Guidelines for role separations forwarding vs authoritative
Dave Warren
davew at hireahit.com
Fri Jul 8 08:01:35 UTC 2016
On 2016-07-07 23:46, Mik J wrote:
> I have a bind DNS that is authoritative for many zones and that same
> system is also forwarding.
> I plan to split these two functions on two different systems.
>
> Have some of you done this task ? Do you have any guidelines or advices ?
>
> I'm thinking about migrating the forwarding functionality to a new
> system with a new IP.
> This will avoid changing the IP of the authoritative server on the DNS
> at a higher level.
Huh. Oddly, I find changing authoritative servers to be quite trivial in
a well managed network.
1) Bring up the new servers.
2) Update ACLs, firewall rules and scripts/automation as needed, if needed.
3) Update the zonefiles and upstream zone files. If the primary master
moved, make the old primary master a temporary slave, such that you can
update slaves at your convenience.
4) Update any remaining monitoring systems, or client-facing resolvers
that forward, stub, or anything else. Consider why you forward, and
whether it's useful or you're just doing configuration for the sake of
configuration.
5) Wait 2-4x the length of the TTL, and/or monitor traffic levels.
6) Pull down the old servers, clean up after them.
Conversely, changing client facing resolver is a constant pain as there
are always "things" that are hardcoded and not using DHCP, depending on
the complexity of your environment, possibly thousands of things. Plus
there are all the terrible DHCP implementations that renew properly, but
fail to update their local configuration until they're restarted. And
the users? Some of them hardcode their resolver settings (see #3 above,
it's a thing they can configure, therefore some do)
But maybe that's just me -- Plus, my authoritative servers are
relatively simple, other than the master, but renumbering the master
without any other changes is also moderately trivial as updating the
slaves can (and is) scripted.
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
More information about the bind-users
mailing list