Solved

Secondary DNS will not answer

Posted on 2007-12-05
10
916 Views
Last Modified: 2012-06-22
I have set up two servers. 192.168.10.1 as primary, and 192.168.10.2 as secondary. I get no errors on any of my tests, but once I take the primary DNS server off line, I cannot surf the web nor do any of test hosted sites (through IIS on 192.168.10.1) come up. I have connectivity only when the primary name server is up. Isn't everything supposed to fall back on the secondary name server?

(DNSReports shows everything perfect, except that I have open DNS servers, and that they will do recursive lookups. But I cannot lock them down, since if I do I can't get on the Net from that machine. All my updates fail, etc.)

But anyways, any ideas where to look or how to fix this secondary DNS not doing it's share of the work here, will be greatly appreciated.

Thank you
0
Comment
Question by:mikec101
10 Comments
 
LVL 6

Assisted Solution

by:darkeryu
darkeryu earned 100 total points
ID: 20409794
hi:

you can use dhcp give two dns setting in scope options.
0
 
LVL 70

Assisted Solution

by:KCTS
KCTS earned 100 total points
ID: 20409803
1. have you set up the client with the preferred and alternate DNS server IPs (either on the DNS option in the TCP/IP Properties or via DHCP options)?

2. Have you set up both DNS servers to forward external resolution to your ISPs Servers ? - see http://www.petri.co.il/configure_dns_forwarding.htm
0
 
LVL 38

Assisted Solution

by:ChiefIT
ChiefIT earned 100 total points
ID: 20409984
Does the router have a manually entered list of primary and secondary DNS in the list of LAN DNS servers.

Does the server have the default gateway entered into the IP stack?
0
 

Author Comment

by:mikec101
ID: 20410307
Maybe I should have mentioned that these name servers are on two separate networks? So correctly I should say NS1 is on 192.168.10.1 and NS2 is on 10.0.0.1. Sorry, I didn't think of that.

I've had SBC delegate reverse DNS to me, so there is no other ISP.

In the Forwarders tab of NS1 I have "All Other domains" and in the "Select domain's forwarder IP address list" I have the IP of NS2 (10.0.0.1).

In the Forwarders tab of NS2 I have "All Other domains" and in the "Select domain's forwarder IP address list" I have the IP of NS1 (192.168.10.1).

"Do not use recursion for this domain" is checked on both servers.

There is no "router", just a DSL modem with 6 static IPs.

NS1 has the Default Gateway on it's own network, 192.168.10.94.
Prim. DNS: 192.168.10.1 (itself)
Sec. DNS: 10.0.0.1 (NS2)

NS2 has the Default Gateway on it's own network, 10.0.0.254
Prim. DNS: 10.0.0.1 (itself)
Sec. DNS:  192.168.10.1 (NS1)

Before the delegation, SBC asked me what the name servers will be. So maybe I should point my primary DNS to itself (or maybe my OWN other name server) and the secondary DNS to SBC's DNS server?

I'm confused. If I still point to SBC, then what's the point in setting up my own DNS?

Thanks.
Mike.
0
 

Author Comment

by:mikec101
ID: 20410331
If I try to do nslookup on any domains on my network, like test_site1.com, I get this:

Default server: ns2.domain.com
Address: 10.0.0.1
Name: test_site1.com
Address: 192.168.10.2

(the sites are hosted on NS1, on a different IP)

If I do nslookup google.com, I get this:

Default server: ns2.domain.com
Address: 10.0.0.1
DNS request timed out.
        timeout was 2 seconds.
*** Request to ns2.type3.net timed-out.
>

Mike




0
6 Surprising Benefits of Threat Intelligence

All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

 
LVL 2

Accepted Solution

by:
lavazzza earned 200 total points
ID: 20412863
First off, I would change forwards on your DNS servers to external sources.  That said, I am not totally convinced that the issue is DNS related.

First:  To answer your question regarding why your SBC is relegating to your servers to resolve DNS is that you can add, remove, and modify A, CNAME, MX records, etc for your domain.  

How is your network laid out?  What kind of router do you have and are you using NAT to both the 192.168.10 and the 10.0.0 networks? If so do you have the proper translations (port 53 or the IP of the DNS servers?)  If the 10.0.0 network is a subnet within the network (a double nat situation) do you have  the appropriate routes loaded in the nat router?  Go to www.DNSstuff.com and do a domain lookup and see first if it can see any of your DNS servers.  From the inside, make sure that the two servers can be pinged from your host.

Are the DNS servers Active Directory Integrated? If not, are they set to replicate to one another or are you just making host entries to each machine.  If you are using these boxes for external DNS resolution of your domain, I would not recommend AD integration because it will expose all the pc's in your network.  Additionally, you will essentially need 2 different DNS zones, one with the public IP's so that people on the internet who are trying to resolve machines you are making public can reach them (you will not point to these from machines on the inside) and one which Active Directory uses and all your internal machines point to as the primary.

Could you provide a network layout of how the 2 dns servers are connected to the network and then the way the inside communicates with the outside network.
0
 

Author Comment

by:mikec101
ID: 20413560
NS1 (all IPs bound to one NIC)
192.168.10.1   DNS
192.168.10.2   IIS
192.168.10.1   MX2

NS2 (both IPs bound to one NIC)
10.0.0.1   DNS
10.0.0.2   MX1

On 10.0.0.x there are two servers: 10.0.0.1 (NS2) and another box with WMCE 2005, on 10.0.0.5. WMCE cannot join a domain (well, it _can_ but it stops being a media server, so I don't care about it being inside the domain). So there isn't much of a "network" - just one server at one location and a server and a workstation at another location.

Like I said, I am not using NAT - I have enough IPs to do what I want. It's that that damn NS2 doesn't take over NS1's job as a name server once I take NS1 off line.

I do have Active Directory, but I can dump that. I just put it on to try it out. There are no other computers on 192.160.10.x, so I don't think it's a NAT issue. Since there is only one server at that location, it's NS1 itself that can't access the Net once I stop the DNS service. I thought it should fall back to NS2, since NS2 is set as it;s secondary DNS server.


Mike
0
 
LVL 2

Expert Comment

by:lavazzza
ID: 20415445
Are these two servers at two separate locations?  If so are they connected via VPN? How does the 192 network physically communicate with the 10 network?
0
 

Author Comment

by:mikec101
ID: 20416064
192 has 10 as it's primary DNS, and 10 has 192 as _its_ primary DNS. NS2 is part of the the DOMAIN.COM domain. I have set up a computer account in AD for NS2 on NS1, and I just joined that domain.

As DNS servers, DOMAIN.COM has NS1.domain.com and NS2.domain.com. I can ping and nslookup NS1 from NS2 and vice-versa, over the Net.

From NS1
Reply from 10.0.0.1: bytes=32 time=16ms TTL=124
[...]
Packets: Sent = 4, Lost = 0 (0% loss)


From NS2
Reply from 10.0.0.1: bytes=32 time=17ms TTL=124
[...]
Packets: Sent = 4, Lost = 0 (0% loss)


I'm not using DHCP. I have static IPs, so the servers are live all the time. I ahve opened the proper ports on both, and I can ping mail, "telnet main_mail.domain.com 25" from NS1, and "telnet mail_bk.domain.com 25." from NS2, etc.

On NS2 I also have 192.168.50.2 (255.255.255.0) mapped to the NIC, and on the WMCE box I have 192.168.50.1 mapped to _its_ NIC. So I mount and  share drives/folders between NS2 and WMCE box through those non-routable IPs, since they are both connected to the same 5 port hub. I can then "tail -f" my DNS logs from NS2 on the WMCE box through a network share of NS2\\DNS_LOG.


Mike.
0
 

Author Comment

by:mikec101
ID: 20416180
Fixed!

On N1, Forwarders tab, remove 10.0.0.1 from "Selected domain's forwarder IP address list"

On N2, Forwarders tab, remove 192.168.0.1 from "Selected domain's forwarder IP address list"

Thanks for all your help. It was the VPN and DHCP that triggered it.

Thank a million!
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

There are several problems reported according slow link speeds or poor performance in TMG 2010, UAG 2010 or ISA 2006. I want to collect here some of the common issues together to give a brief overview what can be the reason. Nevertheless, not all of…
Occasionally you run into the website or two that will not resolve properly using your own DNS servers.  Some people simply set up global forwarders for their DNS server.  I don’t recommend doing this because it can cause problems resolving addresse…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

14 Experts available now in Live!

Get 1:1 Help Now