| Author | Messages | |
jw1
Posts:0
 | | 04/21/2008 11:35 AM |
| Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
| | | |
| bdesmond
Posts:414
 | | 04/21/2008 11:45 AM |
| Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
> Will there be any unexpected consequences if I add an extra IP to a domain > controller or two? We're replacing most of our domain controllers, but a > handful of them are referenced by IP by some dumb applications...and we > don't really want to keep the primary IP the same. > > I'm guessing there would be extra DNS records for each IP address - will > there be any problems as a result? > > > > Thanks, > > > --James > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: http://www.activedir.org/ma/default.aspx >
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
| | | |
| jw1
Posts:0
 | | 04/21/2008 11:50 AM |
| Certainly plan to. Just needed a stopgap since hardware is end-of-life...
--James
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Monday, April 21, 2008 10:43 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
| | | |
| bdesmond
Posts:414
 | | 04/21/2008 12:16 PM |
| Yeah should be fine unless you've got some app connecting on LDAPS and validating the name on the certificate if you have new names and the same IP...
--brian
On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
> Certainly plan to. Just needed a stopgap since hardware is end-of-life… > > > > --James > > > > *From:* ActiveDir-owner@mail.activedir.org [mailto: > ActiveDir-owner@mail.activedir.org] *On Behalf Of *Brian Desmond > *Sent:* Monday, April 21, 2008 10:43 AM > *To:* ActiveDir@mail.activedir.org > *Subject:* Re: [ActiveDir] Adding extra IP to domain controller > > > > Should be fine. I'd still work on sunsetting the hardcoded apps though and > at least changing them to use a generic DNS record. > > > > --brian > > On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> > wrote: > > Will there be any unexpected consequences if I add an extra IP to a domain > controller or two? We're replacing most of our domain controllers, but a > handful of them are referenced by IP by some dumb applications...and we > don't really want to keep the primary IP the same. > > I'm guessing there would be extra DNS records for each IP address - will > there be any problems as a result? > > > > Thanks, > > > --James > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: http://www.activedir.org/ma/default.aspx > > > > > -- > Thanks, > Brian Desmond > brian@briandesmond.com > > c - 312.731.3132 >
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
| | | |
| kamleshap
Posts:27
 | | 04/22/2008 7:37 AM |
| Just to add
Also that IP should be reachable from anywhere in network where domain services are required. Since DC will automatically create A record for it, non reachability will affect replication, ldap queries, machine domain process etc.
-- Kamlesh ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Argue for your limitations, and sure enough, they're yours. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On 4/21/08, Brian Desmond <brian@briandesmond.com> wrote: > > Yeah should be fine unless you've got some app connecting on LDAPS and > validating the name on the certificate if you have new names and the same > IP... > > --brian > > > On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> > wrote: > > > Certainly plan to. Just needed a stopgap since hardware is > > end-of-life… > > > > > > > > --James > > > > > > > > *From:* ActiveDir-owner@mail.activedir.org [mailto: > > ActiveDir-owner@mail.activedir.org] *On Behalf Of *Brian Desmond > > *Sent:* Monday, April 21, 2008 10:43 AM > > *To:* ActiveDir@mail.activedir.org > > *Subject:* Re: [ActiveDir] Adding extra IP to domain controller > > > > > > > > Should be fine. I'd still work on sunsetting the hardcoded apps though > > and at least changing them to use a generic DNS record. > > > > > > > > --brian > > > > On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> > > wrote: > > > > Will there be any unexpected consequences if I add an extra IP to a > > domain controller or two? We're replacing most of our domain controllers, > > but a handful of them are referenced by IP by some dumb applications...and > > we don't really want to keep the primary IP the same. > > > > I'm guessing there would be extra DNS records for each IP address - will > > there be any problems as a result? > > > > > > > > Thanks, > > > > > > --James > > List info : http://www.activedir.org/List.aspx > > List FAQ : http://www.activedir.org/ListFAQ.aspx > > List archive: http://www.activedir.org/ma/default.aspx > > > > > > > > > > -- > > Thanks, > > Brian Desmond > > brian@briandesmond.com > > > > c - 312.731.3132 > > > > > > -- > Thanks, > Brian Desmond > brian@briandesmond.com > > c - 312.731.3132 >
| | | |
| johnserban
Posts:12
 | | 04/22/2008 12:07 PM |
| So far, the responses have had two major assumptions:
1) The checkbox to "Register this connection's address in DNS" will be selected on both network adapters
2) Both network segments are reachable by all clients who may connect to the DC.
Kamlesh makes a valid point that "A" records will be registered for each IP adapter, but more importantly for a DC, so will SRV records. Also, with Dynamic registration, it is possible to register two IP addresses but they will both register under the same DNS name, the computer name. This makes it difficult to predict which IP address will be returned when the DNS name is resolved by clients. Clients could resolve the DC name to an unroutable IP address.
This list has a pretty wide audience and someone will probably respond with a method to make the above scenario work successfully. However, multi-homed domain controllers that advertise on multiple interfaces can be tricky to implement, especially if all of the advertised subnets are not universally reachable by all clients which attempt to connect to the DC.
If your legacy application is not fully AD aware as you suggest by stating the app accesses the DC by IP address, I would suggest not dynamically registering that segment's address (uncheck "Register this connection's address in DNS"). This method, if possible, will be much less problematic to implement. The only caveat is if the DC is also a DNS server. If the DC is a DNS server and the DNS service is bound to the legacy segment network card, it will treat the network card as if you had enabled dynamic registration. If you unbind the DNS server from this card, it will prevent this from happening.
John
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Kamlesh Parmar Sent: Tuesday, April 22, 2008 7:34 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Just to add
Also that IP should be reachable from anywhere in network where domain services are required.
Since DC will automatically create A record for it, non reachability will affect replication, ldap queries, machine domain process etc.
--
Kamlesh
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Argue for your limitations, and sure enough, they're yours. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On 4/21/08, Brian Desmond <brian@briandesmond.com> wrote:
Yeah should be fine unless you've got some app connecting on LDAPS and validating the name on the certificate if you have new names and the same IP...
--brian
On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Certainly plan to. Just needed a stopgap since hardware is end-of-life...
--James
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Monday, April 21, 2008 10:43 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
| | | |
| jw1
Posts:0
 | | 04/22/2008 12:17 PM |
| Sorry - should have noted; these are NOT multihomed. Single network interface.
-----Original Message----- From: "Serban, John" <john.serban@wamu.net> To: "ActiveDir@mail.activedir.org" <ActiveDir@mail.activedir.org> Sent: 4/22/08 11:07 AM Subject: RE: [ActiveDir] Adding extra IP to domain controller
So far, the responses have had two major assumptions:
1) The checkbox to "Register this connection's address in DNS" will be selected on both network adapters
2) Both network segments are reachable by all clients who may connect to the DC.
Kamlesh makes a valid point that "A" records will be registered for each IP adapter, but more importantly for a DC, so will SRV records. Also, with Dynamic registration, it is possible to register two IP addresses but they will both register under the same DNS name, the computer name. This makes it difficult to predict which IP address will be returned when the DNS name is resolved by clients. Clients could resolve the DC name to an unroutable IP address.
This list has a pretty wide audience and someone will probably respond with a method to make the above scenario work successfully. However, multi-homed domain controllers that advertise on multiple interfaces can be tricky to implement, especially if all of the advertised subnets are not universally reachable by all clients which attempt to connect to the DC.
If your legacy application is not fully AD aware as you suggest by stating the app accesses the DC by IP address, I would suggest not dynamically registering that segment's address (uncheck "Register this connection's address in DNS"). This method, if possible, will be much less problematic to implement. The only caveat is if the DC is also a DNS server. If the DC is a DNS server and the DNS service is bound to the legacy segment network card, it will treat the network card as if you had enabled dynamic registration. If you unbind the DNS server from this card, it will prevent this from happening.
John
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Kamlesh Parmar Sent: Tuesday, April 22, 2008 7:34 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Just to add
Also that IP should be reachable from anywhere in network where domain services are required.
Since DC will automatically create A record for it, non reachability will affect replication, ldap queries, machine domain process etc.
--
Kamlesh
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Argue for your limitations, and sure enough, they're yours. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On 4/21/08, Brian Desmond <brian@briandesmond.com> wrote:
Yeah should be fine unless you've got some app connecting on LDAPS and validating the name on the certificate if you have new names and the same IP...
--brian
On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Certainly plan to. Just needed a stopgap since hardware is end-of-life...
--James
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Monday, April 21, 2008 10:43 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
| | | |
| akimmons
Posts:9
 | | 04/22/2008 12:22 PM |
| So are you saying that you just want to assign two different IP addresses to the same NIC?
>>> "Wells, James Arthur" <jw1@bcm.tmc.edu> 04/22/08 10:12 AM >>> Sorry - should have noted; these are NOT multihomed. Single network interface.
-----Original Message----- From: "Serban, John" <john.serban@wamu.net> To: "ActiveDir@mail.activedir.org" <ActiveDir@mail.activedir.org> Sent: 4/22/08 11:07 AM Subject: RE: [ActiveDir] Adding extra IP to domain controller
So far, the responses have had two major assumptions:
1) The checkbox to "Register this connection's address in DNS" will be selected on both network adapters
2) Both network segments are reachable by all clients who may connect to the DC.
Kamlesh makes a valid point that "A" records will be registered for each IP adapter, but more importantly for a DC, so will SRV records. Also, with Dynamic registration, it is possible to register two IP addresses but they will both register under the same DNS name, the computer name. This makes it difficult to predict which IP address will be returned when the DNS name is resolved by clients. Clients could resolve the DC name to an unroutable IP address.
This list has a pretty wide audience and someone will probably respond with a method to make the above scenario work successfully. However, multi-homed domain controllers that advertise on multiple interfaces can be tricky to implement, especially if all of the advertised subnets are not universally reachable by all clients which attempt to connect to the DC.
If your legacy application is not fully AD aware as you suggest by stating the app accesses the DC by IP address, I would suggest not dynamically registering that segment's address (uncheck "Register this connection's address in DNS"). This method, if possible, will be much less problematic to implement. The only caveat is if the DC is also a DNS server. If the DC is a DNS server and the DNS service is bound to the legacy segment network card, it will treat the network card as if you had enabled dynamic registration. If you unbind the DNS server from this card, it will prevent this from happening.
John
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Kamlesh Parmar Sent: Tuesday, April 22, 2008 7:34 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Just to add
Also that IP should be reachable from anywhere in network where domain services are required.
Since DC will automatically create A record for it, non reachability will affect replication, ldap queries, machine domain process etc.
--
Kamlesh
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Argue for your limitations, and sure enough, they're yours. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On 4/21/08, Brian Desmond <brian@briandesmond.com> wrote:
Yeah should be fine unless you've got some app connecting on LDAPS and validating the name on the certificate if you have new names and the same IP...
--brian
On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Certainly plan to. Just needed a stopgap since hardware is end-of-life...
--James
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Monday, April 21, 2008 10:43 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
| | | |
| jw1
Posts:0
 | | 04/22/2008 1:18 PM |
| Yes
-----Original Message----- From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Anthony Kimmons Sent: Tuesday, April 22, 2008 11:18 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Adding extra IP to domain controller
So are you saying that you just want to assign two different IP addresses to the same NIC?
>>> "Wells, James Arthur" <jw1@bcm.tmc.edu> 04/22/08 10:12 AM >>> Sorry - should have noted; these are NOT multihomed. Single network interface.
-----Original Message----- From: "Serban, John" <john.serban@wamu.net> To: "ActiveDir@mail.activedir.org" <ActiveDir@mail.activedir.org> Sent: 4/22/08 11:07 AM Subject: RE: [ActiveDir] Adding extra IP to domain controller
So far, the responses have had two major assumptions:
1) The checkbox to "Register this connection's address in DNS" will be selected on both network adapters
2) Both network segments are reachable by all clients who may connect to the DC.
Kamlesh makes a valid point that "A" records will be registered for each IP adapter, but more importantly for a DC, so will SRV records. Also, with Dynamic registration, it is possible to register two IP addresses but they will both register under the same DNS name, the computer name. This makes it difficult to predict which IP address will be returned when the DNS name is resolved by clients. Clients could resolve the DC name to an unroutable IP address.
This list has a pretty wide audience and someone will probably respond with a method to make the above scenario work successfully. However, multi-homed domain controllers that advertise on multiple interfaces can be tricky to implement, especially if all of the advertised subnets are not universally reachable by all clients which attempt to connect to the DC.
If your legacy application is not fully AD aware as you suggest by stating the app accesses the DC by IP address, I would suggest not dynamically registering that segment's address (uncheck "Register this connection's address in DNS"). This method, if possible, will be much less problematic to implement. The only caveat is if the DC is also a DNS server. If the DC is a DNS server and the DNS service is bound to the legacy segment network card, it will treat the network card as if you had enabled dynamic registration. If you unbind the DNS server from this card, it will prevent this from happening.
John
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Kamlesh Parmar Sent: Tuesday, April 22, 2008 7:34 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Just to add
Also that IP should be reachable from anywhere in network where domain services are required.
Since DC will automatically create A record for it, non reachability will affect replication, ldap queries, machine domain process etc.
--
Kamlesh
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Argue for your limitations, and sure enough, they're yours. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On 4/21/08, Brian Desmond <brian@briandesmond.com> wrote:
Yeah should be fine unless you've got some app connecting on LDAPS and validating the name on the certificate if you have new names and the same IP...
--brian
On Mon, Apr 21, 2008 at 11:45 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Certainly plan to. Just needed a stopgap since hardware is end-of-life...
--James
From: ActiveDir-owner@mail.activedir.org [mailto:ActiveDir-owner@mail.activedir.org] On Behalf Of Brian Desmond Sent: Monday, April 21, 2008 10:43 AM To: ActiveDir@mail.activedir.org Subject: Re: [ActiveDir] Adding extra IP to domain controller
Should be fine. I'd still work on sunsetting the hardcoded apps though and at least changing them to use a generic DNS record.
--brian
On Mon, Apr 21, 2008 at 11:30 AM, Wells, James Arthur <jw1@bcm.tmc.edu> wrote:
Will there be any unexpected consequences if I add an extra IP to a domain controller or two? We're replacing most of our domain controllers, but a handful of them are referenced by IP by some dumb applications...and we don't really want to keep the primary IP the same.
I'm guessing there would be extra DNS records for each IP address - will there be any problems as a result?
Thanks,
--James List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
-- Thanks, Brian Desmond brian@briandesmond.com
c - 312.731.3132
List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.activedir.org/ma/default.aspx
| | | |
|
|