X

i-TEAM, one of the Group’s IT departments, wanted to offer a single solution to all of the Group’s entities as a repository for IP addresses and domain names. It was also to be backed up by internal and external IP address distribution and name resolution services. The idea was also to simplify the global management of the DDI (DNS, DHCP and IPAM), to reduce costs and to improve security and compliance, thus contributing to a better governance of its information system. Previously a user of Infoblox, i-TEAM found this solution too rigid and not user friendly enough for the delegated users, who found it difficult to get to grips with the tool and were making configuration errors. I-TEAM also wanted to easily adapt its new solution to its specific needs to meet some of its requirements. Amongst these, the IT service centre wanted to reinforce the solution’s intrinsic security (partitioning), and to be able to simply deploy personalised management policies for the different entities. One of the challenges faced by this IT department was to adopt a centralised and uniform DDI solution that would allow each of the group’s departments and subsidiaries to manage its DNS zones and addressing plans independently. Although i-TEAM was already responsible for managing part of the group’s DDI infrastructure, several subsidiaries were still using their own solutions. This situation brought about heterogeneity both in terms of general governance and in terms of compliance and security. Each entity also bore the costs of its own solution, both in terms of licences and resources.

Rotherham Metropolitan Borough Council, serving a population of around 260,000 people, provides the majority of local government services in Rotherham, England. Like most local authorities and government bodies in the UK, the council has been severely challenged with regular government cuts and needed to bring efficiency and savings to the way it delivers IT services to 4,100 active users. To successfully deliver those IT services across 3,500 VOIP handsets combined with 4,500 computer devices at the same time, Rotherham had been using an IPAM solution from Infoblox. However, with the two Infoblox appliances being discontinued, Kevin Waller, Implementation Team Manager, made the decision to look for a more efficient and competitive replacement solution. Rotherham requires two data centres to handle the IT for the entire council, and 500+ DHCP-defined networks installed across the grid handling IP requests from clients, printers and other network devices. Just to ‘keep the lights on’, Kevin needed a robust system.

The University of the Basque Country (UPV/EHU) was using SAURON, a solution combining free software and manual development for their IP Addresses Management (IPAM) tool. However, this solution did not offer scalability and did not support IPv6. The university's infrastructure was highly compatible with IPv6 and had been providing IPv6 addresses for more than a year in some VLANs test environments. The corporate website servers also used the dual stack protocol i.e. both IPv4 and IPv6 addresses. However, Sauron was not 100% compatible with IPv6, which was an issue that needed to be addressed. The university was considering a complete renovation of the systems architecture using a professional tool to improve what it offers on campus. The new technology should integrate XIXARE, its own addresses routing system.

De Montfort University (DMU) was using a different system as its DDI solution. However, its hardware 'end of life' was fast approaching. The team was faced with the prospect of having to make significant investment in new hardware to continue receiving support and updates, as well as increasing frustrations with functionality and usability. At this point, Paul went out to tender to find an alternative, more cost-effective solution. The job of managing the University’s IP infrastructure and providing resilient and secure DNS, DHCP and IP Address Management Services (collectively known as DDI) sits with Senior Technical Analyst, Paul Toyne. With over 18 years experience of managing DNS and DHCP systems, Paul was responsible for implementing DMU’s original DDI solution.

STMicroelectronics, a global semiconductor solutions specialist, sought to centralize the management of its DNS and DHCP servers to gain a global vision and fine supervision of its worldwide architecture. The company's organization, with less than 50,000 employees spread across 36 countries, justified this need for a global vision. The previous management of DNS and DHCP servers was decentralized and heterogeneous, leading to the need for a global project to control the entire system.

MetaX was looking for a more structural way to manage IP space, DHCP and DNS on one platform to prevent error-prone network service configuration and improve team working efficiency. They were using Microsoft DNS, managed by Active Directory, which had certain limitations making it incapable of adequately supporting the rapidly-growing business requirements. The IT team was aiming to improve IT performance as well as security. It was clear the whole IT infrastructure needed to be redesigned taking into consideration business requirements. Having a high-availability, integrated DDI (DNS-DHCP-IPAM) solution was mandatory to make this happen.

When HP decided to launch its cloud solution - HP cCell Services, it was clear that professional IP address management was needed. However, there was no in-house product that met the requirements. The central requirements were a high degree of reliability and a solid price/performance ratio. The infrastructure of the HP cCell Services consists of a growing, multi-customer solution; the services provided by a multiplicity of physical and virtual servers. A number of business units at HP were involved in the planning, construction, and operation. The requirement profile of the potential IPAM solution was further heightened by the need for the landscape to be designed in a way that was both modular and highly flexible.

FusionNet, a Class A Internet Service Provider (ISP) in India, was facing several challenges with their conventional DNS servers. The rapidly increasing number of subscribers was causing performance issues, with DNS queries not being resolved in a timely manner, severely affecting customer experience. The rise in complaints from home broadband users regarding lack of internet access resulted in the call center often becoming overloaded. Security was another major concern for FusionNet. Security policies were difficult to enforce, and regulatory issues were at risk as there was no way to block the domains being requested, in accordance with the list defined by government authorities. DNS attacks were mostly service affecting, leading to a 17% increase in average customer churn, causing an associated revenue impact. The workaround of pointing to 3rd party providers in the cloud for providing the DNS service diminished FusionNet’s operational control and opened up issues around compliance.

In 2015, the university network team realized they needed to make a change to overhaul their IPAM, which was not integrated with their manual DHCP management process. They were outgrowing their own inhouse solution, forcing the network team to hard code DNS records. Managing the DNS on campus became arduous, forcing many people to get involved due to the inflexibility of their older solution. The team was getting by with minor tweaks to the system, but there was a limit to what they could change due to the age of the code. They needed a solution that could be molded to meet their unique needs while also utilizing their existing DNS and DHCP servers.

Proximus, the largest quadplay operator in Belgium, was facing a challenge in migrating its customers to a new broadband infrastructure with minimal impact on uptime. The company had upgraded its backbone to a capacity of multi-Terabit/s and decentralized its Broadband Network Gateway (BNG) functionalities. This resulted in a migration from 10 central BNG-nodes towards 700+ existing decentralized nodes. With the new design planning to deploy more than 700 devices for the BNG service, management of local pools was no longer possible. Proximus therefore needed to unify DHCP service via a central solution capable of providing high capacity and performances. The challenge was to create a solution to add new scopes and ranges to the centralized DHCP service, while at the same time enabling the adequate routing on the backbone to the newly created infrastructure.

FHVI used different systems to manage its IP addresses, including an IPAM solution from Microsoft and another portion via Excel files. Part of its inventory of addresses was known by heart by certain members of staff, but not recorded anywhere. This manual organization created a lack of visibility and wasted time and efficiency, especially during operations such as migrations, for which FHVI were very dependent on the skills of certain individuals. Microsoft DNS was also an integral part of the project as it posed security concerns since sensitive data could be more exposed. It became essential that the existing repositories be consolidated in order to simplify the management of IP addresses by all employees and the various sites, so as to grant them a degree of autonomy. The challenge was to consolidate all of the different repositories before making the planned changes. Router modifications were also necessary because the DHCP was referenced in much of the equipment. Overall, the aim was to limit the impact of the migration.

Sage France wanted to regain global control over its DNS Internet service and to eliminate use of their then hosting service provider. The company had three main objectives: get global visibility and control over DNS activity, streamline workflow with a check and validate process for each operation made on DNS servers and maintain a high level of security for the DNS service. Sage France had been using the services of a hosting service provider to manage their DNS servers. The service delivered a robust, secure and stable service. However, the method had several drawbacks. Sage teams had little autonomy and were «overly» dependent on the hosting service. For example, at the creation of DNS records (RR), Sage intervention was limited to A-type recordings. For other operations, the network team had to make a request through the user interface of the host who would execute the requested actions. This restricted access to DNS service prolonged response time, either in the creation of zones and RR or when solving problems. This issue and others like it led Sage to reconsider their DNS service management system.

AEMET, the National Meteorological Service and State Meteorological Authority of Spain, needed to improve its performance by acquiring a centralized tool for the management of all IP addressing. The tool needed to be robust and scalable to guarantee DHCP and DNS services. The previous solution solved the DNS functionality, but its architecture on the relays module and the IPAM module was practically obsolete. There was no interaction between the information of the DHCP and DNS modules on the IPAM addressing database, which caused cost overruns and occasional compatibility problems. Given the intrinsic relationship of the three DDI functionalities, and the upcoming completion of support for DNS, DHCP and IPAM services, the acquisition of an integrating proposal such as that offered by EfficientIP was considered a necessity.

Orange Business Services, a major network service provider, was facing challenges in managing their heterogeneous infrastructure. They had 250 DHCP servers from different constructors, some managed centrally, others independently. This led to a large amount of repetitive administrative tasks, which had to be performed during off-peak hours to avoid impacting service availability. The company also wanted to delegate some administrative tasks to non-expert administrators, but needed a tool that could provide simple interfaces and reject input errors.

The University of Grenoble Alpes, one of the main centres of higher education in France, was created with the merger of several institutions. This merger led to the need for a unified and centralized management of the DDI (DNS, DHCP, IPAM). The university needed to create a platform capable of managing all its addressing plans, while ensuring the delegation of rights so that the various users could also manage their addressing parameters. Some entities were already using EfficientIP, while others were using Infoblox’s solution, or ISC’s open source DNS BIND and DHCP servers. The challenge was to create a single, resilient and high-performance DDI base that could support and accompany the migration of all IT services of the university’s various entities.

gkv informatik, one of the largest data centres and Europe’s leading IT service provider in the statutory health insurance market, was facing challenges with its DDI management infrastructure. The company was managing an almost incomprehensible number of networks using Excel spreadsheets, which was becoming increasingly unmanageable due to the rapidly growing demand for IP addresses within the network. The administration via Excel lists was time-consuming and error-prone. Additionally, the management of DHCP services was performed via separate servers in each individual office, which significantly aggravated the problem of providing and covering the services required with the scarce IT resources available. This resulted in an urgent need for rationalization of DHCP Management.

During the French Open in 2015, the external DNS services of the French Tennis Federation (FFT) suffered a decrease in performance due to a high volume of DNS queries during a short period of time. The DNS resolution times were too long, and Internet access appeared slow. The IT department found a workaround to ensure good service, but it was the catalyst to begin a project to internalize the external DNS service to avoid the situation again in the future. At the same time, an overall security audit of the site was being conducted, so it made sense to also secure the DNS infrastructure.

Super-Pharm, the largest chain of pharmacy stores in Israel, was facing challenges with its IT management due to the limitations of Microsoft DHCP. The organization was constantly acquiring other companies, resulting in an ever-increasing number of devices connecting to their network. However, the limitations of Microsoft DHCP, particularly around capacity, was making it challenging to manage this large, growing volume of stores and devices. Lack of visibility on devices cross-platform was one important problem area. When failure occurred, devices were no longer connected, but staff only learnt about the issues when calls were received by the IT support department. On average, 2 to 3 failures were occurring per year, leading to stores having to be closed for several hours during the failure. This led to important loss of revenue, as well as significant brand damage. A local mode of DHCP service was therefore very much required.

The financial institution identified three main areas of improvement in their network infrastructure and service management. Firstly, they wanted to limit the risk of outage as their traditional Microsoft DHCP servers did not offer a real high availability and failover solution. Secondly, they aimed to improve IP addresses management as the use of spreadsheets showed strong limitations in terms of real time visibility over IP allocations, error prevention and scalability. Lastly, they wanted to centralize IP addresses, DNS and DHCP services that were managed as three different entities with no real consistency between them, leading to high risks of misconfigurations, low management reactivity and expensive operating costs.

gotoBilling, a Florida-based company, provides end-to-end software payment services to a variety of industries including healthcare organizations, service companies, industrial merchants, utilities, and large banks. The company faced the challenge of differentiating itself in a highly competitive marketplace. The key to their differentiation strategy was to leverage security and compliance, integrated into their payment application infrastructure by FireHost, to help protect customer accounts payable and receivable processes. As the company grew, so did their needs for performance, security, compliance, scalability, and versatility. They needed a cloud service that could deliver consistently on all these fronts.

In the fall of 2006, Los Alamos National Laboratory was tasked with performing an audit of their cyber security systems, including inspections of its safeguards and security functions. The audit aimed to ensure that the organization had a system in place that complied with federal regulations, including the Federal Information Security Management Act of 2002 (FISMA). The lab was using sudo, an open source software program that only tracked activity on a machine-by-machine basis. However, the audit revealed inefficiencies associated with using sudo for these purposes. IT administrators were spending an excessive amount of time managing every machine individually to extract and consolidate relevant information from various logs to illustrate compliance and ability to monitor and control privileged users’ activity. Around the same time, the lab learned that it would be inheriting the responsibility of administering about 200 additional UNIX and Linux systems. The staff agreed that it would be impossible to manage this complex heterogeneous environment using the current monolithic architecture of open source sudo.

BankTEL Systems, a provider of financial accounting and cash management software applications, was facing challenges with its existing remote tech support tool, WebEx. The company’s support representatives found that customer end-users often had difficulty following instructions and performing the tasks necessary on their machine to enable a remote support session. Additionally, the remote support team frequently had difficulty maintaining connections to customer servers. The process of connecting to a user's computer sometimes took five to fifteen minutes, which was not acceptable considering that the issue could be resolved in one or two minutes once connected. The company needed a solution that would make the process easier for its end users.

The University of Winchester, a 175-year-old institution, was facing a challenge in securing its vast IT infrastructure. The university had to protect and support around 1500 Windows desktops, used by approximately 8000 students and around 1000 staff members across 16 different departments. The network was set up so that both staff and students could not just connect their own devices to back-end systems, and access was limited to the Internet. The university had not experienced any security breaches, but there was no room for complacency. The challenge was to manage user privileges in a way that would not impact productivity or create additional administrative workload.

DSM was working on an internal project to migrate 18,000 desktops from Windows NT4 to Windows XP. A new group was created to design the XP desktop environment to be as secure as possible. The group identified a critical component to improving security was to remove local administrator rights from end users and to enforce a Least Privilege environment. To achieve this, DSM set a policy that all end users must log on as standard users without elevated privileges. However, DSM relies on a long list of applications that require administrative privileges to do business. If end users no longer had administrative rights, these applications would not work. Additionally, DSM’s sales force must be able to manage certain settings, such as connecting to local printers and configuring an IP address when connecting to a new wireless network. Without administrator privileges, end users would not be able to make necessary system changes when they traveled.

Blum, an international company specializing in the production of functional furniture fittings, was in need of a new remote support solution that would allow their IT department to smoothly communicate with and support traveling employees. The company required a solution that would ensure external companies and service providers weren’t installing their own remote access tools within their company network. The capability for suppliers to connect to Blum’s production plants to manage and support their systems was essential. However, ensuring both employees and vendors meet these strict requirements was a challenge when different remote access solutions were installed. Configuration changes needed to be monitored and logged whenever they were done, which was difficult for administrators to track with multiple support tools in place.

Care New England, a not-for-profit health care system, was facing challenges in managing its desktop infrastructure. The organization supports over 4,800 desktops and over 10,000 desktop end users, which includes over 250 applications such as Horizon. Many of the desktops include laptops used by nurses in the field. The end users are dispersed across New England in Massachusetts, Rhode Island and Connecticut. The large coverage area needed for support, along with the challenges of managing Horizon and several other applications created many challenges for the IT team. A substantial amount of help desk calls were focused around the need to have administrative rights to install applications or run applications that required such rights. The only solutions available were to either send an IT tech to perform installations in person, provide admin rights to users who need the privileged access to run applications, or give a user full administrative rights to perform installs or run applications.

VistaPrint, an online supplier of high-quality graphic design services and customized print products, faced a significant challenge in its customer service center. The company uses Cisco Computer Telephony Integration (CTI) Object Server and has also written applications of their own to optimize monitoring and logging of voice and onscreen activity of customer service representatives during calls. Many key applications that the customer service representatives use require elevated privileges, so each user at the call center is configured as a local administrator on their computer. This posed a security risk as viruses and malware could take advantage of these privileges to gain access through web browsers and email software, leading to downtime for the customer service representatives and therefore a slower response to customers. VistaPrint wanted to achieve a Least Privilege User environment and reduce virus and malware security issues at its call center without jeopardizing employee productivity.

Bucks New University in Buckinghamshire, England, was in need of a robust IT solution to serve its campus communities. The University had entered a joint agreement with Cisco and HP for IT services and infrastructure, and as part of that agreement, the University outlined its remote support needs. The geographical distance between the two campuses and the need to support off-campus locations posed a significant challenge. The University was also in the process of migrating away from its legacy Windows domains, which brought additional challenges. The University needed a solution that could provide support to users on virtually any platform, no matter where they were located.

Quintiles Transnational, a leading global pharmaceutical services organization, manages over 13,000 end-user computers. The company wanted to remove the local administrative privileges from all end-user accounts and run a Least Privilege user environment. This would help Quintiles achieve compliance with the FDA’s Title 21 Code of Federal Regulations, increase security, and better protect client and patient data. However, with administrative privileges removed, end-users would no longer be able to run dozens of critical third-party, off-the-shelf software, as well as many in-house developed applications. End-users would also no longer be able to install local printers or any software on their own. No workaround that they had identified would allow applications that required administrator privileges to run, and writing custom install scripts or frequently visiting individual desktops to install software was not a secure or productive solution.

CACTUS Software, a leading provider of credentialing software design and development, needed a remote support solution that could meet their clients' strict data and network access policies. The solution needed to be in-house to reduce the number of parties involved during remote sessions, enhancing trust and security. It also needed to be easy to implement and highly configurable. The high costs associated with common SaaS-based remote support solutions also prompted CACTUS to seek a solution that could provide a tangible return on investment.