<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=big5">
<style type="text/css" style="display:none"><!-- p { margin-top: 0px; margin-bottom: 0px; }--></style>
</head>
<body dir="ltr" style="font-size:12pt;color:#000000;background-color:#FFFFFF;font-family:Calibri,Arial,Helvetica,sans-serif;">
<p>From 9.1 ARM chapter 7 that mention</p>
<p>The EDNS Client Subnet (ECS) option is used by a recursive resolver to inform an authoritative<br>
name server of the network address block from which the original query was received, enabling<br>
authoritative servers to give different answers to the same resolver for different resolver clients.<br>
<strong></strong></p>
<p><strong></strong> </p>
<p><strong style="color: rgb(255, 0, 0);"><span style="color: rgb(255, 0, 0);">An ACL containing an element of the form ecs prefix will match if a request arrives in containing</span></strong><br style="color: rgb(255, 0, 0);">
<strong style="color: rgb(255, 0, 0);"><span style="color: rgb(255, 0, 0);">an ECS option encoding an address within that prefix. If the request has no ECS option,</span></strong><br style="color: rgb(255, 0, 0);">
<strong style="color: rgb(255, 0, 0);"><span style="color: rgb(255, 0, 0);">then "ecs" elements are simply ignored</span></strong>. Addresses in ACLs that are not prefixed with "ecs" are<br>
matched only against the source address.</p>
<p> </p>
<p>Now i was migrate DNS bint fro 9.10 to 9.11 and use ECS prefix on my allow-query entry but when i use dig
</p>
<p>test (not include +subnet) it not response but when i remvoe that ecs keyword every thing was OK.</p>
<p> </p>
<p>I was use bind 9.11 setup three dns server one for mydomain.idv and two are sub.mydomain.idv.</p>
<p>my sub.mydomain.idv has multi view but has same zone. </p>
<p>when i use dig query sub.mydomain.idv entry it always return last match view, it will not reponse by client subnet</p>
<p>following was my partial named.conf content </p>
<p> </p>
<p>====================sub.mydomain.idv (Primary server -ip:a.b.c.d) =====================</p>
<p>acl "slave-ips" { a.b.c.d; };</p>
<p>server a.b.c.d {<br>
provide-ixfr yes;<br>
request-nsid yes;<br>
send-cookie yes;<br>
edns-udp-size 4096;<br>
max-udp-size 4096;<br>
transfer-format many-answers;<br>
};</p>
<p>server a1.b1.c1.d1 { // mydomain.idv primary server<br>
request-nsid yes;<br>
send-cookie yes;<br>
edns-udp-size 4096;<br>
max-udp-size 4096;<br>
};</p>
<p>include "d:\isc bind 9\etc\ecs-acl-list.txt";<br>
include "d:\isc bind 9\etc\no-ecs-acl-list.txt";<br>
include "d:\isc bind 9\etc\KeyFiles.txt";<br>
include "d:\isc bind 9\etc\logging.conf";</p>
<p>options {<br>
directory "d:\isc bind 9\var\named";<br>
allow-update {none;}; <br>
notify explicit;<br>
allow-transfer { none; };<br>
allow-query { none; }; <br>
};</p>
<p>// End Options</p>
<p>view "area01" {<br>
match-clients { area01; ecs-area01; !{!ecs-area01; any; } ; key Area01.mydomain.idv.;};<br>
zone "sub.mydomain.idv" in {<br>
type master;<br>
allow-query { area01; ecs-area01; };<br>
file "sub/area01.mydomain.idv.txt";<br>
also-notify { a.b.c1.d key Area01.mydomain.idv.; };<br>
allow-transfer { key Area01.mydomain.idv.; };<br>
};<br>
}; // End View</p>
<p>view "area02" {<br>
match-clients { area02; ecs-area02; !{!ecs-area02; any; } ; key Area02.mydomain.idv.; };<br>
zone "sub.mydomain.idv" in {<br>
type master;<br>
allow-query { area02; ecs-area02; };<br>
file "sub/area02.mydomain.idv.txt";<br>
also-notify { a.b.c1.d key Area02.mydomain.idv.; };<br>
allow-transfer { key Area02.mydomain.idv.; };<br>
};<br>
}; // End View</p>
<p>view "area03" {<br>
match-clients { area03; ecs-area03; !{!ecs-area03; any; } ; key Area03.mydomain.idv.; };<br>
zone "sub.mydomain.idv" in {<br>
type master;<br>
allow-query { area03; ecs-area03; };<br>
file "sub/area03.mydomain.idv.txt";<br>
also-notify { a.b.c1.d key Area03.mydomain.idv.;};<br>
allow-transfer { key Area03.mydomain.idv.; };<br>
};<br>
}; // End View</p>
<p>view "deafult" { // Default<br>
match-clients {any; };<br>
zone "sub.mydomain.idv" in {<br>
type master;<br>
allow-query { any; };<br>
file "sub/default.mydomain.idv.txt";<br>
also-notify { a.b.c1.d key Default.mydomain.idv.;};<br>
allow-transfer { key Default.mydomain.idv.; };<br>
};<br>
}; // End View</p>
<p>====================sub.mydomain.idv (Slave server -ip:a.b.c1.d) =====================</p>
<p>server a.b.c.d {<br>
provide-ixfr yes;<br>
request-nsid yes;<br>
send-cookie yes;<br>
edns-udp-size 4096;<br>
max-udp-size 4096;<br>
transfer-format many-answers;<br>
};</p>
<p>server a1.b1.c1.d1 { // mydomain.idv primary server<br>
request-nsid yes;<br>
send-cookie yes;<br>
edns-udp-size 4096;<br>
max-udp-size 4096;<br>
};</p>
<p>include "d:\isc bind 9\etc\ecs-acl-list.txt";<br>
include "d:\isc bind 9\etc\no-ecs-acl-list.txt";<br>
include "d:\isc bind 9\etc\KeyFiles.txt";<br>
include "d:\isc bind 9\etc\logging.conf";</p>
<p>options {<br>
directory "d:\isc bind 9\var\named";<br>
allow-update {none;}; <br>
notify explicit;<br>
allow-transfer { none; };<br>
allow-query { none; }; <br>
};</p>
<p>// End Options</p>
<p>view "area01" {<br>
match-clients { area01; ecs-area01; !{!ecs-area01; any; } ; key Area01.mydomain.idv.;};<br>
zone "sub.mydomain.idv" in {<br>
type slave;<br>
allow-query { area01; ecs-area01; };<br>
file "sub/area01.mydomain.idv.ca";<br>
masters { a.b.c.d key Area01.mydomain.idv.; }; <br>
};<br>
}; // End View</p>
<p>view "area02" {<br>
match-clients { area02; ecs-area02; !{!ecs-area02; any; } ; key Area02.mydomain.idv.;};<br>
zone "sub.mydomain.idv" in {<br>
type slave;<br>
allow-query { area02; ecs-area02; };<br>
file "sub/area02.mydomain.idv.ca";<br>
masters { a.b.c.d key Area02.mydomain.idv.; };<br>
}; // End View</p>
<p>view "area03" {<br>
match-clients { area03; ecs-area03; !{!ecs-area03; any; } ; key Area03.mydomain.idv.;};<br>
zone "sub.mydomain.idv" in {<br>
type slave;<br>
allow-query { area03; ecs-area03; };<br>
file "sub/area03.mydomain.idv.ca";<br>
masters { a.b.c.d key Area03.mydomain.idv.; };<br>
}; // End View</p>
<p>view "deafult" { // Default<br>
match-clients { any; };<br>
zone "sub.mydomain.idv" in {<br>
type slave;<br>
allow-query { any; };<br>
file "sub/default.mydomain.idv.ca";<br>
masters { a.b.c.d key default.mydomain.idv.; };<br>
};<br>
}; // End View</p>
<p> </p>
<p>My dns server was install windows 2012 r2.</p>
<p>My client pc at area02 subnet so when i use dig test (if not area02 - ACL entry) then it willget default view</p>
<p>enrty record. But from above red word it means it query packet not include ecs it will ignore ecs function.</p>
<p> </p>
<p> </p>
<p>when i use dig query sub.mydomain.idv entry through mydomain.idv then it alway return default view entry not view area02 entry.</p>
<p> </p>
<p> </p>
<p> </p>
<p>Did anyone can help me where was wrong...........</p>
<p>use ecs prefix </p>
<p> </p>
<p><br>
</p>
<p> </p>
<p> </p>
<p> </p>
<p> </p>
<br>
<br>
--<br>
本信件可能包含工研院機密資訊，非指定之收件者，請勿使用或揭露本信件內容，並請銷毀此信件。 This email may contain confidential information. Please do not use or disclose it in any way and delete it if you are not the intended recipient.
</body>
</html>