Can we avoid creating DNS records when performing vDiscovery on VMware?

Question

Hi,

as per question in the title. We once ran a vDiscovery on VMware and around 1200 hosts were created with a flag "enable in DNS = yes". This messed up part of our production DNS database since vm's on VMware had almost always  2 IP addresses associated.

We managed to "clean" the database by performing a bulk "disable in DNS" for newly added hosts. This is something we cannot afford this in the long run.

Do you have any better way for performing vDiscovery but to leave added hosts as "disabled for DNS"?

nic w · Answer

Hey Greg,

Thanks for clarifying, just wanted to be certain before replying. Here are your options (probably not exhaustive):

(1) disabling DNS in the vDiscovery job itself (third checkbox disabled, in this case). Some customers do not like this as IPAM-only means you no longer have host record objects created. We have an accepted an IFR about this, if you want to send me an email to nic@infoblox.com I can fill in some details either cc'ing your account engineer or I can find them and add them to the thread.

(2) let's say you don't want to wait on our ENG for an IFR, need host record objects, but still want to make sure DNS records don't exist via disabling it for discovered hosts. You could use outbound notifications to kick off an automation (included in 9.1 and beyond).

I'd use the notification template sources for VMWare-specific objects (ones that have cmp_typevmi_namevmi_id, v_cluster, v_datacenter, v_host etc) for INSERT operations on the DDI DB (alternatively if this is limited to a specific network container you could kick if off using that as a source on EDIT operations) and use a template for object change discovery data (link). Essentially you'd then get a JSON blob that is the record that was just created, DNS and all, hitting an endpoint of your choosing (my customers do SOAR-like things) which then that automation would pull in the affected record / host, and then hit the NIOS WAPI to edit / change. Event-based!

gregbardski · Answer

Hi nic,

what we cannot afford in the long run is the manual process of disabling in DNS the hosts that were added via vDiscovery. The goal is to have new IPAM entries but NO new DNS records.

"better" way for us would mean to get to the menitoned state with as little manual work as possible. This time we had to go through the logs, identify affected hosts, prepare a csv and import it.

Again, the ideal end state is to have host records containing data from VMware imported into IPAM while at the same time make sure these hosts DO NOT appear in DNS.

nic w · Answer

Hey Greg,

I'm a bit unclear in the ask. When you say you disabled in DNS, but "can't afford in the long run" is the goal that the hostnames DO appear in DNS? Or can you elaborate on "better" regarding what an ideal end state is (e.g. host that shows X, Y, and Z fields) please?