fixed rrset ordering - is this still a thing?

[Greg Choules]

Please don't encourage using "search" in resolv.conf or the Windows
equivalent. Search domains make queries take longer, impose unnecessary
load on resolvers and make diagnosis of issues harder because, when users
say "it doesn't work" you have no idea what it was that didn't work.

I tried using separate subdomains for different interfaces on devices once
and ran into exactly that problem. There's also the overhead of maintaining
more zones than you really need.

My suggestion would be to replace the dot with a hyphen. That is, instead
of:
firewall1.example.com = Internet IP address
firewall1.dmz.example.com = IP address on DMZ network
firewall1.management.example.com = IP address on out-of-band management
network

do:

firewall1-internet.example.com = Internet IP address
firewall1-dmz.example.com = IP address on DMZ network
firewall1-management.example.com = IP address on out-of-band management
network

You could even CNAME firewall1 to firewall1-management as this is
(presumably) the interface that users and monitoring/management tools will
want to reach by default.

The hostname of the box is "firewall1" but each interface on it has a
unique name, derived from the hostname plus a "-<something>" suffix. Select
a set of well known and used suffixes for your environment.
If someone really wants to try and SSH to the Internet interface (though I
don't understand why you would), they know the hostname and they know the
suffix, so it's a simple matter of combining them.


On Fri, 1 Mar 2024 at 21:11, Nick Tait via bind-users <
bind-users at lists.isc.org> wrote:

> On 02/03/2024 03:42, Mike Mitchell via bind-users wrote:
>
> Our networking team is in the habit of entering the IP address of every
> network interface on a router under one name.  The very first address
> entry is their out-of-band management interface.  "rrset-order fixed" is
>  used on their domain for address records, so they can ssh to the router
>  by name reliably and not have to worry about interfaces that are down
> or that filter SSH.
>
> I wonder if an alternative (cleaner?) solution to your use case could be
> to use different sub-domains for the different networks (network
> interfaces)? For example:
>
> firewall1.example.com = Internet IP address
> firewall1.*dmz*.example.com = IP address on DMZ network
> firewall1.*management*.example.com = IP address on out-of-band management
> network
>
> If you did this you could make use of DNS search domains to allow
> different parts of the network to resolve the unqualified name "firewall1"
> differently. E.g. If you "ssh firewall1" from a management host it could
> expand that to firewall1.*management*.example.com?
>
> Nick.
> --
> Visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
> from this list
>
> ISC funds the development of this software with paid support
> subscriptions. Contact us at https://www.isc.org/contact/ for more
> information.
>
>
> bind-users mailing list
> bind-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/bind-users
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/bind-users/attachments/20240301/3185770f/attachment-0001.htm>