintainer
groups are hidden.
Value: 1 (one) to enable the variable. Leave the field empty to disable it.
IP_MANDATORY_MAC_ADDR
This variable allows to make the MAC address field required in the IPv4 and IPv6 address
1218
Class Studio Pre-defined Variables
IP_NOT_EDITABLE_MAC_ADDR
This variable allows to prevent users from editing the MAC address field in the IPv4 and IPv6
address addition and edition wizards.
DHCP_STATIC_NOT_EDITABLE_MAC_ADDR
This variable allows to prevent users from editing the MAC address field in the DHCP static
WORKFLOW_REQUEST_HIDE_ACTION
This variable allows to hide the Action requested field in the Workflow outgoing requests
addition wizard.
WORKFLOW_REQUEST_HIDE_ATTACH_TO
This variable allows to hide the Attach to drop-down list in the Workflow outgoing requests
addition wizard.
WORKFLOW_ADD_TICKET_SPACE
This variable allows to associate a Workflow request with a space directly from the addition/edi-
tion wizard in the IPAM.
WORKFLOW_ADD_TICKET_BLOCK
This variable allows to associate a Workflow request with a block-type network directly from
the addition/edition wizard in the IPAM.
WORKFLOW_ADD_TICKET_SUBNET
This variable allows to associate a Workflow ticket with a subnet-type network directly from
the addition/edition wizard in the IPAM.
WORKFLOW_ADD_TICKET_POOL
This variable allows to associate a Workflow ticket with a pool directly from the addition/edition
wizard in the IPAM.
WORKFLOW_ADD_TICKET_ADDRESS
This variable allows to associate a Workflow ticket with an IP address directly from the addi-
tion/edition wizard in the IPAM.
WORKFLOW_ADD_TICKET_DNSZONE
This variable allows to associate a Workflow ticket with a zone directly from the addition/edition
wizard in the DNS.
1219
Class Studio Pre-defined Variables
FORCE_SUBNET_PREFIX
This variable allows to force the value of a terminal network prefix in the addition wizard. For
more details, refer to the section Force prefix.
Value: the prefix of your choice following the format <number>. Leave the field empty to
disable the variable.
VLSM Specificity: if you set this variable on a non-terminal subnet-type network, it only applies
to the non-terminal subnet-type network itself, it does not apply to the networks it contains.
HIDE_IP_ALIAS
This variable allows to hide the Aliases configuration page in the IP address addition wizard.
For more details, refer to the section Configuring and Managing IP Address Aliases.
HOSTDEV_IS_SWITCH
This variable allows to specify that a device is a switch in the module Device manager.
NO_SPACE_FATHER_VLSM
This variable allows to prevent a space from being affiliated with a parent space in the space
addition wizard.
NO_VLSM_SUBNET
This variable allows to prevent users from setting a terminal network as non-terminal in the
network addition wizard. The box Terminal network is hidden.
BLOCK_TYPE
This variable allows to set manually the start and end address of a block-type network, like
you are able to when creating DHCP ranges or IPAM pools.
Value: range to enable the variable. Leave the field empty to disable it.
1220
Appendix K. Configuring RADIUS
Table of Contents
Configuring FreeRadius ............................................................................................... 1221
Configuring RADIUS with Cisco ACS ............................................................................ 1222
Configuring OneTime Password with Token Authentication ............................................. 1223
Configuring FreeRadius
If you intend to authenticate users via RADIUS, you can configure FreeRadius to retrieve your
groups of users. Once FreeRadius is configured, do not forget to add the RADIUS users authen-
tication rule as detailed in the section Relying on RADIUS Authentication.
Configuring the RADIUS Server

To start with, your RADIUS server must be configured with the following information:
• The addresses of the SOLIDserver appliance (the RADIUS 'clients') that might connect to it.
• The EfficientIP vendor number: 2440.
• The dictionary efficientip, it must be configured to send back the following attributes:
Table K.1. Efficientip dictionary: attributes to be returned

Attribute Code Type
efficientip-version 1 integer
efficientip-service-class 2 integer
efficientip-identity-type 3 integer
efficientip-first-name 16 string
efficientip-last-name 17 string
efficientip-pseudonym 18 string
efficientip-ip-host 19 string
efficientip-email 20 string
efficientip-first-login-path 32 string
efficientip-maintainer-group 33 string
efficientip-groups 34 string
efficientip-admin-group 35 string
efficientip-extra-blob 64 string
Configuring a FreeRadius server with SOLIDserver

To send group of users to SOLIDserver and complete the configuration, your FreeRadius server
needs three files: dictionary.efficientip, clients.conf and users.
These files should at least contain the following information:
1221
Configuring RADIUS
dictionary.efficientip
#Dictionnary for efficientip
VENDOR efficientip 2440
BEGIN-VENDOR efficientip
ATTRIBUTE efficientip-version 1 integer

ATTRIBUTE efficientip-service-class 2 integer
ATTRIBUTE efficientip-identity-type 3 integer
ATTRIBUTE efficientip-first-name 16 string
ATTRIBUTE efficientip-last-name 17 string
ATTRIBUTE efficientip-pseudonym 18 string
ATTRIBUTE efficientip-ip-host 19 string
ATTRIBUTE efficientip-email 20 string
ATTRIBUTE efficientip-first-login-path 32 string
ATTRIBUTE efficientip-maintainer-group 33 string
ATTRIBUTE efficientip-groups 34 string
ATTRIBUTE efficientip-admin-group 35 string
ATTRIBUTE efficientip-extra-blob 64 string
END-VENDOR efficientip
clients.conf
client SDS-1000 {
ipaddr = 192.168.100.100
secret = abc123
}
users
localuser Cleartext-Password := "Password123"
efficientip-groups = "mygroup",
Configuring RADIUS with Cisco ACS

SOLIDserver allows to configure the RADIUS authentication rule to authenticate users against
a Cisco Secure Access Control Server (ACS). To do so, define the EfficientIP RADIUS vendor
and VSA set in a RADIUS vendor/VSA import file named efficientip.ini, then follow the procedure
below.
To configure Cisco ACS with RADIUS
1. On the computer running ACS, open an MS-DOS command prompt.

2. Change directories until you get to the directory containing the file CSUtil.exe. For more
details regarding its location, refer to the Cisco ACS documentation.
3. Once you are in the right directory, execute the command below:
CSUtil.exe -addUDV 5 efficientip.ini
In this command, the number 5 is an unused ACS RADIUS vendor slot number and efficien-
tip.ini is the name of the EfficientIP RADIUS vendor/VSA import file you created earlier.
4. Press Enter. A CSUtil.exe confirmation prompt appears.
5. Confirm that you want to add the RADIUS vendor and halt all ACS services during the pro-
cess, type in Y and press Enter. CSUtil.exe halts ACS services, parses the vendor/VSA input
file, and adds the new RADIUS vendor and VSAs to ACS. This process may take a few
minutes. After it is complete, CSUtil.exe restarts ACS services.
Example of an import file "efficientip.ini" for RADIUS vendor/VSA where EfficientIP is set
as a vendor and 2440 is the IETF code number:
1222
Configuring RADIUS
[User Defined Vendor] Name=EfficientIP IETF Code=2440

VSA 1=efficientip-version
VSA 2=efficientip-service-class
VSA 3=efficientip-identity-type
VSA 16=efficientip-first-name
VSA 17=efficientip-last-name
VSA 18=efficientip-pseudonym
VSA 19=efficientip-ip-host
VSA 20=efficientip-email
VSA 32=efficientip-first-login-path
VSA 33=efficientip-maintainer-group
VSA 34=efficientip-groups
VSA 35=efficientip-admin-group
VSA 64=efficientip-extra-blob
[efficientip-version]
Type=INTEGER
Profile=OUT
[efficientip-service-class]
Type=INTEGER
Profile=OUT
[efficientip-identity-type]
Type=INTEGER
Profile=OUT
[efficientip-first-name]
Type=STRING
Profile=OUT
[efficientip-last-name]
Type=STRING
Profile=OUT
[efficientip-pseudonym]
Type=STRING
Profile=OUT
[efficientip-ip-host]
Type=STRING
Profile=OUT
[efficientip-email]
Type=STRING
Profile=OUT
[efficientip-first-login-path]
Type=STRING
Profile=OUT
[efficientip-maintainer-group]
Type=STRING
Profile=OUT
[efficientip-groups]
Type=STRING
Profile=MULTI OUT
[efficientip-admin-group]
Type=STRING
Profile=OUT
[efficientip-extra-blob]
Type=STRING
Profile=OUT
Configuring OneTime Password with Token Authentication

You can set up OneTime Password (OTP) based on a token authentication to secure user ses-
sions. OTP associates a user session with a unique password valid for a limited period of time.
1223
Configuring RADIUS
SOLIDserver caches the credentials to authenticate every user operation. When the cache expires,
SOLIDserver uses the cached credentials to generate and send a new authentication request to
the RADIUS server. If this request fails, the user is disconnected.
To control when the client is disconnected, a set of registry database entries allow to define for
how long SOLIDserver should cache the data:
1. You can either define for how long SOLIDserver should cache passwords, as detailed in the
section Caching OTP Credentials For a Certain Time.
2. Or you can make sure that the cache does not expire while the user is active, as detailed in
the section Renewing Cached OTP Credentials for Logged Users.
Prerequisites
• Configuring RADIUS authentication rule. For more details, refer to the section Relying on RA-
DIUS Authentication.
• Belonging to a group admin, the only group that can access to the page Registry database.
Caching OTP Credentials For a Certain Time

Once you met the prerequisites, you can configure a registry database key to define for how long
SOLIDserver should cache your OTP credentials. To ensure that the user is not disconnected
while SOLIDserver is still open, we recommend that you also configure the key that determines
the duration of SOLIDserver user sessions.
If you would rather edit one key and ensure your users are not disconnected while their session
is active, refer to the section Renewing Cached OTP Credentials for Logged Users.
To define for how long passwords should be cached
1. Adding the registry key that defines for how long OTP credentials are cached

opens.
opens.
d. In the field Name, type in ipmserver.login.password_cache_time .
e. In the field Value, type in the value of your choice, in seconds. The recommended value
is 900.
and the new key is listed.
2. Editing the key that sets SOLIDserver user session time
a. In the search engine of the column Name, type in www.login.session_timeout. Only this
key is listed.
b. In the column Value, click on the value listed. The wizard Registry database Edit a value
opens.
1224
Configuring RADIUS
c. In the field Value, type in the value of your choice, in seconds. It should be shorter than
the value set for the key ipmserver.login.password_cache_time to ensure the user OTP
credentials do not expire before SOLIDserver session ends.
d. Click on OK to commit your changes. The report opens and closes. The page refreshes
Renewing Cached OTP Credentials for Logged Users

Once you met the prerequisites, you can add the registry database key that ensures that logged
users authenticated using OTP are not disconnected while their SOLIDserver session is running.
This key renews cached credentials as long as the user is active.
To edit the registry key that renews cached credentials while the session is active

opens.
4. In the field Name, type in ipmserver.login.password_cache_time_renew .
5. In the field Value, type in 1 to enable the protection of OTP authenticated .
the new key is listed.
1225
Appendix L. Using Remote
Authentication for SSH Connections to
SOLIDserver
Table of Contents
Configuring LDAP Authentication for SSH Connections .................................................. 1226
Configuring RADIUS Authentication for SSH Connections .............................................. 1231
EfficientIP allows to configure SOLIDserver to use LDAP authentication for Secure Shell connec-
tions. This configuration allows to grant existing LDAP users access to as many SOLIDserver
appliances as you want.
Configuring LDAP Authentication for SSH Connections

To configure the LDAP authentication for SSH connections to SOLIDserver, you must:
1. Understand the Specificities and Prerequisites.

2. Edit the LDAP configuration file. For more details, refer to the section Editing the LDAP Con-
figuration File.
3. Edit the Name Service Switch configuration file. For more details, refer to the section Editing
the Name Service Switch Configuration File.
4. Edit the PAM configuration for SSH daemon. For more details, refer to the section Editing the
PAM Configuration for SSH Daemon.
5. If you use an SSL certificate self-signed by Windows, you must also edit the LDAP communic-
ation settings. For more details, refer to the section Editing the LDAP Communication Settings.
Prerequisites
• An LDAP server properly configured and running.
• The LDAP server and SOLIDserver must be set at the same time.
• Make sure the LDAP server is on time.
• Configure the NTP server on SOLIDserver. If you want the LDAP authentication for several
SOLIDserver appliances, the NTP must be configured on every appliance. For more details,
refer to the section Configuring the NTP Server.
• To set up the LDAP authentication for several appliances, you must:
1. Configure the authentication from the managing SOLIDserver.
2. Once the configuration is complete, apply it the remote appliance(s).
Specificities
The configuration of LDAP authentication for SSH connections:
1226
Using Remote Authentication for
SSH Connections to SOLIDserver
• Must be done from the CLI.

• Must be done locally from a SOLIDserver management appliance. When the configuration is
complete:
• You can apply it to the remote SOLIDserver appliance(s) you manage.
• It automatically applies to the Hot Standby, if your SOLIDserver is configured with High
Availability.
• Allows to grant access to SOLIDserver to existing LDAP users, there is no need to edit
SOLIDserver local user or group of users database. That way, if your LDAP server is not re-
sponding, local users with sufficient rights can still access the appliance via SSH.
Editing the LDAP Configuration File

You must first edit the LDAP configuration file to specify the class of users you want to grant SSH
access to. During that edition you must also define the type of permissions you grant to the users
of the class specified.
To edit the file ldap.conf
1. Open a shell session.

2. Connect to a SOLIDserver management appliance using the credentials of the account admin.
3. Edit the file /data1/etc/ldap.conf using the following command:
% emacs /data1/etc/ldap.conf
The edited file should include the following:

# Specify the FQDN or IP address of the LDAP server.
host <IP-address-or-hostname>
# Set the base search that suits your needs: cn=BaseSearch, dc=EXAMPLE, dc=COM.
base <your-base-search>
# Set an existing user among the following: cn=admin, cn=BaseSearch, dc=EXAMPLE, dc=COM.
# This parameter cannot be empty otherwise you will not be able to list users.
rootbinddn <user>
# Enable LDAPS if need be. Valid values: on, off.

ssl <status>
# Specify for the following attributes the name of the LDAP user class that can access SOLIDserver.
pam_filter objectclass=<userclass>
nss_map_objectclass posixAccount <userclass>
# Specify for the following attributes the name of the attribute of the selected user class
# that contains the user login.
pam_login_attribute <login-attribute>
nss_map_attribute uid <login-attribute>
# If the specified user class is not already set with the attributes: uidNumber, gidNumber,
# loginShell, homeDirectory.
# You must specify for the following attributes the name of the attribute of the selected user
# class that contains the users uidNumber and gidNumber.
nss_map_attribute uidNumber <UnixUID-attribute>
nss_map_attribute gidNumber <UnixGID-attribute>
# You can specify for the following attributes the name of the attribute of the selected user
# that contains the loginShell and homeDirectory used to connect to your appliance.
# These attributes are optional, so if you do not want to set them either comment the lines or
# do not include them at all. These attributes cannot be declared without value.
nss_map_attribute loginShell <attribute-containing-the-shell-you-connect-to>
nss_map_attribute homeDirectory <attribute-containing-the-path-to-the-directory-"home">
# Set the level of permissions of the LDAP users accessing SOLIDserver via SSH.
# If you set the value of the example below, you grant administrative rights to all the users
# belonging to the classes specified with "pam_filter" and "nss_map_objectclass".
nss_override_attribute_value uidNumber 1001
nss_override_attribute_value gidNumber 1000
1227
nss_override_attribute_value homeDirectory /data1/users/admin

nss_override_attribute_value loginShell /bin/csh
4. Edit the file /data1/etc/ldap.secret to insert your own LDAP password for the account root-
binddn using the following command:
% emacs /data1/etc/ldap.secret
Editing the Name Service Switch Configuration File

Once you edited the file ldap.conf, you must edit the name service switch configuration file to
edit where the authentication information must be retrieved.
To edit the file nsswitch.conf

3. Edit the file /data1/etc/nsswitch.conf using the following command:
% emacs /data1/etc/nsswitch.conf
4. The edited file should include the following:

#
# nsswitch.conf(5) - name service switch configuration file
# $FreeBSD: releng/10.2/etc/nsswitch.conf 224765 2011-08-10 20:52:02Z dougb $
#
# Edit the value of "group" to retrieve LDAP data. Initial value: "group: compat"
group: files ldap
# Comment the line "group_compat: nis"
# group_compat: nis
hosts: files dns

networks: files
# Edit the value of "passwd" to retrieve LDAP data. Initial value: "passwd: compat"
passwd: files ldap
# Comment the line "passwd_compat: nis"
# passwd_compat: nis
shells: files
services: compat
services_compat: nis
protocols: files
rpc: files
Editing the PAM Configuration for SSH Daemon

Once you edited the files ldap.conf and nsswitch.conf, you must edit the PAM configuration of
SSH daemon to include LDAP settings.
To edit the file pam.d/sshd

3. Edit the file /data1/etc/pam.d/sshd using the following command:
% emacs /data1/etc/pam.d/sshd
1228
# $FreeBSD: releng/10.2/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $

#
# PAM configuration for the "sshd" service
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
# Add the following line to specify that LDAP is used for authentication.
auth sufficient /usr/local/lib/pam_ldap.so no_warn
auth sufficient pam_unix.so no_warn try_first_pass
# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
# Add the following line to specify that you want the credentials to be verified via LDAP.
account sufficient /usr/local/lib/pam_ldap.so no_warn ignore_authinfo_unavail
ignore_unknown_user
account required pam_unix.so
# session
#session optional pam_ssh.so want_agent
session required pam_permit.so
# password
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass
Editing the LDAP Communication Settings

If you use a self-signed certificate generated on MS Windows, you have to edit the LDAP com-
munication settings: the file openldap.conf that defines the options to communicate with LDAP.
Once you edited the files ldap.conf, nsswitch.conf and pam.d/sshd, follow the procedure below.
To edit the file openldap.conf

3. Edit the file /data1/etc/openldap.conf using the following command:
% emacs /data1/etc/openldap.conf

#
# LDAP Defaults
#
# See ldap.conf(5) for details

# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
# Add the following line to disable the CA check.

TLS_REQCERT never
#Dictionnary for efficientip
VENDOR efficientip 2440
1229
BEGIN-VENDOR efficientip
ATTRIBUTE efficientip-version 1 integer

ATTRIBUTE efficientip-service-class 2 integer
ATTRIBUTE efficientip-identity-type 3 integer
ATTRIBUTE efficientip-first-name 16 string
ATTRIBUTE efficientip-last-name 17 string
ATTRIBUTE efficientip-pseudonym 18 string
ATTRIBUTE efficientip-ip-host 19 string
ATTRIBUTE efficientip-email 20 string
ATTRIBUTE efficientip-first-login-path 32 string
ATTRIBUTE efficientip-maintainer-group 33 string
ATTRIBUTE efficientip-groups 34 string
ATTRIBUTE efficientip-admin-group 35 string
ATTRIBUTE efficientip-extra-blob 64 string
END-VENDOR efficientip
Once you edited the the LDAP communication settings, you need to make sure the configuration
is properly set.
Making Sure the Configuration is Properly Set

Once your configuration is complete, there are two ways of making sure it is properly set:
1. Use the command getent to list all the users with SSH access and make sure your LDAP users
are listed and that you did not grant access to the unwanted users.
2. Try to connect to SOLIDserver via SSH using the credentials of an LDAP user to which you
granted access. They were listed in the command result.
To check the list of users allowed to connect via SSH

2. Connect to SOLIDserver using the credentials of the account admin.
% getent passwd
This command returns the list of all the users that can connect via SSH. All local, LDAP
and/or RADIUS users are listed as follows:
<username>:*:1001:1000:admin:/data1/users/admin:/bin/csh
Once you edited the made sure the configuration is properly set, you need to apply the configur-
ation to remote appliances.
Applying the Configuration to Remote Appliances

If you manage several SOLIDserver appliances from the page All SOLIDserver, once you con-
figured the LDAP authentication for SSH connections on the management appliance you can
push your configuration, i.e. apply it, to remote appliances.
Before applying the configuration, refer to the section Making Sure the Configuration is Properly
Set to ensure you are not pushing an erroneous configuration on your network. If the configuration
is incorrect, pushing it might prevent you from connecting to the remote appliance(s) via SSH.
1230
To apply the local LDAP authentication configuration for SSH to remote appliances
1. Open a browser.
2. Connect to the SOLIDserver management appliance you configured using its IP address or
hostname.
3. Go the Administration module. The homepage opens.
4. In the section System, click on the button Remote management. The page All SOLIDserver
opens.
5. Tick the remote appliance(s) to which you want to apply the local LDAP authentication.
6. In the menu, select Tools > Push local LDAP/RADIUS configuration. The wizard Push the
local LDAP/RADIUS authentication opens.
7. Click on OK to commit your choice. The report opens and closes. The page All SOLIDserver
is visible again.
Configuring RADIUS Authentication for SSH Connections

To configure the RADIUS authentication for SSH connections to SOLIDserver, you must:
1. Follow the procedures described in the appendix Configuring RADIUS.

2. Understand the Specificities and Prerequisites.
3. Edit the RADIUS configuration file. For more details, refer to the section Editing the LDAP
Configuration File.
4. Edit the PAM configuration for SSH daemon. For more details, refer to the section Editing the
RADIUS Configuration for SSH Daemon.
5. Edit the list of RADIUS users. For more details, refer to the section Editing the RADIUS Users
List.
Prerequisites
• A RADIUS server properly configured and running.
• The RADIUS server and SOLIDserver must be set at the same time.
• To set up the RADIUS authentication for several appliances, you must:
1. Configure the authentication from the managing SOLIDserver.
2. Once the configuration is complete, apply it the remote appliance(s).
• The user must exist on SOLIDserver.
Specificities
The configuration of RADIUS authentication for SSH connections:
• Must be done from the CLI.

• Must be done locally from a SOLIDserver management appliance. When the configuration is
complete:
• You can apply it to the remote SOLIDserver appliance(s) you manage.
• It automatically applies to the Hot Standby, if your SOLIDserver is configured with High
Availability.
1231
• If your RADIUS server is not responding, local users with sufficient rights can still access the
appliance via SSH.
Editing the RADIUS Configuration File

1
You must first edit the RADIUS configuration file to specify the class of users you want to grant
SSH access to. During that edition you must also define the type of permissions you grant to the
users of the class specified.
To edit the file radius.conf

3. Edit the file /data1/etc/radius.conf using the following command:
% emacs /data1/etc/radius.conf
The edited file should include the RADIUS server IP address, secret key, timeout in seconds
and the maximum number of attempts, as follows: <radius_server_ip>:<port> <secret_key>
<timeout> <maximum_attempts>. Not indicating the port, as in the example below, automat-
ically sets it to the default RADIUS port:
#radius_server_ip:port secret_key timeout maximum_attempts
1.2.3.4 RadiusSecretKey 3
Editing the RADIUS Configuration for SSH Daemon

Once you edited the file radius.conf, you must edit the PAM configuration of SSH daemon to in-
clude RADIUS settings.
To edit the file pam.d/sshd

3. Edit the file /data1/etc/pam.d/sshd using the following command:
% emacs /data1/etc/pam.d/sshd

#
# $FreeBSD: releng/10.2/etc/pam.d/sshd 197769 2009-10-05 09:28:54Z des $
#
# PAM configuration for the "sshd" service
#
# auth
auth sufficient pam_opie.so no_warn no_fake_prompts
auth requisite pam_opieaccess.so no_warn allow_local
#auth sufficient pam_krb5.so no_warn try_first_pass
#auth sufficient pam_ssh.so no_warn try_first_pass
# Radius authentication
auth sufficient pam_radius.so
auth required pam_unix.so no_warn try_first_pass
# account
account required pam_nologin.so
#account required pam_krb5.so
account required pam_login_access.so
1
For more details, refer to the radius.conf Linux man page available at https://linux.die.net/man/5/radius.conf.
1232
account required pam_unix.so
# session
#session optional pam_ssh.so want_agent
session required pam_permit.so
# password
#password sufficient pam_krb5.so no_warn try_first_pass
password required pam_unix.so no_warn try_first_pass
Editing the RADIUS Users List

Once you edited the files radius.conf and pam.d/sshd, you need to add the users for which you
want to allow RADIUS authentication.
If you want a user to connect in SSH only via RADIUS authentication, make sure that his password
is empty. Such user cannot log in using SSH any other way than using RADIUS since, by default,
the server does not allow login to accounts with an empty password.
Any user added to the list will be able to connect SOLIDserver using the secret key configured
in the section Editing the RADIUS Configuration for SSH Daemon.
To add a RADIUS user

3. Add a user using the following command:
% pw useradd -n <username> -u <uid> -m
Note that, as a best practice, setting a uid above 10000 allows to easily identify "Radius-only
users".
Once you edited the RADIUS users list, you need to make sure the configuration is properly set.
Making Sure the Configuration is Properly Set

Once your configuration is complete, there are two ways of making sure it is properly set:
1. Use the command getent to list all the users with SSH access and make sure your RADIUS
users are listed and that you did not grant access to the unwanted users.
2. Try to connect to SOLIDserver via SSH using the credentials of a RADIUS user to which you
granted access. They were listed in the command result.
To check the list of users allowed to connect via SSH

2. Connect to SOLIDserver using the credentials of the account admin.
% getent passwd
This command returns the list of all the users that can connect via SSH. All local, LDAP
and/or RADIUS users are listed as follows:
<username>:*:1001:1000:admin:/data1/users/admin:/bin/csh
1233
Once you edited the made sure the configuration is properly set, you need to apply the configur-
ation to remote appliances.
Applying the Configuration to Remote Appliances

If you manage several SOLIDserver appliances from the page All SOLIDserver, once you con-
figured the RADIUS authentication for SSH connections on the management appliance you can
push your configuration, i.e. apply it, to remote appliances.
Before applying the configuration, refer to the section Making Sure the Configuration is Properly
Set to ensure you are not pushing an erroneous configuration on your network. If the configuration
is incorrect, pushing it might prevent you from connecting to the remote appliance(s) via SSH.
To apply the local RADIUS authentication configuration for SSH to remote

appliances
1. Open a browser.
2. Connect to the SOLIDserver management appliance you configured using its IP address or
hostname.
3. Go the Administration module. The homepage opens.
4. In the section System, click on the button Remote management. The page All SOLIDserver
opens.
5. Tick the remote appliance(s) to which you want to apply the local RADIUS authentication.
6. In the menu, select Tools > Push local LDAP/RADIUS configuration. The wizard Push the
local LDAP/RADIUS authentication opens.
7. Click on OK to commit your choice. The report opens and closes. The page All SOLIDserver
is visible again.
1234
Appendix M. Configuring Non-Supported
Options
Table of Contents
Prerequisites ............................................................................................................... 1236
Limitations .................................................................................................................. 1236
Configuring Non-Supported Firewall Rules .................................................................... 1237
Configuring Non-Supported Apache Settings ................................................................ 1239
Configuring Non-Supported Unbound Settings .............................................................. 1241
Configuring Non-Supported NSD Settings ..................................................................... 1243
Configuring Non-Supported BIND Settings .................................................................... 1245
Configuring Non-Supported SNMP Settings .................................................................. 1249
Configuring Non-Supported DHCP Configurations ......................................................... 1250
Configuring Non-Supported NTP Settings ..................................................................... 1252
Configuring Non-Supported syslog-ng Settings ............................................................. 1253
Configuring Non-Supported PostgreSQL Settings .......................................................... 1254
Administrators can incorporate options - configurations, settings - that are not supported by
SOLIDserver via CLI.
Before configuring any non-supported configuration, keep in mind that:
• These configurations must be set at your own risk. No support help can be expected after
setting any of the non-supported configuration described in this appendix.
• These configurations are very advanced and must be carefully implemented.
You can set non-supported configurations for: firewall rules and options for the services Apache,
Unbound, NSD, BIND, SNMP, DHCP, NTP, syslog-ng and PostgreSQL.
1235
Configuring Non-Supported Options
Prerequisites
• SOLIDserver in version 6.0.1 or greater.
• Configuring local servers: DHCP EfficientIP servers, DNS EfficientIP servers or Hybrid DNS
servers.
• The service you want to configure must be running.
• The user configuring the non-supported options must have:
• Administrative rights over SSH connections to SOLIDserver.
• A good understanding of the environment and of the services configuration file, syntax and
options.
• Checking the changes before applying them to the production environment.
Limitations
• All changes must be performed via SSH, you cannot configure or display non-supported options
from the GUI.
• The configuration of non-supported options can only be done in a specific sections of the files
and nowhere else.
• You can only configure locally non-supported options.
• You can only configure non-supported options on physical servers EfficientIP DNS or DHCP
servers, you cannot set them on a smart architecture.
If you want to add non-supported options on several physical servers managed via the same
architecture, you must set them on each server configuration file individually.
• The non-supported options that you configure overwrite the current configuration. So make
sure that the options you incorporate are not already set in the configuration because the GUI
might not reflect these changes. Besides, configuring options twice may prevent the service
from running properly.
1236
Configuring Non-Supported Firewall Rules

You can configure non-supported firewall rules that the ipfw files automatically incorporate:
• In restricted mode, non-supported rules can be incorporated in the file /ipfw/ipfw.rules.

• In open mode, non-supported rules can be incorporated in the /ipfw/ipfw_open.rules.
By default, both files exist in the directory /ipfw. Note that the current firewall mode of your appli-
ance, Restricted and Open, is visible in the GUI on the page Network configuration, for more
details refer to the section Setting the Firewall.
Before configuring non-supported rules, keep in mind that there is no validation check for these
files, so if you misconfigure either you can lose access to your appliance, via SSH or other-
wise.
Configuring Non-Supported Firewall Configurations in Restricted Mode

By default, the directory /ipfw contains a file ipfw.rules that can be edited to configure the non-
supported firewall rules of your choice if you are in restricted mode.
ipfw.rules
#!/bin/sh
/sbin/ipfw -q flush
if [ -f /etc/ipfw.rules.stats ]; then
. /etc/ipfw.rules.stats
fi
if [ -f /etc/ipfw.rules.sourcerouting ]; then
. /etc/ipfw.rules.sourcerouting
fi
/sbin/ipfw -q add 10 allow ip from any to any via lo0

/sbin/ipfw -q add 14 allow carp from any to any
/sbin/ipfw -q add 20 check-state
...
/sbin/ipfw -q add 59999 deny ip from any to any
/sbin/ipfw -q add 61000 allow ip from any to any
## Include file for customizations

## USE WITH CAUTION
incfile=/usr/local/nessy2/etc/ipfw/ipfw.rules.inc ipfw.rules.inc
if [ -f $incfile ]; then
. $incfile
fi
/sbin/ipfw -q add 5 deny icmp from any to any
echo "PING requests are blocked"
Figure M.1. Example of non-supported firewall rules in restricted mode
wise.
To incorporate non-supported firewall rules in restricted mode
1. Meet the Prerequisites and take into account the Limitations.

2. Connect to your appliance using an SSH session or a port console and root credentials.
1237
3. In the directory /usr/local/nessy2/etc/ipfw/, edit the file ipfw.rules.inc to incorporate the non-
supported firewall rules of your choice.
Keep in mind that if you misconfigure this file you can lose access to your appliance.
4. Restart the firewall daemon to take into account your changes with the command:
service ipfw restart
Configuring Non-Supported Firewall Configurations in Open Mode

By default, the directory /ipfw contains a file ipfw_open.rules that can be edited to configure the
non-supported firewall rules of your choice if you are in open mode.
ipfw_open.rules
#! /bin/sh
/sbin/ipfw -q flush
if [ -f /etc/ipfw.rules.stats ]; then
. /etc/ipfw.rules.stats
fi
if [ -f /etc/ipfw.rules.sourcerouting ]; then
. /etc/ipfw.rules.sourcerouting
fi
/sbin/ipfw -q add 00100 allow ip from any to any

/sbin/ipfw -q add 00100 allow ip6 from any to any
/sbin/ipfw -q add 00101 allow icmp6 from any to any

## USE WITH CAUTION
incfile=/usr/local/nessy2/etc/ipfw/ipfw_open.rules.inc ipfw_open.rules.inc
if [ -f $incfile ]; then
. $incfile
fi
/sbin/ipfw -q add 5 deny icmp from any to any
echo "PING requests are blocked"
Figure M.2. Example of non-supported firewall rules in open mode
wise.
To incorporate non-supported firewall rules in open mode

3. In the directory /usr/local/nessy2/etc/ipfw/, edit the file ipfw_open.rules to incorporate the
non-supported firewall rules of your choice.
Keep in mind that if you misconfigure this file you can lose access to your appliance.
4. Restart the firewall daemon to take into account your changes with the command:
service ipfw restart
1238
Configuring Non-Supported Apache Settings

You can configure non-supported Apache settings that the configuration file httpd automatically
incorporates:
• Before any existing configuration, thanks to the settings specified in the file(s) in the directory
/pre .
• After all the existing configurations, thanks to the settings specified in the file(s) in the directory
/post .
By default, both directories contain a file httpd.conf.inc that you can edit to specify the settings
of your choice. You can also add as many *.inc files as you need in these directories.
httpd.conf
## Include files for customizations
## USE WITH CAUTION
IncludeOptional /usr/local/nessy2/etc/httpd/pre/*.inc myhttpconf.inc
#
# This is the main Apache HTTP server configuration file. It contains the
Listen 81
# configuration directives that give the server its instructions.
...
ServerRoot "/usr/local"
...
Listen 80
LoadModule authn_file_module libexec/apache24/mod_authn_file.so

LoadModule authn_core_module libexec/apache24/mod_authn_core.so
LoadModule authz_host_module libexec/apache24/mod_authz_host.so
...
# Secure (SSL/TLS) connections

#Include etc/apache24/extra/httpd-ssl.conf
#
# Note: The following must must be present to support
# starting without SSL on platforms with no /dev/random equivalent
# but a statically compiled-in mod_ssl.
#
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Include etc/apache24/Includes/*.conf
## Include files for customizations

## USE WITH CAUTION
IncludeOptional /usr/local/nessy2/etc/httpd/post/*.inc httpd.conf.inc
<VirtualHost 10.10.10.10:81>
DocumentRoot /data1/customer-portal
ServerName portal.customer.com
ErrorLog "/var/log/httpd-portal_error_log"
<Directory /data1/customer-portal>
AllowOverride All
Order deny,allow
allow from all
</Directory>
</VirtualHost>
Figure M.3. Example of non-supported Apache settings
1239
Before configuring non-supported settings, keep in mind that there a validation check for this file
but any invalid configuration may prevent the service from running properly or prevent
you from accessing the GUI altogether.
To incorporate non-supported Apache settings

3. Incorporate non-supported configurations in the file that suits your needs:
• Before any other instructions, edit the file httpd.conf.inc according to your needs. The full
path to the file is /usr/local/nessy2/etc/httpd/pre/httpd.conf.inc
You can also add any .inc file in the directory.

• After all instructions, edit the file httpd.conf.inc according to your needs. The full path to
the file is /usr/local/nessy2/etc/httpd/post/httpd.conf.inc
You can also add any .inc file in the directory.
4. Make sure the whole configuration file is still viable using the command:
apachectl configtest
If no errors are returned and the file syntax is OK, go to the next step. If not, you must edit
the content of the included file(s) because you might no longer be able to access or GUI or
prevent the service from running.
5. Once the configuration is OK, restart the Apache daemon to take into account your changes
with the command:
apachectl restart
6. Make sure the daemon is running with the command:

apachectl status
1240
Configuring Non-Supported Unbound Settings

You can configure non-supported Unbound settings that the configuration file unbound automat-
ically incorporates:
• In the section server of the configuration file.

• In the section remote-control of the configuration file.
unbound.conf
server:
verbosity: 1
interface: 0.0.0.0
interface: ::0
port: 53
do-ip4: yes
do-ip6: yes
do-udp: yes
do-tcp: yes
chroot: ""
directory: "/etc/unbound/"
pidfile: "/var/run/unbound/unbound.pid"
hide-identity: yes
hide-version: yes
msg-cache-size: 128m
username: named
# include: /usr/local/nessy2/etc/unbound/global_include.conf global_include.conf
remote-control:
control-enable: yes
control-interface: 127.0.0.1 log-time-ascii: yes
server-key-file: /etc/unbound/unbound_server.key
server-cert-file: /etc/unbound/unbound_server.pem
control-key-file: /etc/unbound/unbound_control.key
control-cert-file: /etc/unbound/unbound_control.pem
# include: /usr/local/nessy2/etc/unbound/remote_include.conf remote_include.conf
control-interface: 192.168.3.4
Figure M.4. Example of non-supported Unbound settings
Before configuring non-supported settings, keep in mind any invalid option is ignored.
To incorporate non-supported Unbound settings

3. Incorporate non-supported options in the file that suits your needs:
• To configure non-supported server settings, edit the file global_include.conf according to

your needs. The full path to the file is /usr/local/nessy2/etc/unbound/global_include.conf
• To configure non-supported remote management settings, edit the file remote_include.conf
according to your needs.The full path to the file is /usr/local/nessy2/etc/unbound/remote_in-
clude.conf
unbound-checkconf /etc/unbound/unbound.conf
1241
If no errors are returned, go to the next step. If not, you must edit the content of the included
file(s) because incorrect configurations are ignored.
5. Once the configuration is OK, restart the Unbound daemon to take into account your changes
with the command:
service ipmdns.sh restart

service ipmdns.sh status
1242
Configuring Non-Supported NSD Settings

You can configure non-supported Unbound settings that the configuration file nsd automatically
incorporates:
• In the section remote-control of the configuration file.

• In the section server of the configuration file.
nsd.conf
remote-control:
control-enable: "yes"
control-interface: ::1
control-interface: 127.0.0.1
control-port: 8953
server-key-file: "/data1/etc/nsd/nsd_server.key"
server-cert-file: "/data1/etc/nsd/nsd_server.pem"
control-key-file: "/data1/etc/nsd/nsd_control.key"
control-cert-file: "/data1/etc/nsd/nsd_control.pem"
# include: /usr/local/nessy2/etc/nsd/remote_include.conf remote_include.conf
server:
include: /data1/etc/nsd/ip-address.conf
database: "/data1/etc/nsd/nsd.db" control-interface: 192.168.3.4
pidfile: "/var/run/nsd/nsd.pid"
difffile: "/data1/etc/nsd/ixfr.db"
xfrdfile: "/data1/etc/nsd/xfrd.state"
server-count: 4
zonesdir: "/data1/etc/namedb/zones"
port: 53
hide-version: yes
verbosity: 0
username: named
ipv4-edns-size: 4096
ipv6-edns-size: 4096
# include: /usr/local/nessy2/etc/nsd/global_include.conf global_include.conf
identity: "myserver"
Figure M.5. Example of non-supported NSD settings
To incorporate non-supported NSD settings

3. Incorporate non-supported options in the file that suits your needs:
• To configure non-supported remote management settings, edit the file remote_include.conf

according to your needs. The full path to the file is /usr/local/nessy2/etc/nsd/remote_in-
clude.conf
• To configure non-supported server settings, edit the file global_include.conf according to
your needs. The full path to the file is /usr/local/nessy2/etc/nsd/global_include.conf
nsd-checkconf /etc/nsd/nsd.conf
1243
5. Once the configuration is OK, restart the NSD daemon to take into account your changes
with the command:

1244
Configuring Non-Supported BIND Settings

You can configure non-supported BIND options that the configuration file named automatically
incorporates:
• At server level, non-supported settings can be incorporated in the sections global and options
of the configuration file.
• At view level, non-supported settings must be manually incorporated in the clause of each view
declared in the server configuration file.
Configuring Non-Supported BIND Settings on a Server

At server level, you can incorporate non-supported settings and parameters to a BIND configur-
ation file thanks to two files:
global_include.conf
Allows to incorporate statements like logging, masters, server, trusted-keys or managed-
keys. In this file, you must specify each statement and its value.
options_include.conf
Allows to incorporate options. In this file, no need to specify the statement "options" be-
cause all the values that you add are automatically part of the statement.
named.conf
include "/usr/local/nessy2/etc/named/global_include.conf"; global_include.conf

key "rndc_key" {
algorithm hmac-md5;
secret "c3Ryb25nIGVub3VnaCBmb34gYnV0IG1hZGUgZm9yIGEgd29tYW4K"
statistics-channels {
;} inet 10.0.0.11 port 8053;
};
controls {
inet 127.0.0.1 port 953 allow {
localhost;
};
};
acl "admin" {
any;
};
options {
listen-on-v6 { any; };
directory "/etc/namedb";
...
include "/usr/local/nessy2/etc/named/options_include.conf"; options_include.conf
};
zone "mycorp.com"{ check-sibling yes;

type slave; transfers-in 100;
file "zones/slave/mycorp.com/mycorp.com"; tcp-client 400;
masters {
10.0.3.30;
};
};
Figure M.6. Example of non-supported BIND settings configured for a server
1245
To incorporate non-supported BIND settings on a server

2. Connect to your appliance or Linux server using an SSH session or a port console and root
credentials.
3. Incorporate non-supported BIND settings for the server in the file that suits your needs:
• To configure settings in the section global, edit in the file global_include.conf according to
your needs. The full path to the file is /usr/local/nessy2/etc/named/global_include.conf
• To configure settings in the section options, edit in the file options_include.conf according
to your needs. The full path to the file is /usr/local/nessy2/etc/named/options_include.conf
/usr/local/nessy2/bin/named-checkconf /etc/namedb/named.conf
If no errors are returned and the configuration file is OK, go to the next step. If not, you must
edit the content of the included file because incorrect configurations are ignored.
5. Once the configuration is OK, restart the DNS daemon to take into account your changes
with the command:
If you installed Linux packages, you must stop and start the daemon using the commands:
service ipmdns stop service ipmdns start
6. Make sure the DNS daemon is running with the command:

If you installed Linux packages, you must use the following command:
service ipmdns status
1246
Configuring Non-Supported BIND Settings on a View

At view level, you can incorporate non-supported settings and parameters to a BIND configuration
file if you create the file:
view_<dnsview-name>_include.conf
Allows to incorporate statements like empty-zones-enable or cleaning-interval to a clause
"view". In this file, no need to specify the statement "view", all the values that you add are
automatically taken into account.
named.conf
key "rndc_key" {
algorithm hmac-md5;
secret "c3Ryb25nIGVub3VnaCBmb34gYnV0IG1hZGUgZm9yIGEgd29tYW4K";
};
controls {
inet 127.0.0.1 port 953 allow {
localhost;
};
};
acl "admin" {
any;
};
view "intranet" {
match-clients {
key myview;
192.168.0.0/24;
};
match-destinations {
!external;
!42.42.42.0/24;
192.168.100.15
};
zone "mycorp.com"{
type slave;
file "zones/slave/mycorp.com/mycorp.com";
masters {
10.0.3.30;
};
include "/data1/etc/named/view_intranet_include.conf"; view_intranet_include.conf
};
cleaning-interval 120;
max-journal-size 1m;
empty-zones-enable no;
Figure M.7. Example of non-supported BIND settings configured for a view called "intranet"
To incorporate non-supported BIND settings on a view

2. Connect to your appliance or Linux server using an SSH session or a port console and root
credentials.
1247
3. In the directory /data1/etc/namedb/, create the file view_<dnsview-name>_include.conf,

where <dnsview-name> is the name of one of your existing views, and incorporate the non-
supported BIND settings of your choice for the view.
/usr/local/nessy2/bin/named-checkconf /etc/namedb/named.conf
If no errors are returned and the configuration file is OK, go to the next step. If not, you must
edit the content of the included file because incorrect configurations are ignored.
5. Once the configuration is OK, restart the DNS daemon to take into account your changes
with the command:
If you installed Linux packages, you must stop and start the daemon using the commands:
service ipmdns stop service ipmdns start
6. Make sure the DNS daemon is running with the command:

If you installed Linux packages, you must use the following command:
service ipmdns status
Keep in mind that if any option is invalid, the included configuration is ignored until you correct
what needs to be changed. As for conflicting options, they overwrite your configuration.
1248
Configuring Non-Supported SNMP Settings

You can configure non-supported SNMP settings that the configuration file snmpd automatically
incorporates after all the directives of the configuration file.
By default, the directory /snmpd contains a file custom.conf that can de edited to specify the
settings of your choice. You can also add as many files as you need in this directory.
snmpd.conf
sysDescr EfficientIP SOLIDserver

sysObjectID .1.3.6.1.4.1.2440
sysServices 72
sysContact EfficientIP Support <support@efficientip.com>
sysLocation Unknown
master agentx
agentaddress udp:161
com2sec secu0 default 'public'
group MyROGroup v1 secu0
group MyROGroup v2c secu0
view all included .1 80
access MyROGroup "" any noauth exact all none none
access MyRWGroup "" any noauth exact all none none
## EIP specific conf

includeFile /data1/share/snmp/eip-snmpd.conf
includeFile /data1/share/snmp/eip-traps.conf
agentXPerms 0775 0775 root agentx

## USE WITH CAUTION
includeDir /usr/local/nessy2/etc/snmpd custom.conf
trapcommunity public
trapsess -v 2c -c public 10.0.11.3
authtrapenable 1
Figure M.8. Example of non-supported SNMP settings
Before configuring non-supported settings, keep in mind that there is no validation check for
this file. Any invalid configuration may prevent the service from running properly.
To incorporate non-supported SNMP settings

3. In the directory /usr/local/nessy2/etc/snmpd, edit the file custom.conf according to your needs
or create a file to incorporate the non-supported SNMP options of your choice.
4. Once the configuration is OK, restart the SNMP daemon to take into account your changes
with the command:
service snmpd restart

service snmpd status
1249
Configuring Non-Supported DHCP Configurations

You can configure non-supported DHCP configurations that the configuration files dhcpd and
dhcpd6 automatically incorporates.
Before configuring non-supported options, keep in mind any invalid option is ignored.
Configuring Non-Supported DHCP Configurations in IPv4

By default, the directory /dhcp contains a file global_include.conf that can de edited to specify
the configurations of your choice.
dhcpd.conf
include "/usr/local/nessy2/etc/dhcp/global_include.conf"; global_include.conf
ddns-update-style none;
ddns-updates off;
option server.log-facility local7; if (exists host-name) {
authoritative; log (info,concat("We have host-name:", option host-name));
option server.min-lease-time 60; }
option Avaya-96xxx code 242 = text;
...
subnet 10.254.239.0 netmask 255.255.255.0 {

pool {
range 110.254.239.10 10.254.239.30;
}
}
Figure M.9. Example of a non-supported DHCP configuration
To incorporate non-supported DHCP configurations

3. In the directory /usr/local/nessy2/etc/dhcp, edit the file global_include.conf according to your
needs to incorporate the non-supported DHCP configurations of your choice.
/usr/local/nessy2/bin/dhcpd -t -cf /data1/etc/dhcpd.conf
5. Once the configuration is OK, restart the DHCP daemon to take into account your changes
with the command:
service ipmdhcp.sh restart

service ipmdhcp.sh status
Configuring Non-Supported DHCP Configurations in IPv6

By default, the directory /dhcp6 contains a file global_include.conf that can de edited to specify
the configurations of your choice.
1250
dhcpd6.conf
include "/usr/local/nessy2/etc/dhcp6/global_include.conf"; global_include.conf
authoritative;
ddns-update-style none;
option server.omapi-port 7912; if (exists host-name) {
log (info,concat("We have client-id:", option dhcp6.client-id));
... }
subnet6 2001:db8:0:1::/64 {
range6 2001:db8:0:1::129 2001:db8:0:1::254;
}
Figure M.10. Example of a non-supported DHCPv6 configuration
To incorporate non-supported DHCPv6 configurations

3. In the directory /usr/local/nessy2/etc/dhcp6, edit the file global_include.conf according to
your needs to incorporate the non-supported DHCP configurations of your choice.
/usr/local/nessy2/bin/dhcpd -6 -t -cf /data1/etc/dhcpd6.conf
5. Once the configuration is OK, restart the NSD daemon to take into account your changes
with the command:
service ipmdhcp6.sh restart

service ipmdhcp6.sh status
1251
Configuring Non-Supported NTP Settings

You can configure non-supported NTP settings that the configuration file ntp automatically incor-
porates.
By default, the directory /etc contains a file ntp.conf.inc that can de edited to specify the settings
of your choice.
ntp.conf
# By default, exchange time with everybody, but dont allow configuration.
restrict -4 default kod notrap nomodify nopeer noquery limited
restrict -6 default kod notrap nomodify nopeer noquery limited
# Local users may interrogate the ntp server more closely.

restrict 127.0.0.1
restrict ::1

## USE WITH CAUTION
includefile /usr/local/nessy2/etc/ntp.conf.inc ntp.conf.inc
peer 192.168.5.6 key 11

peer 2001:db8:1:100 key 33
keys /data1/exports/ntp.keys
trustedkey 11 33
Figure M.11. Example of non-supported NTP settings
Before configuring non-supported settings, keep in mind that there is no validation check for
this file. Any invalid configuration may prevent the service from running properly.
To incorporate non-supported NTP settings

3. In the directory /usr/local/nessy2/etc/, edit the file ntp.conf.inc according to your needs to
incorporate the non-supported NTP options of your choice.
4. Once the configuration is OK, restart the NTP daemon to take into account your changes
with the command:
service ntpd restart

service ntpd status
1252
Configuring Non-Supported syslog-ng Settings

You can configure non-supported NTP settings that the configuration file syslog-ng automatically
incorporates.
By default, the directory /include can contain any file that you can configure with the settings of
your choice.
syslog.conf
@version:3.7
@define allow-config-dups 1
@include "scl.conf"
@include "eip_syslog-ng.conf"
@include "syslog-ng.d/eip_redirect.conf"

## USE WITH CAUTION
@include "syslog-ng.d/include/*" custom.conf
log {
destination{ file("/tmp/test.log"); };
flags(catchall);
};
Figure M.12. Example of non-supported syslog-ng settings
Before configuring non-supported options, keep in mind that:
• There is no validation check for these files. Any invalid configuration may prevent the service
from running properly.
• The user definitions can override the default configuration.
To incorporate non-supported syslog-ng options

3. In the directory /usr/local/nessy2/etc/syslog-ng.d/include/, edit the file custom.conf according
to your needs to incorporate the non-supported syslog-ng settings of your choice.
4. Reload the configuration file to take into account the changes using the command:
syslog-ng-ctl reload
files because incorrect configurations are ignored.
service syslog-ng status
1253
Configuring Non-Supported PostgreSQL Settings

You can configure non-supported NTP settings that the configuration file postgresql automat-
ically incorporates.
postgresql.conf
log_destination = 'syslog'
autovacuum = on
max_connections = 100
maintenance_work_mem = 64MB
update_process_title = off
wal_level = hot_standby
max_wal_senders = 2
listen_addresses = '*'
hot_standby = on
wal_keep_segments = 256
log_min_duration_statement = -1
synchronous_commit = off
commit_delay = 50000
commit_siblings = 5
wal_writer_delay = 2000
geqo_threshold = 9

## USE WITH CAUTION
include_if_exists '/usr/local/nessy2/etc/postgresql.conf.inc' postgresql.conf.inc
shared_preload_libraries = 'auto_explain'
auto_explain.log_min_duration = '1000ms'
Figure M.13. Example of non-supported PostgreSQL settings
Before configuring non-supported options, keep in mind that there is no validation check for
these files. Any invalid configuration may prevent the service from running properly.
To incorporate non-supported PostgreSQL settings

3. In the directory /usr/local/nessy2/etc/, edit the file postgresql.conf.inc according to your needs
to incorporate the non-supported PostgreSQL options of your choice.
4. Restart the PostgreSQL daemon to take into account your changes with the command:
service postgresql restart

service postgresql status
1254
internal module setup, 26
Index propagating, 790
restricting, 790
setting, 790
A Agentless server
ACL DHCP (see Microsoft DHCP)
creating an ACL based on option 82, 400 DNS (see Microsoft DNS)
DNS server ACL, 499 alerts, 1004
editing a view match clients list, 522 acknowledging alerts, 1010
editing a view match destination list, 522 adding alerts, 1007
granting access to known clients, 383 checking alerts, 1010
range ACL, 370 disabling alerts, 1010
restricting access, 383 editing alerts, 1009
Active Directory enabling alerts, 1010
authenticating administrators, 956 allow-notify
domain, 559 at server level, 478
dynamic update authentication, 619 at view level, 528
relying on AD credentials to log users, 954 at zone level, 581
addresses, 238 allow-query
adding, 240 at server level, 480
adding by search, 243 at view level, 531
adding manually, 240 at zone level, 584
assigning, 240 allow-query-cache
configuring aliases, 245 at server level, 481
deleting, 254 at view level, 533
editing, 245 allow-recursion, 476
editing aliases, 247 allow-transfer
editing the network/broadcast address, 244 at server level, 482
moving IPv4 addresses across networks, 251, 253 at view level, 534
moving IPv4 addresses across spaces, 252 at zone level, 585
moving IPv4 addresses across the VLSM, 286 allow-update, 586
pinging an address, 253 also-notify
removing aliases, 248 at server level, 478
renaming Pv4 addresses massively, 250 at view level, 528
restoring, 254 alt-transfer-source, 495
statuses and types, 239 alt-transfer-source-v6, 495
undoing an address deletion, 254 Amazon Route 53
updating DNS servers, 461
Device Manager, 905 analytics
administrators DHCP data sampling, 405
authenticating DNS data sampling, 753
Active Directory, 956 DNS Guardian, 694
LDAP, 958 answerlog, 761
RADIUS, 960 anycast
authenticating remote users, 954 for BGP, 507
local user, 945 for IS-IS, 512
managing group of users, 931 for OSPF, 503
managing users, 945 appliance
advanced properties, 772 default gateway, 109
configuring high availability (see high availability management)
DHCP, 786 reboot, 1060
DNS, 788 remote management, 988
IPAM, 775 shutdown, 1061
inheriting, 790 SNMP agent, 134
1255
Index
troubleshooting, 1051 Custom DB, 1154

upgrading, 1064 custom data
autoselect media port, 122 adding, 1156
AWS deleting, 1157
Amazon Route 53 DNS servers, 461 editing, 1157
importing CSV data, 183
B custom database
backup, 1054 adding, 1155
configuring the remote archive, 1056 deleting, 1156
creating an instant backup, 1055 editing, 1155
restoring a backup, 1058 importing custom data through a CSV file, 183
scheduling a daily backup, 1055 customize
setting a backup rotation, 1055 add image to login page, 1083
uploading a backup, 1058 add image to welcome banner, 1085
BGP (see anycast) edit welcome banner, 1085
BIND hide welcome banner, 1086
DNS servers, 447 meta database, 1154
importing zones archive file, 195 set your own field names, 1087
blackhole, 484
bookmarks, 70 D
DDNS, 619
C (see also secure dynamic update)
CARP (Common Address Redundancy Protocol), server configuration, 497
118 zone authorizations, 586
certificate Device Manager, 878
creating a certificate, 132 devices, 880
HTTPS, 133 adding automatically, 882
importing a certificate, 129 adding manually, 886
Class Studio, 1096 deleting, 889
class objects duplicating, 888
adding, 1107 managing status and visibility, 881
deleting, 1151 merging, 889
editing, 1150 dual stack, 905
organizing, 1151 importing CSV data, 174
classes interfaces, 890
adding, 1100 adding automatically, 892
applying, 1101 adding manually, 896
deleting, 1104 deleting, 904
disabling, 1104 editing, 901
duplicating, 1103 managing status and visibility, 891
enabling, 1104 renaming, 898
moving, 1103 IPAM interaction, 905
renaming, 1102 using advanced properties, 908, 911
using another or no class, 1104 using the link option, 909
rights, 937 using the MAC address, 905
syntax, 1152 monitoring changes, 902
classes (see Class Studio) ports, 890
configuration file adding automatically, 892
DHCP (dhcpd.conf), 136 adding manually, 894
DHCPv6 (dhcpd6.conf), 136 deleting, 904
DNS (named.conf), 136 editing, 899
NSD (nsd.conf), 136 managing status and visibility, 891
Unbound (unbound.conf), 136 renaming, 898
1256
Index
rules, 913 range, 373

from the DHCP, 913 relay agent information, 399
updating from relay agent information (DHCPv6), 401
IPAM addresses automatically, 885 remote ID, 399
IPAM addresses manually, 905 RFC 2132/option 43, 401
NetChange (devices), 884 RFC3046/option 82, 399
NetChange (ports & interfaces), 892 RFC3315/DHCPv6, 399
devices (see Device Manager) scope, 347
DHCP, 298 server, 328
ACL (see ACL) setting options, 396
groups, 363 static, 361
importing vendor class identifier, 399
CSV data, 161 vendor specific information, 401
Infoblox configuration file, 192 DNS, 414
ISC configuration file, 188 anycast, 503
MetaIP configuration file, 193 blackhole, 484
Microsoft configuration file, 191 configuring a resolver, 111
NetID, 194 configuring servers, 473
VitalQIP configuration file, 189 DNS keys, 501
IP helper, 352 DNS64, 490
labels in IPv6, 1093 configuring, 492
leases (see leases) disabling, 493
monitoring supported substatements, 491
audit, 405 DNSCrypt, 515
from the page Analytics, 405 DNSSEC (see DNSSEC)
from the properties page, 404 EDNS options
lease statistics, 404 at server level, 485
server analytics, 405 at view level, 536
state log, 405 forwarding
using rules, 411 server, 473
ping check, 387 view, 526
preventing IP address duplication, 387 zone, 579
ranges (see ranges (DHCP)) Guardian (see Guardian)
relay agents, 352 Hybrid (see Hybrid)
relay agent information, 381 importing
relay agent information (DHCPv6), 382 BIND archive file, 195
reporting (see reports) CSV data, 170
rights, 936 VitalQIP archive file, 197
scopes (see scopes) including non-supported settings, 503
servers, 324 minimal-responses, 486
EfficientIP servers, 326 monitoring
ISC DHCP server, 333 answerlog, 761
Microsoft server, 329 audit, 753
statuses, 325 from the page Analytics, 753
smart architectures, 300 from the properties page, 752
SSL vs SNMP, 326 queries and answers, 759
statics (see statics) query statistics, 752
DHCP options, 395 querylog, 759
advanced configuration, 1198 state log, 753
bulk changes at scope level, 347 recursion at server level, 475
circuit ID, 399 recursion at view level, 529
DHCPv4, 397 reporting (see reports)
DHCPv6, 398 resolver, 440
group, 365 resource records (see resource records)
1257
Index
rights, 935 E
RPZ (see RPZ)
EDNS
RRL, 488
on a DNS server, 485
servers, 438
on a DNS view, 536
Amazon Route 53 servers, 461
EfficientIP
BIND DNS servers, 447
DHCP servers, 326
EfficientIP DNS server, 440
DNS servers, 440
generic servers, 457
exports, 198
Microsoft, 444
configuring exports, 201
Nominum servers, 459
export files, 207
statuses, 440
export templates, 208
synchronizing, 469
finding exports in the database, 200
smart architectures, 416
reimport, 203
sortlist, 487
scheduled export configuration files, 207
at view level, 537
sources, 494
at view level, 537 F
at zone level, 587 failover, 389
views (see views) communications-interrupted state, 390
zone delegation, 577, 613 configuring virtual IP, 118
zones (see zones) DHCP Safe Failover, 389
DNS firewall (see RPZ) Ethernet port, 117
DNS64, 490 management database, 964
DNSSEC, 722 normal state, 389
authoritative server, 728 partner-down state, 391
chain of trust, 725 switching to partner-down, 394
deleting unused keys, 739 Farm, 430
disabling, 736 file transfer
DNSKEY, 723 using SFTP/SCP/RSYNC, 126
adding (see resource records, adding) firewall, 112
DS, 724, 734 forwarding
invalidating a compromised KSK safely, 738 DNS (see DNS, forwarding)
KSK, 732 logs, 1014
NSEC/NSEC3, 724
NSEC3PARAM, 724 G
resolver, 726 gadgets, 77
RRSIG, 723 generic
signing a zone, 728 DNS servers, 457
transmitting the DS to a parent zone, 734 global search, 73
trust anchor, 726 group of users, 931
ZSK, 729 adding groups, 932
domains (VLAN), 916 assigning resources, 937
adding, 917 defining a group rights, 941
deleting, 918 deleting groups, 944
editing, 917 editing a group rights, 942
Dual stack editing groups, 933
Device Manager, 905 enabling and disabling groups, 944
interfaces, 108 importing CSV data, 181
virtual interface, 121 superuser account, 940
dynamic update, 619 GSS-TSIG, 619
(see also secure dynamic update) configuring a server, 623
at zone level, 586 configuring a zone, 624
generating a GSS-TSIG key, 622
uploading a GSS-TSIG key, 622
1258
Index
Guardian, 661 configuring the management appliance, 968

cache, 669 controlling the automated switch, 977
clearing automatically, 674 disabling the configuration, 976
clearing manually, 673 editing the re-enrollment settings, 979
forcing entries expiration, 673 enrolling the Hot Standby, 970
resetting, 672 frequently asked questions, 986
restoring, 673 hot standby appliance, 966
saving, 672 keeping the database when disabling, 985
sending, 676 limitations, 965
sharing, 675 master appliance, 966
configuring, 663 monitoring each appliance services, 1012
configuring from the GUI, 133 monitoring the logs, 974
disabling, 721 monitoring the time drift, 972
enabling, 662 network disruption, 979
limitations, 662 prerequisites, 965
monitoring from the GUI, 690 replacing an appliance, 975
analytics, 694 split-brain, 984
statistics, 690 standalone appliance, 966
prerequisites, 661 switching the appliances role, 974
protection, 702 troubleshooting, 981
client block, 703, 706, 707 HSM, 740
client quarantine, 704 browsing the HSM servers, 741
client ratelimit, 703 disabling the HSM, 749
disabling, 720 limitations, 741
enabling, 702 prerequisites, 740
quarantine_redirect, 705 setting up the HSM, 743
rescue mode, 717 HTTPS
rpz, 714 certificate, 129
triggers, 708 Hybrid, 651
statistics, 677 backup, restoration and upgrade with, 659
clients statistics, 685 checking the compatibility with, 651
server statistics, 677 forcing the compatibility with, 657
GUI, 28 generating the incompatibilities report, 652
breadcrumb, 32 limitations, 657
charts, 55 NSD, 655
contextual menu, 51 switching back to BIND, 658
customizing the list layout, 46 switching to, 654
customizing welcome banner and login page, 1083 Unbound, 656
filtering a list, 40
home page, 29 I
listing page, 38 imports
menu, 33 data
modules, 31 CSV, 140
multi-status column, 51 Device Manager, 174
notications, 74 DHCP, 188
properties page, 53 DNS, 195
tree view, 29 IPAM, 185
wizard, 59 NetChange, 797
from
H BIND DNS, 195
high availability management, 964 Infoblox DHCP, 191
adding a remote appliance, 969 ISC DHCP, 188
configuring the appliances, 968 MetaIP DHCP, 192
1259
Index
Microsoft DHCP, 190 leases, 374

NetID DHCP, 193 blacklisting, 378
NetID IPAM data, 186 converting to statics, 377
VitalQIP DHCP, 189 lease time configuration, 376
VitalQIP DNS, 197 pinging, 387
VitalQIP IPAM data, 185 releasing lease, 377
import templates, 184 tracking logs, 379
Infoblox license
importing a DHCP configuration file, 191 activating a license, 138
interfaces (see Device Manager, interfaces) adding a license, 25
Device Manager, 890 requesting a license, 25, 137
IP addresses (see addresses) Linux
IPAM, 209 DHCP packages, 333
addresses (see addresses) DNS packages, 447
block-type networks (see networks, block-type) local files listing, 1042
importing Locked Synchronization
CSV data, 143 on a DHCP smart architecture, 306
NetID host addresses, 187 on a DNS smart architecture, 420
NetID networks, 186 logs
NetID subnets, 186 redirection, 1014
RIPE objects, 1181 visualization, 1012
Vital QIP data, 185
IP addresses (see addresses) M
labels in IPv6, 1093 maintenance, 1042
networking, 209 backup (see backup)
pools (see pools) clearing SOLIDserver cache, 1051
provisioning, 263 local files listing (see local files listing)
rights, 934 maintenance mode, 1050
RIPE management (see RIPE) reboot (see appliance, reboot)
spaces (see spaces) shutdown (see appliance, shutdown)
subnet-type networks (see networks, subnet-type) troubleshooting (see troubleshooting)
transition options, 257 update macros and rules, 1050
updating management
Device Manager (see addresses) high availability (see high availability management)
Device Manager with addresses, 905 Master/Slave, 422
VLAN Manager with subnet-type networks, 926 max-cache-size, 485
updating from at view level, 535
NetChange discovered items, 842 MetaIP
VLSM (see VLSM) importing a DHCP configuration file, 192
VRF (see VRF) Microsoft DHCP
IPLocator (see NetChange) adding a server, 331
IS-IS (see anycast) importing a configuration file, 190
ISC limitations, 332
importing a DHCP configuration file, 188 prerequisites, 331
ISC DHCP server, 333 server, 329
Microsoft DNS
L adding a server, 445
Labels, IPv6, 1093 limitations, 446
lame-ttl, 484 prerequisites, 444
at view level, 535 server, 444
LDAP minimal-responses, 486
authenticating administrators, 958 monitoring, 995
authentication for SSH, 1226 alerts (see alerts)
1260
Index
database tables size, 1040 rights, 937

DHCP data, 404 routes, 806
DNS data, 752 statistics, 845
high availability appliances, 972 tuning
netstat, 1039 customizing the devices' type, 849
remote appliances, 991 updating
reports (see reports) Device Manager with devices, 884
services logs, 1012 Device Manager with discovered items, 885
services statistics, 1014 IPAM with addresses, 842
session tracking, 1016 versioning, 826
SNMP (see SNMP, monitoring) comparing configuration files, 834
user tracking, 1016 connection profiles, 829
copy user operations in syslog, 1020 disabling, 838
extended user tracking, 1019 downloading configuration files, 836
forward rule operations to syslog, 1020 enabling and configuring, 831
Multi-Master, 424 refreshing configuration files, 832, 837
VLANs, 809
N adding, 810
NetChange, 792 deleting, 811
configuration files versioning, 826 editing, 811
discovered items, 840 NetID
history view, 843 importing a DHCP configuration file, 193
refreshing, 842 importing IPAM data, 186
discovering network devices, 798 netstat, 1039
importing CSV data, 172 network
licenses, 793 adding a specific route, 110
monitoring basic interface configuration, 108
automating devices synchronization, 848 default gateway, 109
keeping the database up to date, 847 DNS resolver, 111
network devices, 794 duplex, 122
adding, 796 Ethernet port failover, 117
connecting via a web console, 803 interface IPv4/IPv6, 108
connecting via SSH, 802 interface trunking (802.1q), 115
connecting via telnet, 803 speed, 122
deleting, 804 static route, 110
making a snapshot, 803 VHID, 118
refreshing, 801 virtual interface, 121
scheduling a refresh, 801 virtual IP, 118
statistics, 845 network flows
ports, 812 DHCP, 1167
802.1X authentication, 816 DNS, 1168
associating a port with a VLAN, 824 High Availability, 1171
configuring tagging mode, 822 IPAM, 1166
edge and terminal ports, 812 NetChange, 1170
editing speed and duplex, 815 remote management, 1171
enabling/disabling, 814 SOLIDserver, 1165
interconnection ports, 812 networks
limiting access using MAC addresses, 817 block-type
limiting access using user rights, 820 adding, 218
port-security, 817 deleting, 231
refreshing, 825 editing, 224
statistics, 845 moving, 227
updating description, 816 network map, 228
splitting, 225
1261
Index
subnet-type hardware appliance, 2

adding, 218 NetChange, 812
By search addition, 221 PXE, 386
deleting, 231 changing the lease time for PXE clients, 387
discovering assigned addresses (IPv4 only), next-server and filename options (v4), 386
227
editing, 224 Q
editing the network/broadcast address, 244 query-source, 494
finding available terminal networks, 221 query-source-v6, 494
managing/unmanaging, 229 querylog, 759
merging, 226 quick wizards, 66
moving, 227
network map, 228
splitting, 225
R
RADIUS
statuses, 217
authenticating administrators, 960
updating VLAN Manager, 926
configuring a FreeRadius server, 1221
Nominum
configuring with Cisco RADIUS ACS, 1222
DNS servers, 459
ranges (DHCP), 366
notify
adding, 367
at server level, 478
deleting, 373
at view level, 528
editing, 370
at zone level, 581
options, 373
notify-source, 495
replicating in the IPAM, 372
notify-source-v6, 495
resizing, 371
NTP, 128
ranges (VLAN), 919
configuring the NTP server, 128
adding, 920
forcing an NTP update, 129
deleting, 922
editing, 921
O resizing, 921
One-to-Many, 310 records
One-to-One, 308 SOA
OSPF (see anycast) resetting, 560
recursion, 475
P at server level, 476
Packager, 1158 at view level, 529
creating packages, 1159 recursive-clients, 477
deleting packages, 1163 remote management, 988
downloading packages, 1162 adding appliances, 989
installing packages, 1161 configuring the management appliance, 988
uninstalling packages, 1162 monitoring the logs, 991
uploading packages, 1159 monitoring the statistics, 991
ping monitoring the time drift, 992
addresses, 253 prerequisites, 988
leases, 387 remote network configuration, 990
terminal networks (IPv4 only), 227 remote service configuration, 990
pools removing appliances from, 994
adding, 234 replacing an appliance, 993
deleting, 236 upgrading remote appliances, 1073
reserving, 235 reports, 995
resizing (IPv4 only), 235 browsing the reports database, 995
port-security (see NetChange, ports) downloading and displaying, 1003
ports (see Device Manager, ports) generating, 1001
Device Manager, 890 managing scheduled reports, 1004
1262
Index
on DHCP scopes, 996 groups of users, 931

on DHCP servers, 996 users, 945
on DNS servers, 997 RIPE, 1176
on DNS views, 999 allocated networks
on DNS zones, 999 deleting, 1193
on NetChange network devices, 1000 importing, 1181
on statistics, 1001 AS numbers (see aut-nums)
on users, 952 assigned networks
scheduling, 1002 adding, 1185
resource records, 592 deleting, 1193
adding, 595 editing, 1190
A, 595 importing, 1182
AAAA, 599 registering changes again, 1194
AFSDB, 600 aut-nums
CAA, 601 adding, 1189
CERT, 601 deleting, 1194
CNAME, 597 editing, 1192
DHCID, 602 importing, 1184
DNAME, 602 configuring the appliance, 1178
DNSKEY, 603 editing the appliance configuration, 1196
DS, 736 management via SOLIDserver, 1177
HINFO, 604 persons
MINFO, 605 adding, 1188
MX, 598 deleting, 1193
NAPTR, 605 editing, 1191
NS, 599 importing, 1183
NSAP, 606 registering changes again, 1194
OPENPGPKEY, 606 prerequisites, 1176
PTR, 596 users (see persons)
SRV, 608 route
SSHFP, 607 adding a specific route, 110
TLSA, 608 static route, 110
TXT, 609 RPZ, 630
URI, 610 limitations, 649
WKS, 610 overriding rules, 648
delegation, 613 policies, 636
deleting, 616 based on domain names, 638
DNSSEC records based on IP addresses, 640
DNSKEY, 723 based on name server domain name, 643
DS, 724 based on name server IP address, 643
NSEC/NSEC3, 724 based on specific resources, 647
NSEC3PARAM, 724 deleting, 648
RRSIG, 723 NODATA, 637
duplicating, 615 NXDOMAIN, 637
editing, 611 order, 637
load balancing, 617 PASSTHRU, 637
moving, 615 REDIRECT, 636
SOA, 593 prerequisites, 630
SPF, 617 records (see RPZ, policies)
supported RRs, 592 rules (see RPZ, policies)
Response policy zone (see RPZ) zones
Response Rate Limiting (RRL) (see DNS, RRL) adding, 632
rights management, 930 converting, 635
authentication rules, 954 deleting, 636
1263
Index
editing, 634 Guardian, 1035

RR (see resource records) hardware, 1024
RSYNC prerequisites, 1024
password, 126 system, 1027
profile, 1022
S SOLIDserver
scopes, 344 basic network configuration, 18
adding, 345 clearing SOLIDserver cache, 1051
defining a space for, 348 first installation, 8
deleting, 352 front/back panel, 2
duplicating (DHCPv4), 351 Linux packages
editing, 346 BIND DNS, 447
moving (DHCPv4), 351 BIND upgrade, 455
options, 347 ISC DHCP, 333
replicating in the IPAM, 349 ISC upgrade, 341
shared network, 350 logging in, 24
super-scope, 350 non-supported options, 1235
SCP prerequisites, 8
password, 126 resetting the configuration via LCD, 22
secure dynamic update, 620 update macros and rules, 1050
configuring the AD domain zone, 624 upgrading, 1064
configuring the server, 623 sortlist
generating a GSS-TSIG key, 622 on a DNS server, 487
preparing the AD server, 621 on a DNS view, 537
uploading a GSS-TSIG key, 622 spaces
security adding, 212
firewall, 112 deleting, 213
saving a backup of the appliance, 1054 editing, 213
SSH password, 125 SPF Records (see resource records)
tracking users' operations, 1016 Split-Scope, DHCPv4, 312
service Split-Scope, DHCPv6, 316
disabling, 124 SPX
enabling, 124 prerequisites, 1176
starting, 124 RIPE, 1176
stopping, 124 SSH, 125
SFTP enable/disable, 124
password, 126 login, 125
Single-Server, DHCPv4, 313 password, 125
Single-Server, DHCPv6, 315 password security level, 125
Single-Server, DNS, 428 SSL
smart architectures certificate, 129
DHCPv4, 300 Stateless, 318
DHCPv6, 300 statics, 354
DNS, 416 adding, 356
locked synchronization (DHCP), 306 copying (DHCPv4), 362
locked synchronization (DNS), 420 deleting, 362
Smart Folders, 1089 editing, 359
SMTP, 127 MAC address types, 1208
SNMP, 134 options, 361
configure the local agent, 134 replicating in the IPAM, 360
monitoring, 1023 statistics, 405, 753
DHCP, 1031 (see also analytics)
DNS, 1032 appliance and services, 1014
DHCP physical server, 404
1264
Index
DNS physical server, 752 changing a user password, 948

Guardian clients, 685 configuring the user login session time, 951
Guardian server, 677 configuring the user password complexity, 949
Stealth, 426 configuring the users connection parameters, 949
subnetting (see networks) connected user, 36
syslog, 1012 language, 37
severity levels, 1013 list format, 37
password, 37
T preferences, 36
templates (IPAM), 263 time and date format, 36
applying templates, 269 editing, 947
creating templates, 264 enabling/disabling, 952
for block-type networks, 266 granting access to changes from all the users,
for pools, 268 1018
for spaces, 265 groups of users, 931
for subnet-type networks, 267 importing CSV data, 182
template classes, 263 local user, 945
tracking redirecting user once they logged out, 952
sessions, 1016 remote authentication, 954
users, 1016 tracking all operations, 1017
transfer-source, 494 tracking operations at a specific time, 1018
transfer-source-v6, 494 tracking operations on a specific IP, 1018
troubleshooting, 1051
guidelines, 1052 V
network capture, 1052 views, 518
troubleshooting dump, 1053 adding, 520
deleting, 523
U editing, 522
undo getting rid of all views, 524
restoring deleted IP addresses, 254 order, 523
uniqueness of IP address VIF (virtual interface), 121
preventing IP address duplication (DHCP), 387 VIP (virtual IP), 118
update Virtual Local Area Network
DHCP database setting up a VLAN using a VIF, 115
from the IPAM, 772 VitalQIP
DNS database importing DHCP data, 189
from the DHCP, 772 importing DNS data, 197
from the IPAM, 772 importing IPAM data, 185
IPAM database VLAN, 923
from the DHCP, 772 adding, 924
from the DNS, 772 deleting, 925
update-policy, 620 editing, 925
upgrade, 1064 statuses, 923
prerequisites, 1064 VLAN Manager, 915
troubleshooting the upgrade, 1074 associating VLANs and IPAM networks, 927
of an appliance, 1075 domains (see domains (VLAN))
of HA appliances, 1076 importing
upgrading an appliance, 1064 CSV data, 177
upgrading HA appliances, 1066 ranges (see ranges (VLAN))
upgrading remote appliances, 1073 removing the IPAM/VLAN interaction, 928
use-alt-transfer-source, 494 rights, 937
user, 945 updating from IPAM networks, 926
adding, 946 VLANs (see VLAN)
1265
Index
VLSM (Variable Length Subnet Masking), 272 Z

choosing the proper method, 272
zones
moving IPv4 addresses across the VLSM, 286
adding
network-based organization, 286
delegation-only, 557
space-based organization, 276
forward, 550
VRF, 293
hint, 556
Virtual Routing and Forwarding
master, 544
adding, 294
slave, 548
deleting, 295
stub, 553
editing, 295
adding or removing an NS record, 567
importing, 158
administrator rights on, 576
VRF Route Target
classless in-addr.arpa delegation, 578
adding, 296
converting, 566
deleting, 297
delegation, 577
editing, 297
deleting, 576
importing, 160
disabling/enabling, 575
VRRP (Virtual Router Redundancy Protocol), 118
duplicating zones, 568
editing
W delegation-only, 565
Workflow, 851 forward, 563
customizing the requests administration, 871 hint, 565
adding statuses, 875 master, 560
best practices, 876 slave, 562
editing the email notification, 874 stub, 564
editing the statuses, 872 forcing a full synchronization, 560
executing requests, 866 forcing commands, 574
using classes, 867 notification, 574
using the execute option, 866 refresh, 574
incoming requests, 861 retransfer, 575
accepting requests, 863 hosting active directory domain zones, 559
archiving requests, 865 importing a VitalQIP archive file, 197
default request administration, 862 migrating to another server, 568
deleting requests, 865 moving zones, 568
finishing requests, 864 security, 583
handling requests, 863 setting authorizations, 569
managing requests content, 862 allow-query, 569
rejecting requests, 864 allow-transfer, 569
outgoing requests, 853 allow-update, 570
adding creation requests, 854 setting forwarders, 572
adding deletion requests, 856 setting master servers, 573
adding edition requests, 855 setting properties, 568
canceling requests, 860 setting space, 569
editing requests, 858 statuses, 543
user access to classes, 852 synchronizing the manager with, 559
WSDL files, 1045
adding, 1045
deleting, 1049
downloading, 1049
editing and dumping, 1047
X
X.509
HTTPS certificate, 129
1266

SOLIDserver Administrator Guide-6.0.2

Diunggah oleh

Informasi Dokumen

Hak Cipta

Format Tersedia

Bagikan dokumen Ini

Bagikan atau Tanam Dokumen

Opsi Berbagi

Apakah menurut Anda dokumen ini bermanfaat?

Apakah konten ini tidak pantas?

Hak Cipta:

Format Tersedia

SOLIDserver Administrator Guide-6.0.2

Diunggah oleh

Hak Cipta:

Format Tersedia

SOLIDserver Administrator

Publication date June 21, 2019

Deleting Gadgets .......................................................................................... 105

Configuring Exports ....................................................................................... 201

Creating Template Classes in Class Studio ..................................................... 263

DHCP Failover Principles and Operational States ............................................ 389

Configuring DNS Sources at Server Level ....................................................... 494

41. Implementing Dynamic Update ......................................................................... 619

Browsing Advanced Properties ....................................................................... 773

Refreshing the Discovered Items Database ..................................................... 842

Adding Device Manager Rules ....................................................................... 913

Specificities .................................................................................................. 965

Editing Smart Folders .................................................................................. 1090

BOOTP Compatibility Options .............................................................................. 1203

• Starting: the hardware appliances description, the installation of SOLIDserver on hardware

SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000

the global IPAM company

eth1 eth2 eth3 eth4 rmgmt console

Figure 1.1. Front panel ports

You may use the following software:

• Hyper terminal or Putty on Windows.

Figure 1.2. Front panel LED, LCD screen and buttons

This LED glows green when the appliance is on.

SDS-260 Front Panel

Figure 1.3. Front panel

The On/Off button. It is lit when the appliance is on.

SDS-260 Back Panel

Figure 1.4. Back panel

SDS-550, SDS-1100 and SDS-2200

SDS-550, SDS-1100, SDS-2200 Front Panel

Figure 1.5. Front panel

The On/Off button. It is lit when the appliance is on.

SDS-550, SDS-1100, SDS-2200 Back Panel

Figure 1.6. Back panel

SDS-3300 and SDS-Blast Series

SDS-3300 and SDS-Blast Series Front Panel

Figure 1.7. Front panel

The On/Off button. It is lit when the appliance is on.

The hot swappable hard drive 2.

SDS-3300 and SDS-Blast Series Back Panel

Figure 1.8. Back panel

SDS-50 First Installation

Configuring SOLIDserver IP Address

To configure SOLIDserver on SDS-50 appliances

1. Plug in the appliance power cable.

SDS-250, SDS-500, SDS-1000, SDS-2000 and SDS-3000 First

1. To set up the first network configuration.

Configuring SOLIDserver IP Address

To configure SOLIDserver on SDS-250, SDS-500, SDS-1000, SDS-2000 and

1. Plug in an Ethernet cable on Eth1, the default interface configured on SOLIDserver.

• Esc: Cancel the current modification and go back to the menu.

• Esc: Cancel the current modification and go back to the menu.

• Esc: Cancel the current modification and go back to the menu.

10. The basic network configuration is applied.

SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 and

1. To set up the iDRAC IP address.

This hardware generation of SOLIDserver comes embedded with a sub-component designed to

1. Configure an IP address for the iDRAC.

1. Setting up the iDRAC IP Address

To set up the iDRAC IP address you must:

1. Make sure you meet the prerequisites.

• Plug in the appliance power supply cable(s):

Setting up the iDRAC IP Address Without LCD Screen

For hardware appliances SDS-260, SDS-550, SDS-1100, SDS-2200, SDS-3300 or SDS-Blast