Reply
Highlighted
Accepted Solution

DDNS in a dual-stack network

Authority
Posts: 18
3630     0

Has anyone had success in getting DDNS updates to the same zone for DHCP and DHCPv6 working side by side?

I have an existing environment where DHCP clients have DDNS updates created in a subzone automatically by Infoblox. This works fine.

I then added an IPv6 network for the clients with DHCPv6 and mirrored the DDNS setup. I assumed what would happen is upon the client acquring v4 and v6 addresses,  the subzone (eg: clients.domain) would then contain both an A record and AAAA record for the client hostname. However I am finding that DDNS updates for the DHCPv6 address fail when using the same subzone. It works fine if I specify a different one (eg:clients6.domain). 

Any idea why this can't work using the same subzone for both protocols? 

 

Thanks.

Re: DDNS in a dual-stack network

Authority
Posts: 18
3631     0

I have managed to solve this, thanks to the solution given on a different topic!

https://community.infoblox.com/t5/DNS-DHCP-IPAM/Competing-DDNS-updates-on-multihomed-PC-using-two-di...

 

I went to Grid DHCP Settings / IPv6 DDNS and set "TXT (DHCID) Record Handling” parameter to the value “Check Only”.

Re: DDNS in a dual-stack network

rahuld
Techie
Posts: 1
3631     0

Hi,

 

I had a similar issue on NIOS 8.2, where DHCP clients were using LAN and Wifi connections as per their wish.

In that case, although the DDNS update was happening for the LAN IP, it was failing for the Wi-Fi IP Address.

I found that the setting the TXT record Handling option to "Check only" does not help.

Pg 978 in NIOS Admin Guide for 8.2 says that:

"Check Only" options checks the existence of TXT records if they existed previously. If no record is present,then the update happens without checking.

"ISC" option will always check the TXT records if they already exist which means the DDNS updates will fail if there is a previous TXT record.

In order disable DDNS verification, we need to select either "ISC Transitional" or "No TXT Records" as they disable the checks even if the TXT records exist.

I was able to fix the issue after setting the TXT record handling to "No TXT Records" as that disabled the TXT records checking completely. So the LAN IP registration on DNS was able to overwrite the A and PTR records of the WiFi IP registration and vice versa.

 

Setting the TXT Record Handling to "No TXT Records" does not create any security threat as the DDNS updates will still be sent by DHCP server only and not by the clients.

Re: DDNS in a dual-stack network

Adviser
Posts: 92
3631     0

Hello Rahul,

 

Appreciate your time in sharing your thoughts to the Infoblox community. While, ‘No TXT Records’ is an optional fix to your problem, to substantiate your statement, “Setting the TXT Record Handling to "No TXT Records" does not create any security threat as the DDNS updates will still be sent by DHCP server only and not by the clients.”, You may also need to ensure that the DNS server *does not accept* an unauthorized attempt to update DNS record by a client/anybody. I hope you may have already controlled this with ACLs.

 

Coming to the original problem discussed in this thread, *DDNS in a dual-stack network*, I would recommend reading through the ‘DDNS Update Method’(Different from DDNS Update Verification Mode) feature available in NIOS 8.0.0 & later. This was a feature request, implemented in NIOS with this specific use case in mind(Based on ISC-Bugs #21139). If you are reading through NIOS administrator guide for version 8.2, you could find this specific information from page #968. I’ll just give an outline of how that works :

 

You’ll get couple of options to choose for ‘DDNS update method’ : Standard or Interim. The default is Interim. When you select Interim, TXT record will be created for DDNS updates and when you select Standard, DHCID record will be created for

DDNS updates. But in the IPv4 DDNS -> Advanced tab or the IPv6 DDNS -> Advanced tab, if you have selected No TXT Record mode for the DHCP server to use when handling DNS updates, then TXT record or DHCID record is not created for DDNS updates. If you change the DDNS update method from Interim to Standard or vice versa, then the DHCP server changes the DHCID type used from TXT record to DHCID record or vice versa as the leases are renewed. This is supported for clients that acquire both IPv4 and IPv6 leases. Infoblox recommends you to configure different DDNS update method for IPV4 leases and IPv6 leases, Interim for IPv4 lease and Standard for IPv6 lease. Thus dual stack updates would continue to work peacefully with TXT records, as long as the update method chosen are different for IPv4 v/s v6 DDNS.

 

Just in case if someone who cannot change TXT handling mode, reads through this article with the original use case in mind.

 

Best regards,

Mohammed Alman.

Showing results for 
Search instead for 
Do you mean 

Recommended for You