Infoblox

---
name: infoblox
description: "Expert coverage of Infoblox DDI across NIOS and BloxOne platforms: NIOS Grid architecture, WAPI REST API, DNS/DHCP/IPAM service management, BloxOne DDI SaaS, BloxOne Threat Defense, RPZ, DNSSEC, DHCP fingerprinting, NetMRI, and Universal DDI. Use for \"Infoblox\", \"NIOS\", \"Grid Master\", \"WAPI\", \"BloxOne\", \"Threat Defense\", \"RPZ\", \"NetMRI\", \"Infoblox API\", \"Grid Member\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `ipam-ddi` skill."
license: MIT
---

# Infoblox

This skill covers Infoblox DDI across all current platforms: NIOS 9.0.x (on-premises Grid) and BloxOne DDI (SaaS). Areas of expertise include:

- NIOS Grid architecture: Grid Master (GM), Grid Master Candidate (GMC), Grid Members, Reporting Members
- DDI services: Authoritative/Recursive DNS, DHCP v4/v6, IPAM with extensible attributes
- WAPI (REST API): Authentication, CRUD operations, next-available-IP, bulk operations, paging
- BloxOne DDI: SaaS deployment, On-Premises Data Connectors (OPDC), Universal DDI portal
- BloxOne Threat Defense: RPZ, DGA detection, DNS tunneling detection, passive DNS
- DNSSEC: Zone signing, ZSK/KSK automated rollover, NSEC3
- DHCP fingerprinting: Device classification, NAC integration
- NetMRI: Network change and configuration management, compliance checking
- Automation: Terraform (infoblox/infoblox provider), Ansible (infoblox.nios_modules)

## How to Approach Tasks

1. **Classify** the request:
   - **Grid design** -- Load `references/architecture.md` for Grid topology, replication, and HA
   - **API / Automation** -- Apply WAPI patterns and IaC guidance below
   - **DNS configuration** -- Zone management, RPZ, DNSSEC, views, forwarders
   - **DHCP configuration** -- Scopes, failover pairs, fixed addresses, fingerprinting
   - **IPAM operations** -- Subnet allocation, next-available-IP, extensible attributes, discovery
   - **Security** -- BloxOne Threat Defense, RPZ, DNS tunneling detection
   - **Troubleshooting** -- Grid replication, DNS resolution, DHCP lease issues

2. **Identify platform** -- Determine if NIOS (on-prem Grid) or BloxOne DDI (SaaS). If unclear, ask. API and management workflows differ significantly.

3. **Load context** -- Read `references/architecture.md` for deep Grid, WAPI, and BloxOne knowledge.

4. **Analyze** -- Apply Infoblox-specific reasoning, not generic DNS/DHCP advice.

5. **Recommend** -- Provide actionable guidance with WAPI calls, CLI commands, or configuration steps.

6. **Verify** -- Suggest validation steps (WAPI queries, Grid Manager checks, DNS lookups).

## NIOS Grid Architecture

### Grid Components

| Component | Role | HA Model |
|---|---|---|
| **Grid Master (GM)** | Authoritative management node; hosts GUI, WAPI, master database | GMC (Grid Master Candidate) auto-promotes on failure |
| **Grid Members** | Distributed DNS/DHCP/IPAM service nodes | Multiple members per site; DHCP failover pairs |
| **Reporting Members** | Analytics, log aggregation, compliance reports | Dedicated nodes offload reporting workload |
| **vNIOS** | Virtual appliance (VMware, KVM, Hyper-V, AWS, Azure, GCP) | Same Grid role as physical; lower throughput |

### Grid Replication

- All configuration changes made on GM replicate to all Members automatically
- **Database-level replication** (not DNS zone transfer) -- ensures exact configuration parity across all Members
- **Delta replication** for incremental changes; full sync when a Member first joins the Grid
- Replication is encrypted; uses proprietary Grid protocol over TCP

### Hardware Appliances

| Model | Target | DNS QPS | DHCP LPS |
|---|---|---|---|
| IB-810 | Branch/remote site | Low | Low |
| IB-1410 | Medium site | Medium | Medium |
| IB-2210 | Large site/campus | High | High |
| IB-4030 | Data center / central | Very high | Very high |

## DDI Services

### DNS

- **Authoritative DNS** -- Primary and secondary zones; BIND-compatible zone format
- **Recursive/Caching DNS** -- Unbound-based resolver; configurable forwarders
- **DNSSEC** -- Sign zones with NSEC3 opt-out; automated ZSK/KSK rollover; upstream validation
- **Response Policy Zones (RPZ)** -- DNS firewall; intercept and rewrite responses
  - Sources: Infoblox threat feeds, custom RPZ zones, external DNSBL feeds
  - Actions: NXDOMAIN (block), NODATA, wildcard redirect, passthru (whitelist)
- **DNS64** -- IPv6 transition; synthesize AAAA records for IPv4-only destinations
- **Split DNS** -- Different zone views for internal vs external clients
- **Scavenging** -- Automatic cleanup of stale DNS resource records

### DHCP

- **DHCP v4 and v6** -- ISC DHCPd-based; full scope/pool management
- **DHCP Fingerprinting** -- Identify device type from DHCP option patterns; tag leases with device class (Windows, iPhone, Cisco IP phone, printer)
- **Failover Pairs** -- DHCP failover between two Grid Members (RFC 3074); active/standby or load-balanced modes
- **Lease History** -- Full audit trail of IP-to-MAC bindings; query by IP, MAC, or time range
- **Fixed Addresses** -- MAC-to-IP reservations; can trigger DNS record creation automatically
- **Network Discovery** -- Integrates DHCP lease data with IPAM to automatically update IP records

### IPAM

- **Hierarchical IP Space** -- Networks organized by container/network/range hierarchy
- **Subnet Management** -- Allocate, split, merge subnets; track utilization per subnet
- **IP Address Tracking** -- Record owner, location, device, purpose, and custom extensible attributes per IP
- **Automated Sync** -- DHCP lease data, DNS records, and router ARP tables automatically populate IPAM
- **Conflict Detection** -- Real-time detection of duplicate IPs and overlapping ranges
- **Network Discovery** -- SNMP-based discovery of active hosts; imports into IPAM
- **Extensible Attributes (EAs)** -- Custom metadata fields on any IPAM object; supports automation workflows

## WAPI (REST API)

### Basics

- **Authentication** -- HTTP Basic Auth or session cookie; HTTPS only
- **Base URL**: `https://<grid-master>/wapi/v<version>/`
- **Current version**: 2.13+ (NIOS 9.0)
- **Response format**: JSON
- **Paging**: `_max_results` and `_paging=1` for large result sets; follow `next_page_id`

### Common Operations

```bash
# Get all networks
curl -k -u admin:password "https://gm.example.com/wapi/v2.12/network"

# Create a host record (A + PTR)
curl -k -u admin:password -X POST \
  "https://gm.example.com/wapi/v2.12/record:host" \
  -H "Content-Type: application/json" \
  -d '{"name":"server01.corp.example.com","ipv4addrs":[{"ipv4addr":"10.1.1.50"}]}'

# Create host with next available IP
curl -k -u admin:password -X POST \
  "https://gm.example.com/wapi/v2.12/record:host" \
  -H "Content-Type: application/json" \
  -d '{"name":"server02.corp.example.com","ipv4addrs":[{"ipv4addr":"func:nextavailableip:10.1.1.0/24"}]}'

# Search leases by MAC address
curl -k -u admin:password \
  "https://gm.example.com/wapi/v2.12/lease?hardware=aa:bb:cc:dd:ee:ff"

# Get next available IP in a subnet
curl -k -u admin:password -X POST \
  "https://gm.example.com/wapi/v2.12/network/ZG5z.../next_available_ip" \
  -d '{"num":1}'

# Update extensible attributes on a network
curl -k -u admin:password -X PUT \
  "https://gm.example.com/wapi/v2.12/network/ZG5z..." \
  -H "Content-Type: application/json" \
  -d '{"extattrs":{"Site":{"value":"NYC-HQ"},"Environment":{"value":"Production"}}}'

# Delete a record (by _ref)
curl -k -u admin:password -X DELETE \
  "https://gm.example.com/wapi/v2.12/record:host/ZG5z..."

# Search with regex
curl -k -u admin:password \
  "https://gm.example.com/wapi/v2.12/record:host?name~=server.*corp.example.com"
```

### WAPI Object Model

| Object | Description |
|---|---|
| `network` | IP subnet (CIDR) |
| `networkcontainer` | Container grouping networks hierarchically |
| `record:host` | Host record (A + PTR combined) |
| `record:a` | A record |
| `record:aaaa` | AAAA record |
| `record:ptr` | PTR record |
| `record:cname` | CNAME record |
| `fixedaddress` | DHCP reservation (MAC-to-IP) |
| `range` | DHCP scope/range |
| `lease` | Active DHCP lease |
| `zone_auth` | Authoritative DNS zone |
| `view` | DNS view (for split DNS) |
| `member` | Grid Member |
| `grid` | Grid configuration |

### WAPI Best Practices

1. **Use `_return_fields`** -- Request only needed fields to reduce response size and latency
2. **Use `_max_results`** -- Set explicit limits; default may truncate large result sets
3. **Use `func:nextavailableip`** -- Atomic next-available-IP allocation prevents race conditions
4. **Use extensible attributes** -- Tag all objects with metadata for automation and reporting
5. **Use `_return_as_object=1`** -- Returns result as object with `_ref` for chained operations
6. **Batch with CSV import** -- For bulk operations (1000+ records), use CSV import job rather than individual API calls

## BloxOne DDI (SaaS)

### Architecture

- Hosted in Infoblox cloud; no hardware or VM to manage
- **On-Premises Data Connectors (OPDC)** -- Lightweight agents deployed on-premises; proxy DNS/DHCP traffic to cloud-hosted service
- **Universal DDI** (2025/2026) -- Unified management portal combining NIOS Grid management and BloxOne DDI
  - Manage NIOS Grid members directly within Infoblox Portal
  - Single API surface for both on-prem and cloud DDI

### BloxOne API

- RESTful API hosted at `https://csp.infoblox.com/api/ddi/v1/`
- OAuth2 authentication (API key-based)
- Different API surface from WAPI; dedicated BloxOne SDK available

### Recent Additions (Q2 FY26)

- Microsoft DNS/DHCP management from BloxOne
- AWS and GCP Cloud IPAM discovery
- External authoritative DNS zones

## BloxOne Threat Defense

- **DNS-layer security** -- Blocks malicious domains via RPZ at DNS resolution time
- **Threat feeds** -- Infoblox curated intelligence: malware, ransomware C2, DGA detection, data exfiltration domains
- **DGA Detection** -- ML-based identification of algorithmically generated domain names
- **DNS tunneling detection** -- Statistical analysis of DNS query patterns for covert channels
- **PDNS (Passive DNS)** -- Historical DNS data for threat hunting; track domain resolution history
- **Lookalike domain detection** -- Homograph and typosquatting identification for brand protection
- Managed from Infoblox Cloud Services Portal (CSP); integrates with SIEM and SOAR platforms

## NetMRI

Infoblox NetMRI provides network automation and change management:

- **Device discovery and inventory** -- SNMP-based; vendor-agnostic
- **Configuration backup** -- Scheduled capture of device configurations; diff comparison
- **Compliance checking** -- Policy rules evaluated against device configs; automated remediation
- **Change automation** -- Script execution across device fleet; Perl/Python and CCS scripting
- Positioned as part of Infoblox's broader network automation portfolio

## Automation (IaC)

### Terraform

```hcl
provider "infoblox" {
  server   = "gm.example.com"
  username = var.ib_username
  password = var.ib_password
}

resource "infoblox_ip_allocation" "server" {
  network_view = "default"
  cidr         = "10.1.1.0/24"
  dns_view     = "default"
  fqdn         = "server03.corp.example.com"
  enable_dns   = true
}
```

### Ansible

```yaml
- name: Create host record
  infoblox.nios_modules.nios_host_record:
    name: server04.corp.example.com
    ipv4addrs:
      - ipv4addr: "func:nextavailableip:10.1.1.0/24"
    state: present
    provider:
      host: "{{ nios_host }}"
      username: "{{ nios_user }}"
      password: "{{ nios_pass }}"
```

## Common Pitfalls

1. **No Grid Master Candidate** -- Running without a GMC means Grid Master failure is a management-plane outage. Always deploy a GMC for production Grids.

2. **WAPI version mismatch** -- Using an older WAPI version may miss newer object types or fields. Always query the Grid for supported WAPI version and use the latest available.

3. **Ignoring extensible attributes** -- EAs are the foundation of Infoblox automation and reporting. Define a standard EA schema (Site, Environment, Owner, Application) from Day 1.

4. **DHCP failover without monitoring** -- Failover pairs need monitoring for split-brain conditions. Monitor Grid Manager health dashboard and set alerts for failover state changes.

5. **RPZ without testing** -- RPZ rules can block legitimate domains (false positives). Deploy in passthru/log mode first, analyze for 2-4 weeks, then switch to blocking.

6. **Network discovery disabled** -- Without SNMP/ARP discovery, IPAM records drift from reality. Enable discovery on all Grid Members with local subnet visibility.

7. **Not using func:nextavailableip** -- Manually selecting IPs via API creates race conditions in automation pipelines. Always use `func:nextavailableip` for automated allocation.

8. **BloxOne vs NIOS API confusion** -- BloxOne DDI and NIOS WAPI are completely different APIs. Ensure automation code targets the correct platform.

## Reference Files

Load these when you need deep knowledge:

- `references/architecture.md` -- NIOS Grid internals, WAPI object model, BloxOne DDI architecture, Threat Defense, NetMRI. Read for "how does X work" questions.