Best practices for small LAN

[Paul Ponting]

I have a Win2k server running AD and DNS and two XP Pro Clients.
I have an ADSL router that connects the whole LAN to the internet, the
router's IP address is 192.168.0.1, the Win2k Sever has an IP of
192.168.0.200 (static) and the two XP clients are DHCP.

The router picks up the DNS from the ISP.

I have the clients primary DNS set to 192.168.0.200 and secondary set to the
IP address that the router picks up from the ISP. The Win2k servers DNS
setting are the same.

Does this sound correct? or do I need to supply more info.

What is the best way to test this is all working correctly (see my last post
on SID's in security settings)

Thanks

 

[Herb Martin]

I have a Win2k server running AD and DNS and two XP Pro Clients.
I have an ADSL router that connects the whole LAN to the internet, the
router's IP address is 192.168.0.1, the Win2k Sever has an IP of
192.168.0.200 (static) and the two XP clients are DHCP.

The router picks up the DNS from the ISP.

I have the clients primary DNS set to 192.168.0.200 and secondary set to the
IP address that the router picks up from the ISP. The Win2k servers DNS
setting are the same.

No -- don't do that. You will get intermittent bad results.

Point ALL internal machines at the internal DNS server(s);
have the Internal DNS server either forward to the ISP
DNS address (or perform actual recurions from the root down,
using root hints.)

I even override my "gateway's" DNS Server so that it can resolve
internal names (this is harder if the gateway is ICS based.)

Does this sound correct? or do I need to supply more info.

No and No. Just point ALL MACHINES (including the DC/DNS
server itself to the Internal DNS.)

What is the best way to test this is all working correctly (see my last post
on SID's in security settings)

ping mydc.domain.com
nslookup mydc.domain.com
nslookup www.yahoo.com

But the above might work (accidentally) even with your earlier (incorrect)
setup.

 

[Paul Ponting]

Herb

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Not quite sure what this means ?
"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"
I set the gateway on the clients to point at the router 192.168.0.1

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

I appreciate your help on this one,

 

[Paul Ponting]

Hi

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Internet access from the client PC's seems to still work fine,

Thanks

Herb

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Not quite sure what this means ?
"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"
I set the gateway on the clients to point at the router 192.168.0.1

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

I appreciate your help on this one,

 

[Herb Martin]

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting up to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Paul Ponting]

Herb

Thanks for the help, I have applied all you have said and it seems to work
fine. There is still a lot to learn about DNS for me, just a matter of
time, I am booked onto the MS 2153 and 2154 courses so maybe there will be
something in these that may assist.

Thanks

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting up to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Paul Ponting]

One other thing, after making these changes I bounced my AD (and DNS) box,
when it was down both the clients still resolved internet addresses, is this
right?

Thanks

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting up to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Herb Martin]

DNS is EASY and there isn't that much you must truly know.

Give me call or send an email if you like. Number is on my
website: LearnQuick.Com

Herb

Thanks for the help, I have applied all you have said and it seems to work
fine. There is still a lot to learn about DNS for me, just a matter of
time, I am booked onto the MS 2153 and 2154 courses so maybe there will be
something in these that may assist.

Thanks

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the

primary
DNS

field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting

up

to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the

internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Herb Martin]

One other thing, after making these changes I bounced my AD (and DNS) box,
when it was down both the clients still resolved internet addresses, is this
right?

If that is your only DNS server then know, that's not right UNLESS
you just happened to use the same "test names/addresses" as were
already in the client caches.

You should actually LOSE Internet Name Resolution while your only
DNS server is down.

Thanks

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the

primary
DNS

field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting

up

to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the

internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Paul Ponting]

Herb

Sorry I never got back to you.
I have been away for a few weeks doing the Microsoft 2152 and 2153 courses.
I have the 2154 next week, so I should know all this stuff

I have had to rebuild my machine due to lots of other problems and I am back
at the DNS problems again
I have rebuilt it exactly the same but it will not resolve internet names,
it will however resolve internal names so I guess the DNS server is up and
running, just not configured properly.

I have tried with the ISP's DNS servers in the forwarders but this does not
work, I have tried to set them manually in the clients and they resolve dns
queries so the ISP DNS IP addresses seem fine.

If I run a simple and a recursive query on the monitoring tab in the DNS
server properties, I get a pass on the simple query but a fail on the
recursive query.

Not sure if this is relevant, but if I go to the root hints tab and select
any of the servers in the list and hit edit and then select the resolve
button, I get a DNS error message saying

"An IP address associated with the given NS (name server) record cannot be
found"

Any ideas where to start?

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting up to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Paul Ponting]

I just noticed another thing, in the DNS console under the server name,
there is not entry for "." (root) I seem to remember there was one there
before I rebuilt it (when it was working)
I also not that there is not Cache container which again was also there. I
used to be able to see in this to see the cached web sites visited.

Does the internet need to be "visible" when installing DNS? If it does and
it wasn't, can it be configured or does it need another install

Thanks

Herb

Sorry I never got back to you.
I have been away for a few weeks doing the Microsoft 2152 and 2153 courses.
I have the 2154 next week, so I should know all this stuff

I have had to rebuild my machine due to lots of other problems and I am back
at the DNS problems again
I have rebuilt it exactly the same but it will not resolve internet names,
it will however resolve internal names so I guess the DNS server is up and
running, just not configured properly.

I have tried with the ISP's DNS servers in the forwarders but this does not
work, I have tried to set them manually in the clients and they resolve dns
queries so the ISP DNS IP addresses seem fine.

If I run a simple and a recursive query on the monitoring tab in the DNS
server properties, I get a pass on the simple query but a fail on the
recursive query.

Not sure if this is relevant, but if I go to the root hints tab and select
any of the servers in the list and hit edit and then select the resolve
button, I get a DNS error message saying

"An IP address associated with the given NS (name server) record cannot be
found"

Any ideas where to start?

[From your other message]

Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the

primary
DNS

field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting

up

to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now only
the IP address of the DNS box is sent to the clients and the secondary IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as it was
when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the

internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Herb Martin]

You don't need a "." for one internal domain -- in fact you should
probably delete it IF you have it.

Look you need to first make sure you can REACH those ISP dns servers:

From you DNS server run:

nslookup www.LearnQuick.Com IP.Address.ISP.Server

If that works, then the server CAN use that IP address as a forwarder
(probably).

Then make sure the NIC of the DNS server has NO entry for those external
servers -- it should point to itself.

Then put the entry for that ISP address in the FORWARDERS tab. Then
try the recursive test and report ALL results.

IF it works, put ONLY the internal server on ALL CLIENTS NIC (just like
on the DNS server itself.)

Try it from the client -- report EXACT attempts and EXACT results.

--
Herb Martin

I just noticed another thing, in the DNS console under the server name,
there is not entry for "." (root) I seem to remember there was one there
before I rebuilt it (when it was working)
I also not that there is not Cache container which again was also there. I
used to be able to see in this to see the cached web sites visited.

Does the internet need to be "visible" when installing DNS? If it does and
it wasn't, can it be configured or does it need another install

Thanks

Herb

Sorry I never got back to you.
I have been away for a few weeks doing the Microsoft 2152 and 2153 courses.
I have the 2154 next week, so I should know all this stuff

I have had to rebuild my machine due to lots of other problems and I am back
at the DNS problems again
I have rebuilt it exactly the same but it will not resolve internet names,
it will however resolve internal names so I guess the DNS server is up and
running, just not configured properly.

I have tried with the ISP's DNS servers in the forwarders but this does not
work, I have tried to set them manually in the clients and they resolve dns
queries so the ISP DNS IP addresses seem fine.

If I run a simple and a recursive query on the monitoring tab in the DNS
server properties, I get a pass on the simple query but a fail on the
recursive query.

Not sure if this is relevant, but if I go to the root hints tab and select
any of the servers in the list and hit edit and then select the resolve
button, I get a DNS error message saying

"An IP address associated with the given NS (name server) record cannot be
found"

Any ideas where to start?

[From your other message]
Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary
DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS address (or
perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that
redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's setting

up

to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now
only
the IP address of the DNS box is sent to the clients and the

secondary
IP

address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go out to
the Internet for resolution.

All I need to do now is correctly set up DNS itself (It is just as

it
was

when auto configured by the AD install)
I need to ensure it points correctly to the router and/or the internet.

Two ways (not totally mutually exclusive):
Root Hints point to the Internet root (usual default)
Forwarding tab entries set to an Internet DNS server (e.g., ISP)
(if you leave the "do not use recursion" clear, then the root
hints will be used if the ISP DNS is not available.)

Suggestion (since both work): Use the Forwarder to the ISP -- the
ISP's DNS becomes your forwarder and does the actual recursion
on the Internet from the "root down" -- your internal DNS server does
not even really need much access to the Internet then (safer).

Consider even checking the "Do not use Recursion" box on the Forwarder
tab (DO NOT check the other entry about "disabling recursion" in the
"Advanced" tab -- it disables Forwarding too.)

Internet access from the client PC's seems to still work fine,

This is probably due to the Internal DNS server doing the actual
recursion using it's own Root Hints (instead of forwarding.)

It's probably a bit faster and a little safer to forward to the ISP.

 

[Paul Ponting]

Herb

Thanks for the info, I tried all this and it still failed.
What I did was disabled the 2nd NIC in the server (192.168.1.240) and
everything started to work. After a while I re-enabled the 2nd NIC and it
has so far carried on working.

The router to the internet is 192.168.0.1 and all clients on the 192.168.0.x
(Net A) side did have there default route set to this so they could access
the internet. After setting up Routing on the server, clients on the
192.168.1.x (Net B) side could not get ping results from clients on the Net
Aside so I set the default route
on the Net A side to be the server interface on Net A.

Now the clients can access the internet and respond to pings from the Net B
side, I just can't understand how the Net A clients are getting to the
internet when there default rout is pointing to the server ?

The next thing I want to do is get the clients on the Net B side to access
the internet via the internet router 192.168.0.1. I guess I will need to
set up some form of static route but cannot figure what static route/s to
setup.

And finally (over the next few weeks) I need to configure my ISA server (it
is installed on the same Win2k server) to proxy all internet requests on the
Net B side. It is installed but I have no idea how to tell the clients to
hit the ISA server and then how the ISA server points to the 192.168.0.1
router.


Thanks for your help

You don't need a "." for one internal domain -- in fact you should
probably delete it IF you have it.
cannot

be

Look you need to first make sure you can REACH those ISP dns servers:

From you DNS server run:

nslookup www.LearnQuick.Com IP.Address.ISP.Server

If that works, then the server CAN use that IP address as a forwarder
(probably).

Then make sure the NIC of the DNS server has NO entry for those external
servers -- it should point to itself.

Then put the entry for that ISP address in the FORWARDERS tab. Then
try the recursive test and report ALL results.

IF it works, put ONLY the internal server on ALL CLIENTS NIC (just like
on the DNS server itself.)

Try it from the client -- report EXACT attempts and EXACT results.

--
Herb Martin

I just noticed another thing, in the DNS console under the server name,
there is not entry for "." (root) I seem to remember there was one there
before I rebuilt it (when it was working)
I also not that there is not Cache container which again was also there. I
used to be able to see in this to see the cached web sites visited.

Does the internet need to be "visible" when installing DNS? If it does and
it wasn't, can it be configured or does it need another install

Thanks


am
back does
not resolve
dns

cannot

be

found"

Any ideas where to start?



[From your other message]
Thanks for the reply, ( I eventually got it
So as I only have 1 internal server running DNS, I only use the primary
DNS
field and leave the secondary blank?

Right -- and you have already done that and seen it works.

How do I have the Internal DNS server forward to the ISP DNS

address
(or

perform actual recursions from the root down, using root hints) ?

Paul (McGuire) answered: In the DNS Server Properties\Forwarding
tab there is an entry box for "Forwarders" - you MAY put the ISP
DNS servers here if you wish to let them do your actual Internet
recursion. (There is a "Do Not Use recursion" checkbox there -- if
you check this and the ISP DNS doesn't work, you won't resolve the
Internet but then if they aren't available it probably doesn't matter.)

"I even override my "gateway's" DNS Server so that it can resolve
internal
names (this is harder if the gateway is ICS based.)"

Do you need your Gateway to resolve Internal names? (If not, this
doesn't matter -- I do, since I terminal serve there and move things
around using internal DNS names.) If so (it's a choice) you also set
the Gateway's NIC\IP\DNS Server properties to the INTERNAL
DNS.

Note: you cannot do this (usually) with "ICS" (not NAT, ISA, or
more other gateways), since ICS uses it's "client DNS" to resolve
external names for internal clients -- but then ICS shouldn't be used
with an Internal DNS server anyway.

I set the gateway on the clients to point at the router 192.168.0.1

That makes sense -- Default Gateway is about ROUTING -- DNS setting
is about Name Resolution.

Are you saying have the gateway point at the DNS box and have that
redirect
this to the router?

Not for routing, only for DNS -- All DNS "clients" point to the INTERNAL
DNS server; even the gateway can RESOLVE NAMES for itself this way.

all Default Gateway settings (from a single segment LAN) point
to the Gateway (except the Gateway, which of course picks it's

setting
up

to
point to the ISP.)

[Your Last message]

Just a quick update, I modified the DHCP settings on the router so now
only
the IP address of the DNS box is sent to the clients and the secondary
IP
address is left blank. This seems to have immediately resolved my SID
problems and domain issues.

Right -- now the clients are pointing to the INTERNAL DNS only and if
it cannot resolve the names we need "it" (the Internal DNS) to go

out

to