Architecture

Architecture overview

Micetro consists of several components. Below, you will find a short description on each component and a high-level architectural diagram of Micetro’s architecture.

../../../_images/micetro-architecture.png

Note

All communications between Men&Mice Management Console and the other Micetro components are encrypted.

User Interfaces

The Management Console connects directly to Men&Mice Central using TCP/IP, connecting to through TCP port 1231. The Men&Mice Web Application talks directly to the Web Server (IIS or Apache) which redirects its request to Men&Mice Central also through TCP port 1231. (For more information on communication ports within Micetro, see Networking requirements.)

Middle Layer

The middle layer is responsible for collecting and synchronizing data and handle requests from different Interfaces. Men&Mice Central has its own database to store all related data. (See Database backend.) The authoritative data is always the data source itself (i.e., the DNS or DHCP server). To retrieve data from the different data sources it uses various methods, as listed above. It might also communicate to other services in order to get or set information - e.g., Microsoft Active Directory to authenticate users. (See Configure Single Sign-On.)

Data Layer

The Men&Mice DNS Server Controller communicates with the DNS server using RNDC (BIND) or DNSP/RPC (Windows Server 2008 and above).

Men&Mice Central

Men&Mice Central stores all user specific information as well as centrally stored information. At least one copy of Men&Mice Central needs to be installed. When a user logs into the system, they start by connecting to Men&Mice Central. Men&Mice Central handles user authentication and contains information about access privileges for the user. If the Micetro IP Address Management component is installed, Men&Mice Central is responsible for management and allocation of IP Addresses. Men&Mice Central listens on TCP port 1231.

In smaller installations, Micetro’s Central component can be installed on one of the DNS or DHCP servers, as it will not require much resources. More resources are needed as the managed environment gets larger. Below is a table that can be used as a guideline for choosing suitable hardware for Men&Mice Central.

Size of environment	Number of objects	Hardware guidelines
Small to medium	Zones: fewer than 100 IP addresses: fewer than 5000 Subnets: fewer than 1000	Central can be run on a server alongside other services, such as on a DNS/DHCP server or a Domain Controller
Medium to large	Zones: fewer than 1000 IP addresses: fewer than 50000 Subnets: fewer than 10000	4 CPU cores, >= 2 GHz 8 GB of memory 50GB disk space
Large Enterprises and service providers	Zones: Tens of thousands IP addresses: Millions Subnets: Hundreds of thousands	>=8 CPU cores, > 2 GHz >=16 GB of memory 100GB disk space

By default Men&Mice Central will use an embedded SQLite database. The embedded database is suitable for small to medium environments but larger environments should instead use a more robust MS SQL or PostgreSQL server. Information on how to use MS SQL pr PostgreSQL as the database for Men&Mice Central can be found in the Database backend section.

If the organization is using Active Directory (AD) and wishes to use AD user authentication, Men&Mice Central must be installed on a Microsoft Windows member server in the domain. All users in that domain, that forest, and trusted forests, will be able to authenticate in Micetro, given that they have been granted access in Micetro. As the other Micetro components (DNS Server Controller and DHCP Server Controller) can be installed on the DNS and DHCP servers, Micetro can manage DNS and DHCP servers that reside in forests where there is no trust between the forest where Central is installed and DNS/DHCP is installed. See AD Sites and Subnets for more information.

Micetro’s Central component can also be installed on a second server that can be used as a “cold standby”. The Micetro’s embedded database will then be periodically copied from the active Central server to the cold standby and, if the active server becomes unavailable, the Central service on the cold standby can be activated. See Configure High Availability for Men&Mice Central for running multiple Central instances for high availability.

Micetro’s DNS Server Controller

The Men&Mice DNS Server Controller is used to control the DNS server and must be installed on each DNS server machine you want to control. The Men&Mice DNS Server Controller reads and writes zone data and option files, and sends commands to the DNS server. The Men&Mice DNS Server Controller listens on TCP port 1337.

(Unix) BIND DNS environment: Micetro’s DNS Server Controller (i.e., DNS agent) is installed on each DNS server that is to be managed.
(Microsoft) AD environment: The DNS agent can be installed on some of the DNS servers or they can all be managed agent free. If they are to be managed agent free, then the DNS Server Controller is typically installed on the machine running Men&Mice Central and when adding the DNS server, the option to add the server as “Microsoft Agent-Free” is chosen. (See Agent-free management of DNS/DHCP servers.)

The DNS Server Controller must be running as a user that has necessary privileges.

If the plan is to install the DNS agent on some of the DNS servers in a Microsoft AD environment, and the environment is a pure AD environment (meaning that all zones are AD integrated), the DNS agent is typically installed on 2 DNS servers in each AD domain. Micetro will read and write DNS updates to the first server from each AD domain, but if the first server becomes unavailable it will failover to the second server.

For more information see Edit Preferred Servers (Management Console).

../../../_images/dns-controller-arch-old.png

Two DNS servers from each domain are added to Men&Mice Central.

Micetro’s DHCP Server Controller

The Men&Mice DHCP Server Controller is used to control the DHCP server.

ISC DHCP: A copy should be installed on each DHCP server machine.
MS DHCP: A copy can be installed on each DHCP server machine, or in certain circumstances it can be installed on another server and connect to the DHCP service over the network. In order for this remote DHCP management to work, the DHCP Server Controller must be installed on a Windows server and must run under an account that has privileges to manage the DHCP service over the network. Operating this way, one DHCP Server Controller can manage several different DHCP servers.
Cisco DHCP: The DHCP Server Controller can be installed on any machine.

The DHCP Server Controller listens for connections from Men&Mice Central on TCP port 4151.

Tip

There are a few strategies to install the Men&Mice DHCP Server Controller (i.e., DHCP agent).

In a Unix ISC DHCP environment, the DHCP agent is installed on all DHCP servers that are to be managed.
In a Microsoft environment, the administrator can install the DHCP agent on one server, some of the servers, or all the servers. If all the DHCP servers are in the same security realm (maybe in different forests but with trust between them), the DHCP agent can be installed on one server, typically the server running Micetro’s Central component.

Note

If the DHCP agent is to be used to manage DHCP on other DHCP servers, the DHCP agent must be running as a member of the AD DHCP Administrators group.
If some of the managed DHCP servers are not in the same forest as Micetro’s Central component, and there is no trust between the forests, the administrator must install at least one DHCP agent in the foreign forest. That DHCP agent can act as a proxy between Central and the DHCP servers and must be running as a member of the AD DHCP Administrators group in the foreign forest.
The DHCP agents can be installed on each managed DHCP servers. In that scenario, the DHCP agent can be run as the Local System account, which means that no additional configuration is needed after the installation is complete.

Cisco IOS DHCP servers can be managed using Micetro. A Men&Mice DHCP Server Controller has to be installed on a machine in the environment, which will then act as an proxy to manage the Cisco IOS DHCP servers, and will use either plain telnet or ssh to connect to the managed servers.

Men&Mice Virtual Appliances

There are two types of Men&Mice Virtual Appliances: a DNS/DHCP Appliance and a DNS Caching Appliance.

The DNS/DHCP Appliance can be used as a DNS and a DHCP server. You can also use the DNS/DHCP Appliance act as a server for Micetro Web Application. Once the DNS/DHCP appliance has been configured, you work with the DNS and DHCP server just as you would work with the BIND and ISC DHCP servers. See Virtual DNS - DHCP Appliance Setup Guide for more information.

The DNS Caching Appliance contains a high-performance Caching-only DNS server. See Caching DNS Servers for more information.

Micetro User Interfaces

Note

Of the different user interfaces, multiple copies may be installed, and multiple instances can be logged in at once to manage the environments.

The Men&Mice Web Application can be installed on any server on the network running Microsoft Internet Information Services (IIS) or Apache.

Tip

It is common practice to install the Web Application on the same server that Micetro’s Central component is installed on.

Micetro’s Management Console is a Windows-only rich client that can be installed on as many client computers as required, and is typically installed on each administrator’s workstation.