DNS configuration for extranet and intranet

Wow!!!! That was a quick response!!

If i had named my internal domain as xyz.local then i would not have had a problem becuase i would then keep the extranet domain name as xyz.com and there would be no clash. I guess my thinkning is right along these lines.

The option A you gave would not be suitable for us.

I am not sure how i would implement option B. Suppose i create a DNS zone as external.xyz.com then how does name resolution take place? Meaning that according to the DNS resolution method the DNS server will look for a DNS zone as xyz.com and then that will point to external.xyz.com. So again i still have xyz.com being in the extranet. Yes the difference is that there will be a separate internal.xyz.com........however i cannot change the present internal domain setup.

So what other options do i have that lets me set up an external DNS server which would still have xyz.com as the zone name and yet not replicate internal DNS traffic??

The internal and external DNS are seperated, you can't put your private IP addresses onto public dns servers.
Your internal DNS servers will spoof authenticity for XYZ.com and will never go outside to resolve it.

But if i try and give the same zone name as xyz.com wouldn't i get the error that the zone already exists??

When i set up the intranet DNS zone most of the DNS entries were automatic.

The extranet DNS would obviously need static entries for the public servers. And ideally for security i am supposed to be setting a secondary zone in the DMZ.

Is it possible for me to do this-
I enter static entries for the public servers and replicate ONLY these entries to a secondary zone in the DMZ. Is there a way to allow replication of ONLY public IP addresses to the secondary zone. ( My internal DNS servers are AD integrated)........ Or am i talking silly??

You could create another Active Directory/primary zone on your main DNS server called external.xyz.com and create you static entries in it. Then create a secondary (read only) copy of the external.xyz.com zone in the extranet.

Only the external zone would be transferred.

Hi,

I had the same issue when I join my current company.

They decided they wanted to have there own exchange server as they we're using pop3.

At that point I found that the previous administrator had setup the internal domain to company.com which was also the external domain.

I don't know if this is any use to you but this is what I did.

1) Setup a new dns server for the internal lan with the domain as company.local

2) Setup a new external dns server with the domain as company.com

3) Create records for all my internal unix box's and left the Microsoft stuff to add there own (win2k +)

4) Created records for my external resources on my new external server.

5) Setup zone transfer so my external zone was pulled to the internal server so my clients didn't have to go off searching for the company.local zone.

6) Changed DHCP so that my clients now look at the new internal dns server.

7) Changed my Domain at network solutions to look at my new primary external server.

8) Took my old server offline after a 3 week run in period.

9) Now my internal clients can see everything belonging to company.local and company.com from the local dns server. And people on the internet get a copy of only my external ip address's and services.

No idea if thats any use to you, but feel free to ask any questions.

thanks

Mark

Hi,

Chicagoan-
I now understand what you were trying to say!!! So basically since i am using internal private IP addresses i do not have to worry and i can still create a public DNS server with the DNS zone with xyz.com correct??

Also you said that i could get the ISP to point to those records but that would be in the case if we do not want to host a public DNS server right?

Diggisaur-
The solution that you presented seems good but is that solution for a case where in which a company uses public IP addresses even for the intranet?

oldhamuk-
What you mentioned was something that i was going to do. But i would like to ask you the same question as i asked above to diggisaur. If u named the domain company.local ( as i was thinking of doing the same) did you have public ip addresses on the LAN?

PLease let me know because i have not handled large networks as yet all the solutions you guys mentioned all make sense. Which is most popularly used in large companies --- naming the internal domain as company.local or company.net or diggisaur's method?

Thanks

We have a class b address range and most of our clients use public ip address's some are private but this all sits behind our firewall.

And seen as though you don't make you internal dns server visable from the outside world the bad buys can't see you address's anyway so nothing to worry about.

you should not name you internal domain company.net as the .net domain suffix is a public domain suffix where as .local is not on the internet and there for your clients can
t get confussed.

My recommendation is to use either .local or .int for you internal domain, as these are not internet domain, but to be safe I always setup LAN's with .local.

Mark

We have a class b address range and most of our clients use public ip address's some are private but this all sits behind our firewall.

And seen as though you don't make you internal dns server visable from the outside world the bad buys can't see you address's anyway so nothing to worry about.

you should not name you internal domain company.net as the .net domain suffix is a public domain suffix where as .local is not on the internet and there for your clients can
t get confussed.

My recommendation is to use either .local or .int for you internal domain, as these are not internet domain, but to be safe I always setup LAN's with .local.

Mark

right - as long as your internal clients are using your private DNS server...

No this particular solution was for an extranet in a screen subnet. SO basically behind a firewall with forwarding to the DNS's.

>a company uses public IP addresses even for the intranet?
doesn't matter what the addresses are if they're not reachable from outside the enterprise

In a DMZ configuration, you could setup a DNS server internally...and externally in the DMZ.  The internal DNS would answer requests from your internal clients.  If forwarding is required, you can the request from your external DNS server.  The external dns server does not need to know anything about the internal dns.  The external DNS server needs only to know about the public servers.  All extranet dns requests go to the external dns server...which knows nothing of the internal systems.

Hope this helps