Introducing SOC Insights for BloxOne Threat Defense: Boost your SOC efficiency with AI-driven insights to eliminate manual work and accelerate investigation and response times. Read the blog announcement here.

Community Suggestions

Reply

WAPI Get Name Server Group Members

New Member
Posts: 6
7758     0

Is there a way to pull Name Server groups via the WAPI?

I have found a couple clues that there might be a way, but I have had no luck in getting the data I'm looking for.

I have searched the documentation and the closest thing I was able to find was the "ns_group" variable within the zone_auth objects. It simply references the zones that use NS Groups, but I can't seem to find anything that would give me the servers within that group.

As far as why I'm trying to do this... I'm trying to automate zone forward requests, and I'd like to specify the forwarding servers of a particular NS group. It does not appear that I can specify a group for the zone_forward, so I must enter the server names invidually.

Thank you!

Nameserver groups in the NIOS WAPI

Adviser
Posts: 33
7759     0

To address your questions and comments in order:

First, there is no way in the most recent WAPI version (2.0) to create a nameserver group or to retrieve a list of its members. To do this you would need to use the older Perl-based API.

Second, when you are creating an authoritative zone (either forward- or reverse-mapping) you can specify a nameserver group as the (set of) nameservers for the zone. For example, the following command

curl --tlsv1 --user 'admin:infoblox' --header 'Content-Type: application/json' --data '{"fqdn": "foo.com", "ns_group": "internal-nameservers"}' 'https://gm.example.com/wapi/v1.1/zone_auth'

creates the new forward-mapping authoritative zone "foo.com" and assigns the (existing) nameserver group "internal-nameservers" to be authoritative for the zone. (This works in WAPI version 1.1 and later.)

Finally, you cannot specify a nameserver group when creating a forward zone (which is not the same as a forward-mapping authoritative zone). This is not a WAPI-specific restriction; you can't do it in the web GUI either. When creating a forward zone you always have to individually specify the servers (including IP addresses) to which requests for that zone will be forwarded. For example, the following command

curl --tlsv1 --user 'admin:infoblox' --header 'Content-Type: application/json' --data '{"fqdn": "bar.com", "forward_to": [{"name": "dns1.example.com", "address": "10.0.0.2"}, {"name": "dns2.example.com", "address": "10.0.0.3"}]}' 'https://gm.example.com/wapi/v1.1/zone_forward'​

will create a forward zone "bar.com" that forwards to the two servers dns1.example.com (with address 10.0.0.2) and dns2.example.com (with address 10.0.0.3). (This also works in WAPI version 1.1 and later.)

Thank you for the response,

New Member
Posts: 6
7759     0

Thank you for the response, very helpful or at least defining what's possible. 

 

Re: Nameserver groups in the NIOS WAPI

Adviser
Posts: 51
7759     0

@FHecker wrote:

To address your questions and comments in order:

First, there is no way in the most recent WAPI version (2.0) to create a nameserver group or to retrieve a list of its members.


Is this still true for WAPI 2.10 or higher?

Showing results for 
Search instead for 
Did you mean: 

Recommended for You