Infoblox BloxOne DDI Reviews

I have been using Infoblox BloxOne DDI for IPAM, which is IP address management, for quite some time, probably about four or five years.

Infoblox BloxOne service and the advanced threat defense capabilities are newer. Infoblox BloxOne SaaS has probably only been available for about 18 months, nearly two years. I am still getting familiar with that. However, I have used the DDI, DHCP, and IPAM quite extensively.

I think the licensing costs for Infoblox BloxOne DDI are quite reasonable. I am coming at that from a point of view of rolling your own stack, which is technically possible, but you have to load up the costs of keeping that stack current, patched, supportable, and security assessed.

If we were looking at any of the roll-your-own options, such as Unbound or PowerDNS, we would be looking at two FTEs just to maintain currency, patch, and compliance and the security posture of the infrastructure. Those FTEs would probably also be implementing change.

When we compare, if we spend 200,000 to 250,000 every year or every second year on security compliance, that is money we could transfer into the licensing for a SaaS service such as Infoblox BloxOne DDI. Then we get all of the continuous patching, threat analysis, and that type of capability coming through without having to maintain such skilled staff.

Maintaining DNS across multi-cloud environments and trying to even hire people that understand two or more of those clouds is nearly impossible. Often what we find is we encounter quite senior cloud engineers who really do not understand how DNS works. They just expect it to function without comprehending its mechanics.

We want to leverage a lot of the automation to support DNSSEC as well, because any sort of certificate and cryptographic capability is where we again hit a scarcity of skilled resources.

I would like to see a bunch of templated or policy-driven provisioning for DNSSEC in the next release of Infoblox BloxOne DDI. Additionally, I would like to see DNS hosting so you do not have to deploy the NIOS appliances yourself or manage another cloud DNS service. This would allow you to pare back your DNS registration and hosting to just registrar services.

That way, you would have a fully integrated, vertically integrated API stack for being able to affect all of your automated changes against your actual public authorities as well rather than just your internal resolvers and authorities. I think that would be something quite cool for them to have.

I have been familiar with Infoblox BloxOne DDI for about three or four years.

Just the three of us are using it at the moment because we have not done any transition yet. In Q1 next year, we will be building out all of the parallel infrastructure and starting migration.

I have done most of the lab testing, preparation builds, and configuration capture for Infoblox BloxOne DDI. We are still in the process of doing that now.

If we were looking at any of the roll-your-own options, such as Unbound or PowerDNS, we would be looking at two FTEs just to maintain currency, patch, and compliance and the security posture of the infrastructure.

What we are aiming to do with our modernization and transformation is to be able to build security context-separated pipelines for DNS changes that we can automate. We are going to be breaking that down into probably making use of resource policy zones in Infoblox BloxOne DDI as well as a zone hierarchy. It is not very deep. It is probably going to be only two to three layers.

However, having the sub-zone delegation set up allows us to segregate off non-production from production and some of our core application systems from the other things that are perhaps in more of a corporate context. Separating corporate context from customer-facing application context will enable us to give essentially credentialed or privileged and titled pipelines to effect DNS change in support of a larger pipeline.

They will be having to call those with change numbers, and we are building out what we think will be our non-man-in-the-middle, non-human-in-the-loop approval chain so that those things can go through. You can have a release manager role see that all of the required things are in place for a pipeline to execute successfully.

We want the confidence that all of the tests are able to run before a pipeline is actually utilized for a production change because we want to do those things unattended and outside of normal business hours. That is the approach we are taking with automation. We are going to be bringing most of that, and we are going to be doing that with GitHub Enterprise, GitHub Actions, and direct webhook calls into Infoblox BloxOne DDI where we have to and Terraform where available.

I think it is probably too early for me to be able to comment on what I would want to improve in Infoblox BloxOne DDI. I do not think I know enough to be able to critique it, really, at the moment. I am sure there will be things that we uncover. However, I have myself and a couple of other people doing quite a lot of self-led training at the moment, and we have a summit coming up later on in the year to skill up on that.

I would rate Infoblox BloxOne DDI a nine based on my current experience. I think technically it is very, very, very good. I am actually pushing them on some things that I would want to see in the SaaS service.

I look at what they are offering and their roadmap and say, that is good. So how soon are you going to introduce things such as hosted DNS as part of your SaaS, which is shifting more into Cloudflare's DNS and Cloudflare Spectrum type of functions. I am expecting them to add even more features.

Infoblox BloxOne DDI absolutely. Cloudflare is transforming all the time, but I expect Infoblox will be gaining a lot of customers who have.

Infoblox BloxOne DDI would not be for smaller companies. I think if you are under 1,200 staff, you probably want to look for a professional service or something that is integrated into the platforms you have already got. I would say 4,000 to 5,000 customers and up is ideal, and then bigger is absolutely necessary to have something such as Infoblox BloxOne DDI.

Unless they are a really big company, I do not recommend it. I am in New Zealand, where we have got three telcos of a reasonable size, but they think they are big companies and they are not because our market is only 5 million people.

Those types of ISPs absolutely should be deploying something such as Infoblox BloxOne DDI as a service. Whether they offer that as an MSP service, I do not think it is positioned quite right. Any banks or the insurance sector should consider utilizing Infoblox BloxOne DDI as well.

I wanted to deploy Infoblox BloxOne DDI at one of the logistics companies here in New Zealand while I was there, but they did not see the value of it, even though now they have since asked me and followed up on conversations about what they might do because they are realizing they have a significant number of blind spots in terms of how they manage DNS across three out of four main clouds.

I have been in the middle as a customer and a partner of Infoblox BloxOne DDI. I am a contractor, normally a freelance contractor. I am often representing the customer I am engaged with at the time or dealing with Infoblox BloxOne DDI and the resellers. However, I am not, legally or financially, the end customer. I am putting together all the decision support and the architecture to start with, and then usually I am continuing on in terms of the implementation and the technical side. I would rate Infoblox BloxOne DDI a nine based on my current experience.

I am working in the enterprise part where we manage DNS, and we use other solutions that are oriented to provide DHCP and DNS at the enterprise level. I am referring to Infoblox.

Currently, I am mostly working with Infoblox BloxOne DDI, but this is an enterprise solution that is not comparable to Cloudflare. I am not only working with BloxOne Threat Defense but also with the DDI part. Typically, Threat Defense is just an extension. Even if it could be provided as its own solution, it is typically part of a DDI migration project, and then the security is just an add-on.

There have been some use cases where the RESTful API is used by some customers. Not many have been in the project, but RESTful API is a standard. The solution has almost all the methods that you find in the GUI, and you can have in the API. The automation is at least by design almost straightforward. I am currently developing a project where probably the customer will decide if they use this API or will use other mechanisms that are embedded in DNS, such as zone transfer and other update mechanisms.

Infoblox BloxOne DDI provides a long list of already available reports that are based on Splunk, so they can also provide other specialization. They have a very rich list of reports for both DNS and DHCP. What I have seen in the use case and in the integration with the security part of the customer is that typically, the project provides integration with a SIEM just to add another source so that you can correlate more easily the events with the client, the server, and the host in general.

I am working with Infoblox Secure DNS, which is called Threat Defense, or BloxOne Threat Defense, even though they change the name frequently. I am not only working with BloxOne Threat Defense but also with the DDI part. Typically, Threat Defense is just an extension. Even if it could be provided as its own solution, it is typically part of a DDI migration project, and then the security is just an add-on.

The anomaly, I would say, is malware or an attack. They can find out if there is an ongoing attack. For example, if you have malware that has not been detected, this malware typically will call home. When it calls home, it makes a DNS request because it needs to resolve a name to an IP. Infoblox BloxOne DDI could anticipate other security tools because this means that the malware has not been detected but is going to make requests to call home. Since the threat intelligence is dynamic, they collect this data worldwide. Their approach is to have a policy where you can decide if certain categories or requests have to be blocked, passed, or just monitored. In this case, the anomaly means that, for example, there could be an increase in requests for some category or domain, and you can highlight this using the tool.

DNS is also sometimes used to feed malware with data because it is open on the firewall as it is the basic part. This tool could provide functionality to find out if some data, some malware data, is piggybacked on the DNS protocol.

There are probably some strict agreements, and the answers are probably not so rapid. It is just a matter of setting the right expectations. The responsiveness could at least be improved, but I have not had many cases, just a few.

I have been working with Infoblox BloxOne DDI for more than two years.

DHCP and DNS are built with stability, so the implementation is just to decide the architecture and implement this functionality. It is fully stable. Of course, you have to design it with criteria.

Infoblox BloxOne DDI has a lot of appliances, so you can scale as you prefer, both from physical and virtual. I do not see any limitations right now.

There are probably some strict agreements, and the answers are probably not so rapid. It is just a matter of setting the right expectations. The responsiveness could at least be improved, but I have not had many cases, just a few.

Neutral

It has not been replaced, but it has been modified as a contest since the WAF part has been embedded in the application part. Since the application part was moved, it was in charge of another department. I just retained the DNS part, so we did not provide the WAF part. There was no replacement at all.

The initial setup for Infoblox BloxOne DDI is not so complex. To have a grid working is not so complex.

From a functional point of view, Infoblox BloxOne DDI is a very good solution. However, as a delivery, it is not so easy because you need a specialization and a partnership. They have their own professional services. Sometimes you have to compare things. It is not just the configuration. Most of the project is not the technology itself. You have to go from one technology to another. Even if many think DHCP and DDI are easy matters, when you work on DDI, you find out many things you need to consider. Most projects when starting from scratch are quite straightforward. However, one important thing is to pay attention to the migration. They have been doing this job for many years and are organized for it.

In my experience, I am satisfied with the functionality. There is no lack of functions. It is a very powerful solution because they work with this technology, so they are probably number one.

Infoblox BloxOne DDI has a long-time solution and expertise focused on DDI. Most of the functionality that is probably unique in this solution is that they have a centralized concept where they manage using a concept of member, where you can have a Grid Master and as a HA solution, a Grid Master candidate, and then you can promote any device, virtual or physical, as a member. This member could have several functions according to your configuration. You could provide DHCP or just DNS or DNS and DHCP. They also have other functionality such as NTP, for example, and also the DFP, which is typically used to integrate with Threat Defense. In this case, you have a proxy that proxies all the DNS requests that go through the cloud provided by Infoblox.

Infoblox BloxOne DDI has several solutions and all the functionality that has been implemented during the specification and the RFC, especially regarding DNS. They have a lot of functionality and expertise. So they provide a whole solution. They have a robust implementation, so you can decide to have a geographically distributed HA or you can have a cluster with two machines to increase availability.

You have a very feasible and very stable solution from a security point of view. Not just the security of the data, but the security of the platform. They are built for this, so they do not have any other pain as you can have on Microsoft where you find everything open and then you have to harden and protect any access. Instead, they do this job and they do this great job as a specific specialization. I would rate this solution a nine out of ten.

I am currently working with ServiceNow, and I use Infoblox BloxOne DDI for managing DHCP and DNS services. I can add, modify, or delete DNS services or DDI devices and manage all the devices within Infoblox BloxOne DDI. It primarily helps me manage the devices giving IPs to others on the network.

The most valuable features of Infoblox BloxOne DDI are its ability to manage all DDI services effectively and monitor them in real-time. If any DDI service goes down, it is easily detectable on the platform. I can also raise tickets with our L3 team for troubleshooting, which streamlines operations. Additionally, the ease of creating fixed IPs and containers for subnet management across different devices enhances its functionality.

Infoblox BloxOne DDI is good to use, but there could be improvements in its visualization and dashboarding UI. While the current functionalities and dashboard are good, better reporting and more flexibility in adding devices would enhance the solution. Additionally, access control could be expanded to give read-only permissions to more users and incorporate AI features for better automation.

I have been working with Infoblox BloxOne DDI for the past one year, primarily in a monitoring capacity.

I have not faced any issues with the performance or stability of Infoblox BloxOne DDI. They regularly update it, and maintenance occurs every two to three months, ensuring smooth operation.

Infoblox BloxOne DDI is very scalable and reliable. I can depend on it a lot, especially when facing network expansions. It accommodates a wide range of devices, showing its scalability.

I do not have any direct contact with tech support. I rely on an L3 person for version upgrades and other technical help.

Positive

I was not involved in the initial part of setting up Infoblox BloxOne DDI in our environment.

I would recommend Infoblox BloxOne DDI to others because it is a centralized platform for managing DDI devices. It is not difficult for others to use, and with a basic overview, they can understand its operation better. I rate Infoblox BloxOne DDI a nine out of ten as a basic user. If user interface enhancements and AI features are implemented, it could improve my rating to a ten. The overall product rating is 9.

For customers in Indonesia, I have implemented it in BCA, Bank Central Asia, BGP, and Bank Server Banton, mostly in the banking sector. 

Primarily, I use it for DNS security, particularly to block domain generation attacks. These attacks can be internal or external, targeting DNS positioning or DNS from outside or within. This has been an effective measure.

The blocking features are crucial for security. A valuable feature is blocking domain generation, which automatically generates domains to protect the internal network. 

Additionally, I need to improve Clean DNS to prevent attacks effectively. Attacks already exist, and addressing them is important. This protection contributes to securing the network.

There is a need for a comprehensive database on DNS. When a new attack occurs, the database requires timely updates. The existing database is updated frequently, but continuous improvements would be beneficial.

I have used DDI, which includes DNS, DHCP, and IP address management, for five years. 

Scalability is moderate. The organization is not very large.

Customer service is okay. It is satisfactory.

Neutral

The initial setup is not difficult. It is straightforward, scoring around seven out of ten in ease. 

Even though automation is not necessary now, I am still progressing with custom automation for the B1 product.

Infoblox is fairly expensive for my customers. I am unsure if this is a general comment or specific to my situation. Customers wonder if discounts or promotions are available.

This is not highly recommended because the organization size is not very large. Customers use BlockPoint DDI, suitable for medium to enterprise levels. 

The overall product rating is ten out of ten.

We use our Infoblox DDI platform for everything: IPAM management, DNS, DHCP, and DNS firewall functionality with their BloxOne Threat Defense cloud. 

We see DNS as the first layer of defense, so we use all the features the platform offers. We do not have DNS and DHCP in our Windows environment anymore.

For network efficiency, having IPAM and DNS together provides a singular view of the network. We know what is active and what is registered in your DNS. We can manage external and internal DNS together on the same platform. 

The integrated view using IPAM and DNS is much simpler because Microsoft AD doesn't offer IPAM. It offers DNS, and it's scattered. This is the reason I like the power of the tool. 

It is costly but it provides the whole integration and allows us to automate a lot of things, like server builds and virtual machine builds. The powerful API Infoblox offers allows my automation team to integrate and query for free IPs within Infoblox, allocate a name, and register it. Full automation is possible on the platform. 

Also, the cloud licensing capabilities give you full visibility of what is happening in the cloud. Everything together, that's the power of the platform.

The automation capabilities have benefited the operations. People can make an API call to see the next free IP. Once they get an IP, they can register the DNS and build their server with the static IP. Then, they can assign the hostname directly through their scripting as soon as the server is live. It has benefited my automation team tremendously. 

They are constantly asking me when we can have this platform in other branches, entities, or data centers because the platform is more European-centric. They have similar requirements in America and other entities separate from AMG Securities. That's how powerful it is.

Compliance and Security

It is our first line of defense. If somebody clicks on a malicious link, the DNS will not resolve it because it will not resolve the name to the IP. This stops the threat in its tracks, so your second line of defense and third line of defense don't have to kick in. 

It actually prevents a lot of false alarms because if a link is blocked by antivirus, it creates an alert for the IT risk team to investigate. By not resolving the IP for a malicious link, it stops many issues before they escalate. This has improved our security posture significantly.

Instead of using the root DNS servers all over the Internet and its Threat Defense cloud. All queries from our clients go out, so we know what the clients are querying and where they are trying to go. We can see at a DNS level if something wrong is happening within the network. 

Additionally, the ability to block unwanted traffic using DNS is powerful. While firewalls and other infrastructure can do this, BloxOne can also prevent the resolution of bot websites or other harmful sites; that's a powerful element. 

At this stage, we are struggling to use some of the DNS features of the platform, which are more about protecting your domain from hijacking and similar threats. However, I don't think it is a problem with the platform itself. It seems to be more of an integration issue with the secondary DNS provider we are trying to use on the Internet, called Cloudflare. 

So, it is more of an integration problem between Cloudflare DNS and any public DNS. I would like to improve the integration aspect of these two products. The platform should be able to work seamlessly with any other secondary DNS provider on the Internet.

If Infoblox can make their licensing cheaper, then this platform could be widely used because it does cost a fortune to have it. That's why we do not have it in every entity that we manage.

I have been using it since 2010, so it has been 14 years. 

I use the latest one, which we recently updated.

I would rate the stability a ten out of ten. Active Directory is supposed to be stable, and it is. Without Active Directory being stable, none of the authentication would work. There was never an issue of stability within Active Directory services. Infoblox actually makes this better because you can use all the IP addresses in a network. 

In Active Directory, you have to split the scope, so you can only use 50% or 30% of the IPs in a particular network because of how the scopes are configured. But if you are very tight on IP space, then Infoblox is your solution, depending on the use case.

I would rate the scalability a ten out of ten. It is the advantage of the platform. You can deploy multiple members in the grid at various locations depending on your requirements. You can have members in the cloud as well, and it's all managed through a central Grid Manager.

We have an enterprise license that covers all my users here, about 1500. This is the only solution for DDI, so everyone uses it. We would expand its usage if the price comes down. 

We try to put the solution to another entity when the feature is available for free within Windows Active Directory. Why would you spend a million on this solution, right? That's why it is not adopted everywhere. 

DNS and DHCP are free in Active Directory. It's a different way of doing things, but if you need an IP address management tool, you can get EfficientIP's tool for ten to fifteen thousand dollars. So why spend so much more? We managed to justify the presence of Infoblox, but the continuous price increase in their licensing is prohibitive. At one point, we might decide it's not worth it and go back to Windows Active Directory.

I have an ongoing issue with Infoblox and Cloudflare DNSSEC. Neither Infoblox is moving forward nor is Cloudflare. These two DNS providers are not working together in the way a customer would expect. Cloudflare is one of the biggest DNS providers on the Internet. As a secondary DNS, they have their own services.

So, these two parties are not working together to solve the problem for the customer. I would expect their professionals to work directly with each other to solve the issue because Infoblox is not a secondary DNS provider on the Internet. 

Cloudflare can be a secondary DNS provider on the Internet. Their businesses are separate in terms of what they can do for customers. There is no competition, and customers need providers like this to work together. We like Infoblox, and we like Cloudflare for what it does.

Positive

I used Microsoft Active Directory. 

We decided to switch to Infoblox to get a unified view of IP addresses, networks, and host names, and to better manage the usage of the IP address space we have.

It is easy to set up, but if you are migrating from Windows Active Directory DNS and DHCP, you do need to enroll their professional services people who can help with the migration. Their professional services team is quite good, and this is how we migrated initially. 

But once you have the platform, the learning curve is really easy. People can learn from each other, and we have never attended any formal training ourselves. I have people on my team who are experts in the platform.

The setup is easy if you use professional services. If you don't want to spend money on professional services, as a new product, it could be difficult for you. Most enterprises are more familiar with DNS and DHCP in Active Directory, so it will be difficult if you do not use professional services. It’s easy if you use them, and I think people should use professional services.

I would rate the complexity of the initial setup an eight out of ten, with ten being complex.

The first initial setup, ten years back, probably took us two weeks to deploy. We slowly migrated from Active Directory to BloxOne without causing any business outages.

Our deployment was done by one professional services engineer. Just one person was enough for maintenance. 

We were super careful because everyone was hesitant to move away from what they knew.

But the main action was to make people learn the platform. We got the Infoblox trainers on-site to conduct training sessions for people so they could get experience directly from the trainers. Training was the main focus when we rolled it out for the first time.

It's difficult to measure. Has it stopped any attacks or prevented any data from going out? If my business asks me question about the ROI, they might consider throwing the solution out.

For the IT infrastructure team, it's a good thing because we get a good way of doing things. Automation teams find it a better way of doing things. 

But can't they do automation with Active Directory DDI? They definitely can. It might be a little difficult, but once their automation scripts are ready, they can always do it. It's a one-time effort.

In terms of measuring the return on investment, in my personal view, this is one of the best tools. But from the business view, considering the money spent on this solution, it may not be the best.

I would rate the pricing a ten out of ten, with ten being very expensive. We actually significant license cost for DDI platform.

We did have the option of EfficientIP. At that time, both Infoblox and EfficientIP were competitive. Infoblox was a new entrant in the market and had a very appealing and it was cheap and affordable solution. It wasn't based on the number of users in the entity. Last time, we had to refresh it, they changed their licensing model with their BloxOne Threat Defense. Per user, it costs around 25 to 30 pounds a year, and that's when it gets costly.

And EfficientIP may not have deployed the threat defense cloud or BloxOne Threat Defense cloud, but enterprises do have their own solutions. Multi-layered security solutions, antivirus, etc. When security budgets are constrained, why spend so much on threat defense per user? We have to look at why we're spending so much on threat defense per user.

Overall, I would rate the solution an ten out of ten. 

I will recommend other users negotiate with Infoblox on their pricing, or they should look at Infoblox's competition. Infoblox moved to user-based licensing and subscription-based licensing. 

We already had Infoblox in our environment, so when you have something in your environment, your reluctance to change is quite high. But if you are looking for something new to implement, to move away from Active Directory, you should look at the competition and negotiate with Infoblox for a multi-year pricing deal.