To create a Grid, you first create a Grid Master, and then add members. Although the Grid Master can be a single appliance (a "single master"), a more resilient design is to use an HA pair (an "HA master") to provide hardware redundancy. For information about HA pairs, see see About HA Pairs. The  The basic procedure for forming two appliances into an HA master is shown in the figure below. You can create a Grid Master in either IPv4, IPv6, or dual mode (IPv4 and IPv6). An IPv4 Grid Master uses IPv4 as the Grid communication protocol, so it supports IPv4 and dual mode Grid members. An IPv6 Grid Master uses IPv6 as the Grid communication protocol, so it supports IPv6 and dual mode Grid members. A dual mode Grid Master supports IPv4, IPv6, and dual mode Grid members. You can set either IPv4 or IPv6 as the communication protocol. All Infoblox hardware platforms, except for appliances with a 50 GB disk, support configuration as a Grid Master or Grid Master candidate. For information about which vNIOS appliance supports configuration as a Grid Master, see vNIOS Appliances.

Initially Configuring a Pair of Appliances as a Grid Master

...

...

After the nodes establish a VPN tunnel between themselves, Node 1 sends Node 2 its entire database (its configuration settings and service data). Since the configuration contains the VRID (virtual router ID) for the HA pair, Node 2 starts listening for VRRP advertisements containing that VRID number. Also, since Node 1 is already sending such advertisements, Node 2 receives one and assumes the passive role in the HA pair.

After the initial transmission of its database, Node 1 continues to send Node 2 real-time database updates through the VPN tunnel.

Node 1 maintains the synchronization of the database throughout the Grid—which, at this point, has no other members—sends VRRP advertisements indicating its physical and network health, and—if configured to do so— provides network services. Node 2 maintains a state of readiness to assume the mastership in the event of a failover. You can see the flow of HA and Grid-related traffic from ports on the active node to ports on the passive node in the figure below. This illustration also shows the ports that you can use for management traffic and network service.

Traffic and Ports that an HA Grid Master Uses

...

...

A member and master first perform a handshake to authenticate each other and exchange encryption keys. Then, they build an encrypted VPN tunnel between themselves. The member typically initiates both of these connections. The master only initiates a key exchange if you manually promote a member to the role of master, (see Promoting a Master Candidate). The figure Establishing a VPN Tunnel for Grid Communications shows the typical connection exchange and default port usage not only between the two nodes forming an HA pair but also between a member and master when the member joins a Grid.

The member and master key exchange occurs when an appliance joins a Grid, during master promotion, and when a member reconnects to a Grid after becoming disconnected. At all other times, Grid-related communications occur through encrypted VPN tunnels.

...

• Spanning Tree Protocol: Disable this or enable this with Portfast. For vendor specific information, search for "HA" in the Infoblox Knowledge Base system at https://support.infoblox.com.

• Trunking: Disable.

  Notetitle

  
  Note

  If

  that if VLAN tagging is enabled on an Infoblox HA appliance, you must enable trunking at the port level.

• EtherChannel: Disable.
• IGMP Snooping: Disable.

• DHCP Snooping: Disable or Enable Trust Interface.
  

  Note

  title	Note

  You must disable DHCP Snooping to

  To successfully run DHCP services on the Grid, you must disable DHCP Snooping. For more information about DHCP services, see 

  About Infoblox DHCP Services

  Configuring Infoblox DHCP Services.

• Port Channeling: Disable.
• Speed and Duplex settings: Match these settings on both the Infoblox appliance and switch.
• Disable other dynamic and proprietary protocols that might interrupt the forwarding of packets.

...

...

...

• Note that, by default, a NIOS appliance automatically negotiates the optimal connection speed and transmission type (full or half duplex) on the physical links between its LAN1 or LAN1 (VLAN), HA, and MGMT ports and the Ethernet ports on the connecting switch. If the two appliances fail to auto-negotiate the optimal settings, see 

...

• Modifying Ethernet Port Settings for steps you can take to resolve the problem.

Placing Both Appliances on the Network

1. Connect the power cable from each NIOS appliance to a power source and turn on the power. If possible, connect the appliances to separate power circuits. If one power circuit fails, the other might still be operative.

2. Connect Ethernet cables from the LAN1 port and the HA port on each appliance to a switch on the network.

   Notetitle

   
   

   Note

   The Ethernet ports on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances are autosensing, so you can use either a straight-through or cross-over Ethernet cable for these connections.

3. For

   Use the LCD on one appliance or make a console connection to it and configure the network settings of its LAN1 port so that it is on the local subnet and you can reach it on the network. LCD supports only IPv4 addressing and not IPv6 addressing. You can configure IPv6 address for the appliance through the CLI or GUI. IPv4 addressing is supported on the LCD; ensure that you have the correct network address values before configuration of the appliance.

   Note

   title	Note

    For details about using the LCD and console, refer to the installation guide that shipped with your product.

4. Similarly, configure the LAN1 port on the other appliance so that it is in the same subnet as the first appliance.
5. Connect your management system to the network so that it can reach the IP addresses of the LAN1 ports on both appliances.

...

1. On your management system, open a browser window, and connect to https://ip_addr, where ip_addr is the IP address of the LAN1 port on Node 1. IPv4 and IPv6 values are valid, based on the LAN1 port configuration.
2. Log in using the default username and password: admin and infoblox. For detailed information about logging in to the GUI, see Logging on to the NIOS UI.
3. Read the Infoblox End-User License Agreement (EULA), and then click I Accept.
   Note that if you want to view the privacy policy of Infoblox, then on the EULA screen, click Infoblox Privacy Policy. Grid Manager displays the policy on a new browser tab.
4. Read the Data Collection and Opt-Out Notice and choose whether to enable (opt in) or disable (opt out) the Infoblox BloxConnect feature.
   By default, the feature is enabled. If you want to disable it, select To Opt-Out of BloxConnect, please click here. The Data Collection and Opt-Out Notice screen is displayed only when you log in to Grid Manager for the first time. For more information, see Configuring BloxConnect.
5. Click OK. The Grid Setup wizard appears. 
6. On the first screen, select Configure a Grid Master and click Next.
7. On the next screen, specify the Grid properties and click Next:
   • Grid Name: Enter a text string that the two appliances use to authenticate each other when establishing a VPN tunnel between them. The default Grid name is Infoblox.
   • Shared Secret: Enter a text string that both appliances use as a shared secret to authenticate each other when establishing a VPN tunnel between them. The default shared secret is test.
   • Confirm Shared Secret: Enter the shared secret again.
   • Hostname: Enter a valid domain name for the appliance.
   • Type of Network Connectivity: Select the type of network connectivity from the drop-down list:
     • IPv4 and IPv6: Select this to configure a dual mode HA Master.
     • IPv4: Select this to configure an IPv4 HA Master.
     • IPv6: Select this to configure an IPv6 HA Master.
   • Is the Grid Master an HA pair?: Select Yes.

     • Send HA and Grid Communication over: This field is displayed only when you are configuring a dual mode HA pair. Select either IPv4 or IPv6 as the communication protocol for VRRP advertisements.

     Notetitle
     • Note
     • that Infoblox recommends that you back up the configuration after you convert a Grid to a different mode.
       Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the Grid Master after the restore.
8. On the next screen, specify the network properties and click Next:
   • Virtual Router ID: Enter the VRID (virtual router ID). This must be a unique VRID number—from 1 to 255—for this subnet.
   • Ports and Addresses: This table lists the network interfaces based on the type of network connectivity of the HA Master.
     For IPv4 HA Master, specify the network information for VIP (IPv4), Node1 HA (IPv4), Node2 HA (IPv4), Node1 LAN1 (IPv4), and Node2 LAN1 (IPv4) interfaces.
     For IPv6 HA Master, specify the network information for VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
     For a dual mode HA Master, if you select IPv4 in the Send HA and Grid Communication over field, specify the network information for the following interfaces: VIP (IPv4), Node1 HA (IPv4), Node1 LAN1 (IPv4), Node2 HA (IPv4), Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
     For a dual mode HA Master, if you select IPv6 in the Send HA and Grid Communication over field, specify the network information for the following interfaces: VIP (IPv4), Node1 LAN1 (IPv4), Node2 LAN1 (IPv4), VIP (IPv6), Node1 LAN1 (IPv6), and Node2 LAN1 (IPv6) interfaces.
     Enter correct information for the following by clicking the field:
     • Interface: Displays the name of the interface. You cannot modify this.
     • Address: Type the IPv4 or IPv6 address depending on the type of interface.
     • Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for IPv4 address or prefix length for IPv6 address. The prefix length ranges from 2 to 127.

     • Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For the IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the default gateway and the link MTU from router advertisements.

       note

       
       

       title

       Note

       You

       that you can now define a link-local address as the default IPv6 gateway and isolate the LAN segment so the local router can provide global addressing and access to the network and Internet. This is supported for both LAN1 and LAN2 interfaces, as well as LAN1 and LAN2 in the failover mode.

     • VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you configure the corresponding switch accordingly.
     • Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
9. Optionally, enter a new password and click Next. The password must be a single string (no spaces) that is at least four characters long.
10. Select the time zone of the Grid Master and indicate whether the Grid Master synchronizes its time with an NTP (Network Time Protocol) server.
    • If you choose to enable NTP, click the Add icon and enter the IP address of an NTP server. Entries may be an IPv4 or IPv6 address. You can enter IP addresses for multiple NTP servers.
    • If you choose to disable NTP, set the date and time for the appliance.
    • Click Next.

11. The last screen displays the settings you specified in the previous panels of the wizard. Verify that the information is correct and click Finish. The application restarts after you click Finish.
    

    Notetitle

    Note:

    • The Grid Setup Wizard provides options such as not changing the default password and manually entering the time and date. However, changing the password and using an NTP server improves security and accuracy (respectively), and so these choices are presented here.
      

    • Record and retain this information in a safe place. If you forget the shared secret, you need to contact Infoblox Technical Support for help. When you add an appliance to the Grid, you must configure it with the same Grid name, shared secret, and VPN port number that you configure on the Grid Master.

12. Close the management window. The configuration for Node 1 is complete.

...

The communication protocol for all the services in a dual mode (IPv4 and IPv6) HA Master is the same protocol as the one used for VRRP advertisements. For example, if you select IPv4 in the Send HA and Grid Communication over field in step 2 of the Grid Setup wizard, then IPv4 is set as the communication protocol for all the services. However, you can override the communication protocol for all the services in a dual mode HA Master. For information, see see Changing the Communication Protocol for a Dual Mode Appliance.

Creating a Single Grid Master

...

• LCD: See Method 1 – Using the LCD. (LCD configuration does not support IPv6 address entry.)
• Console port: See – See Method 2 – Using the CLI.

You can also use the NIOS Grid Setup Wizard to create a single Grid Master. In addition to providing a simple method accompanied by helpful information, the setup wizard allows you to change the admin password and configure time settings for the appliance.

...

1. Connect the power cable from the NIOS appliance to a power source and turn on the power.

2. Connect an Ethernet cable from the LAN1 port on the appliance to a switch on the network.

   note

   
   

   title

   Note

   The

   that the Ethernet ports on the TE-810, TE-820, TE-1410, TE-1420, TE-2210, TE-2220, and IB-4010 appliances are autosensing, so you can use either a straight-through or cross-over Ethernet cable for these connections.

3.  If If you have not changed the default IP address (192.168.1.2/24) of the LAN1 port through the LCD or CLI—and the subnet to which you connect the appliance does not happen to be 192.168.1.0/24—put your management system in the 192.168.1.0/24 subnet and connect an Ethernet cable between your management system and the NIOS appliance.
4. Open a web browser and make an HTTPS connection to the IP address of the LAN1 port. To reach the default IP address, enter: *https://192.168.1.2* .
   Several certificate warnings appear during the login process. This is normal because the preloaded certificate is self-signed (and, therefore, is not in the trusted certificate stores in your browser) and has the host name www.infoblox.com, which does not match the destination IP address you entered in step 3. To stop the warning messages from occurring each time you log in to the GUI, you can generate a new self-signed certificate or import a third-party certificate with a common name that matches the FQDN (fully qualified domain name) of the appliance. For information about certificates, see Managing Certificates.
5. Log in using the default username admin and password infoblox.
6. Read the Infoblox End-User License Agreement, and then click I Accept. Note that if you want to view the privacy policy of Infoblox, then click Infoblox Privacy Policy. Grid Manager displays the policy on a new browser tab.
7. Read the Data Collection and Opt-Out Notice and choose whether to enable (opt in) or disable (opt out) the Infoblox BloxConnect feature.
   By default, the feature is enabled. If you want to disable it, select To Opt-Out of BloxConnect, please click here. The Data Collection and Opt-Out Notice screen is displayed only when you log in to Grid Manager for the first time. For more information, see Configuring BloxConnect.
8. Click OK. The Grid Setup Wizard appears. 
9. On the first screen, select ConfigureaGridMaster and click Next.
10. On the next screen, specify the Grid properties and click Next:
    • Grid Name: Enter a text string that the Grid Master and appliances joining the Grid use to authenticate each other when establishing a VPN tunnel between them. The default Grid name is Infoblox.
    • Shared Secret: Enter a text string that the Grid Master and appliances joining the Grid use as a shared secret to authenticate each other when establishing a VPN tunnel between them. The default shared secret is test.
    • Confirm Shared Secret: Enter the shared secret again.
    • Hostname: Enter a valid domain name for the appliance.
    • Type of Network Connectivity: Select the type of network connectivity for the Grid Master from the drop-down list:
      • IPv4 and IPv6: Select this to configure a dual mode Grid Master.
      • IPv4: Select this to configure an IPv4-only Grid Master.

      • IPv6: Select this to configure an IPv6-only Grid Master.
        

        Notetitle

        Note

        that Infoblox recommends that you back up the configuration after you convert a Grid to a different mode.
        Restoring the old backup by performing a forced restore, may prevent the Grid members from rejoining the Grid Master after the restore.

    • IstheGridMasteranHApair?: Select No.

11. On the next screen, configure the network settings and click Next: 
    1. Ports and Addresses: This table lists the network interfaces based on the type of network connectivity of the Grid Master. For IPv4 Grid Master, specify the network information for LAN1 (IPv4) port and for IPv6 Grid Master, specify the network information for LAN1 (IPv6) port. For a dual mode Grid Master, specify the network information for both LAN1 (IPv4) and LAN1 (IPv6).
       Enter correct information for the following by clicking the field:
       • Interface: Displays the name of the interface. You cannot modify this.
       • Address: Type the IPv4 or IPv6 address depending on the type of interface. An IPv6 address is a 128-bit number in colon hexadecimal notation. It consists of eight 16-bit groups of hexadecimal digits separated by colons (example: 2001:db8:0000:0123:4567:89ab:0000:cdef or 2001:db8::123:4567:89ab:0:cdef).
       • Subnet Mask (IPv4) or Prefix Length (IPv6): Specify an appropriate subnet mask for the IPv4 address or prefix length for the IPv6 address. The prefix length ranges from 2 to 127.

       • Gateway: Type the IPv4 or IPv6 address of the default gateway depending on the type of interface. For the IPv6 interface, you can also type Automatic to enable the appliance to acquire the IPv6 address of the default gateway and the link MTU from router advertisements.

         NotetitleNote

         
         You can now define a link-local address as the default IPv6 gateway and isolate the LAN segment, so the local router can provide global addressing and access to the network and Internet. This is supported for both LAN1 and LAN2 interfaces as well as LAN1 and LAN2 in the failover mode.

       • VLAN Tag: For a VLAN, enter the VLAN tag or ID. You can enter a number from 1 to 4094. Ensure that you configure the corresponding switch accordingly.
       • Port Settings: From the drop-down list, choose the connection speed that you want the port to use. You can also choose the duplex setting. Choose Full for concurrent bidirectional data transmission or Half for data transmission in one direction at a time. Select Automatic to instruct the NIOS appliance to negotiate the optimum port connection type (full or half duplex) and speed with the connecting switch automatically. This is the default setting. You cannot configure port settings for vNIOS appliances.
12. Optionally, enter a new password and click Next. The password must be a single alphanumeric string (no spaces) that is at least four characters long. The password is case-sensitive.
13. Select the time zone of the Grid Master and indicate whether the Grid Master synchronizes its time with an NTP (Network Time Protocol) server, and then click Next.
    • If you choose to enable NTP, click the Add icon and enter the IP address of an NTP server. Entries may be an IPv4 or IPv6 address. You can enter IP addresses for multiple NTP servers.
    • If you choose to disable NTP, set the date and time for the appliance.
14. The last screen displays the settings you specified in the previous panels of the wizard. Verify that the information is correct and click Finish. The application restarts after you click Finish.
    

...

1. Note:

...

1. • The Grid

...

1. • Setup

...

1. • Wizard provides options such as not changing the default password and manually entering the time and date. However, changing the password and using an NTP server improves security and accuracy (respectively), and so these choices are presented here.
     

   • Record and retain this information in a safe place. If you forget the shared secret, you need to contact Infoblox Technical Support for help. When you add an appliance to the Grid, you must configure it with the same Grid name, shared secret, and VPN port number that you configure on the Grid Master.

2. The last screen of the setup wizard states that the changed settings require the appliance to restart. When you click Finish, the appliance restarts.

The setup of the single master is complete. From now on, when you make an HTTPS connection to the appliance, use its new IP address.
In a dual mode Grid Master, the communication protocol for all the services is set to IPv4, by default. You can change the default communication protocol for the services. For information, see see Changing the Communication Protocol for a Dual Mode Appliance.