Infoblox NIOS

Realm Security integrates with Infoblox NIOS to collect DNS, DHCP, NTP, authentication, and other appliance logs. NIOS forwards logs directly over syslog to a Realm Collector running in your environment.

Data Flow:

Infoblox NIOS Grid Members > Syslog > Realm Collector > Realm Cloud

Note: This page covers sending syslog directly from NIOS appliances. To forward Infoblox Threat Defense logs through the Infoblox Data Connector in CEF format, see the Infoblox integration instead.

Prerequisites

• Administrative access to the NIOS Grid Manager, with permission to edit Grid Properties (and Member Properties if you override syslog settings per member).
• Realm Collector is set up and running. See Realm Collector install guide for setting up a collector.
• The IP address of the Realm Collector. NIOS accepts only an IPv4 or IPv6 address for an external syslog server — an FQDN cannot be used.
• Network connectivity from the NIOS Grid members (LAN1 or MGMT interface) to the Realm Collector on the stream port.

Setup Infoblox NIOS Source in Realm

1. Login to Realm console.
2. Go to Sources > Add > Infoblox NIOS and add a new Source.

   Name: Infoblox NIOS
   Description: Infoblox NIOS syslog

3. If a collector is already set up, go to Collectors and select your collector. If not, go to Collectors > Add and give it a name and description.
4. Add an Infoblox NIOS stream to the Collector. Click Add Stream.

   Product Format: Infoblox NIOS
   Port: Select a unique port for this collector or use the Realm generated port.
   Source: Infoblox NIOS

5. Click Add Stream.
6. Take note of the port assigned to the Infoblox NIOS stream. You will need it when configuring the external syslog server in NIOS.

Configure NIOS Syslog Forwarding

For full background, see Infoblox's Using a Syslog Server documentation. The steps below configure syslog forwarding at the Grid level, which applies to all Grid members.

Enable External Syslog

1. Log in to the NIOS Grid Manager.
2. Go to Grid > Grid Manager > Members.
3. From the Toolbar, click Grid Properties > Edit.
4. In the Grid Properties editor, select the Monitoring tab.
5. In the Syslog section, check Log to External Syslog Servers.

Add the Realm Collector as a Syslog Server

1. In the External Syslog Servers table, click the Add icon.
2. Configure the server:

   Address: IP address of the Realm Collector
   Transport: TCP
   Interface: Any
   Source: Any
   Node ID: Host Name
   Port: Port number assigned to the Infoblox NIOS stream in Realm
   Severity: info
   Logging Category: Send all

3. Click Add to add the server to the table.
4. Click Save & Close.
5. If a Restart banner appears at the top of the screen, click Restart to apply the changes.

Field reference:

Field	Recommended Value	Notes
Transport	TCP	TCP provides reliable delivery. UDP is supported by NIOS but messages may be dropped. Use Secure TCP only if your Realm Collector stream is configured for TLS — contact Realm Security support first, as this requires a server certificate to be uploaded to NIOS.
Interface	Any	LAN sends from the LAN1 port. MGMT sends from the MGMT port if configured, otherwise LAN1. Choose the interface that has a route to the Realm Collector.
Source	Any	Internal sends only messages the appliance generates. External sends only messages the appliance receives from other devices. Any sends both.
Node ID	Host Name	Identifies the sending appliance in each message. Host Name uses the appliance FQDN. Other options are LAN (LAN1 IP, the NIOS default), IP and Host Name, and MGMT (MGMT IP, or LAN1 if MGMT is not configured).
Port	Realm stream port	Do not use the NIOS default (514 for TCP/UDP, 6514 for Secure TCP) unless it matches the port assigned to the Realm stream.
Severity	info	NIOS sends messages at the selected level and all levels above it. info includes DNS and DHCP activity. Avoid debug unless requested by Realm Security support, as it significantly increases volume.
Logging Category	Send all	Send all forwards all categories without prefixes. Send selected categories limits forwarding to the categories you choose and prefixes each message with its category name.

Note: If you choose Send selected categories, select from DNS, ADP, DHCP, DTC, Cloud, NTP, File Distribution, Authentication, and Microsoft Integration. To log individual DNS queries and responses, query and response logging must also be enabled under the Grid DNS properties in NIOS.

Override Syslog Settings for a Member (Optional)

To send a specific Grid member's logs to a different collector, or with different settings:

1. Go to Grid > Grid Manager > Members, select the member, and click Edit.
2. In the Member Properties editor, select the Monitoring tab, then the Basic tab.
3. In the Syslog section, click Override.
4. Configure the external syslog server as described in Add the Realm Collector as a Syslog Server.
5. Click Save & Close, then click Restart if prompted.

Verify Configuration

1. In the Realm console, go to Collectors, select your collector, and check the Infoblox NIOS stream for incoming events.
2. If no events arrive, confirm that the Grid members can reach the Realm Collector IP address on the stream port, and that any firewalls between them allow TCP traffic on that port.

Support

For additional details, refer to the official Infoblox Using a Syslog Server documentation.

If you encounter any issues or require assistance, contact Realm Security support.