DNS

  • Thread starter Thread starter drsmith
  • Start date Start date
D

drsmith

I am in a unique situation. My network set behind a
firewall/router that is running NAT to translate routable
addresses to my 172.16 network. A gonernment agency
manages the firewall and the traffic outside of my
network. I have a second remote network connected to the
same government managed network, but has routable
addresses assigned by that agency. No NAT. I need to setup
a Windows 2000 domain controller at the remote location
and make it part of my domain. If I make the DNS server at
the remote location an active directory, secondary DNS,
the 172.16 addresses of my servers here will be replicated
to the remote location. I need the DNS records at the
remote location to point to the outside routable address.
Each of my servers at the primary location is a one to one
translation.

Can this be done? If so, How? What will be the effect on
the DNS at the primary location?
 
INteresting scenario. Seems that the firewalls folks would need to open up
quite a few ports for AD replication/communication to occur, like 30 of
them. Don't think they'll go for that. Besides, DNS is required for DNS,
specifically it's own DNS server that allows Dynamic updates and supports
SRV records. Best bet is to use your own DNS and forward to the agency's DNS
for outside resolution (even outside of your network, not necessarily just
the Internet).

Here are some restricitons to be aware of:

NAT will not support domain traffic since Kerberos, LDAP and RPC cannot pass
thru.
Over 30 ports are needed to open up domain communication thru a firewall.
Best bet is to create a VPN thru the wall, which if using PPTP, only uses
two: TCP 1723 GRE and PProtocol ID 47. IF using L2TP (stronger), that needs
TCP 1701, UDP 500, Protocol ID 50 and Protocol ID 51.

Here's an FYI on DNS and AD that may better help you understand the
requirements for AD and DNS:
http://support.microsoft.com/?id=291382

You'll have to discuss this with the firewall guys to see how flexible they
can be. But it won;t work thru NAT unless VPN'd thru it with port remapping
(which most admins shy away from due to security and the added
administration).

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory
 
Back
Top