DNS server in a DMZ

Hi,
I am auditing a little company that has 10MB internet bandwidth. It should be enough for 50 users. They have a Fortinet firewall with a DMZ module. The idea behind the DMZ is to have a webserver that host the company's home page. It has a public IP address associated to an internet domain.
I have found that the DNS configured in all users machines (windows 7 pro) is the same machine been used as the webserver. I am thinking that this can be the cause of the bottleneck.

The webserver and DNS machine is a Windows 2008 R2 standard server with i7 processor, 8GB RAM, an integrated Network card Realtek PCIe GBE Family Controller with netBios over TCP enabled.

Can you please comment or suggest how can I confirm this can be the cause of the bottleneck?
LVL 2
José PerezAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

asavenerCommented:
Chances are the DNS settings aren't set optimally, rather than it being network latency introduced by the DMZ.

Get on the DNS server and verify that it is set up to forward requests to the ISP's DNS server, has a timeout value of one second, and that it then uses recursive queries to resolve addresses.

All that being said, it's preferable to have the roles separate.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Radhakrishnan RSenior Technical LeadCommented:
Hi,

I believe it's a domain based network? if so, the machines are using the local internal DNS server (DC) as it should be. The webserver also hosted within your network? and allowed to access from external as well? if so, you can give the ISP's DNS address along with your internal DNS address (it's required for local users access). There won't be any harm using this method.

Hope this helps.
0
José PerezAuthor Commented:
I forgot to mention this server has 2 network cards, one for internal DNS and one for Public IP (WebServer)

So, if I clearly understand, you both are saying that current configuration is not harmfull (to have internal DNS and external webserver in one machine)?

but would you better recommend externalizing the DNS to an internal server and leave the DMZ as a dedicated host?
0
asavenerCommented:
Yes, I would recommend separating the roles.  Having both roles on the same machine does not necessarily degrade performance, though.
0
José PerezAuthor Commented:
Thanks.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DNS

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.