Find out how you can simplify operations for your hybrid and multicloud DNS, DHCP, and IP (DDI) environments with Azure through Micetro by reading this white paper.

Multicloud DNS and IP Address Management with Azure

According to information gathered by IDC, The amount spent on shared cloud IT infrastructure will overtake spending on traditional IT gear for data centers in 2022 for the first time. Admins are managing more complex environments than ever before. Find out how you can simplify operations for your hybrid and multicloud DNS, DHCP, and IP (DDI) environments by reading this white paper.

According to information gathered by IDC, the amount spent on shared cloud IT infrastructure will overtake spending on traditional IT gear for data centers in 2022 for the first time. Admins are managing more complex environments than ever before. Find out how you can simplify operations for your hybrid and multicloud DNS, DHCP, and IP (DDI) environments by reading this white paper.

More about this whitepaper

Business in the front, tech in the back. Understand the business reasons for using the same DNS, DHCP, and IPAM overlay with your Azure cloud infrastructure and your on-premises infrastructure

Get real-world insight on configuration via the UI and APIs so that you can simplify deployment and operations in a cloud and multicloud environment

Learn about the drivers for Multicloud DNS and also how to implement it in a sustainable way, which steers your team away from making manual changes in multiple locations helping you to avoid human error and ultimately service outages

What you get

Get access to whitepaper.

Multicloud DNS and IP Address Management with Microsoft Azure

Who Needs Multicloud IP Address Management and DNS Orchestration?

Both humans and machines use names and labels to find and access resources. When crossing from the physical to the digital realm, each element or entity requires a label or address for it to be accessed or used. Internal and external networks have boundaries. They are architected using a range of topologies and then grouped depending upon their characteristics, function, and risk level. Profiles and policies are then applied to these network zones and enclaves to facilitate sharing or enforce segregation.

Multicloud, a relatively recent term, speaks to the extension of our IT footprints to 3rd party zones and services. To be multicloud means to depend on or build on remote clouds with layers outside of our direct governance and control. Technically, we’ve been doing this for a long time, depending on how far up or down the stack you choose to go. We used to call trusted or semi-trusted zones that offered reachability or access to 3rd party services, an extranet. Albeit we might not have programmatically consumed cloud infrastructure services, moreso application services, we nonetheless consumed remote services from remote clouds.

Once an organization consumes services from any external cloud outside of its own fully managed network, it could effectively be thought of as engaging in a form of multicloud architecture. As Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS) extend our organizational footprints into new territories, there is no escaping basic Asset Management for foundational services such as DDI (DNS, DHCP, and IPAM). As footprints inevitably grow and change, multicloud IP Address Management (IPAM) and DNS administration become even more crucial for the digital assets you name and control. Each new edge, network, or cloud-based resource increases the burden of operational responsibility. Unified DDI management and orchestration become table stakes to keep the packets flowing.

“​​It’s not DNS. There's no way it’s DNS. It was DNS” is an utterance we want to avoid and particularly in relation to high-priority incidents. The impact of DNS-related incidents can span more than just an organization. They can ripple outwards affecting customers, suppliers, prospects, and users. Minimizing risk then begins with being able to see the whole picture, ensuring a single Source of Truth (SoT), and elevating DNS hygiene and Change Management practices.

Now, more than ever, it’s an operational necessity to have a trustworthy IPAM, one tightly integrated with a unified DNS management platform. By eliminating common mistakes and catching errors early, everything from early project design to deployments and migrations benefits. With better team collaboration and assurance, harm is minimized, confidence is bolstered, and peace of mind gets built into frictionless workflows.

Microsoft Azure DNS and Active Directory (AD)

With 21% of the public cloud market share, Microsoft Azure is the second most dominant player. Buoyed by a huge and existing on-premises market, Azure’s focus is not just on cloud natives and net new customers but on a seamless journey towards cloud adoption for those already immersed in Microsoft technology. By enabling cost-effective workload migration from existing on-premises footprints, overall complexity can be minimized while change is de-risked.

Additional benefits for existing Microsoft AD (Active Directory) users come in the form of rapidly being able to adopt hybrid cloud strategies, especially for identity services. By using Azure AD Connect, organizations can radically simplify with a common identity for accessing both on-premises and cloud services like Microsoft 365. Azure AD Connect provides synchronization of users, groups, and objects while also offering federation integration, health monitoring, enhanced security, and an overall improved user experience.

As businesses move forward and expand through time and space; their IT footprints morph and grow. Whether it’s due to planned growth or accelerating evolution, technology marches steadily onwards, and IT resources and services can be perceived as being in a state of flux. From inception through to delivery and decommissioning, lifecycle expectations often front-run the reality on the ground. IT teams are on the hook for constantly delivering with a minimum of friction and fuss. This ongoing challenge is best met by smarter approaches to virtual asset management which underpins lifecycle management.

As functionality and requirements inevitably change over time, each service, group, and location sees their IT footprints evolve. This leads to multiple trajectories and streams of work. Collaboration becomes key, as does the need for flexible OTT (Over The Top) solutions that preserve visibility while providing unified management of core atomic assets. IT must be able to audit, allocate, and account for DDI (DNS, DHCP, and IPAM)-related virtual assets at any stage of a project, migration, or build, and not just for operational or security reasons.

IaC (Infrastructure as Code) and IaaS (Infrastructure as a Service) are also shining spotlights on the importance of timely and accurate virtual asset management, highlighting a renewed focus on DDI. From the edge to the core and across all geographies, environments are becoming faster and more ephemeral. They are harder to track and troubleshoot. More intelligent, trusted, and automated workflows are needed. With greater assurance comes peace of mind and optimal outcomes, but only when the foundations are rock solid.

Integrating another organization’s DNS and IPAM footprint is a huge undertaking. There is often little time to gain crucial visibility for subsequent management and orchestration. OTT (Over The Top) solutions excel at this challenge and ensure minimal disruption with maximum positive impact. Even if the acquiree’s designs and namespaces are modular, IP spaces often include duplicate IP prefixes, which can also include disparate and heterogeneous cloud services. Acquisitions require rapid and continuous observability of core digital assets. Multicloud data management then becomes a reality, often including multiple new Microsoft Azure subscriptions and accounts.

While racing to embrace cloud services, it’s worth remembering that many organizations’ digital footprints still exist across a wide range of locations and depend on a broad suite of vendors. Diverse digital and physical assets may live anywhere from the access edge to deep within a data center network. Workloads can run on edge computing in small computer rooms and labs or in large distributed compute clusters located in data centers. Public clouds target distinct problem spaces like long lead times, scarcity, and inelasticity.

Yet, when first embracing these greenfield clouds, blue-sky thinking may lead, but inevitably, each cloud risks becoming the brownfield of tomorrow. Traditional management fundamentals become even more pronounced with the velocity, accessibility, and complexity of cloud computing. Automation and API-driven cloud services accelerate this game, as does SASE (Secure Access Service Edge), which itself leverages elements of SD-WAN (Software-Defined WAN).

Embracing a public cloud such as Microsoft’s still entails Azure DNS and Azure IPAM records having to be fresh and accurate at all times. System observability and controllability are still key for both traditional and cloud footprints. The boundaries of IP and the challenges with DNS and namespaces persist. Irrespective of how you end up connecting users and agents to on-premises or cloud-based workloads, unified DNS, DHCP, and IPAM (DDI) solutions set you up to succeed, continually and reliably.

DDI Automation, Orchestration, and Management

Digital borders are defined by IP addresses, prefixes, and virtual policy enforcement points. IP flows initiate and terminate on interfaces using addresses resolved from records in namespaces. Tracking, allocating, and assuring ourselves that our fundamental building blocks are sound is an arduous undertaking though it should be painless and easy.

In a world of increasingly automated service provisioning and consumption, DDI operations must be timely, concise, and correct. The challenge accelerates when embracing IaC (Infrastructure as Code) and programmatic access to dynamic digital resources. We now begin to more deeply realize that DNS is one of the most, if not the most important, active assets and directories. It facilitates resource location, defines service endpoints, and uncovers paths to dependencies across public and private clouds.

Using a single authoritative UI (User Interface) and API, an OTT and unified DDI solution enable simple integration while streamlining interactions with each silo without displacing them. This DDI solution then becomes the one trusted System of Record (SoR). When your perspective shifts to view DNS as the beating heart of a digital footprint, it’s not just operations and security teams that demand effective and efficient Change Management and record management; it also heavily impacts project and product team delivery.

It’s imperative that a DDI solution can meet your current needs, but it also must be able to evolve with your organization’s changing needs. By selecting a DDI platform that doesn’t involve a rip-and-replace methodology, you free yourself to embrace the best-in-breed DNS and DHCP solutions. Avoiding redesign, migrations, and friction is easy with an OTT (Over The Top) management and orchestration solution. This is how smart teams preserve their existing investments in infrastructure, workflows, and expertise. A new unified and trusted authoritative layer can meet and exceed the demands of the present and even the future.

By providing support for commonly used services such as Windows DNS, BIND, Unbound, PowerDNS, Akamai Fast DNS, Azure DNS, Amazon Route 53, NS1, and Dyn, to name a few, means accelerated time-to-value without any rework. And once your footprint extends outwards from your home cloud to other cloud providers, multicloud data management becomes ever more crucial for development, staging, and production environments.

Business and operational processes are made up of multiple workflows. Sometimes these workflows are informal and opaque, leading to a loss of visibility, accountability, and repeatability. Opportunities for innovation and automation are diminished in darkness. On the other hand, formal workflows that have been modeled and mapped give rise to greater consistency, faster learning, and more frequent optimization. With DNS, DHCP, and IPAM tasks, there is an implicit need for accountability and traceability to give confidence and assurance throughout each and every operating environment.

With an OTT (Over The Top) DDI solution, independent best-of-breed services can evolve at different rates at the service edge, while the core DDI platform and supported data types can evolve more steadily in an agnostic and operator productivity-focused manner. An OTT DDI solution has the luxury of focusing on add-value macro features and workflows (rather than getting stuck in the weeds). This OTT model also gives rise to innovative new features like xDNS for cross-provider zone redundancy, seamless migrations, and superior resilience.

With innovative features and standardized workflows, a single-layer API can now enable a fully programmable environment and unlock automation that becomes a true force multiplier. Workflows can reach beyond a single system or silo and integrate with productivity, notification, and ticketing systems. Security and operations teams can automate incident response and enrichment using a single API that covers all an organization’s DDI assets.

In addition to Micetro’s powerful UI, its fully-featured API also facilitates Azure DNS and Virtual Network actions. The Micetro API acts as a single broker to unlock and enable greater extensibility and automation across home and remote clouds. By providing a single-layer API that abstracts DDI tasks across multiple providers, teams are empowered to enhance their own workflows, build productivity-enhancing integrations, and create custom solutions.

The downstream Azure complexity and glue are fully abstracted away. Common tasks are then initiated from Micetro as a single authoritative source. This enables local and remote teams to be more efficient, make smarter decisions, and collaborate across project or team boundaries. APIs and automation open up a world of previously unrealized innovation.

Once you install the free trial, there is a full set of OpenAPI (Swagger) documentation available directly on your Men&Mice web application accessed via the path /mmws/api/doc/, and the latest product guides are always available at https://menandmice.com/docs.

Multicloud Data Management and Integration with Azure

How to Integrate Micetro with Microsoft Azure

Micetro is an overlay and orchestration solution for DDI (DNS, DHCP, and IPAM) environments, including on-premises and cloud-based assets. Two of Microsoft Azure’s pivotal services are Azure DNS and Virtual Networks, and with Micetro you can take advantage of a unified and consolidated System of Record (SoR) that encompasses all your DNS footprints (and their associated Sources of Truth (SoT)).

Micetro also provides workflows, reporting, and a fully-featured API layer. This simplifies all DNS, DHCP, and IPAM operations within a unified platform, integrating heterogeneous environments rather than replacing them. Micetro uses an OTT (Over The Top) architecture to minimize upheaval, maximize efficiency, and reduce stress.

To begin, we will focus on ensuring all the right elements are in place for a Micetro installation to talk to Azure (including any configuration items required on either end). This will facilitate:

administration of Virtual Networks (and their characteristics)

(automated) asset and record synchronization

workflows (with built-in Change Management)

Note: We will be using a subdomain called “azure” in our demo domain, “menandmice.cloud”. This will allow us to clearly partition our assets and records for the reader, as other guides will focus on Amazon Web Services (AWS), Akamai Fast DNS, Openstack, etc. Your organization’s specific namespace and DNS architecture will look different, of course. Micetro can integrate with and administer a whole range of scenarios and architectures. If you do require any help, have any questions, or would like some training, please reach out to us here.

Download: The following technical sections used version 10.2.2 of the Micetro suite. A fully functioning version is available as a free trial and does not require payment details.

Ensuring Micetro is Ready for Cloud Services

Micetro is a suite of software services. The most important element of that suite is called Men&Mice Central. Men&Mice Central is the heart and soul of Micetro. All the other elements leverage it or connect to it. The following four elements will facilitate integration with Microsoft Azure (and use Micetro’s Cloud Services component):

Men&Mice Central is required first and foremost (as mentioned). It runs on Windows or Linux and is the main hub of Micetro. It performs roles such as Identity and Access Management, database, and API access, among others. Running Men&Mice Central on Windows will provide additional insight into on-premises AD Sites and Subnets. Men&Mice Web Application is the primary UI (User Interface). It is common practice to run it on the same host as Central (but this is not required) though it does require a web server like Apache or IIS to be running on the same host. It also runs on Windows or Linux. Men&Mice Console is required for the initial Micetro setup (after software installation), some system administration, and certain features. All functionality is currently being integrated into the Web Application. Console only runs on Windows. A Men&Mice Server Controller is required to help broker the connection to Azure. These DNS Server Controllers co-locate with BIND, Active Directory, or other DNS servers such as PowerDNS on the relevant underlying operating system

Note: We will not be walking through the basic installation of each element (1-4) above, but rather how to connect the Cloud Services component to Microsoft Azure and administer assets using it. If you need any additional installation help, the detailed walk-through guides are available here. We will link to more detailed documentation where applicable, but https://menandmice.com/docs will always point to the latest version. Please pay particular attention to the required UDP and TCP port communication between elements.

Note_II: We also need to ensure that the correct licenses are installed for the DNS and IPAM modules. Additional licenses (all available and provided with the free trial) are required for the advanced Workflow and Reporting modules.

Microsoft Azure Access Prerequisites and Current Limitations

Once integrated, Micetro will import all zones and records from Microsoft Azure DNS (and also be able to create and edit them). If additionally configured for Virtual Networks integration, Micetro will also learn about Virtual Networks and their subnets, their usage, and their characteristics. It will also populate the Micetro IPAM with this data. To achieve this, Micetro requires access to Microsoft Azure using a set of Application and Object IDs (effectively used as API keys for authentication and authorization). There are detailed instructions for all cloud integrations here, but a brief Azure-specific summary follows below.

Note: The primary Micetro Central host running a Micetro DNS Server Controller must be able to speak outbound to Microsoft Azure using the port TCP 443 and be able to resolve and reach the following URLs:

https://management.core.windows.net Additionally, an Azure “Service Principal” is required, one that has the following roles:

For clarity we will create a custom “Men&Mice Operator” role with all the required permissions and access.

Note: Custom roles require an Azure AD Premium P1 or P2 license. Note_II: Please ensure when creating the custom role that you use the below JSON compliant syntax in the Azure Portal (as the Powershell payload syntax is different).

To create a custom role for the “Men&Mice Operator” that can perform both DNS and IPAM actions, go to your subscription’s “Access Control (IAM) / Roles / Add / Add custom role” and edit the JSON tab to reflect the below (but include your own Subscription ID).

Once the above role has been created, you will be able to assign it to your service principal object (next step) via your subscription’s “Access Control (IAM) / Role assignments”.

A service principal is an identity. It is required when you have applications, hosted services, or automated tools that need to access or modify resources.

Note: To successfully create a service principal and apply a custom role, your access level in the Azure subscription must have the permissions Microsoft.Authorization/*/Write or you must be an “Owner” or “User Access Administrator”.

To create the service principal with the required roles we shall:

register an application (which generates the service principal) Example name: “MnM-MultiCloud-App-Registration” Note: Ensure you also create a client secret as we will use the “Value” (rather than the secret’s ID) when configuring the Micetro integration.

add the newly created role as a role assignment to the application

get the tenant, subscription, and application client ID / Values

Note: As there are multiple steps and checks to the service principal creation process, Microsoft have provided a detailed walk-through available here. The outputs we require are the object IDs and the secret “Value” from the service principal’s app registration.

Tip: Don’t forget to apply your custom “Men&Mice Operator” role to your service principal via your subscription’s “Access Control (IAM) / Role assignments”.

IDs and Values Required for Adding Azure as a Cloud Service

Once the above role, service principal, and role assignment steps are completed, you should now be able to retrieve your (from Azure):

Tenant ID (from “App registrations/<your_app>/Directory (tenant) ID”)

Subscription ID (from “<your_subscription>/Subscription ID”)

Client ID (from “App registrations/<your_app>/Application (client) ID”)

Client Secret (from “App registrations/<your_app>/Client credentials/Client secrets/Value”)

Note: Reminder that it is the secret’s “Value” that is required when adding Azure as a new Cloud Service in the Men&Mice Console.

How to Add Microsoft Azure as a Cloud Service in The Console

In the Men&Mice Console, go to “Cloud Services”, and with a right-click, select “New Cloud Service” (or once “Cloud Services” is highlighted use the green plus symbol).

Here we can then select the type of cloud service required:

Once Azure is selected, we then want to Name our connection, enter a specific Tenant ID, its specific Subscription ID, and then both the Client ID and Client Secret (Value). The configured tenant ID (from the “App registration”) must have the correct role assignment and requisite permissions for the Subscription ID (as previously mentioned).

Note: The “Client Secret” entered above in Figure 3.0 is the Secret “Value” and not the Secret ID.

Micetro will retrieve the data from the cloud provider, save the account information, and then you must select the services required.

Micetro will then synchronize with Microsoft Azure (every 900 seconds) and perform actions on demand. We are now ready for a range of common tasks and workflows including the use of Micetro’s single-layer API to drive automation across our whole DNS namespace and IP footprint.

Note: All sensitive data required for communication with Azure such as IDs and secret values are encrypted both at rest and in transit.

BlueCat acquires Men&Mice to boost its DNS, DHCP and IP address management platform and help organizations improve network resiliency and simplify network management.

Multicloud DNS and IP Address Management with Azure

More about this whitepaper

What you get

Trusted by

Get access to whitepaper.

Products

About Us

Support

Learn More

Legal