?
Solved

dual redundant DCs no longer update reverse lookup zone info from secondary DHCP

Posted on 2013-05-10
4
Medium Priority
?
332 Views
Last Modified: 2013-07-22
Configuration:
primary site:
- two (2)  DCs (2008 R2 domain controllers) configured for redundancy on 172.16.10 subnet
- DNS integrated with AD (Active Directory)
- SOA (Start of Authority) here for entire domain

two (2) remote sites:
- two (2) remote locations 172.16.20 & 172.16.30
- single 2008 R2 server at each site with mainly IP devices
- both remote locations have secondary DNS servers and local DHCP
- DHCP configured to point to primary site DCs as DNS

Functionality we had:
- when we had one (1) DC at primary site (172.16.10) - DHCP updates at secondary sites (172.16.20 & 172.16.30) would show up in "reverse lookup zones" in the DNS of the primary site (172.16.10)  ... this allowed primary site to know dynamic IP addresses of secondary sites remote devices

This functionality was lost when we added second (2) DC to the primary site.  Changes by remote secondary sites' DHCP (172.16.20 & 172.16.30) are no longer seen in primary site (172.16.10) DNS "reverse lookup zones"

How do we configure so we have the desired functionality with redundant primary DCs?

Thanks in advance for your help
0
Comment
Question by:wmhooper
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 40

Expert Comment

by:footech
ID: 39157703
Why not use AD-integrated zones at all sites, and point machines at remote sites to use the local DNS server?  Replication can handle getting all the information to all the DNS servers.

How are the reverse zones configured?  Are they AD-integrated?  If so, are they configured to allow only secure dynamic updates, or what?  For secure zones, since it is the DHCP server that registers the PTR records for dynamic clients, I would check the credentials that you are using.
0
 

Author Comment

by:wmhooper
ID: 39175031
The remote sites are warehouses, with RF devices and single servers - insecure sites from an IT perspective.

The company only wants domain controllers in the central location, plus the disaster recovery location (the reason for the two (2) primary DCs)

Further research on this problem seems to point to the need to have one DC as read / write and the second DC be ReadOnly and not have both DCs as read/write

We may try this option in few months if we can not get the current configuration working as required.
0
 

Author Comment

by:wmhooper
ID: 39175062
From footech:

Q1: How are the reverse zones configured?  Are they AD-integrated?  If so, are they configured to allow only secure dynamic updates, or what?  

A1:The two DCs with reverse zones are AD-integrated. They were configured for secure updates but we also tried to allow for un-secure updates as a test.

Q2: For secure zones, since it is the DHCP server that registers the PTR records for dynamic clients, I would check the credentials that you are using.

A2: The dynamic updates from remote DHCP to the reverse zones on the DCs worked when we only had a single DC.

The introduction of a second redundant DC (at disaster backup site) broke this functionality.
0
 
LVL 40

Accepted Solution

by:
footech earned 1600 total points
ID: 39175986
At the most basic, there's no reason (that I can think of) that just adding another DC would impact DNS records registration.  In my experience, problems with records registration almost always stem from security configuration, resulting in records that cannot be updated due to the record's ownership.
The best recommendation I have is that you configure all DHCP servers to use the same domain account to perform DNS dynamic updates (under Advanced tab > Credentials), and to add all DHCP server accounts to the DNSUpdateProxy group in AD.

See this link for further details.
http://msmvps.com/blogs/acefekay/archive/2009/08/20/dhcp-dynamic-dns-updates-scavenging-static-entries-amp-timestamps-and-the-dnsproxyupdate-group.aspx
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
Trying to figure out group policy inheritance and which settings apply where can be a chore.  Here's a very simple summary I've written which might help.  Keep in mind, this is just a high-level conceptual overview where I try to avoid getting bogge…
Michael from AdRem Software explains how to view the most utilized and worst performing nodes in your network, by accessing the Top Charts view in NetCrunch network monitor (https://www.adremsoft.com/). Top Charts is a view in which you can set seve…
In this video, Percona Solutions Engineer Barrett Chambers discusses some of the basic syntax differences between MySQL and MongoDB. To learn more check out our webinar on MongoDB administration for MySQL DBA: https://www.percona.com/resources/we…

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question