“The Slammer virus affected all the naming resolution pieces in the city,” says Mark Whitt, IS administrator for the city’s IT department. “We couldn’t get the vulnerability under control. So we began looking for a device to reduce our vulnerabilities.”
Enter Infoblox, one of several start-ups offering special-purpose, hardened appliances that handle resolution for key Internet protocols including DNS and DHCP. The city of Houston bought eight Infoblox appliances – which cost $54,000 – that will be fully deployed this summer.
“All of our Web presence is using DNS services from Infoblox. We’re also using Infoblox for our internal name resolution,” Whitt says. “The performance has been great. I haven’t seen any degradation, and we have the enhancements of increased manageability and dynamic DNS updates.”
The city of Houston is not alone. Many organizations are replacing aging DNS software and servers with modern appliances that offer enhanced security and easier management. Other organizations that have made the switch to DNS and DHCP appliances include EMC, Banker’s Life and Casualty, and Pima Community College.
“We’ve seen a lot of renewed interest in IP address management, DNS and DHCP over the last 18 months,” says Dan Golding, senior analyst with Burton Group.
For the last 20 years, most IT shops have used free software such as BIND running on Unix or Linux servers to handle DNS resolution. However, BIND as well as free DNS software from Microsoft are increasingly under attack by hackers. Today, network managers are becoming aware of the vulnerabilities of these older software applications as well as the affect DNS or DHCP outages can have on corporate productivity.
IP address management “was very low down on the priority list,” Golding says. “People sort of woke up one day and noticed that their authoritative DNS servers were supporting major Web services and were running on Pentium or ancient Solaris boxes. They were very rickety. The software was old and might have been running on Windows. Then they started reading about all these DNS-based attacks.”
Some companies use special-purpose IP address management software such as Cisco Network Registrar (CNR), Lucent’s QIP or Nortel’s NetID. However, these products are expensive to operate and are infrequently updated. (Read our Technology Insider on IP address management .)
“The older IP address management platforms are software based, and they require systems administrators, database administrators and network engineers,” Golding says. “They require a team of high priests to keep them running, so it is very expensive. A lot of them require Oracle licenses, too.”
Without protocols such as DNS and DHCP functioning, corporate networks don’t work. Web sites go down, e-mail won’t go through, and mission-critical ERP applications that depend on the Internet won’t function.
“DNS has become critical to IP networks,” says Cricket Liu, vice president of architecture at Infoblox. “DNS is the preferred method for internal naming, as well as the Internet. It handles resolving URLs and sending e-mail. DNS is also used by Microsoft Active Directory implementations. All of a sudden, the dependency on DNS goes from network domains to network servers to desktops.”
At the same time that DNS has become more critical to corporate networks, it has also become more complex. The basic documentation for BIND is more than 100 pages. In addition, BIND is more vulnerable then ever, with the CERT issuing regular warnings related to BIND and other DNS-related issues.
These trends are prompting companies to upgrade their DNS software and servers, and these companies are looking for an offering that is secure, reliable and high performing. That’s where appliances enter the picture. These hardened devices offer the benefits of being inexpensive and easy to run with low administrative and operational expense.
Among the companies selling DNS and DHCP appliances are Infoblox, MetaInfo, BlueCat Networks and International Network Services . Most of these appliances sell for $5,000 to $10,000. Vendors of these appliances report that sales are brisk.
“All of these appliances are pretty high quality,” Golding says. “The things that differentiate one from the next are how well the management works, how well the high availability works and the pricing.”
Golding says he recommends appliances for IP address management to most of his clients. “There are some enterprises that need the functionality that you can only get from software like Lucent’s QIP. But for the vast majority of enterprises, appliances are a better fit.”
The city of Houston’s Whitt says he chose a DNS appliance because it offered tighter security and was less expensive than a traditional software-based package.
“The advantage of having an appliance included out-of-band management, increased meantime between failure, and it reduced some of the moving parts,” Whitt says.
With its DNS and DHCP infrastructures in solid shape, the city is getting ready to roll out new applications, including VoIP. The dynamic DNS updates offered by the Infoblox appliances will support these new applications.
“When I have a client device that needs to register with DNS, the Infoblox appliance makes it automatic vs. the static environment we had, where we had to have an administrator create a name and IP address and put it in the proper zone,” Whitt says. “Dynamic DNS has been a wonder for us.”
Not all organizations choose DNS and DHCP appliances for security reasons. Pima Community College of Tucson, Ariz., replaced Cisco’s CNR product with BlueCat appliances because of the enhanced features and technical support offered by the start-up.
Scott Ferguson, principal analyst for network services at Pima Community College, says he ran into interoperability problems running Cisco’s CNR software at the college’s data center in conjunction with dedicated Sun Netra servers at each of its seven main campuses.
“The setup was problematic,” he says. “We had several instances where the information wasn’t transferred correctly between the different servers. Servers would go down. Actually, the Cisco product is not that difficult from a user standpoint to configure or use, but it seems to be somewhat proprietary, and it doesn’t always adhere to the BIND or DHCP standards.”
Ferguson evaluated DNS and DHCP appliances from several vendors, but he ultimately bought four BlueCat appliances for $28,000. He installed two devices at the college’s data center in high-availability mode, a third device was installed at the data center for external DNS traffic. A fourth device is being installed at the college’s disaster-recovery site.
|
