Infoblox Universal DDI™ Tokens­ - Customer FAQs

OVERVIEW AND KEY CONCEPTS

Q1. What is a token?

A token is a measure of flexible capacity that Infoblox uses to enable your entitlements to Universal DDI capabilities. Instead of buying many separate SKUs, you buy tokens and allocate them as needed across the Universal DDI portfolio.

There are three types of Universal DDI tokens:

• Management Tokens: These required tokens are used to purchase the management capabilities of the Universal DDI Product Suite (Infoblox Universal DNS Management™, Infoblox Universal DHCP Management™, Infoblox Universal IP Address Management™ and Infoblox Universal Asset Insights™). These tokens are allocated according to the number and type of DDI objects, active IPs and assets you choose to manage through Universal DDI.
• Server Tokens: These optional tokens are used to buy NIOS-X servers or Infoblox NIOS-X as a Service instances (DNS, DHCP) that can be deployed as part of the Universal DDI solution. Token allocation is based on the number, size and type of server.
• Reporting Tokens: These optional tokens are used to purchase the Universal DDI Product Suite reporting capabilities. These tokens are allocated based on the monthly volume of log entries or events.

Q2. What are the benefits of the token model?

Token-based licensing offers flexibility, scalability and simplicity, allowing for the purchase and enablement of specific features or services as needed. This model adapts to changing business requirements and provides transparent usage metrics for better planning and budgeting, ensuring a highly customized and efficient solution for any organization.

The token model offers:

• Streamlined Procurement: Start using new products immediately, bypassing lengthy procurement processes.

• Investment and Overage Protection: Gain the flexibility to switch products or resize protocol servers as your needs evolve, ensuring that your investments are always protected. Essential functionality will not be disabled if your usage temporarily exceeds your entitlement. Extended overages are addressed via a True Forward process.
• Centralized Visibility: The Infoblox Portal provides clear visibility into token allocation, helping you forecast growth, justify renewals and avoid surprise overages.

With Universal DDI tokens, new capabilities are delivered through token types corresponding to what you already own, so you can enable the latest features without changing licenses or buying new SKUs. This means that Universal DDI users get near‑instant access to new innovations and can adopt new functionality at their own pace.

For example, if you’re only using Universal DDI for DNS and DHCP management but you’d like to evaluate the asset management capabilities, you can accomplish that by simply reallocating your Management Tokens—no need to purchase additional SKUs.

TOKEN TYPES AND ALLOCATION

Q3. What do Management Tokens cover?

Management Tokens are allocated based on the quantity of items being managed by Universal DDI. This lets you pay for what you are actually using instead of buying rigid, fixed bundles.

Management Tokens are allocated to three categories:

1. DDI Objects: These are DNS, DHCP and IP address management (IPAM) configuration items, such as:
   • DNS views, zones, records and applied access control rules
   • DHCP ranges, exclusion ranges, options, filters and DNS zones
   • IP spaces, address blocks, subnets and host records
2. Active IP Addresses: These are IPs that are observed as in use and managed by IPAM, for example:
   • DHCP leases
   • Discovery
   • Fixed addresses
   • Reservations

   Multiple observations of the same IP are de‑duplicated so it only counts once.

3. Assets: An asset is a physical or virtual device with at least one associated IP address (for example, virtual machines, gateways, endpoints, firewalls, switches, routers or servers).
   • Asset types without IP addresses (e.g., security groups, S3 buckets, subnets, projects) can still be discovered, but they do not consume Management Tokens.
   • Assets are de‑duplicated so information from multiple data sources is merged and counted as a single asset.

More information about discovered assets that do not contribute to token allocation can be found here.

Additional details on Management Tokens can be found here.

Q4. What do Server Tokens cover?

Server Tokens are used to license Infoblox NIOS-X protocol servers that deliver DNS, DHCP—specifically Infoblox NIOS‑X servers and NIOS‑X as a Service instances.

Server Tokens are only required if you are deploying NIOS‑X servers (self-managed or as a service). If you use Universal DDI purely for management of existing NIOS grids or third‑party DNS, Server Tokens are not required.

Server Token allocation is tied to the performance and capacity of NIOS‑X servers:

• NIOS‑X Servers: Self‑hosted in your private cloud, public cloud or on‑premises virtual/physical servers.
• NIOS‑X as a Service: Infoblox‑hosted DDI delivered using an infrastructure‑free, as‑a‑service model.

Server Tokens are purchased and allocated according to:

• The number of NIOS‑X servers you deploy
• The size of each server (XS, S, M, L, XL, etc.)
• The deployment model: NIOS‑X server vs. NIOS‑X as a Service

For example:

• A smaller virtual server (e.g., 2XS or XS) that supports lower volumes of queries, measured in thousands of queries per second (kQPS), leases per second (LPS) and object capacity, consumes fewer server tokens.
• Larger sizes (S, M, L, XL) with higher performance and capacity consume more server tokens.
• NIOS-X as a Service tiers are similarly sized by kQPS, LPS and object counts, each mapped to a specific token requirement.

Server Tokens are designed to give you fine-grained, flexible control over how you deploy NIOS-X servers:

• Right-size each server by choosing the appropriate server size.
• Easily resize servers over time, for example, increasing capacity in a growing cloud region or reducing capacity where demand falls. Token-based licensing tracks these changes automatically.
• Mix deployment models (self-hosted NIOS-X servers and Infoblox-hosted NIOS-X as a Service) under a single account, simplifying planning and budgeting.

The flexibility of the token model means that you can have a large, centralized server and smaller distributed servers, and even re-architect and re-size your server deployments at any time, without having to purchase different SKUs.

Additional details on Server Tokens can be found here.

Q5. What do Reporting Tokens cover?

Reporting Tokens are used to license the logging and event reporting capabilities of Universal DDI—specifically, how much DNS and DHCP telemetry you can store, search and forward.

Reporting Tokens are used when capabilities beyond local logging are needed. They are ideal for organizations that need auditing, troubleshooting, capacity planning or integrations with security information and event management (SIEM)/data lakes based on DNS and DHCP logs.

Reporting Tokens are allocated for three main capabilities:

1. 30-Day Active Search (Live Reporting)
   • All DNS and DHCP logs appear in the Universal DDI reporting interface.
   • You can perform interactive searches and filtering over the last 30 days.
2. Amazon S3 Bucket Log Storage
   • Logs are exported to an S3 bucket you control for asynchronous retrieval and long‑term retention.
   • Commonly used when you already standardize on AWS for log archiving or analytics.
3. Ecosystem/Cloud Data Connector Events
   • DNS and DHCP events are streamed to external tools (e.g., SIEM, security orchestration, automation and response (SOAR), data lakes) via Cloud Data Connector.
   • This enables rich security and operational analytics outside of Infoblox.

Tokens are allocated for DHCP lease logs and DNS query response logs. Tokens are not allocated for system logs, audit logs or service logs.

Allocation is based on log volume. Reporting Tokens are purchased and allocated based on the number of log entries or log events per month. Tokens are allocated in increments of 10 million logs or events per month.

Additional details on Reporting Tokens can be found here.

Q6. Can tokens be reallocated as my requirements and architecture evolve?

Yes. Within each of the three token categories, token allocation can be rebalanced.

For example, a customer moving workloads from on-premises data centers to the cloud might reallocate some Server Tokens from on-premises NIOS-X VMs to new NIOS-X as a Service service points within their cloud environment. No new SKUs, just a different token mix within the same pool.

Q7. Can I reallocate tokens between token types?

Currently, token rebalancing is only permitted within a specific token type. We are investigating the possibility of allowing reallocation between different token types in the future. Token types and quantities can be adjusted at the time of subscription renewal.

Q8. What are token packs, and how are they structured?

Token packs are bundles of each token type offering a flexible and scalable way to license services. Token packs represent the minimum purchase quantities: Management Tokens come in packs of 1000, Server Tokens in packs of 500 and Reporting Tokens in packs of 40.

Q9. Do tokens expire or carry over year to year?

Tokens are purchased for the term of your subscription or contract. During that period:

• You have a defined number of required Management and optional Reporting and Server Tokens.
• As your contract renews, you and your Infoblox account team can adjust token levels to match how your environment and usage have evolved.

Note: Tokens are not a prepaid “bucket” that you consume or burn down. They define the level of usage your subscription covers.

The allocation-based token model offers flexibility and advantages over other licensing models. To illustrate, think of software licensing as managing parking for a vehicle fleet. The common value metric is space consumed: small vehicles take less space, while large ones take more. Pricing reflects how much of this shared parking resource each vehicle uses.

SKU-Based Licensing—Reserved Spots

SKU-based licensing is like buying reserved parking spaces for specific vehicle types (car spots, truck bays, motorcycle slots). Spend is predictable, but spaces are fixed by type. If your mix of vehicles changes, you can’t easily reuse idle spots without a new purchase.

Pay-as-You-Go—Hourly Meters

Pay-as-you-go licensing is like street parking with hourly meters. Any vehicle can park at any time, and you pay only for the time used. It’s very flexible, but the total cost is unpredictable and requires constant monitoring.

Enterprise Licensing Agreements (ELAs)—Corporate Contract

An ELA is like a large corporate parking contract. Drivers can generally park where they need, and overages are reconciled later. Spending feels predictable during the term, but renewal can be painful when true usage is counted.

Token-Based Licensing—Shared Prepaid Parking

Token-based licensing is like prepaid parking powered by tokens. Different vehicle types draw different numbers of tokens based on the space they occupy, but everything uses one shared pool.

There are two primary types of token models:

• Consumption-Based Tokens (Prepaid Credits)
  With consumption-based tokens, tokens behave like prepaid parking credits: Each hour of parking burns tokens permanently. It’s still prepaid, but it behaves more like pay-as-you-go and needs closer usage monitoring.
• Allocation-Based Tokens (The Universal DDI Model)
  With allocation-based token licensing, tokens represent reusable entitlement capacity:
  • Parking a vehicle allocates tokens from the pool; when it leaves, tokens return and can be reused elsewhere.
  • You buy a fixed pool of tokens for the term, so spend is predictable while still allowing you to re-balance capacity across products, instances or environments.
  • Capacity is always visible: at any point, you can see how many tokens are allocated, how many are free and where they’re being used.

MONITORING USAGE AND UNDERSTANDING TRUE FORWARD

Universal DDI token allocation is fully automated and continuously monitored, with clear visibility in the Infoblox Portal. A True Forward model and process let you grow first and then purchase more tokens as needed for future use.

Q10. How does Infoblox measure and monitor token allocation?

Universal DDI token allocation is handled automatically by the platform and made transparent through the Infoblox Portal. Universal DDI uses the following metering model:

Five-Minute Snapshots

Every five minutes, the platform records:

• Management Token Allocation: Total DDI objects, active IPs and assets under management
• Server Token Allocation: Count based on size and type of deployed servers, plus per server kQPS, LPS and capacity (objects)
• Reporting Token Allocation: Log counts by reporting type (Active Search vs. Amazon S3) and by ecosystem events

Monthly High Watermarks

For each calendar month, the platform computes:

• The highest five-minute value for Management Tokens—the monthly Management Token high watermark
• The highest five-minute value for Server Tokens—the monthly Server Token high watermark
• For each server, the highest five-minute value for kQPS, LPS and capacity—used to confirm that the chosen server size is within guardrails

Reporting Tokens are tracked via monthly log/event counts and used in rolling average calculations.

Rolling Three-Month Average and Guardrails

Compliance is based on a rolling three-month average. You are considered outside of license (and subject to True Forward) if:

• The Management Token rolling three-month average exceeds your purchased Management Tokens.
• The Server Token rolling three-month average exceeds your purchased Server Tokens.
• The Reporting Token rolling three-month average exceeds your purchased Reporting Tokens.

Additionally, if a NIOS-X server or NIOS-X as a Service instance exceeds any guardrail three times in one month, the platform will automatically increase the Server Token allocation. This may also trigger a True Forward event if you exceed your licensed token allocation.

Q11. How do I monitor my token allocations?

The Infoblox Portal is the control point for allocation and monitoring:

• Shows tokens purchased by type (Management, Reporting, Server)
• Breaks down usage as:
  • Management Token usage by DDI objects, active IP addresses and assets
  • Server Token usage by server size and type, and associated kQPS/LPS/capacity high watermarks
  • Reporting Token usage by report logging type (Active Search/Amazon S3) and ecosystem events

Q12. Will Universal DDI stop working if I exceed my token license?

No. Universal DDI is designed to continue providing and managing critical services even if your usage temporarily goes above your licensed token level.

Key points:

• Essential functionality will not be disabled when you cross a threshold.
• Instead, if your average usage stays above your entitlement, Infoblox will address it via True Forward, adjusting your subscription level so it reflects how you are using the service.

This approach helps you maintain functionality while keeping licensing aligned with long‑term usage. Seasonal peaks or anomalous spikes will not disrupt services or force an immediate token purchase.

Q13. What is a True Forward and when does it happen?

• If you temporarily exceed your token allocation, services keep running—Infoblox does not shut down or throttle the service.
• If your rolling three-month average for any token type stays above your purchased tokens, your account is flagged for a True Forward event.

Notifications and Process

• The Infoblox Portal generates notifications when overage thresholds are crossed. Users are notified via email and the Infoblox account team receives notification as well.
• The Infoblox account team then works with you to:
  • Review actual usage
  • Right-size Management, Reporting and/or Server Tokens
  • Amend the contract (midterm) or adjust at renewal, depending on timing

GETTING STARTED

If you are new to Infoblox Universal DDI:

1. Talk with your Infoblox account team or partner about your current environment: number of sites, how many knowledge workers you have, approximate number of assets, cloud-based workloads and which DDI management tools you already use.
2. Discuss which Universal DDI capabilities you need, such as:
   • DDI Management: Simplify control of critical network services in hybrid, multi-cloud environments
   • Cloud and Network Visibility: Expand visibility and reduce risk by capturing the full picture of hybrid, multi-cloud assets
   • Cloud Deployment: Deploy critical network services faster with infrastructure-free DDI
3. Based on your inputs, the account or partner team will create an estimated token count (with reasonable headroom for growth) based on your specific deployment and usage scenarios.

From there, you can adjust your token levels over time as Universal DDI usage and coverage evolve.