DHCP best practice

[kenrick]

Hello,

 

We are having problems with our internet dropping out randomly and pages having to be refreshed. We have created two new DNS Servers but the problem still exists. Occasionally we lose internet all together and we have to physically restart the servers to get internet back, restarting DNS services doesn't work.

 

Senior management suggested it might be DHCP but cannot see why. He also mentioned that DNS and DHCP shouldn't be on the same server. What is the current best practice for DNS and DHCP?

 

Many thanks

 

Paul

[Kiest26]

Doesn't sound like a DHCP issue to me. Also all setups I've seen have DHCP and DNS on the same servers and never had an issue

[kenrick]

Exactly my thought too, thanks very much. Can't find anything that says it is bad practice.

[Kiest26]

Have you tried updating nic drivers?

[kenrick]

No I haven't tried updating the Nic drivers. But even when we ran two virtual servers with the DNS running they continued to cause problems. They are running on vSphere 6.0 and the tools are up to date. Do I need to change the nics within esxi? We have brand new physical hosts as well which the VMs run from.

[Kiest26]

I've never used Esxi so don't really have any experience there. During the periods of no internet access are the servers accessible?

[kenrick]

Yes, if the page doesn't display the servers are available and pages refresh. If it completely dies we have to restart the DNS servers, restarting the service doesn't fix the problem but you can still access the server.

[Kiest26]

When it completely dies does internal DNS resolution still work ok?

[kenrick]

Yes, internal DNS is available as we Remote to the DC to enable us to restart it.

[Kiest26]

Are you sure it's available? As the records could be cached allowing you to access the DNS server. If it is working I'd check your root hints (I noticed recently quite a few of mine were invalid) and try different external DNS forwarders if possible

[kenrick]

i guess it is possible they are cached. Do you suggest we just try and remote or ping to other machines?

[Kiest26]

Yeah I'd ping a machine which is unlikely to be cached. How do you filter web traffic? As some solutions mess with DNS and override the forwarders you have on your dns servers

[kenrick]

I will try and ping a machine internally the next time it happens. Our web filter is currently not working, we were using lightspeed. We have a basic filter through our Cyberoam firewall.

[Michael]

Senior management suggested it might be DHCP but cannot see why. He also mentioned that DNS and DHCP shouldn't be on the same server. What is the current best practice for DNS and DHCP?

 

It actually makes sense to have both on the one server - the DHCP lease is given out, then the DNS record(s) updated and then replicated to other DNS servers.

 

I suspect it's most likely to do with your external DNS provider, rather than internal, otherwise you'd have problems mapping network drives for example.

 

Worse case scenario, I'd always suggest resetting all DNS server services, rather than the whole server which takes seconds.

[Mr_Jiminy]

As Michael has said, probably external DNS provider.

 

If you have forwarders in place, this could be a good thing to check first.

 

If this was an internal DNS issue, I suspect you would be experiencing more than merely internet problems... In which case nslookup is probably a good place to start.

 

It doesn't read like a DHCP problem... Do clients lose network connection at the time of the issues?

Edited March 18, 2017 by Mr_Jiminy

[mullet_man]

You mention you have new hosts, was the internet ok before the new hosts?

 

Who is the internet provider? It sounds like an issue at their end. How long has this been happening?

[rob_coles]

I'd be tempted to put a forwarder to Google DNS see if that helps.

[LytchettNM]

So just to reply to the initial question.

If you are working within a windows domain you should have both DHCP & DNS services on the Domain controller or if you have 2 Domain controllers and running 2012 r2 you can configure DHCP across both server in a load sharing setup.

DNS well there are lots of opinion's about the best way to setup, just root hint's will work but will slow you resolution time as you will keep sending requests out to the internet to find the host you need for the website you require. Forwards make more sense as if the local DNS server has not got the record you only send 1 request outside your network to get resolution, but where do you point your forwards? personal I send to our ISP's servers as they should be setup for the regional area that they serve if you point to a service like google you may return a non-regional response i.e. A server in the US and not UK or Europe assuming your in the U.K.

If you are having issues getting to the internet the first thing you should do from the box that having the issues run NSLookup to the site and for that matter others to confirm it's not the site your trying to access having a problem plus also ping a couple of sites like BBC and google plus maybe something in your ISP's network to make sure you are still connected to them.

Edited March 18, 2017 by Techforyou

[kenrick]

Thanks Michael for your input. If we restart the services it doesn't resolve the problem, which is why we have to restart the servers. Sometimes only one server needs restarting, other times both servers need to be restarted. Our forwarders point to Google, our service provider can only support DNS if you have under a million dns requests.

[kenrick]

We already do this Rob. Although we now have it to our own external DNS Server and then on to Google to see if that helped, it didn't. This is how it was setup originally.

[kenrick]

Thank you for confirming the correct setup. Our service provider Ja net cannot help with our DNS as we have too many requests, which is why we forward to Google. I have tried pinging yahoo.co.uk and its ip address simultaneously and when a page cannot be displayed neither ping drops out. I originally used NSLookup to investigate latency with Office 365 and there are times when it drops out passed our network, but never within it. I assumed that they have just configured their routers to drop nslookup requests.

[Kiest26]

Interesting how sometimes both have to be restarted as a single DNS server should be sufficient. Are both fully operational even when everything is working fine? Maybe one is constantly having issues and the other is failing occasionally so your then failing over to the other giving the impression of an intermittent issue

[kenrick]

No, problem existed before the new hardware too. We had one physical server and one virtual. We tried moving to two new virtual servers on the brand new hosts. Been happening a while, Ja net said all seems fine. Might ask them to investigate again.

[Kiest26]

Do the new servers have remote management such as HP ILO enabled? Maybe there's an IP conflict

[kenrick]

Yes they have ILO enabled but problem existed on old HP Servers too. The new servers have different IPs as we did a live migration to the new kit.