The Infoblox Subscriber Insight solution provides a mechanism to monitor events related to the subscriber session. This solution allows you to identify subscriber devices, such as laptops, computers, tablets, and smartphones on your data networks that are violating RPZ rules. It can also find the type of domain the subscriber tries to access.

The Infoblox Policy Enforcement solution analyzes the DNS queries, identify subscribers and correlates the information to enforce the subscriber security policies per subscriber.

The solution works by receiving RADIUS accounting messages from a RADIUS server through the NAS (Network Access Server) gateway. The DNS server caches the RADIUS accounting messages, which includes subscriber information and subscriber security policies. The subscriber security policy specifies the RPZs that are applicable for a subscriber. DNS RPZs are used to determine the bad FQDNs. If a subscriber, who has opted for the service, queries an FQDN that is listed in the RPZ, the DNS resolver performs RPZ actions for the subscriber query.

Subscribers behind a home gateway network are identified by their local ID or client ID, which is the MAC address of the subscriber device. The local ID is received by the DNS server as part of the RADIUS accounting message. As all subscribers behind a home gateway network will have the same IP address of the home router, the local ID is used to create separate records for each of the subscribers in the subscriber cache. Each subscriber behind the home gateway network can have their own policy. Note that if a guest connects through a home gateway network, then the default home router policy is applied to the guest device.

The Infoblox Subscriber Insight and Subscriber Policy Enforcement is currently supported on the following Infoblox appliances: IB-1415, IB-1425, IB-2215, IB-2225, PT-1405, PT-2205, IB-4030, IB-4030-10GE, IB-VM-1405, IB-VM-1415, IB-VM-1425, IB-VM-2205, IB-VM-2225, IB-VM-1425, and IB-FLEX. You can enable DNS cache acceleration feature on IB-4030, IB-4030-10GE, and IB-FLEX appliances.

As illustrated in the Figure 46.1, the Infoblox DNS member, with subscriber collection service enabled, receives RADIUS accounting messages, which includes subscriber information and the subscriber security policies, through the NAS gateway. The subscriber security policy specifies the RPZs that are applicable for a subscriber. When a subscriber queries an FQDN that is listed in the RPZ, the DNS resolver performs RPZ actions for the subscriber query. The NIOS appliance logs all RPZ related events, conformed to CEF (Common Event Format), in the syslog. The CEF logs include the subscriber identity information, thus identifying the subscribers that are violating RPZ rules. In a Grid with a reporting server, you can view the Detailed RPZ Violations by Subscriber ID report that contains information about RPZ hits by the users. For information, see Detailed RPZ Violations by Subscriber ID.

Figure 46.1 Infoblox Subscriber Insight and Subscriber Policy Enforcement

License Requirements and Admin Permissions

To configure Infoblox Subscriber Services, you must install the RPZ license. But for IB-FLEX members, the RPZ license is included in the FLEX Grid Activation license. For information about how to install licenses, see Managing Licenses.

Only superusers can configure Infoblox Subscriber Services. Limited-access admin groups can perform this operation only if their administrative permissions are defined. For information about administrative permissions, see About Administrative Permissions.

Guidelines for Using Infoblox Subscriber Insight and Subscriber Policy Enforcement

Following are some guidelines to take into consideration when using Infoblox Subscriber Threat Insight and Subscriber Policy Enforcement:

A Grid member can be associated with only one subscriber site.
The Grid members in the subscriber site must be added as primary or secondary name servers for all RPZs.
The subscriber collection service does not support an IPv6 only Grid member.
All NAS gateways in a subscriber site must be configured for IPv4 only and must use the same port.
The subscriber data is not persistent and will be cleared from the subscriber cache if you stop the subscriber collection service on all the members of a subscriber site.
The NAS gateways can send the RADIUS accounting messages to only one Grid member (collector member) in a subscriber site.
You must configure IP space discriminators to support overlapping subscriber IP addresses and different DNS interfaces must be used for overlapping IP addresses. For information about configuring IP space discriminators, see Adding IP Space Discriminators.

Configuring Infoblox Subscriber Insight and Subscriber Policy Enforcement

To set up Infoblox Subscriber Insight and Subscriber Policy Enforcement, you must install a Grid-wide or a member level RPZ license and configure the Grid members to serve recursive DNS queries. Note that for IB-FLEX members, you do not need to install an RPZ license as the FLEX Grid Activation license includes the RPZ license. You must also configure a subscriber site and add Grid members (collector members and RPZ members) and NAS (Network Access Server) gateways to receive RADIUS accounting messages from a RADIUS server. The RADIUS accounting messages include subscriber information (such as subscriber source IP address, subscriber ID, and the IP space discriminator for networks with overlapping IP addresses) and subscriber security policies. The source IP address, subscriber ID, and the subscriber security policy is mapped in the DNS cache. The collector member caches the subscriber information and the policies, which are replicated to all Grid members within the subscriber site. The RPZ members in the subscriber site applies policies for incoming subscriber queries and performs RPZ actions.

Note the following while configuring Infoblox Subscriber Insight and Subscriber Policy Enforcement:

You can configure up to a total of 32 RPZs in the default view and set the priorities for the RPZs. Subscribers with subscriber security policies can set the policy to any of the 32 RPZs and the RPZs are applied to selective subscribers depending on the subscriber security policies. But for subscribers who have not opted for the service, only the first five (top priority) RPZs are applied. Note that once the first hit matches, the rest of the RPZs will not be looked up.
For DNS queries received from unknown subscriber source IP addresses, the DNS server processes the queries based on the standard DNS query processing.

To configure the Infoblox Subscriber Insight and Subscriber Policy Enforcement on supported Infoblox appliances, complete the following:

Obtain and install a valid Grid-wide or member level RPZ license. But for IB-FLEX members, the RPZ license is included in the FLEX Grid Activation license. For information about licenses, see License Requirements and Admin Permissions. You can also configure a reporting appliance in the Grid to see subscriber reports that contain statistics about RPZ related events.
Configure admin permissions so admin users can manage the Infoblox Subscriber Service related tasks. For information about how to configure admin permission, see About Administrative Permissions.
Create a subscriber site with at least one Grid member and a NAS gateway. For information, see Adding Subscriber Sites. It is recommended to add more than one Grid member to the subscriber site for redundancy. You can add a maximum of five Grid members to the subscriber site.
Start the subscriber collection service on all the members in the subscriber site, as described in Starting and Stopping the Subscriber Collection Service.
Create RPZs in the default DNS view and specify the order of RPZs. Note that only the default DNS view is supported for configuring RPZs for Subscriber Services. For information about creating RPZs, see Configuring Local RPZs. For information about specifying the order of RPZs, see Reordering RPZs. You can create a total of 32 RPZs. Subscribers with subscriber security policies can set the policy to any combination of the 32 RPZs and the RPZs are applied to selective subscribers depending on the subscriber security policies. But for subscribers who have not opted for the service, only the first five (top priority) RPZs are applied. The NAS gateways must provide the subscriber security policies that enable the selection of RPZs applicable for the subscriber.
Enable all the members intheGridtorespond to recursive queries, as described in Enabling Recursive Queries. Add a forwarder and enable Use Forwarders Only option in the Forwarders tab of the Member DNS Properties editor.
Enable RPZ logging in the Member DNS Properties editor for each member of the subscriber site, to ensure that all events related to RPZ are logged to the syslog. Note that you can also enable logging of queries and responses, but it might significantly affect system performance. For information about how to set logging categories, see Setting DNS Logging Categories.
After completing the DNS configuration on the Grid members, start the DNS service on the Grid members. For information about how to start and stop the DNS service, see Starting and Stopping the DNS Service.
Note: Ensure that you enable IPv6 on the Grid members to support IPv6 subscribers. For information, see Configuring IPv6 on a Grid Member.
Add AVPs that are not available in the list of predefined AVPs. For information, see Adding AVPs.
Configure the subscriber ID settings to associate an AVP with the subscriber in the Subscriber Services Properties editor, as described in Configuring Subscriber Services Properties.

After you set up the Infoblox Subscriber Insight and Subscriber Policy Enforcement, you can do the following:

View the subscriber sites, as described in Viewing Subscriber Sites.
View the NAS gateway message rates for the accounting servers of the subscriber site, as described in Viewing NAS Gateway Message Rates.
Monitor RPZ related events and subscriber policy violations using predefined reports and the syslog, as described in Monitoring Subscriber Policy Violations.
Configure Infoblox Subscriber Parental Control solution, as described in Infoblox Subscriber Parental Control.

Starting and Stopping the Subscriber Collection Service

To start the subscriber collection service, you must have at least one RPZ license installed (it can be a Grid-wide license or a member-level license.) You can also stop the service when necessary.

To start or stop the subscriber collection service:

From the Grid tab -> Grid Manager tab -> Services tab, click the Subscriber Collection link. Grid Manager displays only the members that are running the subscriber collection service. Select the member check box.
From the Toolbar, click Start to start the service or Stop to stop the service.

Note: The subscriber data is not persistent and will be cleared from the subscriber cache if you stop the subscriber collection service on all the members of a subscriber site.

Configuring Subscriber Services Properties

To configure the subscriber services properties:

From the Data Management tab -> DNS tab -> Subscriber Services Deployment tab, expand the Toolbar and click Subscriber Services Properties.
In the General tab, complete the following:

- Subscriber ID: Select what AVP that you want to use as the subscriber ID. Depending on the AVP you select in this field, the appliance extracts those AVPs from the RADIUS accounting messages. All the sites in the Grid will use the AVP selected in this field as the subscriber ID. You can select one of the following AVPs from the drop-down list: APN, Calling-Station-Id, Class, IMEI, IMSI, MSISDN, and User-Name.
- REGEX for Subscriber ID data extraction: Specify the regular expression for subscriber ID if you want to extract specific data from the RADIUS accounting messages. The regular expression can contain as many sub-expression groups that you may specify in the next field.
- Subexpression: Choose a number of the sub-expression groups from the drop-down list. If the sub-expression is set to zero, then the text matching the entire regular expression is used for data extraction. If it is non-zero, then the REGEX must contain at least that many sub-expression groups.
- Alternate Subscriber ID: Select the AVP that you want to use as the alternate subscriber ID. For example, the alternate subscriber ID can be used to identify the fixed line or home gateway router. Depending on the AVP you select in this field, the appliance extracts those AVPs from the RADIUS accounting messages. All the sites in the Grid will use the AVP selected in this field as the alternate subscriber ID. Note that the alternate subscriber ID configuration will override the subscriber ID configuration when both the AVPs are available in the RADIUS account messages.
  You can select one of the following AVPs from the drop-down list: APN, Calling-Station-Id, Class, IMEI, IMSI, MSISDN, and User-Name. Note that for subscribers who have opted for Parental Control service, you can select User-Name as the alternate subscriber ID.
- REGEX for Alternate Subscriber ID data extraction: Specify the regular expression for alternate subscriber ID if you want to extract specific data from the RADIUS accounting messages. The regular expression can contain as many sub-expression groups that you may specify in the next field.
- Subexpression: Choose a number of the sub-expression groups from the drop-down list. If the sub-expression is set to zero, then the text matching the entire regular expression is used for data extraction. If it is non-zero, then the REGEX must contain at least that many sub-expression groups.
- Local ID: Select LocalId AVP from the drop-down list to identify subscribers behind a gateway. For example, a home gateway. Each device behind the home gateway network is identified by their local ID/ client ID which is the MAC address of the subscriber device. The appliance extracts the local ID/client ID from the RADIUS accounting messages. Note that for subscribers who have opted for Parental Control service, must select LocalID AVP.
  The home gateway router attaches the MAC address of the host in an EDNS0 option to BIND query request. BIND extracts the EDNS0 option, and uses the value to look up for the relevant policy. The client identification information defined in draft-tale-dnsop-edns0-clientid is used to determine the client ID.
- REGEX for Local ID data extraction: Specify the regular expression for local ID if you want to extract specific data from the RADIUS accounting messages. The regular expression can contain as many sub-expression groups that you may specify in the next field.
- Subexpression: Choose a number of the sub-expression groups from the drop-down list. If the sub-expression is set to zero, then the text matching the entire regular expression is used for data extraction. If it is non-zero, then the REGEX must contain at least that many sub-expression groups.
- IPv6 Anchor IP Address: The ordered list of IPv6 anchor IP address AVP precedence. Note that you cannot modify the IPv6 anchor list, but you can change the order of the list.
- IP Space Discriminator: Select the IP space discriminator from the drop-down list. The IP space discriminator that you select in this field will be applicable for all the subscriber sites in the Grid. For example, if you select NAS-IP-Address in this field, then all subscribers will use their NAS-IP-Address AVP as the IP space discriminator. For information on how to add IP space discriminators, see Adding IP Space Discriminators.
- REGEX for IP Space Discriminator data extraction: Specify the regular expression for IP space discriminator if you want to extract specific data from the RADIUS accounting messages. The regular expression can contain sub-expression groups that you may specify in the next field.
- Subexpression: Choose a number of the sub-expression groups from the drop-down list. If the sub-expression is set to zero, then the text matching the entire regular expression is used for data extraction. If it is non-zero, then the REGEX must contain at least that many sub-expression groups.
- NAS Contextual Information: Select one of the following from the drop-down list: APN, NAS-IP-Address, NAS-IPv6-Address, NAS-Identifier, NAS-Port, or NAS-Port-Identifier.
- Ancillary Fields: You can select a list of ordered AVP ancillary fields. Select an ancillary field from the Available column and click the right arrow to move it to the Selected column.
- Interim Accounting Interval: Specify the time interval in minutes for the RADIUS accounting data to be fully populated in the subscriber collector. This interval is also used to clean up old subscriber information from the cache where all entries older then the interim interval are deleted from the subscriber cache. This cleanup action is performed every day at 2:00 AM local time based on the time zone configured on your appliance. Note that if you have configured DNS anycast for the Grid member, then DNS anycast will be disabled for the member during the interim accounting interval.
- Collect on the MGMT interface only: Select this check box if you want the NAS RADIUS traffic to be accepted over the MGMT interface only.