whitepaper Practitioners Guide to Managing DHCP, DNS, & IP Addresses (DDI)

Transcription

1 Practitioners Guide to Managing DHCP, DNS, & IP Addresses (DDI)

2 Introduction Don t expect technology advancements to slow down anytime soon. Innovations like cloud and BYOD mobile computing are now commonplace, and new trends are on the horizon. In an IP-connected world, each new trend poses new challenges for IT operations. For example, virtualization of servers and desktops along with the Internet of Things place heavy demands on IP address, DHCP, and DNS administration. Consider how dramatic technology changes have been during the past 5 years. Recent studies show that many organizations now manage three to five IP addresses per employee 1 in addition to all the addresses required for production, development, and QA environments. Trends suggest that the rate of change will only accelerate. From an IT ops view, this underscores the need for specialized IP configuration and monitoring tools. This guide discusses best practices for configuring and monitoring DHCP, DNS, and IP addresses, and how specialized tools can help. The Problem The question many organizations are asking is whether tools that help manage DHCP, DNS, and IP addresses are nice to have or a must-have. According to a SolarWinds survey of 200 IT pros, organizations are spending on average about 49 man-hours a month managing IP addresses and DHCP and DNS configurations. That is more than a quarter of a network admin s work time. The top time-consuming tasks are: 1. DHCP and DNS configuration management 2. IP conflict troubleshooting 3. IP address administration 4. DDI monitoring To understand why these tasks are time intensive, consider the following real-world scenario: Someone brought a personal computer into work and plugged it into the network. Soon thereafter, all remote connections to the accounting server went down. IT started investigating the problem. First, they rebooted the remote access server. Next, they changed the switch port and network cables. They even tried unplugging all devices from the switch. That made the problem go away. That s how they knew that another device connected to the switch was causing the problem. They started looking for an IP conflict. After an extensive search, they found the outside computer plugged into the network. This same scenario frequently occurs with a variety of outcomes. For example, instead of an outside device, an admin might configure a new VM with what he or she believes is an available static IP address. Or, someone might provision a new server with the right IP address, but makes a mistake with the DHCP or DNS provisioning. Regardless of what causes the problem, the results are usually the same disruption to business operations and lost time spent on trial-and-error troubleshooting. What could have prevented or reduced the impact of these scenarios? A solution that tracks and verifies unused IP addresses. This would reduce the likelihood of using the wrong IP address. A solution that applies consistent configuration changes to DHCP and DNS services would help ensure that changes are made properly. Also, a solution that 1 Gartner: Andrew Lerner, Lawrence Orans Market Guide for DNS, DHCP and IP Address Management 2

3 actively monitors IPs and endpoints and provides historical details makes troubleshooting problems easier and faster. Using specialized IP configuration and monitoring tools not only improves administrator efficiency, they also reduce mistakes. Gartner, an IT market research firm, recently concluded that DDI solutions can save organizations 50% in admin labor costs. Furthermore, other experts warn that most network outages are due to configuration errors. 2 These findings were confirmed in our SolarWinds survey 88% reported that DDI management is essential to network management and that configuring and monitoring IPs improves reliability by reducing failure and improving time to recovery. So why should you consider a DDI solution and what should you look for? The following sections provide recommendations. DHCP and DNS Configuration Management Standardize IP address, DHCP, and DNS provisioning Our survey of IT pros revealed that managing DHCP and DNS configurations is the most time-consuming IP management task. For each IP address provisioned or decommissioned, there are often additional DHCP and DNS configuration changes that must be made. Therefore, look for a solution that makes the process of IP address provisioning or decommissioning seamless and consistent with finding an available IP address and making DHCP and DNS configuration changes. Using an integrated DHCP and DNS configuration tool simplifies and streamlines many IP management tasks. This is accomplished primarily in two ways. First, you can combine and simplify typical work processes. For example, finding an available IP address and provisioning DHCP and DNS can be combined into one seamless workflow. The process can be as simple as locating the target subnet, identifying an available IP address, and editing the available DHCP and DNS properties. When the action is saved, the changes are pushed to the target systems. No more consulting and updating a spreadsheet, locating and making changes to the target DHCP server, and then locating the target DNS servers and modifying a record. The IP management system makes this simple and seamless. CASE STUDY MANAGED HEALTHCARE SERVICE PROVIDER Situation: This managed healthcare organization underwent a complete overhaul and replacement of their network monitoring system two years ago. As part of the refresh, the manual process for tracking IP addresses using a spreadsheet was replaced with a software-based IPAM solution from the same vendor. Challenge: The networking team was managing IP addresses using a manual spreadsheet process. The team would average 20 requests per month for IP addresses from other infrastructure teams. These requests were not given a high priority and consequently, the other teams were kept waiting until someone in network operations picked up the ticket and filled the request. SolarWinds IP Manager: The SolarWinds IP Address Manager was deployed and has 72,000 devices under management, incorporating everything with an IP address including IT infrastructure, enduser devices, and printers. The NOC administers and manages the product, but the individual groups manage and assign their own IP addresses. This self-service model has greatly improved operational efficiency across multiple IT organizations. Benefit: The most immediate benefit to the infrastructure teams was the time savings. The request and allocation process is immediate, so no one has to wait for the network operations team to complete the task. The tool performs the entire discovery process as well as tracking IP address information (both current and historical), providing a complete and accurate picture of the IP schema. One unexpected benefit was the ability to manage and alert if a DCHP scope is filling up. This feature uncovered the root cause of an ongoing problem the company had been experiencing with DHCP. Second, IP management software provides a management layer which homogenizes heterogeneous services. For example, when provisioning DHCP and DNS settings, you no longer need to be concerned about learning the intricacies of how each underlying service 2 Gartner: Ronni J. Colville and George Spafford Configuration Management for Virtual and Cloud Infrastructures 3

4 works. It no longer matters how a DHCP reservation is configured on a Microsoft, Cisco, or Open Source DHCP server because the IP Management software knows how to execute the request (error-free) on the target system. This overlay management model provides four important benefits. First, it protects investments in existing service components by eliminating the need to replace your current infrastructure. Second, administrators require less training (or re-training). Third, network planners can scale or change underlying service components with minimal disruption. And finally, it delivers a high degree of standardization and consistency which improves mean time to failure (MTTF) and mean time to recovery (MTTR). IP Conflict Troubleshooting Find and Fix IP Conflicts Fast The survey showed that troubleshooting IP-related problems is the second most timeconsuming IP management task. When an IP conflict occurs, you must do the following to resolve the problem: Ensure that the problem is an IP conflict Determine which device caused the conflict Locate the offending device Isolate the offending device from the rest of the network Find an available IP address Re-provision the offending device using a new unique address Without specialized troubleshooting tools, these steps can take hours to complete. Therefore, look for a solution that can help you troubleshoot as well as remediate common problems. Troubleshooting complements monitoring and alerting. A solution s ability to facilitate the rapid detection, diagnosis, and remediation of a problem is equally important. For example, suppose that an IP address conflict existed on the network. A great IP address management solution shouldn t only detect a conflict. It should also be able to analyze why the conflict occurred, tell you where the affected devices are connected to your network, and help remediate the problem. The software should be able to temporarily disable the switch port that s being used by the device in question, assign a new IP address to the device, and then update any related DNS entries. IP Address Administration Inventory and Track IP Subnets and Address Blocks Our survey respondents cited managing IP address documentation as the third most timeconsuming IP management task and for good reason. When managing tens of thousands of IP addresses, you can spend a great deal of time and effort inventorying and tracking each IP address. In fact, the reason you maintain an accurate inventory of IP addresses is to ensure that each device uses a unique address. Without a reliable inventory, addresses are more likely to be used multiple times and cause an IP conflict. Manual methods, like spreadsheets, are unreliable because they depend on regular manual entries to track and update IP address records. Look for a solution that uses an authoritative, collaborative database to track current statuses and operational history for each managed IP address. The database should 4

5 be automatically maintained using a variety of network scanning techniques and DHCP integration to help reduce manual effort and ensure accuracy. The best solutions will use both DHCP data and network scanning to accurately determine the operational status of an IP address. Because DHCP dynamically assigns many IP addresses, it s important to know what IP addresses DHCP has leased or reserved. However, not all IP addresses are managed via DHCP. Therefore, you cannot rely on DHCP alone as a complete authoritative source. You need a second source to accurately verify the status of an IP address. That second source of data comes from scanning the network to determine which IP addresses are in use. When you use DHCP and network scanning together, your IP address management database will be more accurate and require minimal effort to maintain. When you use network scanning, you should use these scanning methods: 1) Neighbor scans (reading ARP tables), 2) ICMP scans, and 3) SNMP scans. The database should also be collaborative. This means it should be a resource for many individuals across the organization. Because a good IP management solution is capable of managing all IP address blocks and DNS and DHCP servers, it s imperative for the solution to recognize organizational boundaries. For example, network administrators may manage the corporate IP space along with DNS services and provision core network devices; however, they don t commonly manage local subnets and the devices within those subnets. These tasks are often assigned to system administrators. Because of this, an IP management system must be able to adhere to established administrative boundaries. Otherwise, the solution will be disruptive to the organization s established management framework. Therefore, an IP management system should allow the subnet to delegate administrative access and allow for the use of role-based access control. DDI Monitoring Actively Monitor DHCP Scope, Subnets, IP Conflicts, DNS errors, and more The survey results revealed that monitoring DDI resources is the fourth most timeconsuming IP management task. A large network can have thousands of IP addresses in use at any given time. It s unrealistic to expect an administrator to be able to spot a problem with a single address the instant it happens. Therefore, the purpose of monitoring is to raise awareness of situations that could potentially be problematic either from a network configuration standpoint, or from a security standpoint. Key IP resources that should be monitored include: DHCP scopes and static subnets for IP address usage and depletion, DNS A/PTR records mismatch errors, and configuration change events. In addition, the solution should also include alerting and reporting features. Alerts will escalate emerging problems and reports will help with planning and improving processes. Look for a solution that monitors critical IP resources and can proactively alert you of a pending problem. Summary We started our discussion by noting that the fast pace of IT innovation can pose challenges to IT operations management, and inevitably, old management practices must give way to new ones in order to embrace innovation and improve efficiency. When managing IP addresses, DHCP, and DNS, this means adopting an IP configuration and monitoring 5

6 solution that delivers significant improvements in the areas of DHCP and DNS configuration management, IP conflict troubleshooting, IP address administration and DDI monitoring. Organizations who use an IP configuration and monitoring solution report experiencing the following benefits: Reduced the time spent managing IP-related tasks Improved MTTF and MTTR Improved resource forecasting and planning But let s put this in a sharper perspective. Gartner believes a DDI solution can help firms reduce the opex expense of managing DHCP, DNS, and IP addresses by 50%. 3 With a few basic assumptions, we can calculate the savings in cost and manpower. Consider the following: Assumptions IP's to Manage Solution Cost Pricing per managed IP Maintenance Renewal OPEX Savings Rate Hrly Salary for IT Staff Person-hrs Spent MONTHLY Managing DHCP, DNS and IP Addresses Today OTHER Anticipated Monthly Savings OTHER Anticipated Monthly Costs Purchase Maintenance Other Anticipated Annual Costs TOTAL Outlay 5, , $ % 50% $ $ - $ - Outlay Year 1 Year 2 Year 3 Year 4 Year 5 TOTAL Savings Annual OPEX Savings Based on Partial FTE Other Anticipated Savings TOTAL Savings Net Savings 8, , , , , , , , , , , , $16, , , , , , , , , , , , $53, , , , , , $37, To learn more about how SolarWinds can help you manage DHCP, DNS, and IP addresses, please visit our website. 3 Gartner: Andrew Lerner, Lawrence Orans Market Guide for DNS, DHCP and IP Address Management 2014 SolarWinds, Inc. All rights reserved. SolarWinds, the SolarWinds logo, ipmonitor, LANsurveyor, and Orion are among the trademarks or registered trademarks of the company in the United States and/or other countries. All other trademarks are property of their respective owners. WP