+ Post New Thread
Results 1 to 11 of 11
Hardware Thread, DNS Forwarders in Technical; Hi folks, We have an issue with DNS forwarders. There are two DCs in our domain at the top level, ...
  1. #1
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    927
    Thank Post
    840
    Thanked 20 Times in 18 Posts
    Rep Power
    11

    Question DNS Forwarders

    Hi folks,

    We have an issue with DNS forwarders.

    There are two DCs in our domain at the top level, both of which do DNS (and one does DHCP). It's a Hyper-V cluster so DC2 sits outside the cluster and DC1 sits within it. DC2 also has the FSMO role. As it's a Hyper-V cluster the primary DNS server (also a DC) has to be outside the cluster.

    We sit behind an LA provided connection with lots of port blocks, so have to use the LA's forwarders. This isn't an issue per se as they seem to work fine. The problem is that DC2 is extremely slow at responding to DNS requests, whereas DC1 is fine. The only difference I can spot between the two is that when the respective DCs try to validate the forwarders DC1 gives an "OK" immediately whereas DC2 often can't validate them at all.

    DNS has been removed from DC2, and it has been removed as a DC, then promoted back, with DNS reinstalled. This hasn't helped.

    Anyone have any ideas as to what could be causing this?

    TIA

  2. #2

    Join Date
    Feb 2011
    Location
    Australia
    Posts
    109
    Thank Post
    0
    Thanked 10 Times in 10 Posts
    Rep Power
    9
    Have you tried a nslookup against DC2.

    If it times out then it may not have the proper forwarded configured, it may also be under heavy load (limiting it's ability to respond to requests).

  3. Thanks to TheMinister from:

    Gongalong (20th March 2012)

  4. #3

    glennda's Avatar
    Join Date
    Jun 2009
    Location
    Sussex
    Posts
    7,821
    Thank Post
    272
    Thanked 1,140 Times in 1,036 Posts
    Rep Power
    351
    Check the default gateways are correct and do a tracert from both then compare.

  5. Thanks to glennda from:

    Gongalong (20th March 2012)

  6. #4
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    927
    Thank Post
    840
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    TheMinister: Yes, NSLOOKUP has timeout issues. I've used DIG which is a bit informative in that it gives the length of time taken to resolve an issue. On DC1 this is millseconds. On DC2 this can be several seconds.

    Both DC1 and DC2 are configured with the same forwarders.

    glennda: Both are using the same default gateway. Should the TRACERT be done to the forwarders?

  7. #5
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    927
    Thank Post
    840
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    I've checked the forwarders anyway with TRACERT. On DC1 they are found within 6 hops. On DC2 it takes 30 hops, and the request times out on every hop.

    The $64 million dollar question is: why?

  8. #6

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,297
    Thank Post
    242
    Thanked 1,586 Times in 1,263 Posts
    Rep Power
    344
    Have you spoken to your LA about this? Another possibility is that it could be a network/switch related issue.

  9. Thanks to Michael from:

    Gongalong (20th March 2012)

  10. #7
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    927
    Thank Post
    840
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    Yes, and they say the forwarders are used by hundreds of schools and the LA itself, hence if there were a problem with the forwarders it would be well known about.

    The problem must be internal to us, but why is one DC behaving so differently to the other? That's the mystery.

    The consultant involved with this for testing is thinking of creating a third DC which they will push between the two hosts to see if it behaves differently (as these are all VMs).

  11. #8

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,297
    Thank Post
    242
    Thanked 1,586 Times in 1,263 Posts
    Rep Power
    344
    I'm guessing that the two servers are connected to different switches, even if they are joined together via fibre for example?

    If they are linked via fibre, I would check the modules as well as the switch and cabling. From what you describe it doesn't specifically sound like an LA or server issue, but certainly a network or switch related issue.

  12. Thanks to Michael from:

    Gongalong (30th March 2012)

  13. #9

    Join Date
    Jun 2007
    Location
    London
    Posts
    895
    Thank Post
    64
    Thanked 171 Times in 140 Posts
    Rep Power
    56
    On each DC check the network connections' TCP/IP settings. What have you got set up for DNS on each? This might help: Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003

  14. Thanks to timzim from:

    Gongalong (30th March 2012)

  15. #10

    Join Date
    Feb 2011
    Location
    Australia
    Posts
    109
    Thank Post
    0
    Thanked 10 Times in 10 Posts
    Rep Power
    9
    Can you post the tracert of DC1 and DC2 ?

  16. Thanks to TheMinister from:

    Gongalong (30th March 2012)

  17. #11
    Gongalong's Avatar
    Join Date
    Oct 2011
    Location
    United Kingdom
    Posts
    927
    Thank Post
    840
    Thanked 20 Times in 18 Posts
    Rep Power
    11
    Quote Originally Posted by Michael View Post
    I'm guessing that the two servers are connected to different switches, even if they are joined together via fibre for example?

    If they are linked via fibre, I would check the modules as well as the switch and cabling. From what you describe it doesn't specifically sound like an LA or server issue, but certainly a network or switch related issue.
    They are on a different area of the network, but this is part of the backup system which seems to be working fine, at least as far as the LAN is concerned. Unfortunately I didn't install the switches and I don't support them, so it's a tricky area to investigate.
    Quote Originally Posted by timzim View Post
    On each DC check the network connections' TCP/IP settings. What have you got set up for DNS on each? This might help: Best practices for DNS client settings in Windows 2000 Server and in Windows Server 2003
    DNS has essentially been mirrored on the two DCs, so they should be identical.
    Quote Originally Posted by TheMinister View Post
    Can you post the tracert of DC1 and DC2 ?
    I can, but there's not an awful lot to see. Basically the TRACERT for DC2 just doesn't show any connection for any of the hops. DC1 shows a valid TRACERT over the previously mentioned number of hops.



SHARE:
+ Post New Thread

Similar Threads

  1. Root Zones Vs DNS Forwarder
    By RabbieBurns in forum Internet Related/Filtering/Firewall
    Replies: 1
    Last Post: 28th July 2010, 03:17 PM
  2. DNS forwarding failing
    By localzuk in forum Windows Server 2000/2003
    Replies: 1
    Last Post: 16th July 2010, 04:50 PM
  3. DNS forwarding
    By DSapseid in forum Windows
    Replies: 6
    Last Post: 14th September 2009, 11:12 AM
  4. DNS Forwarding
    By Hightower in forum Windows
    Replies: 23
    Last Post: 12th March 2009, 02:47 PM
  5. DNS Forward Lookup Zone query
    By SpuffMonkey in forum Windows
    Replies: 0
    Last Post: 19th February 2007, 05:20 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •