Try   HackMD

為了減少測試 Infoblox 佈署及組態環境的時間，參考先前使用 VMware OVFTools 和 Infoblox WAPI 的經驗，並加上 GOVC(vSphere CLI) 工具，透過撰寫 BASH 腳本檔來完成測試環境的半自動佈署任務。

佈署準備

架構資訊

根據 [Infoblox DNS 安全解決方案測試需求及說明] 內容進行 POC 環境佈署。

版本資訊

項目 版本
VMware ESXi 7.0.3 build-20036589
Infoblox NIOS nios-9.0.3-50212-ee11d5834df9-2023-11-23-00-01-55-fixed-500G.ova
NIOS Grid Master VM TE-V1516 [註1]
- 14 vCPU
- 64GB RAM
- 500GB 系統空間
NIOS Reporting VM TR-V5005 [註1]
- 8 vCPU
- 64GB RAM (測試資源限制調整至 32 GB)
- 500 GB 系統空間
- 250 GB 報表空間 [註2]

註1. 以上 Infoblox 虛擬機器(vNIOS) 機種配置可參考自身的硬體資源調整。
註2. 報表空間依報表使用量評估，至少 250 GB。

佈署流程

由於佈署程序會採用 OVFTools 及 GOVC 工具，在 OVA 佈署階段會同時完成：

  1. 虛擬主機(Infoblox DNS & Reporting)佈署。
  2. 配置虛擬主機網路設定。
  3. 指派測試用基礎授權-NIOS,GRID,DNS/DHCP,RPZ。

    目前沒有 Threat Analytics 及 Reporting 授權的引用方式，所以無法直接完成，有點遺憾！

  4. 新增 Infoblox Reporting 虛擬主機的第二顆虛擬磁碟（250GB）。
  5. 調整 Infoblox Reporting 虛擬主機的記憶體大小為 32 GB。

    預設安裝為 64 GB，因為測試資源受限，故調整虛擬主機記憶體。

  6. 虛擬主機網路及授權資訊確認 (透過 SSH 連線使用 NIOS CLI 執行)。
    • 確認網路配置: show network。
    • Infoblox DNS 虛擬主機指派 Threat Analytics 授權: set temp_license。
    • 確認授權配置: show license, show license gridwide 和 show license all。
  7. 完成 建立叢集/配置成員/加入叢集 相關任務。
    • Infoblox Reporting 虛擬主機指派 Reporting 授權。

    Reporting 授權必須在成員加入叢集後才能進行指派。

  8. 啟用服務
    • 啟用 DNS 服務
    • 建立 RPZ Feeds
    • 啟用 Threat Analytics 服務
    • 建立 Authoritative Zone (從 AD DNS 進行區域傳送)
    • 建立 Forward Zone (區域查詢轉送至指定 DNS 主機)

    Authoritative Zone 和 Forward Zone 建立，可視實際測試狀況選項配置。

  9. 配置 Reporting 服務

    目前一定要手動介入才能完成的組態項目，沒有 API 相關資訊可以參考。

佈署流程圖

佈署虛擬機器
配置網路
指派授權
調整硬體配置
虛擬主機
組態確認
建立叢集
配置成員
加入叢集
啟用基礎服務
配置Reporting服務
完成

程式架構

主要分成佈署環境及組態服務兩大部份。根據簡單的概念撰寫以下相關部署腳本檔及安裝組態檔。

腳本檔 說明
config/grid.conf 測試環境參數
00_setup_lab.sh 測試環境佈署，提供虛擬機器安裝及網路配置
01_config_lab.sh 服務組態主程式，與下列執行腳本關聯應用
11_config_grid.sh 建立 Grid 架構
12_enable_dns_service.sh 啟用 Grid DNS 服務
13_create_rpz_feed.sh 建立 Name Server Group
建立 RPZ Feeds 紀錄
14_create_ta_service.sh 啟用 Threat Analytics 服務
15_create_transfer_zone.sh 搭配 AD DNS 的區域傳輸 (Zone Transfer) 建立 Authoritative Zone
16_create_forward_zone.sh 搭配指定網域查詢建立 Forward Zone
99_clean_lab.sh 清除佈署測試環境
connect_infoblox.sh SSH 遠端連線
rpz_feed.csv Infoblox RPZ Feeds 紀錄檔

佈署步驟

佈署測試環境

直接執行主程式 00_setup_lab.sh，完成兩台 Infoblox 虛擬主機的安裝、網路配置及硬體調整。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →
Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

第一階段佈署測試環境，從 vCenter 檢視工作，從執行程式開始到佈署兩台虛擬機器電源開機，大約花了 5~6 分鐘，其中自動化地完成了虛擬機器佈署、網路組態配置、硬體資源調整和基本授權指派。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

組態基礎服務

接著會繼續執行 01_config_lab.sh，會根據預設腳本透過 API 方式進行，依序完成相關功能組態。

在虛擬機器佈署階段，已經完成了網路設備組態，才能順利進行以下程序。

  • 建立 Grid 叢集

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

  • 啟用 Grid DNS 服務

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

  • 指派 Threat Analytics 與 Reporting 授權 [第一次手動介入處理]

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

    這裡必須中斷用手動指派 Threat Analytics 與 Reporting 授權！目前沒有任何 API 使用資訊。

    Image Not Showing Possible Reasons
    • The image file may be corrupted
    • The server hosting the image is unavailable
    • The image path is incorrect
    • The image format is not supported
    Learn More →

執行 connect_infoblox.sh 採用 SSH 連線登入，使用 NIOS CLI 進行相關設定。

在虛擬機器佈署階段，已經啟用了 Infoblox remote_cosole 功能。

先連線至 Infoblox Reporting 虛擬機器，使用 set temp_license 指派 Reporting 授權，並使用 show license all 檢視結果。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

使用 show disk 檢視報表存放空間。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

再來連線 Infoblox DNS 虛擬機器，使用 set temp_license 指派 Reporting 授權，並使用 show license all 檢視結果。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →
Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

繼續跟著輔助流程進行。

  • 匯入 Infoblox RPZ Feed 情資

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →
    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

  • 啟用 Threat Analytics 服務

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

  • 建立 Authoritative Zone 和 Forward Zone

    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

基本上自動化服務配置至此已經告一段落！

  • 完成 Reporting 組態 [第二次手動介入處理]
    Image Not Showing Possible Reasons
    • The image was uploaded to a note which you don't have access to
    • The note which the image was originally uploaded to has been deleted
    Learn More →

連線 Grid Manager 管理介面。可以檢視 DNS 服務和 Threat Analytics 服務已經綠燈正常運行。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

點擊 Grid > Grid Manager > Reporting，再選擇右側工具列 Edit 編輯屬性。

螢幕快照 2024-01-22 15-49-30

重啟服務後確認 Reporting 服務運作狀態，也是綠燈正常運行。

圖片

對，還沒完！點選 Reporting 繼續完成 App Configuration 任務。

就是覺得重複性的畫面點擊設定很麻煩！如果也可以用 API 完成就好了？！

圖片

設定外部檔案伺服器以提供查詢匯出，由於測試不需要，就任意輸入內容完成即可。

圖片

若是後續的警報、報表需要匯出至檔案伺服器時，就要重新配置此選項。

點選 Reporting 功能，確認 Apps 選單為 Infoblox Reporting & Analytics，再點選上方 Administration > Set up 後，便可調整檔案服務器選項。

螢幕快照 2024-03-21 09-34-45

在 Reporting 功能頁，點選右上方 Settings > Alert actions，可以設定警報和報表觸發時的作動行為。

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

其中 File Transfer Action 功能就需要設定正確的檔案伺服器，點選右側 Setup Infoblox Reporting & Analytics 進行組態。

螢幕快照 2024-03-21 09-47-53

只不過在我的系統上點選設定後會出現 "我是傳奇"？！見

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →
了！暫時就用上面提供的方式進行設定吧！

Image Not Showing Possible Reasons
  • The image was uploaded to a note which you don't have access to
  • The note which the image was originally uploaded to has been deleted
Learn More →

回到 Reporting 頁面，應該會看到以下畫面，報告分析尚未開始所以顯示空白為正常。

圖片

設定終了，完成任務！

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

  • 經過粗略的紀錄，採用此種方式可以在 30-40 分鐘完成 Infoblox 基本架構的安裝及服務組態。
  • 透過相同的程序，也可應用在 POC 配置，若客戶環境允許也可輕鬆佈署 Infoblox 解決方案。
  • 如果有 Threat Analytics 和 Reporting 授權指派和 Reporting 初始化設定的 API 資訊，相信更能減少整體佈署的完成時間。

參考

Last changed by 
 
farmer87
0
1
793

Read more

Infoblox POC 測試驗證架構

以下資訊來自 Infoblox 原廠資深解決方案架構師 Michael Chang | mchang@infoblox.com

Jun 28, 2024
客製化 Infoblox 報告儀表板

[toc]Infoblox 提供報告和分析 (Reporting and Analytics) 解決方案，會自動收集、分析和呈現核心網路服務數據，協助管理者規劃管理網路。除了提供預先定義的儀表板和報告（predefined dashboards and reports），可取得核心網路服務相關活動和效能資訊。也提供了增強性報告介面（enhanced reporting interface），以便管理者可以建立自訂儀表板、報告和警報（custom dashboards, reports, alerts）。

Apr 1, 2024
VCF/VVF/vSAN 訂閱授權計算器(License Calculator via BASH)

VMware 更新產品策略，提供全新簡化的產品組合。並由原先 CPU（Socket）數量計價調整為核心（Cores）數量計價。另外根據產品組合提供進階附加服務（Add-on Services）加購，相關產品資訊請參考官方網站。 圖片 由於計價方式調整，所以官方也提供相關計價說明及工具，以便提供客戶對於目前及未來佈署環境所需授權數量的評估規劃。 目前計價重點則在於 VCF, VVF 的核心數授權計算和 vSAN Add-on 容量授權計算。 官方知識庫 目前有關授權計算，官方提供以下相關說明：

Feb 26, 2024
使用 BASH 和 GOVC 撰寫程式估算 VMware vSphere 訂閱授權

[toc]VMware vSphere 產品改為訂閱制，VMware 官方 [KB#95927] 也提供了一個 PowerCLI 工具，用於識別以下產品的正確授權數量：

Feb 25, 2024
Read more from farmer87
Published on HackMD