DNS for Multi-Homed Web Server

[Microsoft]

We currently have 2 high speed ISP's. The external web Server has 2 NICs in
it. One is assigned an IP from ISP1 the other NIC is assigned an IP from
ISP2. I am able to pull up our web site using either IP from an external
computer. We recently started hosting our DNS. I have 2 DNS servers. DNS1
has an ISP1 IP assigned to it, while DNS2 has an ISP2 IP assigned to it.
For redundancy and fault tolerance reasons I thought it might be
advantageous to have the DNS1 record for www point to the NIC1 IP, and the
DNS2 record for www point to the NIC2 IP.

My thought is that if ISP1 goes down. All DNS requests and web traffic
should still be capable of reaching our web server through ISP2 (obviously
having to have some clients flush their cached DNS settings so that they
would request the other IP from the other DNS server). The reverse scenario
should also be true where if ISP2 goes down then everyone could still reach
www through ISP2's associated systems. From what I've read on DNS is
"strongly suggests" that you not point the same record to two different IPs
but it does not in any of my references go into detail as to possible
problems with this layout. Is this a plausible fault-tolerant solution?
What are its inherent faults?

One problem that I've already mulled over is that with essentially 2 live
production www routes I've doubled the chances that half of my customers
might have resolution problems, whereas with typically only 1 ISP you can be
sure that as long as your ISP is up, all of your clients can access the
system. With 2 ISPs in production I run twice the risk of one of my
connections going down and having half of my clients required to flush DNS
before they can re-connect.

I can say that I ran the system in this configuration for several weeks up
to maybe a little over a month. It seemed that eventually a section of our
clients couldn't access the web site. The ISP that they were coming through
was NOT down however, and they could reach the site using the associated IP
rather than trying to resolve the name, so I have to believe something is
wrong with it from a DNS perspective but I'm not quite sure what. In the
mean time, we are once again just running off 1 ISP with the two DNS servers
set to sync records. In effect we are not ever using the ISP2 associated
NIC IP. I would like to have the greatest amount of fault-tolerance that we
can with our existing resources, and would gladly take suggestions. I want
to understand what may have been wrong with the previous setup before I ever
try to reinstate it.

Hopefully I haven't repeated myself too much, and I appreciate any help.

BTW I was told by our ISP that we don't have a large enough block of IP
addresses to do BGP, so I believe that is not an option.

Thanks
Kasey Davis
(e-mail address removed)

 

[Herb Martin]

One problem that I've already mulled over is that with essentially 2 live

production www routes I've doubled the chances that half of my customers

True -- only true fault tolerance here is some kind of Network Load Balance
(or other) cluster.

Even then, the routers would need to be redundant.

 

[Michael Johnston [MSFT]]

This will NOT be an effective load balance. The server can only have one active default gateway at a time. For instance,
suppose the server has two NICs, NICa and NICb. Let's also suppose that NICa has the current active default gateway. If the
server receives a packet on NICb, the respose will go out NICa and will be potentially sourced from the IP address on NICa.
Depending on the protocol in use, this may break the connection. You need a hardware loadbalancer to balance these two ISP
connections in order for this to work. Many Cisco routers have this functionality.

Thank you,
Mike Johnston
Microsoft Network Support
--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the
terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from
which they originated.