<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">And make sure that all of your servers are sync’d to the same NTP. That has burned me in the past.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">John<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""> bind-users [mailto:bind-users-bounces@lists.isc.org]
<b>On Behalf Of </b>Bob Harold<br>
<b>Sent:</b> Wednesday, October 17, 2018 9:16 AM<br>
<b>To:</b> ampranti@gmail.com<br>
<b>Cc:</b> bind-users@lists.isc.org<br>
<b>Subject:</b> Re: Zone transfer failure<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Oct 17, 2018 at 9:56 AM Andreas Brandino <<a href="mailto:ampranti@gmail.com">ampranti@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal">Both servers receive the NOTIFY message from NS1. What I see on the logs:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>NS3:</b><br>
17-Oct-2018 16:41:00.688 notify: info: client 1.1.1.1#19513/key ns1ns3_key: view external: received notify for zone '<a href="http://myzone.com" target="_blank">myzone.com</a>': TSIG 'ns1ns3_key'<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Notice the "view external" in the line above, compared to ns5, which got the notify on the internal view. That appears to be the issue.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Try adding the IP of NS1 to the "match" list for the internal view on NS3.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">-- <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Bob Harold<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b>NS5:</b><br>
17-Oct-2018 16:40:56.131 notify: info: client 1.1.1.1#32586/key ns1ns5_key: received notify for zone '<a href="http://myzone.com" target="_blank">myzone.com</a>': TSIG 'ns1ns5_key'<br>
17-Oct-2018 16:40:56.139 notify: info: zone <a href="http://myzone.com/IN" target="_blank">
myzone.com/IN</a>: sending notifies (serial 2018101910)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The 2nd line is missing on NS3. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">At this point NS5 starts the zone copy (<b>NS1 </b>logs):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">17-Oct-2018 16:41:01.233 xfer-out: info: client 5.5.5.5#40909/key ns1ns5_key (<a href="http://myzone.com" target="_blank">myzone.com</a>): view internal: transfer of '<a href="http://myzone.com/IN" target="_blank">myzone.com/IN</a>': AXFR
started: TSIG ns1ns5_key<br>
17-Oct-2018 16:41:01.234 xfer-out: info: client 5.5.5.5#40909/key ns1ns5_key (<a href="http://myzone.com" target="_blank">myzone.com</a>): view internal: transfer of '<a href="http://myzone.com/IN" target="_blank">myzone.com/IN</a>': AXFR ended<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">At this point NS3 does nothing.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">This is not a firewall or networking problem because I can start the transfer manually.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best Regards<o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Στις Τετ, 17 Οκτ 2018 στις 4:35 μ.μ., ο/η Bob Harold <<a href="mailto:rharolde@umich.edu" target="_blank">rharolde@umich.edu</a>> έγραψε:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal">On Wed, Oct 17, 2018 at 7:23 AM Andreas Brandino <<a href="mailto:ampranti@gmail.com" target="_blank">ampranti@gmail.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">Hello all,<br>
<br>
I wonder if anyone can help me to find the cause of the problem I am currently having.<br>
All servers are running on Debian and BIND 9.10.3-P4-Debian.<br>
<br>
I have a master server and 4 slaves.<br>
The zone is transfered from the master [ns1] to all slaves [ns3,ns4,ns5 and ns6].<br>
I am also using TSIG with a different key for each server. <br>
Moreover, the zone file refers to the internal view.<br>
<br>
When I change the <a href="http://myzone.com" target="_blank">myzone.com</a>, I always update the serial and I reload the zone.<br>
<br>
The problem:<br>
ns3 and ns4 never get the updated zone file automatically.<br>
On the other hand, ns4 and ns5 always get the updated zone file immediately.<br>
<br>
If I initialize the transfer manually from ns3 and ns4, I get no errors.<br>
<br>
Here is the config:<br>
<br>
NS1 config: (IP 1.1.1.1 - master DNS)<br>
<br>
zone "<a href="http://myzone.com" target="_blank">myzone.com</a>" {<br>
type master;<br>
file "/etc/bind/master/myzone.com.INSIDE";<br>
allow-transfer { key ns1ns3_key; key ns1ns4_key; key ns1ns5_key; key ns1ns6_key; };<br>
also-notify {<br>
3.3.3.3 port 53 key ns1ns3_key;<br>
4.4.4.4 port 53 key ns1ns4_key;<br>
5.5.5.5 port 53 key ns1ns5_key;<br>
6.6.6.6 port 53 key ns1ns6_key;<br>
};<br>
notify explicit;<br>
notify-source 1.1.1.1 ;<br>
};<br>
<br>
<br>
NS3 config: (IP 3.3.3.3 - transfer fails)<br>
<br>
zone " myzone .com" {<br>
file "/etc/bind/master/myzone.com.INSIDE";<br>
type slave;<br>
allow-update { key ns1ns3_key; };<br>
masters { 1.1.1.1; };<br>
allow-notify { 1.1.1.1; };<br>
notify yes;<br>
request-ixfr no;<br>
};<br>
<br>
NS5 config: (IP 5.5.5.5, successful transfer)<br>
<br>
zone "<a href="http://myzone.com" target="_blank">myzone.com</a>" {<br>
file "/etc/bind/master/myzone.com.INSIDE";<br>
type slave;<br>
allow-update { key ns1ns5_key; };<br>
masters { 1.1.1.1; };<br>
notify yes;<br>
request-ixfr no;<br>
};<br>
<br>
Do you see any errors in the above configuration that could cause this problem?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best Regards<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">What you don't show is the 'match' statement for your views. Perhaps 1 does not match the internal view on 3, so the notify packet hits the wrong view. Check the notify messages in the logs on 3, compared to 5. Here is a typical notify
log message:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p style="margin:0in;margin-bottom:.0001pt">30-Sep-2018 23:12:37.135 general: info: zone
<a href="http://psych.lsa.umich.edu/IN/oncampus" target="_blank">psych.lsa.umich.edu/IN/oncampus</a>: notify from 141.211.147.150#38695: zone is up to date<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p style="margin:0in;margin-bottom:.0001pt">Note the zone/class/view contains ".../IN/oncampus" - check the view in your logs.<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p style="margin:0in;margin-bottom:.0001pt">If you cannot find the notify, you might need to turn on logging for category "general". Or check routing and firewall rules if the packet is not being received.<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p style="margin:0in;margin-bottom:.0001pt">-- <o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt">Bob Harold<o:p></o:p></p>
<p style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>