Enterprise DNS Architecture - AD and BIND

[Bob Harold]

On Wed, Dec 14, 2016 at 1:41 PM, Veaceslav Revutchi <slavarevutchi at gmail.com
> wrote:

> On Wed, Dec 14, 2016 at 10:35 AM, Barry S. Finkel <bsfinkel at att.net>
> wrote:
> > On 12/14/2016 Veaceslav Revutchi <slavarevutchi at gmail.com> wrote:
> >
> >> Since this thread is still fresh, what is the current best practice
> >> when slaving from AD? Do you pick one DC and list it as master or is
> >> it safe to list multiple? We are looking to do the same and just
> >> started the conversation with our AD team. The serial numbers among
> >> DCs authoritative for the same zone are quite spread out and it takes
> >> a few minutes for the DC with the lowest number to catch up. I'm not
> >> sure if I can assume that two DCs with the same serial number have the
> >> same zone contents. Haven't done a zone transfer comparizon yet.
> >>
> >> Curious to know what your experience is when slaving from AD.
> >>
> >> Thank you,
> >> Slava
> >
> >
> > I have not included the previous text in this reply.
> >
> > When I was managing a BIND/AD DNS infrastructure, I chose
> > ONLY ONE of the AD DNS Servers as a master.  There is a problem
> > with serial numbers (KB282826 - I have that number memorized).
> > If a MS DNS Server is not a master for a slave, then the zone
> > serial number does not matter, as the zone is internal only to
> > the Windows infrastructure.  If the DNS Server is a master for
> > the zone, then the zone serial number does matter.
> >
> > Assume, for example, that you have two MS DNS Servers for a zone,
> > one on each of two Domain Controllers - DCA, and DCB.  Assume
> > that for a given zone both DCs have the same zone contents and
> > zone serial number, say 100.  Now, a machine sends a dynamic update for
> > the zone to DCA at the same time that another machine sends another
> > update to that zone to DCB.  Each DC DNS now has a copy of the zone
> > with an increased serial number (101) BUT with different contents.
> > Sometime, under the covers of AD, the MS code will synchronize the
> > zone contents between DCA and DCB, but what serial number should be
> > assigned to the combined zone?  It can't be 101, as that has already
> > been used.  Can it be 102?  What happens if another dynamic update
> > is sent to DCA or DCB while the synchronization is occurring?
> > This is the problem, and why I chose only one DC to be the master
> > for all of the DC zones.
> >
> > Also note that with the MS "_" zones, there are dynamic updates that
> > do not change the contents of a zone but do increase the zone serial
> > number.  Thus there are lots of unnecessary zone transfers from the
> > AD DNS Server to the BIND slave server(s).  (This was true when I was
> > the DNS manager, and I never got permission to ask MS why the serial
> > number was incremented when the zone had not changed.  Things might
> > have changed in the past five years.)
>
> Barry,
>
> Appreciate you sharing this. This is good info.
>
> Thank you!
>
>
My experience slaving AD zones with BIND servers:
Ignore "failed while receiving responses: not exact " errors.  I think that
just means that the serial number changed during the transfer.
I had them turn off 'notify' and we use the 'refresh' timer (15 minutes) to
pull updates.
I also ignore these errors for those servers:
failed to connect: timed out
failed while receiving responses: REFUSED

I list more than one, for redundancy, and ignore serial number mismatches.
Since it is constantly increasing, updates missed on one transfer should be
in the next transfer.

That 'works'.  Whether that means "works fine" or "users have gotten used
to it" is hard to say.

-- 
Bob Harold
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20161215/9ded9b69/attachment.html>