Solved

DNS over VPN Tunnel

Posted on 2011-02-28
18
1,737 Views
Last Modified: 2012-05-11
I have two sites on two seperate internal domains connected via an IPSEC VPN tunnel.  One side, siteb.local (one Win2K and one Win2K3 DC), has a Netscreen 5GT, and the other side, sitea.local (2 Win2K3 DCs), has a Fortigate 80C.  The tunnels between the sites are up and I can ping and rdp by IP both ways no problem.  But I am not able to get DNS to work.  I have added a stub domain on either side but it will not update.  I have also tried DNS forwarders but that isn't working either.  What am I missing???
0
Comment
Question by:Compushare
  • 7
  • 7
  • 3
  • +1
18 Comments
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
Do you have enabled TCP/53 and UDP/53 for zone transfers/queries on firewall/router?

Regards,
Krzysztof
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
There are port restrictions on the tunnels
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
So, looks that could be a problem :/
Echo request works fine but DNS queries UDP/53 and zone transfers TCP/53 doesn't. Are your DNS zones configured as Active Directory-Integrated or work as standard Primary/Secondary/Stub zones?

Krzysztof
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
Sorry typing too fast.  Meant to say there are no port restrictions on the tunnels
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
So, please tell me if "Are your DNS zones configured as Active Directory-Integrated or work as standard Primary/Secondary/Stub zones?" ?
That requires also enabling Zone transfers on DNS servers in zone's properties and define which DNS servers can request zone transfers

Krzysztof
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
Please check my guide according to standard Stub Zone creation (and look for enabling zone transfer) and check if it helps

Krzysztof
Configuring-Stub-zone.pdf
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
They are AD integrated, didn't check the Zone transfer tab, thanks for the guide.  Logging in to those servers now to check.
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
When you created stub zones, do you see all NS and A records of DNS servers for those domains within a zone?

Krzysztof
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
One siteb I added the secondary zone on the Win2K DNS server and I saw the NS and A records populate from sitea domain.  I added a stub domain on the Win2K3 DNS server in sitea and it will not pull the NS and A records "The DNS server encountered a problem while attempting to load this zone" .  also I have added the sitea DC to the siteb domain Name Server tab and vice versa since the Zone Transfer tab on both DCs says to only allow transfers to server listed in the Name Servers tab.
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
If they are from different domains, you need to add them using IP adrdress not Name Servers tab :)
But it looks like it works one way :/
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
Ok I did it by IP instead and have the same result.  Works on one side, but not on the other
0
 
LVL 39

Expert Comment

by:Krzysztof Pytko
Comment Utility
Try to click on that "not workin" stub zone and choose "Transfer from master" wait some time and tell me what do you see in DNS event log

Krzysztof
0
 
LVL 3

Expert Comment

by:InterframeGap
Comment Utility
Down load from www.isc.org Bind for NT.
Once downloaded, extract the contents (don't need to install)

find dig.exe

at the command line:

dig axfr company.com. @primary.dnservercompany.com

If you get zone transfer failed:

1) telnet primary dns server port 53 (get a connection?)
2) MSS/MTU - The MTU on the Tunnel will be less than 1500. So DNS will fail on a transfer since it's using the MTU.  You need to change the tunnel settings to "spoof" the MSS on the tcp negotiation to be say 1400 or 1380.  Once both sides have a "mtu of 1380" this should work since you have 40B of overhead on tcp/ip and XBytes on the vpn tunnel (AH/IPSEC/PPTP etc).
3) Make sure you are not stopping unreachables or mtu path discovery.  VPNs tend to block this by default since it's a security risk.  This causes the client not to be able to negotiate a good MSS.

4) Quick test:
Windoze> ping -l 1460 -f -n 10 -w 2 -i 20
-l = payload 1460+40 for header makes 1500
-f = don't fragment
-n = number of packets
-w = wait time 2 seconds
-i = make sure the ttl is set correctly (no modifications on the box).

If that fails work you way down on the "-l" by 40Bytes so you will then ping -l 1420...

Hope this helps
0
 
LVL 2

Accepted Solution

by:
UserProto earned 500 total points
Comment Utility
You must specify domains in forwarders tab: for sitea dns forwarders tab looks: domain siteb.loca - siteb dns server IP, and for siteb dns forwarders tab looks: domain sitea.local - sitea dns server IP. And for all other domains dns must leave unchanged
0
 
LVL 1

Author Comment

by:Compushare
Comment Utility
I still am in the same spot.  On siteb Win2K DNS I have sitea secondary domain and it populates with all the A records.  On sitea Win2K3 DNS the stub domain will not work for siteb.  Records do not populate.  I have used BIND as described and the transfer failed.  I have the interface on the Fortigate set to MTU 1380 and the untrust and trust interfaces on the Netscreen set to MTU 1380.  Still no change.  Before changing the MTU on either side I was only able to complete a ping from sitea to siteb when I set the payload to 1380, now after changing the MTU size on the VPN appliances I have to set it to 1200 for it to complete the ping.  I did not setup forwarders since there are secondary/stub domains in DNS and you can't have both.  Any other ideas?
0
 
LVL 3

Expert Comment

by:InterframeGap
Comment Utility
Yea - however, I'm dealing with production issues.  I'll get back to you as soon as I can - may be later tonight or tomorrow morning.

DMT
0
 
LVL 3

Expert Comment

by:InterframeGap
Comment Utility
Oh - one other thing - do you have netmon 3 installed on both of these servers or at least on one?  A trace of the data transfer sucess/failure would be helpful.

I have not read all your last post, so I'll write later when I have more time.

DMT
0
 
LVL 1

Author Closing Comment

by:Compushare
Comment Utility
This was part of the solution, the other part was moving DNS off the Win2K box onto a Win2K3 box.
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
VOIP Setup through a Watchguard BOVPN 4 26
Joining Domain Issue 4 31
Active directory upgrade to DFSR 4 27
IT Contract Fee 17 53
There have been a lot of times when we have seen the need to enter a large number of DNS entries in a forward lookup zone. The standard procedure would be to launch the DNS Manager console, create the Zone and start adding new hosts using the New…
Resolve DNS query failed errors for Exchange
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now