IP Address Manager ADMINISTRATOR GUIDE. Version Last Updated: Tuesday, October 24, 2017

Transcription

1 ADMINISTRATOR GUIDE IP Address Manager Version Last Updated: Tuesday, October 24, 2017 Retrieve the latest version from:

2 2017 SolarWinds Worldwide, LLC. All rights reserved. This document may not be reproduced by any means nor modified, decompiled, disassembled, published or distributed, in whole or in part, or translated to any electronic medium or other means without the prior written consent of SolarWinds. All right, title, and interest in and to the software and documentation are and shall remain the exclusive property of SolarWinds and its respective licensors. SOLARWINDS DISCLAIMS ALL WARRANTIES, CONDITIONS OR OTHER TERMS, EXPRESS OR IMPLIED, STATUTORY OR OTHERWISE, ON SOFTWARE AND DOCUMENTATION FURNISHED HEREUNDER INCLUDING WITHOUT LIMITATION THE WARRANTIES OF DESIGN, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, AND NONINFRINGEMENT. IN NO EVENT SHALL SOLARWINDS, ITS SUPPLIERS, NOR ITS LICENSORS BE LIABLE FOR ANY DAMAGES, WHETHER ARISING IN TORT, CONTRACT OR ANY OTHER LEGAL THEORY EVEN IF SOLARWINDS HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. The SolarWinds and other SolarWinds marks, identified on the SolarWinds website, as updated from SolarWinds from time to time and incorporated herein, are registered with the U.S. Patent and Trademark Office and may be registered or pending registration in other countries. All other SolarWinds trademarks may be common law marks or registered or pending registration in the United States or in other countries. All other trademarks or registered trademarks contained and/or mentioned herein are used for identification purposes only and may be trademarks or registered trademarks of their respective companies. page 2

3 Table of Contents Introduction 1 Install IPAM 2 IPAM installation requirements 2 General installation requirements 2 Hardware requirements 2 Software requirements 3 Big line SQL database requirements 4 Requirements for virtual machines and servers 4 Requirements for the Orion database server (SQL Server) 4 Upgrade paths 6 Installation 6 IPAM licensing 7 Maintain licenses with License Manager 8 IPAM License Manager 8 Install License Manager 8 Deactivate and register licenses with the License Manager 8 Use License Manager 9 Check license status 9 Configure IPAM 10 Log in to the Orion Web Console 10 IPAM Getting Started wizard 10 Configure subnet scan settings manually 11 Populate UDT User and Switch Ports in the IP address view 12 Credentials 12 Add Windows credentials 13 page i

4 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Add SNMP credentials 13 Add Cisco CLI credentials 14 Define system settings for IPAM 15 Add a custom field 16 Customize the IPAM Summary view 16 Change view layout 17 Add a resource 17 Delete a resource 17 Copy a resource 17 Reorder resource display 17 Customize tab views 18 User role delegation 18 Roles and privileges 18 Add user accounts 20 Create a custom role 20 Custom roles 21 Define a custom role 21 Manage IP addresses 23 Add IP addresses 23 Search for IP addresses 24 Import and export IP addresses and subnets 24 Import an IP address into existing addresses 25 Import using Bulk Add Subnets 25 Import IP addresses and subnets from SolarWinds Engineer's Toolset 26 Export IP addresses and settings 26 Assign a subnet to an orphan IP address 27 Export IP addresses and settings 28 Organize an IP address space into subnets 28 page ii

5 IP Address Details view 29 Historical tracking 29 IP address conflicts 29 IP address conflict scenarios 30 IP address conflict scenarios 30 IPv6 monitoring 31 IPv6 scanning 32 Add IPv6 addresses 33 Create an IPv6 global prefix 33 Create an IPv6 subnet 34 Assign IPv6 addresses 34 Edit an IPv6 prefix 34 Add IPv6 subnets 34 Add IPv6 addresses 35 Edit multiple IPv6 addresses 35 Delete monitored IP addresses from a defined subnet 35 Set an IP address status to Available, Used, Transient, or Reserved 35 IPAM status icons 35 Edit IP address properties 37 Edit multiple IP address properties 38 Edit multiple IP ranges 38 Remove multiple IP ranges 38 Manage Subnets and IP Addresses page 39 IP Address View 39 Network View 40 Chart View 40 Manage subnets in IPAM 40 Create subnets 40 page iii

6 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Create a range of IP addresses in a subnet 41 Edit subnets 42 Manage subnet scans 42 View subnet scans 42 Edit subnet scans 42 Manage supernets in IPAM 43 Create supernets 43 Edit supernets 43 DHCP management 44 Requirements for monitoring Cisco DHCP servers 44 ISC DHCP server requirements 44 Configure an ISC DHCP server 45 ISC DHCP 46 Configure an ISC DHCP server 47 Add DHCP servers to IPAM 48 Edit DHCP servers 49 Remove DHCP servers 50 DHCP scopes management 50 DHCP scope options 50 Unsupported DHCP options 51 Create DHCP scopes 51 Edit DHCP scopes 53 DHCP split scopes 54 DHCP reservations 56 Remove scopes 57 DHCP Graph view 57 DNS management 58 Add a DNS server 58 page iv

7 View DNS records 59 DNS server WMI permissions 59 Enable an account for WMI 59 Grant read-only access to non-administrator accounts for IPAM DNS monitoring 59 DNS zone transfers 61 Edit a DNS server 62 Remove DNS servers 62 DNS records 62 Edit DNS records 62 DNS records mismatch 63 Add a DNS zone 63 Edit a DNS zone 65 Bind DNS monitoring and management 65 BIND credentials 66 Required permissions 66 Add a BIND DNS server 66 Create reports with IPAM 68 Get started with Report Writer 68 Preview mode 68 Design mode 68 Preview mode 68 General Options tab 69 Select Fields Options tab 69 Predefined Orion IPAM reports 70 Statistics reports 70 Events report 70 Open predefined IPAM reports 70 Alerts 72 page v

8 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER View all active alerts 72 View all triggered alerts 72 View alerts in Orion System Manager 73 IPAM advanced alert example 73 Additional IPAM Features 75 Manage groups in IPAM 75 IPAM groups 75 Create groups 76 Edit groups 76 Edit groups 76 Integrate SolarWinds Engineer s Toolset with IPAM 76 Interact with the THWACK user community 77 Thwack - Recent IPAM posts resource 77 Provide feedback 77 Networking concepts and terminology 78 page vi

9 Introduction IP Address Manager (IPAM) provides detailed visibility into IP address DHCP scope, and subnet use. Use IPAM to plan for network growth, view available and used IP address space, and troubleshoot IP address conflicts. IPAM uses ICMP and SNMP calls to collect details from devices on your network, track IP address use, and record IP addresses that are no longer in use. All data are accessible from the Orion Web Console. There are three scanning modes used to scan IP addresses: ICMP scan (ping sweep) SNMP scan Neighbor scan (using ARP tables) Common IPAM tasks include: importing spreadsheets, creating subnets, managing the DHCP server, and IP address historical tracking. page 1

10 Install IPAM This section includes the following topics: Requirements Installation Licensing IPAM installation requirements IPAM can be installed as a stand-alone product or as a module to Network Performance Monitor (NPM). The module scenario above requires a minimum version of NPM General installation requirements SolarWinds recommends installing your Orion product on its own server, with the IPAM database hosted separately on its own SQL Server. Installations of multiple IPAM servers using the same database are not supported. Hardware requirements The following table lists minimum hardware requirements and recommendations for your Orion server. Hardware requirements are listed by Orion license level. H ARDWARE IP1000, OR IP4000 IP16000 IPLX CPU Speed 2.0 GHz 2.4 GHz 3.0 GHz Dual processor, dual core is recommended. Hard Drive Space 2 GB 5 GB 20 GB A RAID 1 drive for server operating system, IPAM installation, and tempdb files are recommended. The installer needs 1GB on the drive where a temporary Windows system or user variables are stored. Per Windows standards, some common files may need to be installed on the same drive as your server operating system. Memory 3 GB 4 GB 4 GB page 2

11 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER H ARDWARE Application Ports IP1000, OR IP4000 IP16000 IPLX 161/SNMP and 443/SNMP. VMware ESX/ESXi Servers are polled on /TCP open for Orion module traffic 17778/ HTTPS open to access the SolarWinds Information Service API Software requirements The following table lists minimum software requirements and recommendations for your server. S OFTWARE Operating System REQUIREMENTS Windows Server 2008, 2008 SP2, 2008 R2 and 2008 R2 SP1 Windows Server 2012, 2012 R2 IIS and Windows 2012 must be installed. SolarWinds recommends that IPAM administrators have local administrator privileges to ensure full functionality of local Orion tools. Accounts limited to use of the IPAM Web Console do not require administrator privileges. SolarWinds does not support production installations of Orion products on Windows XP, Windows Vista, or Windows 7 systems. Web Server Microsoft IIS version 6.0 and later in 32-bit mode. DNS specifications require that host names be composed of alphanumeric characters (A-Z, 0-9), the minus sign (-), and periods (.). Underscore characters (_) are not allowed. For more information, see RFC 952. SolarWinds neither recommends nor supports the installation of any Orion IPAM product on the same server or using the same database server as a Research in Motion (RIM) Blackberry server..net Framework SNMP Trap Services Web Console Browser Version 3.5. or 4.0.NET Framework 3.5 SP1 is recommended. Windows operating system management and monitoring tools component Microsoft Internet Explorer version 8 or later with Active scripting. Firefox 3.0 or later (Toolset Integration is not supported on Firefox). Chrome 42 and 43 page 3

12 Big line SQL database requirements The Orion Installation wizard installs the following required x86 components if they are not found on your Orion database server: SQL Server System Common Language Runtime (CLR) Types. Orion products use secure SQL CLR stored procedures for selected, non-business data operations to improve overall performance. Microsoft SQL Server Native Client Microsoft SQL Server Management Objects Requirements for virtual machines and servers Orion installations on VMware virtual machines and Microsoft virtual servers are fully supported if the following minimum configuration requirements are met for each virtual machine. SolarWinds strongly recommends that you maintain your SQL Server database on a separate physical server. VIRTUAL MACHINE CONFIGURATION IPAM REQUIREMENTS BY LICENSE LEVEL IP1000, or IP4000 IP16000 IPLX CPU Speed 2.0 GHz 2.4 GHz 3.0 GHz Allocated Hard Drive Space 2GB 5GB 20GB Due to intense I/O requirements, the SQL Server should be hosted on a separate physical server configured as RAID 1+0. RAID 5 is not recommended for the SQL Server hard drive. Memory 3 GB 4 GB 4 GB Network Interface Each virtual machine on which IPAM is installed should have its own dedicated network interface card. Because Orion uses SNMP to monitor your network, if you are unable to dedicate a network interface card to your Orion server, you may experience gaps in monitoring data due to the low priority generally assigned to SNMP traffic. Requirements for the Orion database server (SQL Server) The following table lists software and hardware requirements for your Orion database server. page 4

13 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER REQUIREMENTS IP1000, OR IP4000 IP16000 IPLX SQL Server SQL Server 2005 SP3 Express, Standard, or Enterprise SQL Server 2005 SP4 Express, Standard, or Enterprise SQL 2008 without SP, 2008 SP1, 2008 SP2, 2008 SP3 Express, Standard, or Enterprise SQL 2008 R2 without SP, 2008 R2 SP1, 2008 R2 SP2 Express, Standard, or Enterprise SQL Server 2012 SP1, 2012 SP2 Express, Standard, or Enterprise SQL Server 2014 Express, Standard, or Enterprise SQL Server 2005 SP3 must upgrade to SP4 or SQL 2008 as it will be dropped in the next release. Due to latency effects, SolarWinds does not recommend installing your SQL Server and your IPAM server or additional polling engine in different locations across a WAN. See Install SolarWinds software and SolarWinds database (SQL Server) across a WAN for more information. Either mixed-mode or SQL authentication must be supported. If you are managing your Orion database, SolarWinds recommends that you install the SQL Server Management Studio component. If your Orion IPAM product installs SQL Server System CLR Types, a manual restart of the SQL Server service for your Orion database is required. Use the following database select statement to check your SQL Server version, service pack or release level, and edition: select SERVERPROPERTY ('productversion'), SERVERPROPERTY ('productlevel'), SERVERPROPERTY ('edition') SQL Server Collation English with collation setting SQL_Latin1_General_CP1_CI_AS English with collation setting SQL_Latin1_General_CP1_CS_AS German with collation setting German_PhoneBook_CI_AS Japanese with collation setting Japanese_CI_AS Simplified Chinese with collation setting Chinese_PRC_CI_AS CPU Speed 2.0 GHz 2.4 GHz 3.0 GHz page 5

14 REQUIREMENTS IP1000, OR IP4000 IP16000 IPLX Hard Drive Space 2 GB 5 GB 20 GB Due to intense I/O requirements, a RAID 1+0 drive is strongly recommended for the SQL Server database and Orion data and log files. RAID 5 is not recommended for the SQL Server hard drive. The Orion installer needs at least 1GB on the drive where the temporary Windows system or user variables are stored. Per Windows standards, some common files may need to be installed on the drive as your server operating system. Memory 2 GB 3 GB 4 GB SolarWinds recommends additional RAM of up to 8 GB for Orion IPAM installations that include more than 1000 monitors. Upgrade paths SolarWinds Orion modules and stand-alone products are compatible with the specific versions of SolarWinds Orion Network Performance Monitor (NPM). See Compatibility of SolarWinds Orion products for installation and upgrade and End of Life Support for the latest updates. Stand-alone products do not require any other SolarWinds products to be installed. To upgrade from earlier versions of IPAM, follow the given upgrade path. Installation Before you install Orion IPAM, ensure that your environment meets the requirements. Upgrade additional Orion pollers or Web Consoles at the same time you update your Orion server. 1. Log in as an administrator to the server on which you are installing SolarWinds IPAM. Back up your database before you perform an upgrade. 2. Extract the contents of the downloaded installation ZIP file and launch the executable. 3. Click Next on the Welcome window. The system scans the environment to ensure that the system requirements are met. If your system is not compatible, the installer provides a link to the resolution. After the compatibility issue is resolved, run the installation again. 4. Accept the terms in the license agreement. 5. Click Next, and click Finish. 6. Click Enter Licensing Information. page 6

15 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 7. If the computer on which you installed IPAM is connected to the internet, complete the following procedure. a. Click I want to activate my license over the Internet. b. Browse to the SolarWinds Customer Portal and log in with your customer ID and password. c. Copy your IPAM Activation Key to the clipboard and then paste it into the Activation Key field on the Activate IPAM window. d. Click Next. e. Enter your contact information. f. If you use a proxy server to access the Internet, select Proxy Server and enter the proxy address and port number. g. Click Next. 8. After the Orion IP Address Manager Setup wizard completes, click Finish. 9. If the Configuration wizard does not start automatically, click Start > All Programs > SolarWinds Orion > Configuration Wizard. 10. Review the welcome text, and click Next. 11. Select the services to install in the Service Settings window, and click Next. 12. Click Finish after the Orion Configuration wizard completes the installation. You can now manage your network with IPAM. IPAM licensing IPAM is licensed in accordance with the number of IP addresses you manage in one of three statuses: Used, Reserved, and Transient. Unused IP addresses do not count towards the managed IP address count. IPAM licensing count is the same for IPv4 and IPv6. The following license are available: LICENSE NUMBER OF MANAGED IP ADDRESSES DHCP AND DNS NODES IP1000 Up to Nodes IP4000 Up to Nodes IP16000 Up to Nodes IPX Unlimited Unlimited Nodes SolarWinds does not recommend managing more than 1 million addresses per installation. page 7

16 Maintain licenses with License Manager With SolarWinds License Manager, an easily installed free utility, you can migrate Orion licenses from one computer to another without contacting SolarWinds Customer Service. The following sections provide procedures for installing and using License Manager. IPAM License Manager Use SolarWinds License Manager to migrate Orion licenses from one computer to another computer. Install License Manager on the computer that has SolarWinds products installed. The License Manager can only license products on that computer. Install License Manager You must install License Manager on a computer with the correct time. 1. Start the SolarWinds License Manager Setup in the SolarWinds program folder. If problems with License Manager occur, or if the computer does not have access to the Internet, download and install the latest version of License Manager. 2. Click Next, and then click Install. Deactivate and register licenses with the License Manager If you move your SolarWinds product to another server, you must deactivate the license on the computer with the currently licensed product, and reactivate it on the server with the new installation. To deactivate and reuse a license without contacting SolarWinds Customer Service, your product needs to be under active maintenance. 1. Log in to the computer where the licensed SolarWinds product is installed. 2. Start the License Manager in the SolarWinds program folder. 3. Select the products you want to deactivate on this computer, and click Deactivate. You can deactivate more than one product at the same time. With this option, the deactivation file contains information about each product. With some products, you can use the internal licensing tool of the product to deactivate licenses. 4. Complete the Deactivation wizard, and save the deactivation file. 5. Log in to the SolarWinds Customer Portal, and navigate to the License Management page. 6. Select your product instance, and click Deactivate License Manually. page 8

17 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 7. On the Manage License Deactivation page, locate the deactivation file you created in License Manager, and click Upload. The deactivated licenses are now available to activate on a new computer. Use the License Manager to deactivate licenses offline with a created file that can be uploaded to the customer portal. 8. Log in to the computer on which to install your products, and begin installation. 9. When asked to specify your licenses, provide your information. The license you deactivated is assigned to the new installation. Use License Manager You must run License Manager on the computer where the currently licensed SolarWinds product is installed before you can move licenses to a new installation. The following procedure deactivates currently installed licenses that can then be transferred to a new installation. Check license status Orion IPAM provides a tool to display the current usage of your license by indicating the number of currently managed addresses. This number is also displayed in the lower right of the Manage Subnets page. 1. Click Start > All Programs > SolarWinds Orion > Orion IP Address Manager > Orion IP Address Manager Licensing. 2. Click Restart IPAM Services to update the website with the license change. 3. Click Close. page 9

18 Configure IPAM This section includes the following topics: Define system settings for IPAM Configure subnet scan settings manually Add a custom field Populate UDT User and Switch Ports in the IP address view Credentials User role delegation Log in to the Orion Web Console 1. Launch the Orion Web Console using either of the following methods: Start Orion Web Console in your SolarWinds Orion program folder. Launch a browser and enter or where ip_address is the IP address of your Orion server, or where hostname is the domain name of your Orion server. 2. Enter the user name and password, and click Login. IPAM Getting Started wizard Use the IPAM Getting Started wizard to quickly begin using Orion IP Address Manager. You can add subnets, IP addresses, DHCP and DNS servers. 1. Log in to the Orion Web Console. 2. Click Settings >All Settings > IPAM Settings > Getting started wizard. page 10

19 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 3. Select an option and click Next to begin adding items: Add Subnets & IP Addresses Add DNS Server Add DHCP Server Configure subnet scan settings manually IPAM uses SNMP and ICMP to scan and determine the status of your monitored network. You can select how IPAM automatically scans your network for changes. 1. Click Settings > All Settings > IPAM Settings > Manage Subnet Scan Settings. 2. Enter the maximum number of simultaneous scans you want IPAM to attempt. 3. Provide a value for the transient period. IPAM continuously scans all managed IP addresses on your network. If a device fails to respond to any SNMP or ICMP requests for the period of time designated as the transient period, Orion IPAM changes the status of the unresponsive IP address from Used to Available. Any associated custom attribute is overwritten. 4. You can assign transient scan intervals on a per subnet basis from the Edit Subnet Properties window. 5. ICMP is used by default to scan your network subnets for changes. To configure ICMP: a. Provide a number of pings per address. b. Designate the delay between pings and the ping timeout, in milliseconds, for ICMP requests on your network. page 11

20 6. To configure SNMP to scan your network subnets: a. Select Enable SNMP Scanning in the SNMP Scanning section. b. Select Enable SNMP neighbor scanning. c. Provide a number of SNMP retries. d. Designate the SNMP Timeout, in milliseconds, for SNMP requests on your network. 7. Click Save. You can disable scanning on a per subnet basis. See Edit subnets for more information about editing subnet properties. Populate UDT User and Switch Ports in the IP address view Integration with User Device Tracker (UDT) adds User and Switch Ports columns to your IP Address view and provides end-to-end IP address to user-device mapping. IPAM detects if UDT is installed and automatically adds the columns. Only direct MAC connections identified by UDT are mapped to IPAM. Indirect or unknown connections are not shown in IPAM. To populate the columns with data: 1. Click My Dashboards > Manage Subnets & IP Addresses. The UDT Users and Switch Ports columns are added to the IP Address view. 2. To populate data in the UDT columns, enable data collection in both IPAM and UDT. In IPAM, add a subnet. For example, , , In UDT, add nodes. For example, , , Add a domain controller (AD integrated) in UDT as a node , See IP Address Conflicts for more information about using UDT and IPAM for troubleshooting issues. Credentials This section includes the following topics: Add Windows credentials Add Windows credentials Add Cisco CLI credentials page 12

21 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Add Windows credentials Store Windows credentials for Orion IPAM to use to access and scan your DHCP network devices. You can update credentials locally from the IPAM server or over an HTTPS connection. The Windows account must have the interactive log in rights enabled for IPAM to log in. 1. Click Settings > All Settings > IPAM Settings > Credentials for Scope scans. 2. Click Add New and select Windows. 3. Enter a display name, a user name, and a password for the credential. 4. Click Save. The Windows account specified within IPAM must be on the DHCP server and be DHCP users, DHCP administrators, or local administrators. If IPAM is not in the same Windows domain as the DHCP server, IPAM must have the identical account and password. Add SNMP credentials You can store SNMP credentials used for scanning SNMP devices on your network. Orion IPAM attempts SNMP communication using the stored credentials in the order provided. 1. Click Settings > All Settings > IPAM Settings > SNMP Credentials. 2. Click Add. 3. Enter a display name for the credential. 4. Select the SNMP version of the credential. If the credential you add is required to scan devices using the enhanced security features of SNMPv3, select SNMPv3. If you select SNMPv2c and you do not want Orion IPAM to use SNMPv1 if an SNMPv2c request fails, select Use SNMP v2 only. IPAM uses SNMPv2c by default. 5. Enter an SNMP Port number. The default is port To use SNMPv1 or SNMPv2c for subnet scanning with the SNMP credential, enter a valid read-only community string for the devices you want to scan with the credential. 7. To use SNMPv3 for subnet scanning with the SNMP credential, provide the following: 8. Click Save. SNMPv3 Authentication Method and Password/Key SNMPv3 Privacy/Encryption Method and Password/Key page 13

22 Add Cisco CLI credentials IPAM uses CLI (command-line interface) commands and Telnet or SSH protocols to gather data from CISCO devices. Store the CLI credentials IPAM uses to connect to your Cisco devices. Verify that your CISCO DHCP servers have configurable connection types (SSH or Telnet), ports, and a user name and password. If you change passwords on managed devices, ensure that you also change them in the IPAM credentials list. 1. Click Settings > All Settings > IPAM Settings > Credentials for Scope scans. 2. Click Add New and select Cisco. 3. Enter a display name, a user name, and a password for the credential. The user name and password is the same user account you use to log in to the device through CLI to perform system configurations. 4. Select the Enable Level. The Enable Level must have privileges to execute configure terminal commands and to configure IP SLA operations. 5. Enter the Enable Password. 6. Select the Protocol. 7. Select the Port. 8. Click Save. page 14

23 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Define system settings for IPAM After you install and configure IPAM, you can edit the system settings to set variables that address your specific needs. 1. Click Settings > All Settings > IPAM Settings. 2. Click System Settings. 3. Edit settings: 4. Click Save. Enable Duplicated Subnets: Enable this option to create a subnet that is a duplicate or overlaps an existing subnet. For example, if an MSP has customers on duplicate internal addresses, create the duplicate space and give the subnet a different name. If the subnet is disabled, the status from multiple DHCP server scopes merge into one subnet, rather than have different subnets for each server s scope. Thresholds: Define the Critical and Warning thresholds for your IP address space. Configuration details: Define default scan intervals and default CIDR values, enable subnet scans, and choose to automatically add IP addresses. Visual settings: Define how many items display in the tree pane, the network view items, and the IP Address view items. Personal settings: Enable this option to display a notification message when changes are made to a parent subnet. page 15

24 Add a custom field Orion IPAM provides predefined text properties to help organize your network and create URL custom links. You can add descriptive text fields to addresses, subnets, supernets, and groups or link to external URLs. The Orion Network Performance Monitor Custom Property Editor capabilities are not integrated with the Orion IPAM module at this time. 1. Click Settings > All Settings > IPAM Settings > Manage IPAM Custom Fields. 2. Click Add. 3. Enter custom field details: 4. Click Save. Database column: the label used when IPAM references the custom field you define in the IPAM Web Console. The value is the alphanumeric label used in the IPAM table of your Orion database for the custom field you define. By default, IPAM generates this value sequentially. Description: a description of the custom field. Field type: the field type for the custom property can be text-based or a URL-linked property. Link title: a title for your custom property URL link. For example, a link to your IP SLA module Web interface. Max string length: sets a limit to the number of characters you can use for any value of the custom field you define. Add to groups, supernets, subnets, DHCP servers, scopes, DNS servers, zones: make the field available to all network components defined in Orion IPAM. You can edit this field when you edit any network component. Add to IP addresses: make the field available to all IP addresses monitored by IPAM. You can edit this field when you edit any IP address. Customize the IPAM Summary view The IP Address Manager page provides a highly customizable display of the current status of managed IP addresses on your monitored network. You can customize your IP Address Manager view by adding, deleting, or reordering any available Orion resource. By default, the IP Address Manager view provides the following resources: Top 10 Subnets by % IP Address Used Top 10 DHCP Scopes by Utilization IP Address Conflicts Search for IP Address Custom List of Reports page 16

25 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Change view layout 1. Click Settings > All Settings > IP Addresses > Customize Page. 2. Click Edit 3. Select the number of columns. 4. Select the width, in pixels, of each column. 5. Click Submit. Add a resource 1. Click IP Addresses > Customize Page. 2. Click + next to the column in which you want to add a resource. 3. On the Add Resources page click + next to a resource group. 4. Select the resources you want to add. 5. Click Submit. Delete a resource 1. Click IP Addresses > Customize Page. 2. Select the resource. 3. Click X next to the resource column. 4. Click Preview to review changes in a new window. 5. After you have completed your changes click Done. Copy a resource 1. Click IP Addresses > Customize Page. 2. Select the resource. 3. Click next to the resource column to copy the selected resource. 4. Click Preview to review changes in a new window. 5. After you have completed your changes click Done. Reorder resource display 1. Click IP Addresses > Customize Page. 2. Select a resource and use the arrow keys to arrange them. 3. Click Preview to review changes in a new window. 4. After you have completed your changes click Done. page 17

26 Customize tab views Both the Network view and the IP Address view may be personalized by reordering their respective default column arrangements. User role delegation Use role definitions to restrict user access to help maintain security to your IP addresses without limiting your ability to delegate required network management activities. This section includes the following topics: Roles and privileges Add user accounts Roles and privileges When you add user accounts in IPAM, you assign each user a role. The role determines the user's privileges. If subnets are moved to create hierarchy changes, inherited roles are inherited from the new parent. Customized roles are not changed. ROLE Administrator PRIVILEGES The Administrator user role has read and write access, can initiate scans to all subnets, manage credentials, custom fields, and IPAM settings and has full access to DHCP management and DNS monitoring. Only administrators can perform certain actions, such as: SNMP credentials management Custom fields management Subnet scan settings configuration Directly configure custom roles in the Subnet Edit dialog Power User Power Users have the same privileges granted to Operators with the addition of the following abilities: Drag-and-drop reorganization of network components in the Manage Subnets and IP Addresses view. Supernet and group properties management, including the ability to edit supernet and group properties and custom fields on portions of the network made available by the Administrator. page 18

27 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Operator Operators have the same privileges granted to Read Only users with the addition of the following abilities: Addition and deletion of IP address ranges from portions of the network made available by the site administrator Subnet status selection on the Manage Subnets & IP Addresses page IP address property and custom field management, including the ability to edit IP address properties on portions of the network made available by the site administrator Read Only This role has read-only access to DHCP servers, scopes, leases, reservations and DNS servers, and zones. This role restricts all access, including access to all DHCP management and DNS monitoring, to the following: All IPAM Web Console resources, including search and Top XX resources All IP address and network component properties and custom fields on the Manage Subnets and IP Addresses page The Chart view on the Manage Subnets & IP Addresses page Custom A Custom Role is customized on a per subnet basis and specifies which privileges a user has. You can also overwrite the inherited permissions on child objects. The child objects inherit the same permissions as the parent. page 19

28 Add user accounts You must add a user account for each person who needs to log in to IPAM. Each user is assigned a role, which determines the user's permissions. 1. Click Settings > All Settings > IPAM Settings > Manage Roles & Permissions. 2. Click Add New Account. 3. Choose an account type, and click Next. 4. Enter the credentials, and click Next. 5. Define the general settings for Orion Account Limitations and Menu Bar views. 6. Expand the IP Address Manager Settings. 7. Select the role and click Submit. Create a custom role A custom role is customized on a per subnet basis and specifies which privileges a user has. You can also overwrite the inherited permissions on child objects. The child objects inherit the same permissions as the parent. page 20

29 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER DHCP and DNS access depends on the global account setting for those nodes. 1. From the Role and Permissions selection box, select Custom, and click Edit. 2. Select a group or subnet. 3. Select a role. The Inherited column tells you if the role becomes inherited with other subnets. The permission on the child object must be the same or higher than the parent object. 4. Click Submit. Custom roles The following section details how to create an IPAM custom role. These roles can be customized down to a per subnet basis. The visibility of supernets and subnets is affected by the role. The availability of operations is also affected by the role. You can overwrite the inherited permissions on child objects. The child objects inherit the same or higher permissions as the parent. Define a custom role 1. From the Role and Permissions selection box, select Custom, and click Edit. 2. Select a group or subnet, and choose a role. The Inherited column tells you if the role becomes inherited with other subnets. For multiple selections, press the Ctrl key while selecting the group or subnet. page 21

30 3. You can set permissions for particular subnets by selecting the subnet and then selecting a user role. The permission on the child object must be the same or higher than the parent object. After submitting, a message displays confirming the creation of the new role. To customize either the Network view or the IP Address view, click a column header and drag it to your preferred location. Your view personalization is saved immediately, and it is retained for the next time you use Orion IPAM. From the menu, you can select which resources to add, and resize the columns to fit your needs. page 22

31 Manage IP addresses This section includes the following topics: Add IP addresses Import and export IP addresses and subnets Import an IP address into existing addresses Create a range of IP addresses in a subnet Search for IP addresses Assign a subnet to an orphan IP address Organize an IP address space into subnets IP address conflicts IP Address Details view Manage groups in IPAM IPv6 monitoring Add IP addresses IP addresses must be added to IPAM before they can be monitored. The following options are available for adding IP addresses to IPAM: Import a spreadsheets into IPAM Manually add IP addresses to a subnet Bulk import subnets Import addresses into existing subnets Add IPV6 addresses A range of IP addresses can be added to any defined subnet. This is usually done when you want to monitor specific addresses within a large subnet. For smaller subnets containing 4096 or fewer IP addresses (/20 or and higher mask), Orion IPAM automatically monitors all included IP addresses. IPAM automatically monitors all IP addresses in subnets defined with 4096 IP addresses (/20 or mask) or fewer. You can manage IP addresses in larger subnets with these ranges. To add IP addresses for monitoring, add a parent subnet into any existing group, supernet, or subnet to a group that Orion IPAM is monitoring. See Create subnets for more information about adding subnets. Use the Subnet Allocation wizard to directly define subnets and allocate included IP addresses. page 23

32 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER You can also add IPv6 sites and addresses for planning purposes. See IPv6 Addresses for more information. Search for IP addresses Use the Search for IP Address resource to search multiple fields within the Orion IPAM table of your Orion database for IP addresses you manage with IPAM. 1. Click My Dashboards > IPAM Summary. 2. Under the Search for IP Address, select the criteria. 3. Enter a string or IP address, and click Search. Wildcards (*,?) are permitted, as shown in the following examples: Cisco*, *.*, W?ndows, Server-*, *.SolarWinds.com. IPAM queries the IPAM table of your Orion database and displays a list of IP addresses that match your criteria. Each IP address is listed in numerical order. Click an IP address to open that IP Address view. From the IP Address view, you can edit properties and set the status of the selected IP address. See Manage Subnets and IP Addresses page for more information about the IP Address view. Import and export IP addresses and subnets The Import wizard guides you through the process of importing IP addresses and subnets. Users can determine where the IP address information is imported to. The imported data can be distributed in existing IP addresses across the subnet tree and new subnets can automatically be created with the import. Users can import IP4 and IP6 groups, supernets, and IPV6 global prefixes, including subnet tree hierarchy. Imported data respects user delegation permissions. Only a.csv,.xls, or.xlsx file can be imported. 1. Click IP Address Manager > Import > Import Spreadsheet. 2. Click Next and then click Browse. 3. Select the contents of the file included in the import. page 24

33 4. For each Database Column from the import file, select a corresponding Spreadsheet Column name to use in the IPAM table of your database. 5. Click Next. 6. Select optional columns to import. 7. Select the option that tells IPAM how to handle the imported content, and click Next. 8. Click Add custom field to import any custom fields. 9. Click Save to add the custom field. 10. Click Next. 11. Click Confirm. 12. Click Done. See Import an IP address into existing addresses if you are importing into existing addresses. Import an IP address into existing addresses 1. Select a subnet to import into. 2. Open the subnet. 3. Click Import. If you restrict changes to only one subnet, other IP addresses outside of the subnet range are ignored. If you see a Validation Problems page because of an issue with the imported file, review the information in the grid and export the errors and correct them in a separate file. Import using Bulk Add Subnets Users can easily import subnets by bulk by entering or copying IP addresses in the page. 1. Click Manage Subnets & IP Addresses > Import. 2. Select Bulk Add Subnets. 3. Insert subnet or CIDR prefixes in the box. 4. Click Parse and Show Results Below. 5. Confirm the success message, and click Next. page 25

34 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 6. To move the subnets into a smaller supernet, select Move new subnets into the smallest appropriate supernet. a. Enter subnet properties. b. If you do not want system scans to overwrite system information, select Disable Automatic Scanning. c. Enter the scanning interval in minutes. 7. Click Done. Import IP addresses and subnets from SolarWinds Engineer's Toolset 1. Locate the Toolset IP Manager database on your Toolset server. 2. Copy the Toolset IP Address Manager database to a location on your Orion server. 3. Open a command prompt on the Orion server. 4. Enter CD :\ProgramFiles\SolarWinds\Orion\IPAM. 5. Enter "NET STOP ''SolarWinds Orion Module Engine". 6. Enter SolarWinds.IPAM.Init.exe import <Fullpath to your Toolset IP Address Manager database>. 7. Enter NET START "SolarWinds Orion Module Engine". The Toolset IP Address Manager database has an.ipdb extension. Export IP addresses and settings You can export IP addresses and settings, including any custom fields you have defined, subnet properties, friendly names, mask, and CIDR, as Microsoft Excel.xls and.csv files. The following procedure exports IP addresses and subnets from the Orion IPAM table of your Orion database as columns in a new spreadsheet. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. To export: An entire group: click the parent group of the group to export in the network organization pane, and then select the group in the Network View. An entire supernet: click a parent group or supernet of the supernetto export in the network organization pane, and then select the supernets in the Network View. Before IPAM can export any supernet, the supernet must be populated with at least one defined subnet. An entire subnet: click a parent group or supernet of the subnetto export in the network organization pane, and then select the subnets in the Network View. IP addresses: click the parent subnet of the IP address to export in the network organization pane, and then select the IP addresses to export in the Network View. page 26

35 3. Click Export in the tool bar. 4. Select the columns you want to export. The IPv4 Address column is selected automatically, and becomes the first column in the generated spreadsheet. Each additional setting or property you select becomes an additional column in the generated spreadsheet. 5. Click Export. 6. When you are prompted to open or save the file, click Save. 7. Provide a file name and location for the generated spreadsheet, and click Save. Assign a subnet to an orphan IP address After you import IP addresses from a spreadsheet, it is possible that one or more IP addresses may have been imported without being assigned to a managed subnet. In order to properly manage your network, Orion IPAM requires that all IP addresses are assigned to a managed subnet, even if the managed subnet contains only a single IP address. If Orion IPAM is unable to locate a configured subnet for each imported IP address, a warning banner is displayed above the Manage Subnets & IP Addresses view. The following procedure assigns parent subnets to orphaned IP addresses to enable their management by Orion IPAM. If you try to manage more IP addresses than your current license limit, Orion IPAM adds as many IP addresses as it can. The remaining addresses are added as orphaned IP addresses. 1. Click Assign parent subnets to orphaned IPs in the warning banner. 2. Select a single orphaned IP address. 3. Click Assign Subnet. 4. If you do not want to use the default subnet name provided by Orion IPAM, provide a new subnet name for the parent subnet. Orion IPAM suggests both a subnet address and a CIDR prefix length based on the orphaned IP address. The default subnet name provided by Orion IPAM is made by connecting the subnet address and the CIDR prefix length. 5. If you do not want to use the default subnet address and CIDR prefix length provided by Orion IPAM, provide a new subnet address and an appropriate CIDR prefix length for the parent subnet. Orion IPAM suggests both a subnet address and a CIDR prefix length based on the orphaned IP address. 6. The Description, VLAN ID, and Location for the new parent subnet fields are optional. 7. Use the slider to set the Scan Interval. 8. If you do not want Orion IPAM to automatically scan your parent subnet for changes, select Disable Automatic Scanning. 9. Click Save. page 27

36 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Export IP addresses and settings You can export IP addresses and settings, including any custom fields you have defined, subnet properties, friendly names, mask, and CIDR, as Microsoft Excel.xls and.csv files. The following procedure exports IP addresses and subnets from the Orion IPAM table of your Orion database as columns in a new spreadsheet. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. To export: An entire group: click the parent group of the group to export in the network organization pane, and then select the group in the Network View. An entire supernet: click a parent group or supernet of the supernetto export in the network organization pane, and then select the supernets in the Network View. Before IPAM can export any supernet, the supernet must be populated with at least one defined subnet. An entire subnet: click a parent group or supernet of the subnetto export in the network organization pane, and then select the subnets in the Network View. IP addresses: click the parent subnet of the IP address to export in the network organization pane, and then select the IP addresses to export in the Network View. 3. Click Export in the tool bar. 4. Select the columns you want to export. The IPv4 Address column is selected automatically, and becomes the first column in the generated spreadsheet. Each additional setting or property you select becomes an additional column in the generated spreadsheet. 5. Click Export. 6. When you are prompted to open or save the file, click Save. 7. Provide a file name and location for the generated spreadsheet, and click Save. Organize an IP address space into subnets Adding subnets to an existing supernet or to a new supernet makes it easier to manage your network. Use the Subnet Allocation wizard to organize your managed IP address space into subnets. Use the real-time subnet calculator to quickly determine the most efficient way to subdivide any supernet. 1. Click My Dashboards > Manage Subnets & IP Addresses. 2. Click Add > Subnet Allocation Wizard. 3. Enter the address of the supernet to divide in the Supernet Address field. 4. Select a CIDR prefix length. page 28

37 5. Select a subnet size. Typically, in subnets defined to contain more than two IP addresses, the first and last addresses are reserved as the network address, to identify the subnet to the network, and the broadcast address, to communicate with all addresses within the subnet. As a result, the number of available IP addresses is always two fewer than the number actually contained within a given subnet. 6. To only see allocated subnets, clear Show subnets not already allocated. 7. Click Refresh to display a list of subnets that can be allocated based on your criteria. 8. Select the subnets you want to manage, and click Next. 9. (Optional) provide a description, VLAN ID, and location for the subnets. 10. Select Disable Automatic Scanning to automatically scan the subnets for changes. 11. Click Done. IP Address Details view The IPAM IP Address Details view provides all details associated with an IP address, including Mac or host name assignment history, and DNS records. From the Manage Subnets and IP Addresses page, select a single IP address, and then click View Details to display the status of that IP address. Historical tracking Use the historical tracking feature for IP addresses, MAC assignments, and Host name assignments to view how properties have changed over time. For example, you can track MAC addresses and host names previously assigned to an IP Address. For IP addresses that have been deleted and added with a different node ID, IPAM history displays historical information from the date of the most recent node ID. Any information prior to the recent addition is deleted from IPAM history. IPAM does not retain historical information for deleted IP addresses. IP address conflicts IPAM actively scans the network and if it detects any duplicate static IP assignments or duplicate IP provisioning from a DHCP server, it triggers an event. It also detects if there is more than one MAC address using the same IP address within the same network. IPAM looks for differences in MAC addresses, from two distinct simultaneous scans for a single IP address, within a subnet. The event information displays the IP address, subnet, and MAC addresses that are in conflict. If there is an IP address in conflict, click the IP or MAC address information in the alert message to view the IP Address Detail view page. Review the device and port information of the machines connected with the User Device Tracker integration to troubleshoot the source of the conflict. page 29

38 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER IP address conflict scenarios IPAM automatically detects IP conflicts by scanning servers and devices, and alerts you when conflicts are found. IPAM alerts for the following IP address conflict scenarios. During subnet scans, MAC addresses obtained from SNMP, SNMP neighbor, and IPAM reservations are called Static entries and those obtained from DHCP servers are called Dynamic entries. SNMP versus SNMP Neighbor: There is a difference in MAC addresses retrieved from the ARP table of the configured device and SNMP OIDs during the subnet scan for an IP address. SNMP versus DHCP: There is a difference in a MAC fetched from an SNMP OID and DHCP leases from a DHCP server, for an IP address during a subnet scan. SNMP Neighbor versus DHCP: There is a difference in MAC addresses retrieved from the ARP table of the configured device and DHCP leases from the DHCP server. DHCP versus DHCP: A range of IP addresses within a subnet may be managed by two DHCP servers. This conflict occurs when there is a difference in MAC addresses retrieved from two DHCP server lease information. DHCP versus DHCP (scope overlap): A range of IP addresses under a subnet may be managed by two DHCP servers. There are cases when a part of an IP address range under one DHCP server is managed by another DHCP server. In both instances, there is an overlap in scopes between two DHCP servers. This is considered a conflict. IPAM reservation versus SNMP/DHCP/SNMP neighbor: There are situations where you reserve an IP address under a subnet in IPAM that contains a MAC address for an internal reference. This type of conflict occurs when there is a difference in MAC addressees from either SNMP OIDs, DHCP leases, or neighbor devices with reserved MAC addresses in IPAM. In the above cases a generic event displays with the alert warning: The conflict for IP Address: is detected with MACs: 5C-26-0A- 5C-AB-DC, CA warning format read as follows: The IP address: is in conflict. The following devices were detected on the network with same IP address: - PingSweep vs Neighbor data MAC: 00- DB-DF-15-B0-03, MAC: 20-CF-30-3A-89-AB. See IP address conflicts for more information about UDT and IPAM for troubleshooting an issue. IP address conflict scenarios IPAM automatically detects IP conflicts by scanning servers and devices, and alerts you when conflicts are found. IPAM alerts for the following IP address conflict scenarios. During subnet scans, MAC addresses obtained from SNMP, SNMP neighbor, and IPAM reservations are called Static entries and those obtained from DHCP servers are called Dynamic entries. page 30

39 SNMP versus SNMP Neighbor: There is a difference in MAC addresses retrieved from the ARP table of the configured device and SNMP OIDs during the subnet scan for an IP address. SNMP versus DHCP: There is a difference in a MAC fetched from an SNMP OID and DHCP leases from a DHCP server, for an IP address during a subnet scan. SNMP Neighbor versus DHCP: There is a difference in MAC addresses retrieved from the ARP table of the configured device and DHCP leases from the DHCP server. DHCP versus DHCP: A range of IP addresses within a subnet may be managed by two DHCP servers. This conflict occurs when there is a difference in MAC addresses retrieved from two DHCP server lease information. DHCP versus DHCP (scope overlap): A range of IP addresses under a subnet may be managed by two DHCP servers. There are cases when a part of an IP address range under one DHCP server is managed by another DHCP server. In both instances, there is an overlap in scopes between two DHCP servers. This is considered a conflict. IPAM reservation versus SNMP/DHCP/SNMP neighbor: There are situations where you reserve an IP address under a subnet in IPAM that contains a MAC address for an internal reference. This type of conflict occurs when there is a difference in MAC addressees from either SNMP OIDs, DHCP leases, or neighbor devices with reserved MAC addresses in IPAM. In the above cases a generic event displays with the alert warning: The conflict for IP Address: is detected with MACs: 5C-26-0A- 5C-AB-DC, CA warning format read as follows: The IP address: is in conflict. The following devices were detected on the network with same IP address: - PingSweep vs Neighbor data MAC: 00- DB-DF-15-B0-03, MAC: 20-CF-30-3A-89-AB. IPv6 monitoring You can add IPv6 (Internet Protocol version 6) sites to subnets to monitor. Use the Discover IP address functionality to automatically add existing IPs to subnets. page 31

40 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER IPv6 addresses can be grouped to assist with network organization. To leverage the amount of addresses available, as well as the organizational features inherent with the implementation, create a logical address plan. For example, designate two nibbles (a nibble is 4 bits or 1 hex character) for your country code. This is 2^8, or 256, possibilities for unique countries. Next, designate another nibble for state or location. Finally, designate bits for site, building, and floor. 1. Create an IPv6 Global site called SolarWinds v6 Lab. 2. Add your IPv6 sites. 3. Add a building and floors. IPv6 scanning IPAM IPv6 address discovery uses Neighborhood Discovery Protocol (NDP). Information is obtained from routers based on the following MIBs and OIDs: IPv6 MIB, OID (ipv6nettomediatablephysicaladdress) IP MIB, OID (ipnettophysicaltable) ipv6nettomediavalid Cisco proprietary CISCO-IETF-IP-MIB, OID (cinetnettomediatable) page 32

41 For troubleshooting, verify with these device OIDs. 1. Click Discover IPs to access this functionality from the IPv6 subnet(s) or IPv6 Global prefix menus. 2. Select routers to scan. The discovery populates all discovered IPs under their IPv6 subnet(s) in the selection. All found IPs that do not belong to a selected subnet are discarded. IPAM uses your SNMP credentials to access the selected routers. Add IPv6 addresses The process entails three parts: create an IPv6 global prefix, create an IPv6 subnet, and then assign IPv6 addresses to the subnet. Create an IPv6 global prefix An IPv6 address global prefix is a combination of an IPv6 prefix (address) and a prefix length. The prefix takes the form ipv6-prefix/prefix-length and represents a block of address space (or a network). The ipv6- prefix variable follows general IPv6 addressing rules. The /prefix-length variable is a decimal value that indicates the number of contiguous, higher-order bits of the address that make up the network portion of the address. page 33

42 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER For example, 10FA:6604:8136:6502::/64 is a possible IPv6 prefix. 1. Click My Dashboards > Manage Subnets & IP Addresses. 2. Select a directory folder from the left menu tree, and then click Add > IPv6 Global Prefix. 3. Provide a name and description. 4. Enter the global prefix address. 5. Click Save. After an IPv6 global prefix has been created and addresses have been assigned, you cannot edit the prefix. To change an IPv6 global prefix, you must delete the prefix and create a new one. If you have only created a prefix, you can click Edit to edit the prefix before you add addresses. Create an IPv6 subnet 1. Click My Dashboards > Manage Subnets & IP Addresses. 2. Select the IPv6 site you want to add the subnet under. 3. Click Add IPv6 Subnet. 4. Enter a name and description. 5. Click Save. Assign IPv6 addresses 1. Click My Dashboards > Manage Subnets & IP Addresses. 2. Expand the IPv6 site and select a subnet to assign addresses to. 3. Click Add IP Address. 4. Enter the IP address and select a status. 5. Click Save. Edit an IPv6 prefix When an IPv6 global prefix has been created and addresses have been assigned, you cannot edit the prefix. To change an IPv6 global prefix, you must delete the prefix and create a new one. If you have only created a prefix, then you can click Edit to edit the prefix before adding addresses. Add IPv6 subnets 1. From the Menu bar, click IP Addresses > Manage Subnets & IP Addresses. 2. Select the IPv6 site you want to add the subnet under. 3. Click Add IPv6 Subnet. 4. Enter a name and description. 5. Click Save. page 34

43 Add IPv6 addresses 1. From the Menu bar, click IP Addresses > Manage Subnets & IP Addresses. 2. Expand the IPv6 site and select a subnet to assign addresses to. 3. Click Add IP Address. 4. Enter the IP address and select the status as needed. 5. Click Save. Edit multiple IPv6 addresses 1. From the Menu, click IP Addresses > Manage Subnets & IP Addresses. 2. Select the parent IPv6 subnet. 3. Under the IP Address View tab, select the addresses you want to edit. 4. Click Edit. Make any edits. 5. Click Save. Delete monitored IP addresses from a defined subnet 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the subnet from which you want to delete a range of IP addresses. 3. Select the IP addresses you want to delete in the right pane of the IP Address view. 4. Click IP Range > Remove. 5. Click Yes to confirm the deletion, and click Save. Set an IP address status to Available, Used, Transient, or Reserved The status of any monitored IP address within a defined subnet may be set from the IP Address view on the Manage Subnets & IP Addresses page. If a subnet contains more than 4096 IP addresses (lower than /20 or mask), IPAM only displays IP addresses in previously added ranges. For larger subnets, you must add IP address ranges for monitoring before IPAM can display addresses that may be managed. 1. Click My Dashboards > Manage Subnets & IP Addresses. 2. Click the subnet. 3. Select the IP addresses to be modified. 4. Click Set Status and then select Available, Used, Transient, or Reserved. IPAM status icons In IPAM, network components are represented by colored icons indicating the extent to which each component is used, as shown in the following table. page 35

44 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER ICON C OMPONENT STATUS STATUS DESCRIPTION Group Group Used (Closed) Used (Opened) The group is closed, but it contains at least one other component (group, subnet, or supernet). The group is open, and it contains at least one other component (group, subnet, or supernet). Gray Purple Cyan Yellow Red Yellow Green Red Yellow IP Address Available All addresses in defined groups, subnets, and supernets are, by default, considered Available unless they are typically reserved, as in the case of the network and broadcast addresses, or until they are otherwise assigned. IP Address Reserved Typically, in subnets defined to contain more than two IP addresses, the smallest address the network address identifies the subnet to the rest of the network and the largest address the broadcast address is used to communicate to all addresses within the subnet. Both addresses are considered to be Reserved for a defined subnet. IP Address Transient Addresses that are dynamically assigned to devices that may power on and off regularly or that may enter and exit the network frequently are designated as Transient. IP Address Used Any address currently assigned to a monitored device is considered Used. Subnet Critical At least 80 percent of all possible addresses in the subnet are designated as Used. Subnet Warning 60 to 80 percent of all possible addresses in the subnet are designated as Used. Subnet Good Less than 60 percent of all possible subnet addresses are designated as Used. Supernet Critical At least 80 percent of all possible addresses in the supernet are designated as Used. Supernet Warning 60 to 80 percent of all possible addresses in the supernet are designated as Used. page 36

45 ICON C OMPONENT STATUS STATUS DESCRIPTION Green Red Yellow Green Supernet Good Less than 60 percent of all possible addresses in the supernet are designated as Used. DHCP Scope Critical At least 80 percent of all possible addresses in the Scope are designated as Used. DHCP Scope Warning 60 to 80 percent of all possible addresses in the Scope are designated as Used. DHCP Scope Good Less than 60 percent of all possible addresses in the Scope are designated as Used. DHCP Scope Disabled DHCP scope is currently disabled. Disabled Unreachable DHCP Scope/Zone Unreachable DNS Scope/Zone is unreachable. Edit IP address properties IPAM can store a wide array of information about the devices to which IP addresses are assigned. The following table lists the properties IPAM can record in the IPAM table of your Orion database. IP ADDRESS PROPERTIES Comment DNS IPv6 Address Last Credential Last Response Time Last Synchronization MAC Address Machine Type Node Alias Status System Contact System Description System Location System Name Type Vendor Device Status Dynamic Lease Expiration Scanning Status Node Alias page 37

46 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER You can edit IP address properties directly from the IP Address view, including custom properties, on the Manage Subnets & IP Addresses page. The following procedure edits the properties of an IP address within a defined subnet. If a defined subnet contains more than 4096 IP addresses (lower than /20 or mask), IPAM only displays IP addresses in previously added ranges. For larger subnets, you must add IP address ranges for monitoring before IPAM can display addresses that may be managed. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the subnet containing the IP address you want to edit. 3. Select the IP address to be edited in the right IP Address view pane. 4. Click Edit and then select or provide values for each IP address property. If you have defined custom fields for IP addresses, they are available for editing. See Add a custom field for more information about configuring custom fields in Orion IPAM. 5. Click Save when you have completed the configuration of IP address properties. Selecting the Scanning option to Off does not modify values overwritten by network scanning. Edit multiple IP address properties You can edit properties of selected IP address ranges. Change the Status, Type, and Scanning statuses for selected ranges, additional user fields, and system information. Edit multiple IP ranges 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Select the subnet you want to edit. 3. Click Select IP Range. 4. Enter the starting and ending IP addresses for the range. 5. Click Select + Edit to edit the properties. 6. Select options to edit. 7. Click Save. System Information is overwritten if scanning is enabled. Select Off to turn off automatic scanning from the Scanning menu. Remove multiple IP ranges 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Select the subnet you want to edit. 3. Click Select IP Range. page 38

47 4. Enter the starting and ending IP addresses for the range. 5. Click Select + Remove to remove the selected range from IPAM. 6. Click Yes. Manage Subnets and IP Addresses page The Manage Subnets & IP Addresses page is the primary management interface for IPAM. The page is divided into two panes. The left pane provides a network tree representing the organization of your network into supernets, subnets, and groups. Depending on the type of network organization currently selected in the organization pane, the right pane provides one of the following three views: IP Address Network Chart See Manage subnets in IPAM for more information about organizing your network with subnets. See Manage supernets in IPAM for more information about organizing your network with supernets. See Manage groups in IPAM for more information about organizing your network with groups. The following sections describe the information that is available on each of these Manage Subnets & IP Addresses views. IP Address View The IP Address View displays whenever a subnet is selected, either in the Network View on the right or in the network organization pane on the left of the Manage Subnets & IP Addresses page. This view provides a list of all IP addresses that are within the selected subnet. This view can be filtered by selecting the DHCP Managed menu. Each IP address is listed with a selection of IP address properties. With the exception of Last Update, which is reported by IPAM as the result of a network scan, values for displayed IP address properties are set using the Edit IP Address window. See Add IP addresses for more information about editing IP address properties. page 39

48 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Network View The Network View displays whenever a group or supernet is selected in the network organization pane on the left of the Manage Subnets & IP Addresses page. If a group is selected, the view provides a list of all other groups, supernets, and subnets that are defined within the selected group. If a supernet is selected, the view provides a list of all subnets that are defined within the selected supernet. The Network tab also provides the ability to edit a single IP address and delete and import subnets by bulk. The status of displayed network components is designated using colored icons. See IPAM status icons for more information about network component iconsipam status icons Each network component (group, subnet, and supernet) is listed with a selection of component properties. With the exception of Last Discovery, which is reported by IPAM as the result of a network scan, values for displayed network component properties are set using the appropriate Edit Network Component Properties window. See Edit groups for more information about editing group properties. See Edit subnets for more information about editing subnet properties. See Edit supernets for more information about editing supernet properties. Chart View The Chart View provides a concise, visual report of your IP address allocation for any network component selected in the network organization pane. It is on the right pane of the Manage Subnets & IP Addresses page. A pie chart displays the designated status of your monitored IP addresses. An availability report displays both the percentage of all possible IP addresses in the selected group, subnet, or supernet that are present for monitoring and the percentage of present IP addresses that are available for assignment. See IPAM status icons for more information about IP address states in IPAM. Manage subnets in IPAM Subnet creation and editing are primary functions of IPAM. Create subnets Create individual subnets within selected subnets, supernets, and groups directly from the Manage Subnets & IP Addresses page. Use the IPAM Subnet Allocation wizard to create subnets within a designated supernet based on subnet size. page 40

49 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the network, group, or supernet to which you want to add the subnet. 3. Click Add > Subnet. 4. Enter a subnet name. If you leave this field empty, IPAM automatically generates a name based on the subnet address and CIDR prefix length you provide. 5. Provide a subnet address and a CIDR prefix length for the subnet. See Networking concepts and terminology for more information about CIDR and subnet addressing. 6. (Optional) provide a description, VLAN ID, or location for the subnet. 7. If you have defined custom fields for subnets, provide values. 8. Use the slider to set the scan interval. 9. If you do not want IPAM to automatically scan the subnet for changes, select Disable Automatic Scanning. 10. After you have configured the subnet, click Save. You can now drag and drop the subnet into other groups and supernets to organize your network. Create a range of IP addresses in a subnet It can be useful to deal with IP addresses in terms of defined IP address ranges, such as in a / 20 subnet, especially when you have larger subnets. The following procedure adds a range of IP addresses within a defined subnet. By default, IPAM displays all IP addresses in a subnet if the selected subnet contains 4096 or fewer IP addresses (/20 or and higher mask). For smaller subnets, it is not necessary to add IP address ranges for monitoring unless you have previously deleted the addresses in the range you want to add. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. In the network tree pane on the left, click the subnet to which you want to add your new IP address range. 3. Click IP Range > Add. 4. Provide the starting IP address and the ending IP address of your IP address range. IP address ranges cannot be defined outside the subnet indicated in the Parent Address field. 5. Click Save. page 41

50 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Edit subnets Use the Edit Subnet Properties box to edit the properties of a subnet, add custom information, add custom URLs, disable automatic scanning, or change the scan interval. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the subnet you want to edit. 3. Click Properties. 4. Edit the subnet name and the CIDR prefix length for your subnet. 5. Edit the description, VLAN ID, or location for your subnet. 6. Click Save after you have configured your subnet. Manage subnet scans The Subnet Scan Status view displays all subnet scans that are in progress or scheduled for completion. Subnet scans are listed according to the Database Column property for each scanned subnet. View subnet scans The information for each subnet scan includes: Status: provides the time when the next scan of the corresponding subnet begins. If a scan is in progress, Status displays the time elapsed since the scan started. Scan Type Last Discovery: indicates the date and time when the corresponding subnet was last scanned. To view subnet scans: 1. Click Settings > All Settings > IPAM Settings. 2. In the Subnet Scans box, click View scan job status. The Scan Job Status page provides the status of any jobs that are scheduled for scanning manually or automatically. Edit subnet scans Click Edit at the end of a listed subnet scan row to enable or disable automatic scanning and set a scan interval for the subnet. 1. Click View Subnet Scan Status in the Subnet Scans grouping. 2. To change the settings of a subnet scan, click Edit at the end of the corresponding row. page 42

51 Manage supernets in IPAM Supernets are useful organizational tools for managing your network. The following sections provide information about: Create supernets Edit supernets Create supernets Create a supernet for organizing your network components. 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the network, supernet, or group to which you want to add the supernet. 3. Click Add > Supernet. 4. Enter a supernet name for your subnet. If you leave this field empty, IPAM automatically generates a name based on the supernet address and CIDR prefix length you provide. 5. Enter a supernet address and a CIDR prefix length for the subnet. 6. (Optional) provide a description for the supernet. 7. If you have defined custom fields for supernets, provide values. 8. After you have configured the supernet, click Save. You can now drag and drop the supernet into other groups and supernets to organize your network. Edit supernets To edit the properties of a supernet: 1. Click IP Address Manager > Manage Subnets & IP Addresses. 2. Click the supernet you want to edit. 3. Click Properties. 4. Enter the supernet name and the CIDR prefix length. 5. (Optional) Enter a description for your subnet. 6. If you have defined custom fields for supernets, edit the values. 7. After you have configured your supernet, click Save. page 43

52 DHCP management IPAM integrates DHCP and DNS management with IP address management into one interface. You can manage ISC and Cisco DHCP servers, ASA devices, and Windows DHCP servers. Requirements for monitoring Cisco DHCP servers To monitor Cisco IOS DHCP servers in IPAM, the devices being added must support the following: Cisco commands: o o o - show running-config - show ip dhcp pool - show ip dhcp binding ASA devices commands: o o -show dhcpd binding-show running-config dhcpd-show dhscpd statistics -show interface l inc interface l ip address Layer 3 switch or router IOS version 12.2(8)T or later Enable level 15 ISC DHCP server requirements The following ISC DHCP minimum requirements and configurations are needed for IPAM to access your ISC servers. REQUIREMENTS CONFIGURATIONS Base version Operating system ISC = isc-dhcp p1 POSIX compliant Linux distributions User access User account needs to be configured to enable remote telnet or SSH access to ISC DHCP machine. Read and write file access for users on the configuration files. Cli commands dhcpd --version grep echo $PATH_DHCPD_DB dhcpd -t -cf page 44

53 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER ps -w -A -o comm,pid,args grep ^dhcpd w (or) ps -A -o comm,pid,args grep ^dhcp (or) ps -x -o comm,pid,args grep ^dhcp [ -f "" ] && echo 'true' uname -mrs sha1sum (or) sha1 (or) digest -v -a sha1 [ -r "" ] && echo 'true' [ -w "" ] && echo 'true' cat \cp -u -f -b -S.backup -p "" "" \rm -r -f "" mkdir Configuration file "/etc/dhcpd.conf" "/etc/inet/dhcpd4.conf" "/etc/dhcp/dhcpd.conf" "/usr/local/etc/dhcpd.conf" IPAM needs to seek the config file in one of the paths above. Lease file "/var/db/dhcpd.leases "/var/lib/dhcpd/dhcpd.leases" "/var/lib/dhcp/dhcpd.leases" "/var/db/dhcpd/dhcpd.leases" Script file "/etc/init.d/dhcpd" "/etc/init.d/dhcp" "/etc/rc.d/dhcpd " "/etc/init.d/isc-dhcp-server" "/usr/local/etc/rc.d/isc-dhcpd Configure an ISC DHCP server Nested configurations are not supported. On a new installation of ISC DHCP from a terminal prompt: page 45

54 1. Enter the following command to install DHCPD: sudo apt-get install isc-dhcp-server 2. To change the default configuration, edit /etc/dhcp3/dhcpd.conf. 3. To specify the interfaces DHCPD listens to, edit /etc/default/isc-dhcp-server. By default, DHCPD listens to eth0. 4. Assign a static IP to the interface that you use for DHCP. Verify that the ISC service is running so IPAM can communicate with your ISC DHCP server. After you edit the configuration file, restart the service. ISC DHCP Use ISC DHCP management and monitoring support to create, edit, or remove DHCP subnets directly and update servers automatically through the IPAM Web Console. You can also manage ISC DHCP subnet options, ranges, pools, and monitor ISC shared subnet utilization. Monitor server status and availability and IP address static assignments within groups. Nested configurations are not supported. The following ISC DHCP minimum requirements and configurations are needed for IPAM to access your ISC servers. REQUIREMENTS CONFIGURATIONS Base version Operating system ISC = isc-dhcp p1 POSIX compliant Linux distributions User access User account configured to enable remote telnet or SSH access to ISC DHCP machine Read and write file access for users on the configuration files Cli commands dhcpd --version grep echo $PATH_DHCPD_DB dhcpd -t -cf ps -w -A -o comm,pid,args grep ^dhcpd w (or) ps -A -o comm,pid,args grep ^dhcp (or) ps -x -o comm,pid,args grep ^dhcp [ -f "" ] && echo 'true' uname -mrs sha1sum (or) sha1 (or) digest -v -a sha1 [ -r "" ] && echo 'true' page 46

55 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER [ -w "" ] && echo 'true' cat \cp -u -f -b -S.backup -p "" "" \rm -r -f "" mkdir Configuration file IPAM seeks the config file in one of the following paths below: "/etc/dhcpd.conf" "/etc/inet/dhcpd4.conf" "/etc/dhcp/dhcpd.conf" "/usr/local/etc/dhcpd.conf" Lease file "/var/db/dhcpd.leases "/var/lib/dhcpd/dhcpd.leases" "/var/lib/dhcp/dhcpd.leases" "/var/db/dhcpd/dhcpd.leases" Script file "/etc/init.d/dhcpd" "/etc/init.d/dhcp" "/etc/rc.d/dhcpd " "/etc/init.d/isc-dhcp-server" "/usr/local/etc/rc.d/isc-dhcpd Configure an ISC DHCP server On a new installation of ISC DHCP from a terminal prompt: 1. Enter the following command to install DHCPD: sudo apt-get install isc-dhcp-server 2. To change the default configuration, edit /etc/dhcp3/dhcpd.conf. 3. To specify the interfaces DHCPD listens to, edit /etc/default/isc-dhcp-server. By default, DHCPD listens to eth0. 4. Assign a static IP to the interface that you use for DHCP. Verify that the ISC service is running so IPAM can communicate with your ISC DHCP server. After you edit the configuration file, restart the service. To begin managing your ISC servers, they must first be added to IPAM. See Add DHCP servers to IPAM for more information. page 47

56 Add DHCP servers to IPAM IPAM integrates DHCP and DNS management with IP address management into one interface. Add a DNS server to manage a database of public IP addresses. Before you begin: Discover your nodes. Add your nodes to IPAM. Bind DNS translates domain names into IP addresses. IPAM supports Bind DNS 9.1 through 9.11.n. Add a DHCP server to manage scopes and IP address leases. A scope is a range of IP addresses that the DHCP server leases to clients on a subnet. This example adds the DHCP server EASTADDS01V. 1. Click My Dashboards > IPAM Summary. 2. In the Getting Started with IP Address Management box, click Add DHCP Server. 3. Select EASTADDS01V from the Choose DHCP Server drop-down menu. 4. Select a credentials type, and enter the credential name, user name, and password for that credential. 5. Click Test. page 48

57 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 6. Select your default DHCP Server Scan Settings, and click Add DHCP Server. The DHCP Server is added to the DHCP & DNS Management page and is scanning IP address and scope lease activity. The Windows account specified within IPAM must exist on the DHCP server and be a member of one of the three following groups: DHCP Users DHCP Administrators Local Administrators IPAM impersonates the specified account on the local computer in order to gain access. If the IPAM computer is not within the same Windows domain as the DHCP server, the IPAM computer must have the identical account and password. Edit DHCP servers Edit the properties of a DHCP Server. 1. Click the DHCP & DNS Monitoring tab. 2. Select the DHCP server that you want to edit. 3. Click Edit Server. 4. Click Save. The edited properties are fields specific to IPAM and not related to any data in the DHCP server. page 49

58 Remove DHCP servers Remove a DHCP server from the IPAM Web Console. 1. Click the DHCP Servers tab. 2. Select the DHCP servers that you want to remove. 3. Click Remove Servers. 4. Click Delete Listed Items. DHCP scopes management The following sections detail how to create, edit, split, and remove DHCP Scopes in IPAM. Click DHCP & DNS Management tab > DHCP Scopes to choose from several options: Add new DHCP servers Add new DHCP scopes DHCP split scopes DHCP reservations DHCP scope options IPAM supports the majority of DHCP scope options defined within the RFC 2132 standard. Select these options when you add a scope in the Options wizard. The available options vary based on vendor. Click Add New Option to add options. Set up VoIP options (66 and 67) on your scopes. page 50

59 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Unsupported DHCP options The following options are unsupported: Microsoft Windows Options 39 TCP Keepalive Data 58 Renewal Time Value 59 Rebinding Time Value There is no UI option to create option 58 and 59 on a Windows DHCP server. Options 58 and 59 cannot be set directly, they are simply a function of lease time(option 51). Option code 39 only works with Windows2003 devices. Cisco Options 12 Host Name 50 Address Request 52 Overload 53 DHCP Msg Type 54 DHCP Server Id 58 Renewal Time 59 Rebinding Time 61 Client Id 67 BootFile Name ISC Options 50 Address Request 53 DHCP Message Type 54 DHCP Server Identifier 56 DHCP Message 58 Renewal Time 59 Rebinding Time Create DHCP scopes A scope is a consecutive range of IP addresses that a DHCP server can lease to a DHCP client. By defining one or more scopes on your DHCP servers, the server can manage the distribution and assignment of IP addresses to DHCP clients. Select from the list of DHCP servers to add a scope. The interface options vary by vendor. page 51

60 The IPAM Summary page displays the Top 10 DHCP Scopes by Utilization with Split Scopes resource. page 52

61 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER To edit the resource, select a sort order and use the SQL filters to limit which scopes are displayed. Edit DHCP scopes Edit the scope detail properties of a DHCP scope. 1. Click IP Address Manager > DHCP& DNS Monitoring. 2. Click Scopes. 3. Select the scope name that you want to edit. 4. Click Edit Scope Details in the menu bar. You can edit the name and description and add custom fields. 5. Click Next. 6. Edit the IP address range or click Add Exclusion, and click Next. page 53

62 7. Define the lease duration, and click Next. 8. Define DNS options, and click Next. 9. Review the changes and click Update Scope. When editing, you may see a dialog if the scope is not a Windows 2008 R2 DHCP Server. You can ignore this message. DHCP split scopes Split scopes: Provide load balancing between two DHCP servers Ensure high availability DHCP services for your network The IPAM Summary page displays the Top 10 DHCP Scopes by Utilization with Split Scopes resource. page 54

63 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER To edit a resource, select a sort order and use the SQL filters to limit the which scopes are displayed. When you split a scope, the primary server is responsible for one group of IP addresses, and the secondary server is responsible for the remainder. An offer delay time (generally between 1000 and 5000 milliseconds) is set for the secondary server to ensure that if the primary server is unable to provide an IP address within the offer delay time, the secondary server provides an IP address using its pool of addresses. Scopes are split into one of two configurations: 50/50: half of the IP addresses are on the primary DHCP server and half are on the secondary server. This configuration is usually used for load balancing. 80/20: 80% of the IP addresses are on the primary DHCP server and 20% are on the secondary server. This configuration is generally used to ensure high availability. When a scope is split, the result is two scopes, each of which excludes the IP addresses that the other scope (and server) manages. For example, scope01 is on your primary DHCP server. Scope01 includes the entire subnet of /24 (254 IP addresses), with no exclusions. You split scope01, and name the second scope scope02 on your secondary DHCP server. You choose an 80/20 split. Scope01 still spans the entire subnet, but excludes the last 20% of the addresses in that subnet ( ). Scope02 also spans the entire subnet, but excludes the first 80% of the addresses in that subnet ( ). page 55

64 Splitting scopes on some Cisco DHCP servers may require you to perform additional configuration steps on the servers themselves. You must have two DHCP servers of the same type to split a scope between them. DHCP reservations Create, update, and delete DHCP reservations (static leases). The following steps change the reservation status of an IP address on a Windows DHCP server: 1. Navigate to the Edit IP Address View tab. 2. Select an IP address and click Set Status. 3. Set the status to Reserved. 4. Select the DHCP server and choose where this change is to be in implemented. Send Reservation to DHCP Server. Make Reservation in IPAM only. This column displays the reservation status on the DHCP server. page 56

65 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Remove scopes Remove a DHCP scope. 1. Navigate to IP Address Manager > DHCP Scope & DNS Monitoring > Scopes tab. 2. Select the DHCP scopes that you want to remove. 3. Click Remove Scopes. 4. Click Delete Listed Items. If you want the scope from the DHCP server and the corresponding subnets removed, select the corresponding boxes. DHCP Graph view The Graph view presents a graphical representation of the selected DHCP servers IP address percentage use. Unless certain scopes or servers are selected, the DHCP Graph view collects statistics for what is visible in the current tab. 1. Click the DHCP Servers tab. 2. Select the DHCP servers that you want to graph. 3. Click Graph View. page 57

66 DNS management The following chapter details how IPAM can help manage and monitor your DNS servers. SELECT FROM THE TOPICS BELOW: Add a DNS server to IPAM DNS server WMI permissions DNS zone transfers DNS records BIND DNS monitoring and management DNS records mismatch Add a DNS server All DNS servers must already exist as nodes in your installation. Windows DNS Server 2003, Server 2008, and Server 2012 are supported. Bind DNS 9.1 through 9.11.n are supported. Some environments may require you to grant read-only access to a non-administrator account. See Grant read-only access to non-administrator accounts for IPAM DNS Monitoring for more information. 1. Navigate to the IP Addresses tab and click DHCP & DNS Monitoring. 2. On the DNS Servers tab, click Add new DNS Server. 3. Select a DNS Server from the list. If the server is not listed, use the Group By menu to sort the DNS servers listed. 4. Select credentials. WMI credentials can be inherited from the node to the DNS server. page 58

67 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 5. Enter the user name and password and then click Test to confirm. If you provide Windows credentials for accessing and receiving information through WMI, you must provide the account name in the following order: Domain or Computer Name\User Name for domain level authentication or user name for workgroup level authentication. 6. Select Enable Scanning to enable incremental DNS Zone transfers. IPAM scans for the DNS server for new zones and settings based upon the interval time. 7. Click Add Server. The DNS Zones display. View DNS records 1. Navigate to the DNS Zone tab and select a zone name. 2. Click DNS Records. DNS server WMI permissions The following section details the permissions required for IPAM users to monitor DNS servers. Enable an account for WMI A DNS server administrator account that can make changes on the DNS server is required to manage DNS servers. If you have a stand-alone DNS server, you can use a local administrator account that is configured for WMI access. Administrator accounts are configured to make DNS server management tasks by default. For an AD and DNS setup, this is an account with full DACL with remote WMI management enabled Grant read-only access to non-administrator accounts for IPAM DNS monitoring To poll the DNS server without an administrator account, you must be added the user to the DNSAdmin group. The account must have Read\Write permissions for DNS management so that the account is able to write itself to the DNS server as a zone transfer server. Admins can specify the rights of a user within their account settings to limit them to have a read only access to the DNS portion of IPAM. Enable an account for WMI Use the DNS Server Administrator account based on your network configuration. page 59

68 In Standalone DNS, administrators are configured to make DNS server management tasks by default. In a AD+DNS setup, use the account with full DACL to manage the DNS Server. The account must have remote WMI for management enabled. The following steps detail how to use a non-administrator account. To configure DCOM services 1. Start dcomcnfg. 2. Expand Component Services\Computers, right-click My Computer, and select Properties. 3. Click the COM Security tab. 4. In the Access Permissions group: Click Edit Default, add your account, and select Enable Local Access and Remote Access. Click Edit Limits, add your account, and select Enable Local and Remote Access. 5. In the Launch and Activation permissions: Click Edit Default, add your account, and select Allow all. Click Edit Limits, add your account, and select Allow all. To configure access to the WMI branch 1. Start the MMC console and add the WMI Control Snap-in. 2. Right-click Snap-in and click Properties. 3. In the Security tab, select MicrosoftDNS and CIMV2 branch, and then click Security. 4. Add your account, and Allow Execute Methods, Enable Account, Remote Enable. 5. On the DNS Security tab, verify that the new user you created has DNSAdmin rights. 6. Start dnsmgmt.msc. page 60

69 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 7. Right-click the server or service and view properties to confirm that all the options for the user are selected. To test the connection to a DNS server with specific credentials, use the wbemtest tool and connect to a machine using namespace, such as: \\remote_hostname\root\microsoftdns DNS zone transfers Add a DNS server in IPAM to change the transfer zone configurations on the DNS server. IPAM changes the Transfer Zone tab by adding the IP address of the IPAM server. This feature requires an admin account for adding DNS servers. For example, if you have Allow zone transfers selected for servers listed on the Name Servers tab, IPAM sets this configuration to Only to the Following Servers. To manually configure your DNS server, verify that zone transfers are enabled. You must select the To any server option or IPAM defaults to the Only to the Following Servers option using the IP address of the IPAM server. page 61

70 Edit a DNS server 1. Navigate to IP Addresses tab > DHCP & DNS Monitoring > DNS Servers tab. 2. Click Edit DNS Server. 3. Edit the properties as needed, and click Save. Remove DNS servers 1. Navigate to IP Addresses tab > DHCP & DNS Monitoring > DNS Servers tab. 2. Select a server to delete and then click Edit DNS Servers. 3. Click Delete Listed Items. DNS records IPAM supports five DNS record types. Each DNS record can be customized as needed. IPAM automatically detects DNS forward and reverse mismatches. Automatic creates DNS PTR records when new devices are added into DNS zones. From this location you can manage all aspects of your domain registration. You can also change your domain name servers. Edit DNS records 1. Select a zone and then click A DNS Records. The A DNS Records details page opens. 2. Select a single record to edit. 3. To delete a record, select the record and then click Delete. DNS RECORDS SUPPORTED IN IPAM A record: an A record provides the IP address of a domain. Example: www, mail, ftp, webmail, www2, secure, store, dev AAAA Record: returns a 128-bit IPv6 address, most commonly used to map host names to an IP address of the host. CNAME record: CNAME records map aliases with domain names. Example: Record: webmail Address: mail.hostedmail.com MX record: MX records use your external mail servers to process your . page 62

71 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER Example: Priority: 10 Address: mail.domain.com PTR record: a domain name pointer maps a network interface (IP) to a host name. DNS records mismatch IPAM provides DNS forward and reverse mismatch records detection by periodically scanning all DNS zones and highlighting mismatches on the IPAM Summary page. DNS record inconsistencies display in red in the DNS Records Mismatch resource. Add a DNS zone The following section details how to add a DNS zone in IPAM. 1. Navigate to the DNS Zones tab. 2. Click Add New > DNS Zone. page 63

72 3. Select a DNS server to apply the zone to. 4. Select the zone type. 5. Select the DNS Lookup Type and enter a DNS Zone Name. 6. Click Next. 7. Enter the Zone File Name and select transfers. 8. Click Next. page 64

73 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER 9. Review the information and click Create Zone. 10. Click OK. Edit a DNS zone 1. Navigate to the DNS Zones tab. 2. Select a zone to edit. 3. Click Edit Zone Details. 4. Edit the zone definition and lookup types, the DNS file name, or transfer details. 5. Review the details and click Save. Bind DNS monitoring and management IPAM offers support for Linux-based BIND DNS server monitoring and management. page 65

74 BIND credentials The following are the minimum requirements needed to monitor BIND DNS. IPAM supports BIND versions BIND 9.9+, BIND 9.10+, and BIND SolarWinds recommends BIND 9.11+, as it supports commands for checking configuration syntax, which IPAM is able to use for configuration change validation during management operations. Required permissions The user account needs to be configured to enable remote telnet or SSH access to the BIND machine. Read and write file access is required for all BIND configuration files /etc/named.conf and all included files. All zone data files: IPAM needs read and write access to the system temp directory /tmp CLI Commands: IPAM uses both standard Linux commands (POSIX) and BIND specific commands. Below are the commands used by IPAM for both management and monitoring: named ps grep sha1sum cat if [ -r "filepath" ] ; then echo 'true'; else echo 'false'; fi if [ -w "filepath" ] ; then echo 'true'; else echo 'false'; fi if [ $? -eq 0 ] ; then echo 'true'; else echo 'false'; fi cp mkdir rm named-checkconf After you add a BIND in IPAM, your device syncs and imports BIND DNS configurations which can then be monitored or managed. Add a BIND DNS server 1. Go to DHCP & DNS Management > DNS Servers tab. 2. Click Add New DNS Server. 3. Select your BIND DNS server from the populated list and then select BIND Credential. Create a new page 66

75 ADMINISTRATOR GUIDE: IP ADDRESS MANAGER one if needed. 4. Enable scanning, and click Add Server. page 67