Observability
How DNS login and authentication work when setting up an HA pool
There are instances where a customer’s security team may report that, after HA configuration, the poller is attempting to log in to the DNS server, or they may receive security alerts for failed login attempts from the SolarWinds poller using that account. This often raises the question of whether DNS admin credentials are required only as a one-time activity.
First published date
Last published date
Overview
In SolarWinds High Availability, DNS server credentials are not just a one-time use item. They are stored so the HA service can authenticate whenever needed. By design, the HA service must log in to the DNS server each time it needs to update the DNS entry.
Product section
Resolution
Below is how it works:
1. During HA configuration
When user set up HA, the HA service uses the provided DNS admin credentials to verify connectivity and permissions. This is the one-time step support meaning the credentials are entered only once during setup, not that they are used only once.
2. During ongoing HA operations
* On failover: The active poller’s HA service logs in to the DNS server to update the DNS record so clients point to the new active server.
* On failback: The same process occurs, updating the record back to the original active server.
For quick reference:
https://documentation.solarwinds.com/en/success_center/orionplatform/content/ha-manage-pools.htm
In conclusion:
* The HA service will log in to the DNS server during configuration to verify communication and permissions.
* It will also log in during a failover or failback to update the DNS record.
* The credentials entered during initial HA setup are stored for ongoing use and can be updated later via the pools edit settings if required.