Efficientip

---
name: efficientip
description: "Expert coverage of EfficientIP SOLIDserver DDI platform: SOLIDserver architecture, Smart IPAM, DNS Blast high-performance DNS, DNS Guardian security, VLAN/VRF management, Terraform/Ansible automation, and SaaS DDI deployment. Use for \"EfficientIP\", \"SOLIDserver\", \"DNS Guardian\", \"DNS Blast\", \"EfficientIP IPAM\", \"EfficientIP DDI\", \"SOLIDserver API\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `ipam-ddi` skill."
license: MIT
---

# EfficientIP SOLIDserver

This skill covers EfficientIP SOLIDserver DDI. Areas of expertise include:

- SOLIDserver architecture: Physical/virtual/cloud appliances, primary/secondary replication
- Smart IPAM: Dynamic IP lifecycle management, VLAN/VRF tracking, extensible custom fields
- DNS services: Authoritative/recursive DNS, multi-tenant DNS views, DNSSEC
- DNS Blast: Hardware-accelerated high-performance DNS (tens of millions QPS)
- DNS Guardian: DDoS protection, DNS tunneling detection, cache poisoning protection, DGA detection
- DHCP services: IPv4/IPv6, scope management, relay architecture
- REST API: JSON over HTTPS, OAuth2/Basic Auth, webhook triggers
- Automation: Terraform (efficientip/solidserver provider), Ansible (EfficientIP.solidserver collection)
- SaaS/Hybrid: EfficientIP Cloud DDI, hybrid on-prem + cloud deployment

## How to Approach Tasks

1. **Classify** the request:
   - **Architecture** -- SOLIDserver deployment, primary/secondary topology, SaaS vs on-prem
   - **IPAM operations** -- Smart IPAM, subnet management, VLAN/VRF tracking, bulk import
   - **DNS configuration** -- Zone management, views, DNSSEC, DNS Blast performance tuning
   - **DNS security** -- DNS Guardian configuration, DDoS countermeasures, tunneling detection
   - **DHCP configuration** -- Scope management, failover, option configuration
   - **Automation** -- REST API, Terraform, Ansible, ServiceNow integration
   - **Migration** -- Infoblox-to-EfficientIP migration, spreadsheet import

2. **Gather context** -- Deployment model (appliance, VM, cloud, SaaS), scale (subnets, zones, QPS), security requirements, integration targets

3. **Analyze** -- Apply EfficientIP-specific reasoning. Leverage DNS Guardian for security-focused requirements and DNS Blast for performance-critical DNS.

4. **Recommend** -- Provide actionable guidance with API calls, configuration steps, or Terraform/Ansible examples.

5. **Verify** -- Suggest validation steps using SOLIDserver console or API queries.

## SOLIDserver Architecture

### Deployment Options

| Form Factor | Description |
|---|---|
| **Physical appliance** | Dedicated hardware with DNS Blast acceleration |
| **Virtual appliance** | VMware, KVM, Hyper-V |
| **Cloud** | AWS, Azure, GCP marketplace images |
| **SaaS** | EfficientIP Cloud DDI; fully managed |

### HA Model

- **Primary/Secondary** appliance pairs with replicated database
- Automatic failover on primary failure
- Secondary promotes to primary; read-only management until promotion
- Simpler topology than Infoblox Grid; appropriate for most enterprise deployments

## Smart IPAM

- **Dynamic IP lifecycle** -- IPs automatically reserved, allocated, and released via DHCP and DNS integration
- **VLAN/VRF Management** -- Track VLAN-to-subnet mappings and VRF instances alongside IP addressing
- **Custom fields** -- Extensible metadata on IP objects for automation and CMDB integration
- **Bulk import** -- CSV and Excel import for migrating existing IP spreadsheets
- **Time-to-Live tracking** -- Monitor IP assignment review/renewal dates
- **Network discovery** -- SNMP and ping-based discovery feeds IPAM automatically
- **Utilization dashboards** -- Real-time subnet utilization with threshold alerting

## DNS Services

### Authoritative and Recursive DNS

- Separate service roles for authoritative zone hosting and recursive resolution
- BIND-compatible zone management
- **Multi-tenant DNS** -- Separate DNS views per tenant or business unit
- **DNSSEC** -- Zone signing, key management, automated rollover

### DNS Blast

DNS Blast is EfficientIP's high-performance DNS engine:

- **Hardware-accelerated** processing on dedicated appliances
- **Performance**: Tens of millions of queries per second on dedicated hardware; 2M+ QPS on virtual instances
- Optimized for authoritative DNS at carrier/ISP scale
- DNS Guardian operates at the DNS Blast level for inline security

## DNS Guardian

DNS Guardian is EfficientIP's DNS security module providing real-time threat protection:

| Capability | Description |
|---|---|
| **DNS DDoS protection** | Behavioral analysis to identify and mitigate volumetric DNS attacks |
| **DNS tunneling detection** | Statistical analysis of query patterns (entropy, query length, TTL anomalies) |
| **Cache poisoning protection** | Transaction ID randomization; DNSSEC validation enforcement |
| **DGA malware detection** | ML-based identification of domain generation algorithm traffic |
| **Bot detection** | Pattern recognition for bot-generated DNS query storms |
| **Countermeasures** | Rate limiting, client blacklisting, sinkholing, selective blocking |

Countermeasures can be **automatic** (triggered by detection thresholds) or **manual** (operator-initiated).

## REST API

### Basics

- **Base URL**: `https://<solidserver>/rest/`
- **Authentication**: Basic Auth or OAuth2
- **Format**: JSON
- **Webhook triggers**: Push notifications to external systems when IP allocations change

### Common Operations

```bash
# List all subnets
curl -u admin:password "https://solidserver/rest/ip_block_subnet_list"

# Create a subnet
curl -u admin:password -X POST "https://solidserver/rest/ip_subnet_add" \
  -d "subnet_addr=10.1.1.0&subnet_prefix=24&subnet_name=Server-VLAN"

# Get next available IP
curl -u admin:password "https://solidserver/rest/ip_address_find_free" \
  -d "subnet_id=123&max_find=1"

# Create a DNS zone
curl -u admin:password -X POST "https://solidserver/rest/dns_zone_add" \
  -d "dns_name=corp.example.com&dns_type=master"
```

## Automation

### Terraform

```hcl
provider "solidserver" {
  host     = "solidserver.example.com"
  username = var.eip_username
  password = var.eip_password
}

resource "solidserver_ip_subnet" "server_vlan" {
  space   = "Default"
  block   = "10.0.0.0/8"
  size    = 24
  name    = "Server-VLAN"
  gateway = "10.1.1.1"
}
```

### Ansible

```yaml
- name: Create DNS zone
  efficientip.solidserver.solidserver_dns_zone:
    name: "corp.example.com"
    type: "master"
    server: "{{ eip_host }}"
    username: "{{ eip_user }}"
    password: "{{ eip_pass }}"
```

### ServiceNow Integration

- Native connector for IPAM request/fulfillment workflows
- IP allocation triggered by ServiceNow tickets
- Bi-directional sync between CMDB and SOLIDserver IPAM

## Migration from Infoblox

EfficientIP provides migration tooling for Infoblox NIOS data:

1. **Export from NIOS** -- WAPI bulk export or CSV export of networks, records, DHCP scopes
2. **Schema mapping** -- Map Infoblox extensible attributes to SOLIDserver custom fields
3. **Import** -- SOLIDserver bulk import from CSV/Excel
4. **DNS cutover** -- Update NS delegations and DHCP relay agents
5. **Validation** -- Compare resolution results and DHCP behavior

## Common Pitfalls

1. **Undersizing for DNS DDoS** -- DNS Guardian requires adequate hardware to absorb attack traffic. Size appliances for 10x normal QPS to handle volumetric attacks.

2. **Ignoring VLAN/VRF tracking** -- SOLIDserver can track VLAN-to-subnet mappings alongside IP addressing. Use this from Day 1 to maintain a single source of truth.

3. **Not leveraging DNS Blast** -- For high-QPS environments, DNS Blast on dedicated hardware significantly outperforms standard DNS. Evaluate hardware appliances for authoritative DNS at scale.

4. **Manual countermeasures only** -- DNS Guardian can trigger countermeasures automatically. Configure automatic response thresholds for common attacks to reduce MTTR.

5. **Skipping custom fields** -- SOLIDserver custom fields are essential for automation and reporting. Define a standard schema before initial data import.