--- title: "Best Practices for Deploying NIOS-X Servers" canonical: "https://docs.infoblox.com/space/BloxOneInfrastructure/204538456/Best%20Practices%20for%20Deploying%20NIOS-X%20Servers" format: markdown --- > ❌ ### Important Note > ❌ > ❌ The minimum system requirements specified for NIOS-X servers must be dedicated to the server you plan to deploy. They cannot be shared with or used for other non-Infoblox servers. Doing so will negatively affect the performance of your Infoblox Platform services. For information about the minimum system requirements and port usage, see the following: > ❌ > ❌ - *[Firewall Requirments for Infoblox Cloud Services](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/873660456)* > ❌ - *[Minimum System Requirements for NIOS-X Servers](https://docs.infoblox.com/space/BloxOneInfrastructure/873758806/Minimum+System+Requirements+for+NIOS-X+Servers)* > ❌ - *[Supported Platforms for NIOS-X Servers](https://docs.infoblox.com/space/BloxOneInfrastructure/873693279/Supported+Platforms+for+NIOS-X+Servers)* > ❌ - *[Port Usage for Bare-Metal NIOS-X Servers](https://docs.infoblox.com/space/BloxOneInfrastructure/873758860/Port+Usage+for+Bare-Metal+NIOS-X+Servers)* To ensure a successful deployment of NIOS-X servers, consider the following best practices: ## For Infoblox Platform and Services - When connecting a NIOS-X physical server to the Infoblox Portal, ensure that you DO NOT enter the join token using the Device UI. Otherwise, the server will lose connectivity to the Infoblox Portal when the server certificate expires. Instead, use the serial number of the server to connect to the Infoblox Portal. - When deploying NIOS-X virtual machines, the use of hyphens (-) in Terraform script is not supported. - When you deploy a NIOS-X server as a container and plan to run DNS forwarding proxy and Universal DDI on the same server, ensure that port 1053 is open and available. Otherwise, you might encounter an error if the server OS is running other applications on port 1053. - When setting up DNS forwarding proxies as NIOS-X servers for failover purposes, Infoblox recommends that you deploy two DNS forwarding proxies using one as the primary proxy and the other as the secondary. - If you change the IP address or make any configuration changes on the NIOS-X server outside of the Infoblox Portal, you must restart the system for the change to take effect. If the change is made within the Infoblox Platform infrastructure, no restart is required. - For DNS to function properly in OVA deployments on ESXi servers, ensure that you enable the **Synchronize guest time with server** option during the deployment and that your ESXi server is synchronized with the NTP server. If you do not select the **Synchronize guest time with server** option (or if this option is disabled), the NIOS-X server synchronizes with the Ubuntu NTP servers: *ntp.ubuntu.com* and *ubuntu.pool.ntp.org*. When you disable this option, ensure that you open the UDP 123 port for time synchronization with the Ubuntu NTP servers. For more information, see *[Synchronizing Time with NTP Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35437920)*. - When you enable NIOS-X servers running on physical hardware to the Infoblox Platform, the QPS (query per second) throughput might vary, depending on your server models and the cache hit ratios. You might see a bigger performance impact when the cache hit ratio is lower. In general, NIOS can forward at least 3,500 QPS to Infoblox Platform. For standalone installations, the QPS may vary depending on the hardware used and the cache hit. However, the number of queries per second should fall in the range of 3,500 QPS using an OVA with 512 MB memory and 1 CPU. - Infoblox Platform has designated `52.119.40.100` as the default DNS resolver for all NIOS-X physical and virtual servers, eliminating the need for you to configure a local DNS resolver. Apart from the default resolver `52.119.40.100`, Infoblox recommends you add `52.119.41.100` and any other DNS resolvers that can resolve recursive DNS queries to the resolver configuration. This ensures that your NIOS-X servers remain connected to the Infoblox cloud even if one of the resolvers becomes unavailable. If the host system's does not specify any DNS resolver, or only specifies the loopback address (`127.0.0.1`), Docker will default to using `8.8.8.8` and `8.8.4.4` for container DNS resolution. Note that Infoblox does not recommend using the loopback address (`127.0.0.1`) when configuring a local DNS resolver. - Note that `52.119.40.100` is the default local DNS resolver for NIOS-X server deployments. This resolver can only resolve domains that are essential for NIOS-X server connectivity with Infoblox cloud. If you are configuring FQDN for services such as NTP for the server or data connector configuration, ensure that the local resolver can resolve the domain. If you have an Infoblox Threat Defense subscription, you can configure external networks so that `52.119.40.100` can function as a recursive DNS resolver. For information on how to configure external networks, see *[Configuring External Networks](https://docs.infoblox.com/space/BloxOneThreatDefense/35473665/Configuring+External+Networks)*. > ⚠️ DNS uses both TCP and UDP ports. Therefore, the interface must have both TCP and UDP available. ### Limitations - When IPv6 is enabled on NIOS‑X servers, the Customer Metrics, AuthN, and Device UI will not be accessible over IPv6. ## For Universal DDI - For any NIOS-X server using Universal DDI, the interface must be reachable through WAN to resolve DNS client queries. - If you have configured any DNS name servers through the DHCP options or NIOS-X servers, ensure that you point them to the DNS forwarding proxies. - For DNS to function properly in OVA deployments on ESXi servers, ensure that you enable the **Synchronize guest time with NIOS-X server** option during the deployment and that your ESXi server is synchronized with the NTP server. If you do not select the **Synchronize guest time with NIOS-X server** option (or if this option is disabled), the NIOS-X server synchronizes with the Ubuntu NTP servers: *ntp.ubuntu.com* and *ubuntu.pool.ntp.org*. When you disable this option, ensure that you open the UDP 123 port for time synchronization with the Ubuntu NTP servers. For more information, see *[Synchronizing Time with NTP Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35437920)*. > ⚠️ DNS uses both TCP and UDP ports. Therefore, the interface must have both TCP and UDP available. ## For Data Connector - To redeploy Data Connector on the same NIOS-X server on a container and not on a VM, manually clean up the ***/Infoblox*** directory on the server before redeploying Data Connector. - For Data Connector to function properly in OVA deployments on ESXi servers, specify the NTP server during deployment. If you do not specify the NTP server, then open the UDP 123 port for time synchronization with the Ubuntu NTP servers. For more information, see *[Synchronizing Time on the ESXi Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneThreatDefense/pages/35437920)*. - Before deploying Data Connector, prepare your environment according to the requirements for the supported platforms, and open all ports necessary for unrestricted outbound access. When deploying Data Connector, configure it as a NIOS-X server through the Infoblox Portal. - To reduce data transfer that takes place when IPAM metadata is synchronized between the Grid, Data Connector, and the Infoblox Platform destination, enable **NIOS Object Change Tracking.** When you enable this feature, the NIOS-X server tracks the changes made to NIOS objects and periodically synchronizes changed objects. For more information on NIOS, see the *[Infoblox NIOS Guide](https://infoblox-docs.atlassian.net/wiki/spaces/NIOS)*. - Threshold levels for sever CPU Usage, Server Disk, Usage, and Server Memory Usage should be configured at less than 75%. For details on configuring application notification settings in the Infoblox Portal, see *[Configuring Notification Settings](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneCloud/pages/35430340)*. ## Scheduling Updates To ensure your NIOS-X servers remain secure and up to date, we recommend that you configure a regular upgrade schedule for both software and configuration updates. For detailed steps, please see [Scheduling Software Updates for Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/184583758) and [Scheduling Configuration Updates for Servers](https://infoblox-docs.atlassian.net/wiki/spaces/BloxOneInfrastructure/pages/184583817). > ⚠️ Avoid using subnets smaller than /30 for host interface IP settings to prevent configuration issues. Use a /24 subnet to ensure the gateway IP is within the same subnet and avoid validation errors.