IPAM

Let's face it, your business relies on your network. From email to web browsing, and video meetings to chats, your network is indispensable to the usability of these applications that facilitate basic work functions like collaboration, communication, education and sales. Your network is mission-critical and the performance and availability of your network is paramount. Recognizing this, many organizations actively manage and monitor their networks in order to detect performance degradations and outages on network links, routers, switches and computing infrastructure. Such proactive monitoring affords an early warning system for teams responsible for network uptime and performance to identify and begin troubleshooting issues, not to mention potential security events, before network users are affected. Deployed redundancy of links and infrastructure can provide uninterrupted performance from the end user perspective, while allowing time for troubleshooting teams to rectify the situat...

Automation is a hot topic within IT organizations these days, as well it should be. Automation offers tangible benefits in terms of reducing costs, increasing agility, diminishing manual efforts and minimizing human errors while performing a process. I recommend considering IP address management (IPAM) tasks within your automation design as I proposed in a prior post , given IPAM's tentacles menacingly reaching into virtually every IP device initialization, movement or decommissioning process. But how does one go about designing automation? Consider that you can automate a process if it consists of a repeatable set of discrete tasks required to perform a function or unit of work. Some tasks may be performed in parallel with others and most tasks require input values provided by or derived from prior tasks to begin. Documenting the tasks required and the sequence or flow of tasks, i.e., as a workflow or flowchart, is a prescribed first step. Once you've laid out the basic flow, ...

Automation is among the key motivators for implementing an IP address management (IPAM) system. With the ubiquitous adoption of Internet-based technologies engendering IP networks over which nearly all of your applications communicate, it makes sense to simplify and minimize resource impacts for such networked applications and corresponding support. This IP convergence provides financial, efficiency, and productivity benefits in and of itself, but it also escalates reliance on and ensuing scrutiny of IP network performance, resiliency and integration into key business processes.  Underpinning this IP convergence is the IPAM foundation. Email, web, application servers need IP addresses and DNS names. User laptops, mobiles, and other devices need IP addresses. Cloud virtual machines or containers need IP addresses and DNS names. Literally every device you need to connect to your network needs an IP address; and if users need to reach it by name, it also needs a DNS name. With no IP a...

Software-defined wide area networks (SD-WANs) enable organizations to increase networking efficiencies, improve cloud application performance, centralize provisioning, simplify operations, and reduce costs. Please read my recent post for an overview of  SD-WAN. In this post, we'll discuss the importance of flexible, adaptable and "software-defined" IP address management (IPAM) to fully realize the benefits of SD-WAN and to improve your security posture in the face of multiple Internet breakout points. IPAM comprises foundational network services for your IP network, which typically encompasses private networks, cloud networks, remote access networks, Internet of Thing networks and the Internet. Key IPAM functions include managing IPv4 and IPv6 address space across this diverse network landscape and requires tracking assigned and available addresses, allocating address blocks, splitting and joining address blocks as well as moving and freeing up address blocks and subnets...

The concept of software-defined networking (SDN) can be traced back to common channel signaling (CCS) technology developed during the 1970's and 1980's for use in telecom networks. The CCS #7 protocol operates via a signaling network independent of the telephony traffic (e.g., bearer) network and provides call setup, routing, release and related functions. In an analogous fashion, SDN decouples the data or bearer plane from the control or signaling plane. As illustrated in Figure 1, the data plane comprises network routing hardware or virtualized network functions while the control plane includes software that “defines” or monitors, manages and reconfigures network routers to achieve optimal performance. Software-defined wide area networks (SD-WANs), the WAN component of SDN, enable organizations to partially or entirely supplant private network services such as Multi-Protocol Label Switching (MPLS) in order to improve network performance, centralize provisioning, simplify oper...

 The discipline of network management affords innumerable technical and business benefits to organizations via the centralization of control, monitoring, and provisioning of distributed network elements such as routers and application or services databases. These benefits include holistic management of the entire network from a centralized point where appropriate resources and expertise can be leveraged for troubleshooting, resolution, and escalation. This pan-network approach lends itself well to supporting structured network change control procedures and is even more crucial today with enterprise networks expanding into clouds, IoT subnetworks, and mobile networks. Because IP addresses and associated DHCP and DNS functions are foundational to IT services and applications running over an IP network, these functions must be prudently managed, much as other critical network infrastructure elements are managed. The most commonly applied network management approach is that of the FCAP...

Researchers from the University of California and Tsinghua University in China have published discovery of a new form of DNS cache poisoning attack. This form of attack leverages "side channels" through use of the Internet Control Message Protocol (ICMP) to improve the likelihood of attack success by identifying the subset of source UDP ports actually used by a recursive server when issuing queries. Confining this pool of randomized ports helps reduce the universe of port numbers the attacker can try when attempting to emulate a proper query response.  Source port and DNS transaction identifier randomization has been the recommended mitigation approaches against cache poisoning attacks, even for more nefarious Kaminsky-discovered attacks. However, this use of side channels reduces the robustness of source port randomization mitigation. Of course, DNS security extensions (DNSSEC) remains the only definitive means to mitigate cache poisoning attacks, including this new variant....