NIOS 8.6 - GSS-TSIG update SPOF

[#1]

Hi,

My company decided to migrate Windows DHCP servers to Infoblox appliances running NIOS 8.6.

In the frame of this project, we have to configure GSS-TSIG DDNS updates on external domains configured on MS AD servers.

To do so we refered to this documentation : https://docs.infoblox.com/space/nios86/35826736/About+GSS-TSIG#Configuring-DHCP-to-Send-GSS-TSIG-Upd...

Everything is working as expected but, we do not know how to get rid of the SPOF implied in external forward-mapping zone configuration as you can only enter one IP for each zone :

It is said that you have to enter Primary NS server IP but this is not HA compliant.

On our MS infrastructure, each NS server for a zone can assume Primary server function which makes AD DNS infra redundant. So we would like to add all NS server IPs (linked to their own DNS Principal) per external zone.

Has someone already faced this problem ? Is there a solution ?

Thanks for your replies,

Regards,

JF

[#2]

I asked the same question 4 years ago, we ended up deploying with only a single nameserver defined... I have no idea if this got addressed in a later version...

https://community.infoblox.com/t5/nios-dns-dhcp-ipam/why-can-t-i-have-more-than-1-gss-tsig-external-...

[#3]

Thanks for the feedback. This is good to know that we're not the only ones to ask for this stuff.

I dont see how complicted it would be to have the possibility to add several "DNS Principal/DNS IP" pairs for each zones.

[#4]

It sounds like a simple ask to us mere mortals, but to a software engineer it's a complicated subject - do they send the updates in parallel, what about duplicates, how does AD handle this, do they send them one at a time, how long do you wait for a response before sending to the next one, what happens if you get a "refused" type response, if you then have to queue updates how do you manage that queue, how quickly can you process the queue if the endpoint isn't responding quickly enough, do you start throwing updates away if you get a timeout.... yadda yadda yadda.......

[#5]

The underlying DHCPD daemon only supports a single destination unfortunately,  so it its not possible today to have DHCP send DDNS updates to multiple destinations.

Under normal conditions, any AD Domain Controller that receives the update will replicate it to all the other DNS servers hosting that zone in the domain or forest.

[#6]

Unfortunately, this is still the case. We were told by Professional Services to use single and abandon our multimaster setup. We are looking into using Anycast as a way to have DHCP/clients send registration to Anycast address and closest "primary" server responds and accepts registration. Replication to take care of getting registration on other primary. We don't plan to implement for couple months as we have other migrations to complete but hope that Anycast method works.

[#7]

So we're talking about sending updates to MS DNS here - so I guess you're talking about having the primary DNS "service" (ie multiple primaries) sat behind an anycast IP? Does MS support anycast or are you going to hand-craft something to get it working? Maybe you can run something like FRR on Windows, I have no idea.

[#8]

Haha I really should google stuff first:

https://learn.microsoft.com/en-us/windows-server/networking/dns/deploy/anycast

[#9]

Our Infoblox technical consultant advised us to file a Request for Enhancement (RFE) which we did. It would be nice if more Infoblox customers would file the same RFE so it gets more leverage.  It is now a matter of waiting.

Although far from ideal we have decided to tolerate the SPOF for now. A procedure has been written if this SPOF fails. We have also started a study into alternative configurations. For example, a combination of a stub domain on Infoblox and zone delegation on MS DNS.

[#10]

Hello Garcia,

My company filled a RFE aswell on this matter. We are waiting for answer from Infoblox.

Regards,

Julien Foll