Network appliances—hardware devices with preinstalled software that you can bring into service with little or no configuration—have been around for years. Network appliances offer several advantages, including low cost, ease of use, and high reliability. Because they arrive completely assembled and with software preinstalled, the time and cost to get them running is reduced. Simplified UIs for configuration and administration often reduce the levels of technical skill required for successful implementation. And because appliances are designed to perform one function well, they are often more reliable than general-purpose servers that are dedicated to the same function.
Like network appliances, DNS server appliances have been around for several years, and they appeal to users for the same reasons. From a user perspective, DNS services are a hidden function, just a part of the technical infrastructure. Yet, reliable DNS services are as crucial to successful network applications as the electric power that runs the network. When name resolution fails, client-to-server communication fails and work stops.
Administrators who use Windows Server 2003's or Windows 2000 Server's DNS Service might want to understand how DNS server appliances compare with general-purpose servers running the Windows DNS Service. The articles Inside Out, "Windows Server 2003 DNS," October 2003, http://www.winnetmag.com, InstantDoc ID 40049, and Inside Out, "Solving DNS Problems," September 2003, InstantDoc ID 39771, offer an excellent description of Windows 2003's DNS Service.
Two key capabilities in a Windows DNS Service server are support for stub zones and conditional forwarders. Stub zone servers store only the Start of Authority (SOA) and Name Server (NS) records for a domain (i.e., a zone). When you configure a client to use a DNS Service server that has the domain configured as a stub zone, that server can't respond directly to name-resolution requests for hosts in the zone. Instead, the stub zone server forwards the request to one of the DNS Service servers it knows is authoritative for the zone. You can let Active Directory (AD) replicate a list of authoritative servers to a stub zone server, or you can manually configure each stub zone server with a list of authoritative DNS Service servers. Zones with conditional forwarders are similar to stub zones, except that you must configure each zone's conditional forwarder with a list of DNS Service servers that are authoritative for the zone—automatic replication of this information from AD isn't an option.
You're likely to find some key differences between Windows DNS Services servers and non-Windows DNS server appliances in the areas of AD integration and security. For example, some non-Windows DNS server appliances lack complete AD integration features. Conversely, Windows DNS Service servers don't support encrypted zone transfer and update features like some non-Windows DNS server appliances do. Let's look at DNS server appliances from the top DNS server appliance vendors: ApplianSys, BlueCat Networks, BorderWare Technologies, Incognito Software, Infoblox, Offmyserver, and Threshold Networks.
ApplianSys's DNSBOX Series
ApplianSys produces three DNS server appliances: DNSBOX300, DNSBOX050, and DNSBOX100. DNSBOX300 and DNSBOX050 run Nixu NameSurfer Suite, software for DNS and IP address management. The DNSBOX100 is a slave-only BIND-based DNS server appliance that can act as a secondary DNS server to any standards-based master DNS server. When you pair DNSBOX100 with DNSBOX300, zone transfers and updates occur through a secure VPN tunnel for a higher level of security than that offered by BIND 9's Transaction Signature (TSIG) facility.
ApplianSys's three appliances run under a hardened version of Linux. Compared with the other appliances I discuss in this article, the DNSBOX appliances are unique in that they boot and run from a pair of CompactFlash (CF) cards rather than a disk drive, which eliminates a moving part that can often become the source of a system failure. DNSBOX300 has a 1U (1.75") rack-mountable chassis with a 1GHz Pentium III processor, 512MB of RAM, and a 10Mbps/100Mbps Ethernet port. DNSBOX050 uses a 1.4GHz Celeron processor with 512MB of PC133 DRAM, whereas DNSBOX100 uses a 1.7GHz Celeron processor with 512MB of PC2100 Double Data Rate (DDR) memory.
DNSBOX050 has a DNS feature set similar to that of DNSBOX300 but is designed for smaller networks. All the appliances feature AD integration, which includes support for Internet Engineering Task Force (IETF) Request for Comments (RFC) 2782 SRV records. Both master servers include a DHCP server, integrated dynamic DNS (DDNS) host registration, and data validity and consistency checking to find syntax errors, logical errors, and duplicate names and IP addresses. A built-in firewall reduces exposure to unwanted access.
To configure and manage the appliances, you use a Web-based interface, which features Secure Sockets Layer (SSL) secured communication, supports an audit trail of changes, and provides unlimited undo/redo functionality. The appliances support distributed administration. The primary administrator can create multiple administrative-user IDs, granting each ID the right to manage only specific domains. You can also configure the appliances to perform automated updates to BIND and the Linux OS, further reducing the administrative workload.
DNSBOX300 with a 1U rack mount costs $10,950, whereas DNSBOX100 with a 1U rack mount costs $2950. The DNSBOX050 minicube desktop unit costs $4250.
Previous
Register
