Win2K3 DNS Server problem

Windows 2003 server domain controller configured as active directory integrated with DNS server...?
DO you have the proper ISP dtials..router is configured properly with ISP IP address/subnet mask/Gateway & DNS adress.Then IN WIn2k3 DNS server configuration primay DNS address is self server static IP address and at cleint side also.
SO firestly check the ISP ..>Router..>Switch.....>server + pc...Physical connections adn Network settings and check any firewall application or Hardware confiured on your network or personel fireall is installed.

Regards,
vijay kadadi

And also run the NSlookup & ipconfig /flushdns commands.

Regards,
vijay kadadi

MightySW - Not running DHCP, static.  DG = 192.168.1.1

pinging outside addresses results in host not found error

I have connectivity, if I configure ISP DNS in server NIC, I can browse the Internet

DNS config looks good and there are no errors in Event Viewer

Problem could be with Cisco firewall (router), but I need to confirm DNS is setup properly

You can see if DNS is correctly configured by looking at the DNS server snapin.  If you just created an Active Directory Integrated zone then it more than likely is setup correctly.  

My bet is with the gateway (router).  When you bypass the router and enter the DNS for the ISP's it resolves externally.  

All of this assuming that everything internally is resolving correctly.  Can you ping internal objects by name and fully qualified domain name (machine.domain.local) ?

Firewalls generally deny ICMP (ping).  If you can resolve to an outside address (use IE to get to www.microsoft.com) then the forwarders are working properly.  

Check the DNS event log for errors (open the DNS management console and look at the event log).  If you are seeing errors then TS to resolve them.  If no errors, then monitor day to day.  If still no errors, then you are now a DNS GURU!  Congrats!

Quote:

pinging outside addresses results in host not found error

I have connectivity, if I configure ISP DNS in server NIC, I can browse the Internet  

:endquote

This is clearly in the server.  Your router is passing IP from the server when you configure ISP DNS at the NIC,

When you have the forwarder CORRECTLY setup to point to your ISP DNS, do you thus have your server NIC pointing DNS to 127.0.0.1?

jwelter -  I'm not using 127.0.0.1, rather IP of the server in question.  Should work the same as loopback correct?

I should also mention I ran DNS test and while simple query worked, recursive query failed.

To be honest, bwander, I have not used the server IP; I used the loopback.  I could look it up in my manuals here but, again, I have it set to loopback and it works.

I'd humor yourself and try it.

If it still bombs, and if you can handle it, I'd unload the DNS off the server and start over.  Sometimes things get all squirrelled up if something isn't right halfway through the setup and you try and "patch it".  Better to start fresh.  I setup my DNS in minutes so it shouldn't be that bad.  Go ahead and use the loopback and not the IP for the NIC's DNS, do your forwarder config, and give it a try.

Are you 1000% sure that under the dnsmgmt snap-in, when you click on your SERVER and then dbbl-click Forwarders in the right pane, on the forwarders tab, it says for DNS domain: "All other DNS domains", and in the list below, your ISP DNS server(s) are listed (not the IP of the ISP, the IP of DNS of the ISP)? -Also Number of secs before forwards timeout on mine is 5, do not use recursion is un-checked.

Something else to check:  On that next tab (Advanced), only BIND secondaries, Enable round robin, Enable netmask ordering, and Secure cache against pollution are checked on.

FYI: I use a 2Wire residential gateway, which passes DNS, so for my forwarder, I have my router/gateway configured as the forwarder.  I don't know how CISCO works, but you could try entering the IP address of your gateway as the forwarder.

Good luck & let me know your progress!

Everything is default, and as you listed in your post.  Nothing has been changed except to add the forwarders, which of course are the ISP's DNS servers.

Changing to lookpback address did not work.

I suspect the firewall, but I'd like to run some diagnostics, or specific tests that would indicate that as the failure point.

Do you have any suggestions?

What kind of router is it?

Cisco ASA

Maybe I'm missing something here.  What exactly is your problem.  Is it that you cannot ping outside addresses, or is it that the recursive query failed, or is there something else?

I believe the problem is that the DNS server is not forwarding requests for external domains.  I can't resolve external addresses, ie. www.dell.com    I just get a host not found error.

If I change the forwarders configured in the DNS Mgmt snap-in, no change
If I remove them, and rely on root hints, no change

If I change my NIC DNS settings to ISP DNS address, I can resolve external addresses.

ah - I missed the NIC part.

Is the DNS server configured to allow Recursive Queries?  On the Forwarders Tab at the bottom "Do not use recursion for this domain."  

Do not use recursion for this domain is NOT checked.

Yeeek,  I'm afraid you might have to take this to a Cisco thread.  The ASA is Cisco's move "up?" from PIX.  -Stateful packet inspection firewall.  I don't have any experience with that router but what I've read could indicate some configuration is required there.   It sounds like your server is configured correctly, short of updates applied and a reboot (need to flush dns and start clean).

Sorry, my friend.  -best of luck!

Firewall admin assures me DNS ports are not blocked and DNS servers (the forwarders in question) are set to allow queries from "internal" addresses, which this is.

As I said, I too suspect the firewall, but I need to exhaust all tests and diags and I want to be sure my server is not misconfigured, before I go that route.

Last really, really dumb question, but can you open a command prompt and do an ipconfig /all and post the response here?

Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings\Administrator>ipconfig /all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : server
   Primary Dns Suffix  . . . . . . . : domain.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : domain.local

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom BCM5708C NetXtreme II GigE (NDIS
 VBD Client)
   Physical Address. . . . . . . . . : {removed}
   DHCP Enabled. . . . . . . . . . . : No
   IP Address. . . . . . . . . . . . : 192.168.5.10
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.5.1
   DNS Servers . . . . . . . . . . . : 127.0.0.1
   Primary WINS Server . . . . . . . : 192.168.5.10

I don't run a WINS server so I don't have that entry.  Everything else looks ok.  (Not to offend, I'm sure you know what's up).

I hate to overstate the obvious, but, your server looks good.  If you've started fresh with a new install of DNS, setup the forwarder correctly, rebooted, etc.,  I can't help but think your issue is with that ASA.  I peeked around the Cisco threads and there is ALOT to know about configuring those guys and in particular with DNS and NAT.

If you don't have administrative control of the ASA, then you could be looking at a he said-she said thing, unless you have a good relationship w/ the admin, in which case you'll have to get him/her to work with you on this.

All imho.  Good luck

jwelter - thanks for the help

I need to correct something I said earlier.

I thought I could configure the NICs DNS with external DNS servers and browse the Internet....but actually this is NOT correct.

Since the last post, I have concluded the problem is with the ASA.  I'll post again when this has been confirmed.

In DNS servers primary address instead of 127.0.0.1 ..try with your server ip address=192.168.5.10 and then check for Internet browsing.And Yes ISA firewall configuration is necessary for your rules and trusted IP range in your Network.

Regards,
vijay kadadi