<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I configured five test zones on a bind10-devel-20120119 authoritative server and am setting them up for outbound zone transfer to a bind 9.9.0rc2 server for DNSSEC inline signing. Initially I configured a transfer_acl for each zone, but
since they are all the same, it probably makes more sense to configure a transfer_acl globally. Here’s where I get confused. Shown below are what appear to be different transfer_acl entries at three different scopes: Xfrout global, Xfrout/zone_config global,
and Xfrout/zone_config[i] zone list element.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">> config show Xfrout/transfer_acl <o:p></o:p></p>
<p class="MsoNormal">Xfrout/transfer_acl[0] {"action": "REJECT"} any<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">> config show Xfrout/zone_config/transfer_acl<o:p></o:p></p>
<p class="MsoNormal">Xfrout/zone_config/transfer_acl[0] {"action": "ACCEPT"} any (default)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">> config show Xfrout/zone_config[0]/transfer_acl<o:p></o:p></p>
<p class="MsoNormal">Xfrout/zone_config[0]/transfer_acl[0] {"action": "ACCEPT", "from": "10.1.88.13", "key": "nsb0-nsb0s"} any<o:p></o:p></p>
<p class="MsoNormal">Xfrout/zone_config[0]/transfer_acl[1] {"action": "ACCEPT", "from": "2001:4870:20ca:158:383e:4365:e3fe:ef7e", "key": "nsb0-nsb0s"}any<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The first and third ones are described in the bind10 guide, but the second is not. Furthermore the second one seems to be setting up outbound zone transfers to be wide open. Would you please comment on what the second transfer_acl does
and how it interacts with the other two. Thanks. Jeff.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Jeffry A. Spain<br>
Network Administrator<br>
</span><span style="color:blue">Cincinnati Country Day School</span><span style="color:#1F497D"><br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>