<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">You have to use separate IPs for the separate views on the master and the slave.<br>
<br>
<o:p></o:p></p>
<p class="MsoNormal">Here we just put alias IPs on the primary interfaces and use those for the second view.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> bind-users <bind-users-bounces@lists.isc.org> <b>
On Behalf Of </b>Roberto Carna<br>
<b>Sent:</b> Wednesday, July 03, 2019 3:21 PM<br>
<b>To:</b> ML BIND Users <bind-users@lists.isc.org><br>
<b>Subject:</b> Bind 9 with Views: zone transfer refused from master to slave<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi people, I have a master/slave Bind 9.10.3 servers configured with views and TSIG keys on a Debian 9 host. But the transfer from master to slave is refused in the slave side, there is no a descriptive error.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In both Views I have delegated the same two zones: <a href="http://black.com">
black.com</a> and <a href="http://white.com">white.com</a>, with different records according to the view.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Please if I send my configuration, can you help me to detect the fail in the zone transfer from master to slave??? Thanks a lot in advance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">MASTER<br>
<br>
named.conf:<br>
<br>
key "rndc-key" {<br>
algorithm hmac-md5;<br>
secret "+PGWO1r5rrT8hcA47Anu0w==";<br>
};<br>
<br>
controls {<br>
inet 127.0.0.1 allow { localhost; } keys { rndc-key; };<br>
};<br>
<br>
include "/etc/bind/named.conf.options";<br>
include "/etc/bind/named.conf.local";<br>
<br>
named.conf.options:<br>
<br>
options {<br>
directory "/var/cache/bind";<br>
also-notify { 10.0.0.2; };<br>
dnssec-validation no;<br>
dnssec-enable yes;<br>
auth-nxdomain no; <br>
allow-query { any; };<br>
notify explicit;<br>
recursion no;<br>
version "none";<br>
};<br>
<br>
<br>
named.conf.local:<br>
<br>
key one {<br>
algorithm HMAC-MD5;<br>
secret "uohej/pa1oLBK4Cfhi3zAA==";<br>
};<br>
<br>
key two {<br>
algorithm HMAC-MD5;<br>
secret "HcKSpnKhqg/+KFvOg2uTag==";<br>
};<br>
<br>
key three {<br>
algorithm HMAC-MD5;<br>
secret "1JikGx1kdjq/cTCsi36/JQ==";<br>
};<br>
<br>
acl one { !key two; !key three; key one; <a href="http://10.10.0.0/24">10.10.0.0/24</a>; };<br>
acl two { !key one; !key three; key two; <a href="http://10.10.1.0/24">10.10.1.0/24</a>; };<br>
acl three { !key one; !key two; key three; <a href="http://10.10.2.0/24">10.10.2.0/24</a>; };<br>
<br>
view "one" {<br>
match-clients { one; };<br>
server 10.0.0.2 { keys one; };<br>
recursion yes;<br>
allow-transfer { key one; };<br>
<br>
zone "<a href="http://black.com">black.com</a>." {<br>
type master;<br>
file "/etc/bind/zones/black.com.one.db";<br>
also-notify { 10.0.0.2 key one; };<br>
};<br>
<br>
zone "<a href="http://white.com">white.com</a>" {<br>
type master;<br>
file "/etc/bind/zones/white.com.one.db";<br>
also-notify { 10.0.0.2 key one; };<br>
};<br>
};<br>
<br>
view "two" {<br>
match-clients { two; };<br>
server 10.0.0.2 { keys two; };<br>
recursion yes;<br>
allow-transfer { key two; };<br>
<br>
zone "<a href="http://black.com">black.com</a>." {<br>
type master;<br>
file "/etc/bind/zones/black.com.two.db";<br>
also-notify { 10.0.0.2 key one; };<br>
};<br>
<br>
zone "<a href="http://white.com">white.com</a>" {<br>
type master;<br>
file "/etc/bind/zones/white.com.two.db";<br>
also-notify { 10.0.0.2 key one; };<br>
};<br>
};<br>
<br>
<br>
SLAVE<br>
<br>
named.conf:<br>
<br>
include "/etc/bind/named.conf.options";<br>
include "/etc/bind/named.conf.local";<br>
<br>
named.conf.options:<br>
<br>
options {<br>
directory "/var/cache/bind";<br>
allow-transfer {"none";};<br>
dnssec-validation no;<br>
dnssec-enable yes;<br>
auth-nxdomain no; <br>
allow-query { any; };<br>
notify explicit;<br>
recursion no;<br>
version "none";<br>
};<br>
<br>
<br>
named.conf.local:<br>
<br>
key one {<br>
algorithm HMAC-MD5;<br>
secret "uohej/pa1oLBK4Cfhi3zAA==";<br>
};<br>
<br>
key two {<br>
algorithm HMAC-MD5;<br>
secret "HcKSpnKhqg/+KFvOg2uTag==";<br>
};<br>
<br>
key three {<br>
algorithm HMAC-MD5;<br>
secret "1JikGx1kdjq/cTCsi36/JQ==";<br>
};<br>
<br>
acl one { !key two; !key three; key one; <a href="http://10.10.0.0/24">10.10.0.0/24</a>; };<br>
acl two { !key one; !key three; key two; <a href="http://10.10.1.0/24">10.10.1.0/24</a>; };<br>
acl three { !key one; !key two; key three; <a href="http://10.10.2.0/24">10.10.2.0/24</a>; };<br>
<br>
view "one" {<br>
match-clients { one; };<br>
server 10.0.0.1 { keys one; };<br>
recursion yes;<br>
<br>
zone "<a href="http://black.com">black.com</a>" {<br>
type slave;<br>
masters { 10.0.0.1 key one; };<br>
file "/etc/bind/zones/black.com.one.db";<br>
};<br>
<br>
zone "<a href="http://white.com">white.com</a>" {<br>
type slave;<br>
masters { 10.0.0.1 key one; };<br>
file "/etc/bind/zones/white.com.one.db";<br>
};<br>
<br>
};<br>
<br>
view "two" {<br>
match-clients { two; };<br>
server 10.0.0.1 { keys two; };<br>
recursion yes;<br>
<br>
zone "<a href="http://black.com">black.com</a>" {<br>
type slave;<br>
masters { 10.0.0.1 key one; };<br>
file "/etc/bind/zones/black.com.two.db";<br>
};<br>
<br>
zone "<a href="http://white.com">white.com</a>" {<br>
type slave;<br>
masters { 10.0.0.1 key one; };<br>
file "/etc/bind/zones/white.com.two.db";<br>
};<br>
<br>
};<o:p></o:p></p>
</div>
</div>
</body>
</html>