5 holiday tips to make managing DDI a little easier

With the holiday season upon us, here are five tips to make managing your DDI environment a little easier in BlueCat Address Manager.

With the holiday season upon us, what better time to present five tips to manage your DDI environment?

Tip 1: Use default domains to create DNS host names from the IP address space

There are many ways to create DNS resource records in the Address Manager user interface:

  1. Use the Quick Actions from the My IPAM page.
  2. Create them from the DNS zone level.
  3. Create them from the IP address level in an IP network.

The third method provides an interesting benefit, allowing a user to manage both the IP address space and DNS host records from the same place. The default behavior when creating host records from an IP address is to type the host record’s fully-qualified domain name, such as host1.example.com. While this behavior is reasonable, if you have to create many host records in the same zone, the default domain feature can make administration much easier.

Default domains are set within the IP address space, at an IP block or network level. Wherever you can, create the default domain at the highest block level possible to take advantage of inheritance. Then, when it’s time to create the host record, you simply type the relative portion of the name and leave the default domain name in place. If you need to create a host record with a different domain name, select the Override Default Domains checkbox. You can also create multiple default domains if you use more than one domain name on a regular basis.

Screenshot of creating a host record from an IP address in BlueCat Address Manager

Tip 2: What access rights are required to create DNS host records?

While we are on the topic of DNS host names, let’s discuss access rights. Let’s say you want to give a group of users the ability to fully manage the resource records in a particular zone.  After granting them the View access right to the configuration so that they can navigate the system, you grant them Full Access at the zone level (which includes all resource records in the zone by virtue of inheritance).

After assigning these access rights, one of the users logs in and attempts to create some resource records. While the user is able to create CNAMES and MX records without a problem, the error message “You do not have access to carry out that action on this entity” appears when the user tries to create a host record:

Screenshot of access denied error message when trying to create a host record in BlueCat Address Manager

The problem is actually not related to DNS access rights as evidenced by the fact that the user was able to create CNAME and MX records in the zone. The situation is related more to the way Address Manager relates certain objects to each other. In Address Manager, the name portion in a host record is linked to the associated IP address object. If sufficient access rights are not assigned to the IP network, the user cannot create the host records. After assigning a minimum access right of Add to the parent network, the user will be able to create the host records and the problem will be solved.

Tip 3: Remove an intermediate IPv4 block without deleting its child network(s)

You may have encountered the following situation while modeling your IP address space. Let’s say you manage the 192.168.0.0/16 IP address space and you need to delegate administration of a portion of the space, 192.168.1.0/24, to another user. Because you are fairly new to Address Manager, you created both a block and a network representing the 192.168.1.0/24 space. While this appeared to work fine, after some time, you realize that the intermediate block offers no additional value and actually forces the user to click an additional unnecessary object when navigating to the network. You don’t want to delete the /24 block because that will also delete the network. Address Manager includes an IP modeling tool just for this purpose called Merge with Parent.

Screenshot of the Merge with Parent tool in BlueCat Address Manager

The Merge with Parent tool removes the intermediate block or blocks with the parent without deleting any child objects such as networks or other blocks.

There is one additional important point to be aware of when using this tool. Any deployment roles or deployment options assigned at intermediate IP block level will be passed up to the parent block during the merge operation, unless the same role or option already exists at the parent level.  As such, before performing a merge with parent operation, delete any existing roles/options at the intermediate level and then recreate them after the merge.

Tip 4: When resizing a DHCP range, force any existing DHCP clients to get IP addresses from the newly resized range

You may need to resize an existing DHCP range from time-to-time. For example, you decide to implement a new network policy that reserves the first 20 IP addresses in a network for static assignment.(Bonus tip: you can use IP Groups to help manage this.) If your existing DHCP ranges start at an offset of 10 addresses from the beginning of the network, you can resize the DHCP ranges very easily using the Resize tool.

Screenshot of resizing the IPv4 DHCP range with selection of the Unassigned Hosts option in BlueCat Address Manager

Notice in the picture, when you resize a DHCP range, you must choose from three Pool Resize options. These options apply when a DHCP range is decreased in size and current DHCP clients will become “orphaned”, i.e. their existing leased addresses will no longer be available in the smaller address range.

The default behavior is to have existing DHCP leases converted to DHCP Reserved Hosts (also known as DHCP reservations) when the existing lease expires. If this is not the desired behavior, you can change the settings so that existing leases are changed to static hosts or unassigned hosts. To force clients with existing leases to obtain an IP address from the newly resized range, select the Unassigned Hosts option.

Tip 5: Use Address Manager to manage DNS forest wide zones in Windows

When configuring Address Manager to manage Windows DNS zones, you must create (or use an existing) user account in Windows with sufficient rights to manage DNS. Address Manager uses this account to perform administrative tasks. While this account can be added to an administrator’s group such as Domain Admins, membership in the DNS Admins group is sufficient to manage domain-wide zones. However, if you are managing your organization’s main Active Directory Integrated zone, you will also need to have at least one forest-wide zone, the Active Directory _msdcs_domain.tld subdomain used in certain client queries.

By default, the DNS Admins group does not have permissions to the _msdcs subdomain and if you do not give the group permissions to this zone, an error will result when you try to deploy from Address Manager to a Read-Write server.

To remedy this situation:

  1. Open the DNS Manager MMC from a device that can manage the zone.
  2. Right click the _msdcs_domain.tld subdomain and select the Security tab.
  3. Assign Full Control permissions to the DNSAdmins group.
  4. Click the Advanced button, select the DNSAdmins group, click Edit and from the Apply to drop-down list, select This object and all descendant objects.

This will grant the necessary permissions to the zone and all child resource records.

Screenshot of assigning permissions to the _msdcs subdomain for the DNS Admins group


An avatar of the author

BlueCat provides core services and solutions that help our customers and their teams deliver change-ready networks. With BlueCat, organizations can build reliable, secure, and agile mission-critical networks that can support transformation initiatives such as cloud adoption and automation. BlueCat’s growing portfolio includes services and solutions for automated and unified DDI management, network security, multicloud management, and network observability and health.

Related content

Simplify NIS2 compliance with DNS management

Learn whether the EU’s NIS2 requirements apply to your organization and about how DNS management and BlueCat can boost your path to compliance.

Read more

Detect anomalies and CVE risks with Infrastructure Assurance 8.4 

The Infrastructure Assurance 8.4 release features an anomaly detection engine for outliers and a CVE analysis engine to uncover device vulnerabilities.

Read more

Get fast, resilient, and flexible DDI management with Integrity 9.6

With Integrity 9.6, network admins can get support for new DNS record types, architect and configure multi-primary DNS, and automate IP assignments.

Read more

Deepen your security insight with Infrastructure Assurance 8.3

BlueCat Infrastructure Assurance 8.3, with an enhanced analytics dashboard, including interactive widgets and top 10 alerts, is now available.

Read more

BlueCat to acquire LiveAction

BlueCat adds LiveAction’s network observability and intelligence platform, which helps large enterprises optimize the performance, resiliency, and security of their networks.