Setting up the HA Pool failed with "DNS Server Access denied" while binding the DNS with TSIG Infoblox

Whilst at the DNS binding with Infoblox, a TSIG algorithm mismatch or incorrect TSIG credentials can cause "DNS server access denied" at the SolarWinds web console or "BADKEY" responses when checked via Wireshark packet capture, to verify whether they are accepted or rejected by Infoblox. 

The following error displays in a Wireshark packet capture:

Mapping Reference:

0 = Unknown, 1 = Md5, 2 = Sha1, 3 = Sha256, 4 = Sha384, 5 = Sha512

For SolarWinds Platform HA configurations using Infoblox BIND DNS, the DNS update can fail when the TSIG algorithm, key name, shared secret, DNS view, or zone authority does not match between SolarWinds and Infoblox. This issue corresponds to HMAC-MD5.

Note:

• SolarWinds documentation specifies HMAC-MD5 for BIND TSIG keys, with a key size between 1 and 512 bytes. 
• Back up the SolarWinds Platform database before changing the TSIG algorithm setting.

1. Confirm that the issue is related to TSIG authentication. Review the HA validation result, HighAvailability.Service.log, Infoblox logs, and, if available a packet capture.
2. Verify the following Infoblox settings:
   • The TSIG algorithm is HMAC-MD5.
   • The TSIG key name matches exactly, including case and any trailing dot.
   • The shared secret matches byte-for-byte.
   • The key is assigned to the correct DNS view.
   • The key is authorized to update the required DNS zone.
   • The configured DNS server is authoritative for that zone.
3. Open Database Manager.
4. Locate and open the Settings table.
5. Search for the setting

   1. Settings_BindDnsTsigAlgorithm

6. If the value is not 1, update it to 1.
7. Use the following query to verify the value

8. -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   SELECT * FROM [dbo].[Settings] WHERE name = 'Settings_BindDnsTsigAlgorithm'

9. -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   UPDATE [dbo].[Settings]
   SET CurrentValue = '1'
   WHERE name = 'Settings_BindDnsTsigAlgorithm';

10. Restart the SolarWinds Platform services on both HA members so the setting is reloaded.
11. Retry the TSIG validation in the HA Pool configuration.