Microsoft cluster updating its own DNS records

[#1]

We have some new Microsoft Failover Clusters, which need to be able to update their own DNS records, eg when the service moves to another cluster node. According to Microsoft we need to give the ‘Cluster Name Object (CNO)’ (a computer object in AD) access in DNS to update the cluster DNS records. Microsoft assume you’re using Microsoft DNS, where this isn’t a big issue however we're using Infoblox for DNS...

To attempt this, I created a group in AD which contains the CNO, plus the computer objects for the nodes themselves. Then in Infoblox I added the new AD group in Administrators – Groups, then on Permissions gave the group RW access to the HOST records for the cluster. I don’t know if there’s any more I need to do here in Infoblox though…

We get errors in the Windows event logs saying ‘the system failed to register host (a or AAAA) resource records (RRs) for network adapter…’ etc. Is there any more we need to do in Infoblox to allow the AD group members to update those records?

(The cluster DNS records are HOST records and are not protected).

[#2]

If your Infoblox is authoritative for the relevant DNS zone, I guess you need to allow dynamic updates from these servers to the relevant zone(s). A simple way to achieve this, is by using a named ACL based on source IP and configuring this in the 'update' tab on the zone properties.

You could also use GSS-TSIG to allow signed dynamic updates from the domain controllers, this is more secure and allows for more granular control, but it also more difficult to setup. I would highly recommend testing that out in a lab environment first.

[#3]

Thanks, that seems to have worked, also had to give access to the reverse zone, but the errors on the Windows servers have stopped. Just waiting for the project to try a cluster swap to confirm...