Time Server DNS Issue: Help in Diagnosis Needed

[Andie]

Follow up to a previous thread:

 

http://www.edugeek.net/forums/windows-server-2000-2003/105868-server-time-issue.html

 

I am struggling with the simple issue of setting up our server to get time from an authoritative source. I am also struggling with getting my issue across to our Internet provider (Updata). They say they have unblocked ports to requested ntp servers, but that we must have a local DNS issue that is still causing problems. I have checked various registry settings as per the last thread, and all seems to be set up correctly. However, I am still hitting a brick wall with getting correct time.

 

Please can some wise Edugeek member look at the attached file where I have copied and annotated the various errors I am getting from the server, cmd, etc.? If you can shed light on this in simple English, it may help me get the right response from Updata...! Thank you.

Time Server DNS Issue.pdf

[pete]

I'd agree with Updata - until your server (ms-lnm-server.asjs.internal) can provide a valid dns response, ignore the whole ntp issue.

 

Where does ms-lnm-server.asjs.internal go to for external DNS queries?

Does an nslookup for google.com (for example) work?

How about uk.pool.ntp.org? (you'll get a different IP every few queries (hence "pool")).

[Psymon]

Looks like either DNS has not got forwarders configured (right click server name in DNS, properties, forwarders) or that it hasn't got internet access to access these forwarders.

 

The only other thing is something is preventing this query (firewall on server / hardware firewall on gateway?).

 

Simon

[Andie]

I'd agree with Updata - until your server (ms-lnm-server.asjs.internal) can provide a valid dns response, ignore the whole ntp issue.

 

Where does ms-lnm-server.asjs.internal go to for external DNS queries?

Does an nslookup for google.com (for example) work?

How about uk.pool.ntp.org? (you'll get a different IP every few queries (hence "pool")).

 

Thanks, this is really helpful. I needed to know where the issue was, and wasn't sure that I was explaining things to Updata enough for them to be giving me an accurate response. I don't get a response from google or the pool either.

[Andie]

Looks like either DNS has not got forwarders configured (right click server name in DNS, properties, forwarders) or that it hasn't got internet access to access these forwarders.

 

The only other thing is something is preventing this query (firewall on server / hardware firewall on gateway?).

 

Simon

 

Thanks. I don't have any forwarders or conditional forwarders listed in properties. This is all completely new to me so I'm off to work out my next step...! Great to have some help from you guys so I know where to look.

[Psymon]

In the forwarders use 8.8.8.8 and 8.8.4.4 for now - these are google's DNS servers. That should solve your problem. You should be given DNS servers by your ISP which you can also use - i find google's are pretty reliable and responsive.

 

Forwarders are used when your server does not have the DNS record your client is asking for - so you need external DNS to help it on it's way.

 

Simon

[Andie]

In the forwarders use 8.8.8.8 and 8.8.4.4 for now - these are google's DNS servers. That should solve your problem. You should be given DNS servers by your ISP which you can also use - i find google's are pretty reliable and responsive.

 

Forwarders are used when your server does not have the DNS record your client is asking for - so you need external DNS to help it on it's way.

 

Simon

 

I have just tried adding 8.8.8.8 to Forwarders, and after a few seconds it came back with Unable to Resolve......?

[Psymon]

Sounds like the DNS server has no internet access then - do you have a firewall in place that could be blocking it?

 

Also - considering your machine has internet access (and I assume everyone else on site does) - what are your DNS settings if they are not pointing to an internal erver? Are all of your network's PCs going straight to external DNS?

 

You could find this out by posting the result of the following cmd "ipconfig /all" - I have a strange feeling that this DNS server is not doing very much if it hasn't got any forwarders.

Edited April 17, 2013 by Psymon

[Geoff]

I imagine your RBC has DNS servers and blocks all other DNS traffic at the border, forcing you to use their DNS.

[Andie]

Sounds like the DNS server has no internet access then - do you have a firewall in place that could be blocking it?

 

Also - considering your machine has internet access (and I assume everyone else on site does) - what are your DNS settings if they are not pointing to an internal erver? Are all of your network's PCs going straight to external DNS?

 

You could find this out by posting the result of the following cmd "ipconfig /all" - I have a strange feeling that this DNS server is not doing very much if it hasn't got any forwarders.

 

All of our machines can access the Internet fine for everyday use. ipconfig /all shows the correct IP address of our server in DNS Servers. But I have run tracert -d 8.8.8.8 at command prompt. That shows I can get to the router, then two other IP addresses starting with 10.112 after that and then timeout. Does that mean anything?

[Psymon]

I find it pretty bizarre that your machines can use the internet for everyday use when you have no forwarders populated on the DNS server.

 

If a DNS record does not exist on your server (which in all likeliness bbc.co.uk / google.co.uk / edugeek.net etc... do not, as it's a private DNS server), then it doesn't know where to go to get the correct IP for the website to provide it to your machines.

 

Unless you are using root hints for everything which is a possibility?

Edited April 17, 2013 by Psymon

[Andie]

I find it pretty bizarre that your machines can use the internet for everyday use when you have no forwarders populated on the DNS server.

 

If a DNS record does not exist on your server (which in all likeliness bbc.co.uk / google.co.uk / edugeek.net etc... do not, as it's a private DNS server), then it doesn't know where to go to get the correct IP for the website to provide it to your machines.

 

Unless you are using root hints for everything which is a possibility?

 

There seem to be a lot of entries in root hints, and it is set up to use that if all else fails. But I don't understand why I can't get to the time server.

[Andie]

I imagine your RBC has DNS servers and blocks all other DNS traffic at the border, forcing you to use their DNS.

 

Is RBC our regional broadband consortium? We are part of E2BN, but Updata are our ISP. And I can't get the E2BN time server to resolve either.

[Psymon]

It is definately a DNS issue - as DNS cannot provide your machine with the IP address of time.windows.com.

 

I was suggesting you ping the IP of time.windows.com (65.55.21.23) but microsoft block all pings...

 

Can you resolve bbc.co.uk / google.co.uk etc...?

Edited April 17, 2013 by Psymon

[Andie]

 

Can you resolve bbc.co.uk / google.co.uk etc...?

 

No, as I said earlier in a reply to @pete, nslookup times out for google, bbc, etc.

[2097]

out of interest , does you ISp provider provide a Proxy for web browsing ? ( our local authority did )

 

we had the same thing , our exchange server was rejecting mail to certain places etc .. And running a trace to that server would timeout on certain hops .

 

But ! web browsing was fine as it was going straight through to there proxys .

[Andie]

out of interest , does you ISp provider provide a Proxy for web browsing ? ( our local authority did )

 

we had the same thing , our exchange server was rejecting mail to certain places etc .. And running a trace to that server would timeout on certain hops .

 

But ! web browsing was fine as it was going straight through to there proxys .

 

We have a proxy set up in our LAN Connections in IE settings, if that's what you mean.

[Psymon]

Is ths proxy set up on the DNS server?

[Andie]

Is ths proxy set up on the DNS server?

 

It is set up in IE Properties on the server, if that is what you mean.

[Geoff]

If you are using a proxy that will explain why web pages load. As the proxy does the DNS lookup not the client machine. Anyway, you need to find some working forwarders. If you are blocked from accessing publicly available ones like Googles or OpenDNS then use your ISPs.

[2097]

Is the Proxy you have in IE provided by your ISP or local authority ?

 

Like i said before up there , we had a problem emailing some domains . Turned out it was a routing issue and was nothing to do with our network .

[Andie]

Thanks to everyone who helped out with this. I have learnt a lot from you all and from what I found on the web once I knew where to look. I have now had a decent converation with our ISP and they have provided me with the county DNS IP addresses. Hopefully I'll be able to set these up next week. Thinking back, the clock probably started to slip after we changed from LA as ISP to Updata, and some of the equipment/routing changed.