<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7651.59">
<TITLE>RE: Windows AD, Windows DHCP, BIND, and DDNS</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/plain format -->
<P><FONT SIZE=2>Joe,<BR>
<BR>
On your Windows DHCP server, use DHCP MMC, right click on DHCP server name, and select options. In Options, select DNS tab and uncheck the required DNS registration options.<BR>
<BR>
Best,<BR>
<BR>
Frank<BR>
<BR>
<BR>
-----Original Message-----<BR>
From: bind-users-bounces@lists.isc.org on behalf of Borgia, Joe A CTR USAF AFMC AFRL/RIOS<BR>
Sent: Mon 6/15/2009 10:27 AM<BR>
To: bind-users@lists.isc.org<BR>
Subject: Windows AD, Windows DHCP, BIND, and DDNS<BR>
<BR>
Folks,<BR>
<BR>
<BR>
<BR>
I need some help.<BR>
<BR>
<BR>
<BR>
At my site, I am running Windows AD, Windows DHCP, and BIND version<BR>
9.6.0-P1.<BR>
<BR>
<BR>
<BR>
The AD namespace that my customer implemented is different from the BIND<BR>
namespace. The majority of the clients here are Windows XP/Vista-based<BR>
systems that receive their IP via Windows DHCP. We'd like to have these<BR>
systems register themselves manually via DDNS to our BIND namespace. Just<BR>
for proof-of-concept before we even try to tackle TSIG to secure it, we're<BR>
using the "allow-update" directive.<BR>
<BR>
<BR>
<BR>
DHCP Server: 10.10.10.10<BR>
<BR>
<BR>
<BR>
We setup allow-update for 10.10.10.10 for both the forward lookup "hosts"<BR>
file and reverse lookup "hosts.rev" file.<BR>
<BR>
Our BIND namespace is bind.domain.mil<BR>
<BR>
Our AD namespace is our.ds.domain.mil<BR>
<BR>
<BR>
<BR>
When a client gets an IP with the BIND server configured to allow the<BR>
Windows DHCP server to do the updating, rather than registering that client<BR>
as host.bind.domain.mil, it registers it only in the reverse lookup table as<BR>
host.our.ds.domain.mil, which is undesirable. We want the host to be<BR>
host.bind.domain.mil on the BIND servers, both forward and reverse.<BR>
<BR>
<BR>
<BR>
When I setup an ACL called "dynamic-update" for 10.10.0.0/16 and allow all<BR>
of that network to perform the updates on the BIND server, it works better,<BR>
but not completely because to make that work, we had to go into the client's<BR>
TCP/IP settings, and tell it to register specifically as bind.domain.mil.<BR>
Doing that caused the client to register itself properly in both forward and<BR>
reverse lookup zones. However, apparently, the DHCP server is also<BR>
registering the reverse lookup IP with host.our.ds.domain.mil. When you do a<BR>
reverse lookup on the client, you get both FQDNs back in the response.<BR>
<BR>
<BR>
<BR>
The two problems with this are first, to make this work, each client has to<BR>
be touched to configure that DNS namespace to register it properly and<BR>
second, we need to get the DHCP server to stop doing this registration for<BR>
AD in the BIND servers.<BR>
<BR>
<BR>
<BR>
It'd be ideal if we could just have the Windows DHCP server update the BIND<BR>
servers with the proper DNS suffix. I've looked around the Internet and it<BR>
doesn't seem as if there are too many people with different namespaces<BR>
between BIND and AD trying to do what we're doing. If the namespaces<BR>
matched, this would work perfectly. Unfortunately, we are not in a position<BR>
to change either namespace, so we have to make this work somehow.<BR>
<BR>
<BR>
<BR>
Anyone have any ideas?<BR>
<BR>
<BR>
<BR>
Thanks in advance,<BR>
<BR>
Joe<BR>
<BR>
------------------------------------<BR>
<BR>
Joseph A. Borgia, Jr.<BR>
<BR>
Sr. UNIX/SAN Engineer<BR>
<BR>
Team Rome IT - Rome Research Corporation<BR>
<BR>
U.S. Air Force Research Laboratory/Rome Research Site/RIOS<BR>
<BR>
COMM: 315-330-3952<BR>
<BR>
DSN: 587-3952<BR>
<BR>
FAX: 315-330-8258<BR>
<BR>
<BR>
<BR>
<BR>
</FONT>
</P>
</BODY>
</HTML>