NIOS 8.6 - GSS-TSIG update SPOF

[#1]

Hi,

My company decided to migrate Windows DHCP servers to Infoblox appliances running NIOS 8.6.

In the frame of this project, we have to configure GSS-TSIG DDNS updates on external domains configured on MS AD servers.

To do so we refered to this documentation : https://docs.infoblox.com/space/nios86/35826736/About+GSS-TSIG#Configuring-DHCP-to-Send-GSS-TSIG-Upd...

Everything is working as expected but, we do not know how to get rid of the SPOF implied in external forward-mapping zone configuration as you can only enter one IP for each zone :

It is said that you have to enter Primary NS server IP but this is not HA compliant.

On our MS infrastructure, each NS server for a zone can assume Primary server function which makes AD DNS infra redundant. So we would like to add all NS server IPs (linked to their own DNS Principal) per external zone.

Has someone already faced this problem ? Is there a solution ?

Thanks for your replies,

Regards,

JF

[#2]

I asked the same question 4 years ago, we ended up deploying with only a single nameserver defined... I have no idea if this got addressed in a later version...

https://community.infoblox.com/t5/nios-dns-dhcp-ipam/why-can-t-i-have-more-than-1-gss-tsig-external-...

[#3]

Thanks for the feedback. This is good to know that we're not the only ones to ask for this stuff.

I dont see how complicted it would be to have the possibility to add several "DNS Principal/DNS IP" pairs for each zones.

[#4]

It sounds like a simple ask to us mere mortals, but to a software engineer it's a complicated subject - do they send the updates in parallel, what about duplicates, how does AD handle this, do they send them one at a time, how long do you wait for a response before sending to the next one, what happens if you get a "refused" type response, if you then have to queue updates how do you manage that queue, how quickly can you process the queue if the endpoint isn't responding quickly enough, do you start throwing updates away if you get a timeout.... yadda yadda yadda.......

[#5]

The underlying DHCPD daemon only supports a single destination unfortunately,  so it its not possible today to have DHCP send DDNS updates to multiple destinations.

Under normal conditions, any AD Domain Controller that receives the update will replicate it to all the other DNS servers hosting that zone in the domain or forest.