ISC Bind in Active Directory
Kevin Darcy
kcd at chrysler.com
Thu Oct 18 20:17:01 UTC 2012
You should think of DNS hosting, DNS resolution and DHCP, as separate
services that can either be put together on a single platform, or run on
separate platforms in various combinations, interoperating with each
other. Another important factor is whether your AD domain is colocated
with a bunch of other non-AD stuff, or whether it's a separate namespace
(either a descendant of your main domain, or some namespace entirely).
In our case, our AD folks insist on AD-integrated zones, but on the
other hand, they're in completely different namespaces. So it's a fairly
simple matter of delegating from and (for reasons of performance and
resiliency) replicating that data into our BIND-based infrastructure. We
handle the DNS resolution and DHCP, and all of the clients can resolve
the AD names from us, even though we're not the primary master for any
of the zones. YMMV. One of the drawbacks of this approach is that Domain
Controllers and certain other types of AD-related servers need to be
added twice -- once into the AD-integrated zone for AD infrastructure
purposes, and then again into a more generic zone, so that the proper
forward/reverse mappings are created and kept in sync. Ideally, AD would
generate outbound Dynamic Updates for the maintenance of reverse records
for their resources, if they don't happen to control the relevant
reverse zone(s), but good luck with that -- it's not in Microsoft's own
best economic interests to foster interoperability with non-Microsoft
DNS server implementations...
- Kevin
On 10/18/2012 2:03 PM, Aaron Thompson wrote:
> Hi All,
>
> I'm hopping to get some feedback from people who use ISC Bind and
> DHCPD in Active Directory environments.
>
> Currently we use Bind/DHCPD for dynamic DNS and DHCP. It's been a
> pretty stable service, redundant and we are polling statistics with
> Cacti. There is concern by Management of using a somewhat non
> standard approach for Active Directory SRV records being handled by
> ISC services and not AD.
>
> The options we are looking at is migrating to AD for DNS and DHCP
> services or to have Bind/DHCPD handle SRV records for AD.
>
> Some technical info on our our BIND environment.
>
> Some Client Identifiers
> 300 DHCP Pools
> Dynamic DNS
> Cacti Graphs - Reporting
> Syslog via Splunk
>
> Overall it's been a very stable design for the last 5+ years.
>
> If you have any relevant feed back I would appreciate it. I'm looking
> for information on experience with Active Directory integration with
> ISC or if anyone has had problems/stability issues with AD doing
> DNS/DHCP or AD working with ISC.
>
> Thanks in advance.
>
> Here's a brief survey <http://www.surveymonkey.com/s/2VYNKWR> for
> Schools that have ISC running in an AD environment.
>
> http://www.surveymonkey.com/s/2VYNKWR
>
> -
> Aaron Thompson
> Network Architect for IT Operations
>
> Berklee College of Music
> 1140 Boylston Street, MS-186-NETT
> Boston, MA 02215-3693
>
> www.berklee.edu
> 617.747.8656
>
> -
> Aaron Thompson
> Network Architect for IT Operations
>
> Berklee College of Music
> 1140 Boylston Street, MS-186-NETT
> Boston, MA 02215-3693
>
> www.berklee.edu
> 617.747.8656
>
>
>
> _______________________________________________
> Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe from this list
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20121018/897b6f84/attachment.html>
More information about the bind-users
mailing list