Primary/Secondary DNS Issue

[DavidM]

Hello --

I'm trying to set up a standalone (non-Active Directory) DNS server on my
companies Intranet using W2K for our customers to use to access our internal
production servers... mainly web severs, SQL Servers, etc.

Essentially, I have a primary DNS server using IP of 10.246.16.43.
I have a secondary setup using IP of 10l2.46.16.50

Primary appears to work fine and I can resolve names by removing all DNS
entries for my normal PC setup and entering only my primary DNS server for
my domain.

When I do a test query on the primary DNS, it works fine.

If I go to my secondary DNS, which shows all the correct zones, etc., and do
a test query, it fails. Am I even allowed to do this? I realize I can't
update the secondary, as its a read-only backup (unless I promote), but why
are my DNS failing? Also, if I do promote it to primary and try to do a
test again, it still fails! I'm not sure where else to check.

I've verifed that the "version #" for the zone is in-sync and the same
between primary and secondary. In fact, I've incremented the number by 10
just to ensure they are the same.

I've added both the 16.43 and 16.50 servers as DNS servers and have them
setup on the zone to only allow transfers between servers on the Name Server
tab.

Just for completeness, I added to host entries called ns1.mydomain.net and
ns2.mydomain.net pointing to the primary and secondary servers. These are
the names that I use on the Name Server tab when I browse.


Assuming I could query, I was thinking I could enter both primary/secondary
within my TCP/IP setup on my PC. I should then be able to do an NSLOOKUP
(which will use the primary) and perform an ls -d mydomain.net to show
entries. This does work today. However, if I remove the primary or "pause"
it and do the following for the secondary:

NSLOOKUP

server 10.246.16.50
ls -d mydomain.net

It comes back and says query failed.

As it stands now, it looks like only my primary is working and resolving
queries.

If anyone has any ideas why this isn't working, I'd appreciate any help.

 

[Ace Fekay [MVP]]

In

NSLOOKUP

It comes back and says query failed.

As it stands now, it looks like only my primary is working and
resolving queries.

If anyone has any ideas why this isn't working, I'd appreciate any
help.

The "ls" command requires zone transfer ability. Is zone transfers allowed
on the secondary zone?


--
Regards,
Ace

G O E A G L E S !!! Superbowl bound NFC Champs!!

Please direct all replies ONLY to the Microsoft public newsgroups
so all can benefit.

This posting is provided "AS-IS" with no warranties or guarantees
and confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft Windows MVP - Windows Server - Directory Services

Security Is Like An Onion, It Has Layers
HAM AND EGGS: A day's work for a chicken;
A lifetime commitment for a pig.

 

[DavidM]

Hi --

zone transfer is allowed only between the two DNS servers using the name of
ns1.mydomain.net and ns2.mydomain.net. I'm actually running the NSLOOKUP
from ns1 to see if I can do an LS from either.

Such as:

NSLOOKUP

server 10.246.16.50 (my secondary DNS server)
ls -d mydomain.net

Which fails and said query refused.


Last question... Am I allowed to do a query test from the DNS Manager from
the secondary? When I try this, it fails It works fine from the primary.




"Ace Fekay [MVP]"

 

[Andrew Hodgson]

Hi --

zone transfer is allowed only between the two DNS servers using the name of
ns1.mydomain.net and ns2.mydomain.net. I'm actually running the NSLOOKUP
from ns1 to see if I can do an LS from either.

I take it you put IP addresses for NS1 and NS2 in the relevant boxes.

Such as:

NSLOOKUP

So what happens if you use NSLookup with an A record on the secondary?
Does it resolve?

Andrew.

 

[Ace Fekay [MVP]]

In

Hi --

zone transfer is allowed only between the two DNS servers using the
name of ns1.mydomain.net and ns2.mydomain.net. I'm actually running
the NSLOOKUP from ns1 to see if I can do an LS from either.

Such as:

NSLOOKUP

Which fails and said query refused.

QUERY REFUSED.
Exactly my point. Zone transfers may be allowed from ns1 to ns2, but not the
other way. You'll need to specifically go into the secondary zone properties
and allow zone transfers from ns2 to ns1 for that zone.

Last question... Am I allowed to do a query test from the DNS Manager
from the secondary? When I try this, it fails It works fine from
the primary.

This I haven't tried, but don't see why it doesn't work. Do you have a
forwarder individually set on each to your ISP's DNS?

Ace