<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div>On Mar 16, 2014, at 3:32 AM, Bob McDonald <<a href="mailto:bmcdonaldjr@gmail.com">bmcdonaldjr@gmail.com</a>> wrote:</div><div><br class="Apple-interchange-newline"><blockquote type="cite"><div dir="ltr"><div><div>Ok so it's not painless. Do the updates still get forwarded to the master by the slaves or do I need to have all Windows devices needing update capability to point at the master?<br><br></div>
TIA,<br><br></div>Bob<br></div><div class="gmail_extra"></div></blockquote><div><br></div><div><div>I don't believe it works with update forwarding. I've certainly never gotten it to work. However, Microsoft will send the updates tot he master listed in the SOA record, so as long as that shows your otherwise-hidden master, and firewall access is set up for it, everything should work fine.</div><div><br></div><div>Regards,</div><div>Chris Buxton</div><br><div></div></div><br><blockquote type="cite"><div class="gmail_extra"><div class="gmail_quote">On Fri, Mar 14, 2014 at 7:36 PM, Chris Buxton <span dir="ltr"><<a href="mailto:clists@buxtonfamily.us" target="_blank">clists@buxtonfamily.us</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="">On Mar 14, 2014, at 10:50 AM, Bob McDonald <<a href="mailto:bmcdonaldjr@gmail.com">bmcdonaldjr@gmail.com</a>> wrote:<br>
<br>
> I agree that TSIG or SIG(0) signed updates are certainly a more desirable approach than allowing updates via address. My DHCP server is setup to sign all of it's updates this way. However, I have AD domain controllers in the environment that don't currently use signed updates. Is there a fairly painless way to convert all the AD machines to signed updates?<br>
<br>
</div>You would need to set up GSS-TSIG, which is not painless. (It's certainly doable, but there are plenty of pitfalls to overcome.) Windows doesn't support TSIG, just GSS-TSIG.<br>
<br>
AFAIK, use of GSS-TSIG requires update-policy instead of allow-update on the master.<br>
<br>
Regards,<br>
Chris Buxton.</blockquote></div><br></div>
</blockquote></div><br></body></html>