• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

DNS failover

B

boss6021

Limp Gawd
2FA
Joined
Oct 11, 2006
Messages
386
Hey guys,

So, I have an issue at my company's offices. We have 8 sites all connected by MPLS. They have a Server 2012 GC DC at each site. All subnets are individual to location, and are entered into AD sites and services. All replication between servers is working. I can ping, and contact all DCs from any location by IP and hostname.

The issue is when and if one of the DCs goes down at a location, it should fail over to another DC. This doesn't happen. I need to find out why, and what is needed to fix it. Cheaper is better, but if it costs money to do it right, then I have the go ahead to acquire what is needed to make it happen. Thanks in advance for any help.
 
How is your dns setup on clients and servers. How many addresses does each client/server have entered. Why you have DC's going down is probably a valid issue as well.
 
deep-cover said:
How is your dns setup on clients and servers. How many addresses does each client/server have entered. Why you have DC's going down is probably a valid issue as well.
Click to expand...

Each client currently has 2 DNS addresses. Client DNS is assigned via DHCP and is set to their primary being the local DC, with secondary being the next closest location. We have also tried using different secondary DNS servers. The DCs going down is a planned test, and not an actual failure.

What happens when the primary on location DC goes down, the clients are unable to authenticate afterwards. They lose access to AD and any shares. Even after being off overnight, the DNS doesn't fail over to secondary as expected.
 
How is traffic routed between sites? Is there a site-to-site VPN setup? Are there any restrictions on who can travel that route (mapped to ad users?)?

Have you tried setting one of the machines up with only 1 DNS entry, and point that to the DC at the other site? Does it work or fail the same way?
 
Biznatch said:
How is traffic routed between sites? Is there a site-to-site VPN setup? Are there any restrictions on who can travel that route (mapped to ad users?)?

Have you tried setting one of the machines up with only 1 DNS entry, and point that to the DC at the other site? Does it work or fail the same way?
Click to expand...

Site to site is handled via an MPLS connection to each site. No restrictions are in place.

When the client is manually set to 1 DNS it of course works. This negates the purpose of automatic failover though. There is an issue with it failing over to the secondary DNS server listed.
 
a diagram would help.

how many domain controllers at each site?
check your dns A and NS records
how long is expiration and TTL intervals?
 
bloodypulp said:
a diagram would help.

how many domain controllers at each site?
check your dns A and NS records
how long is expiration and TTL intervals?
Click to expand...

All sites have 1 DC with the exception of Helena. The records have been checked. The expiration is set to 1 day, and TTL is 1 hour.

AD_Sites1.jpg
 
Can you ping, say, google.com when the primary DC is down?
 
boss6021 said:
Yes, as far as I know outside resolution was functioning as expected.
Click to expand...

If the only DNS servers configured on the clients are your DCs, and the clients can still resolve external domains when the primary DNS is down, then it's not a DNS issue.

The machine is getting a DNS response from the secondary DNS server.

So, from one of the sites with issues, just for giggles..

from a cmd prompt:

nslookup
server secondary dns
domain.local

Code: 
C:\>nslookup
Default Server:  dc1.domain.local
Address:  10.2.189.3

> server 10.4.189.11
Default Server:  dc2.domain.local
Address:  10.4.189.11

> domain.local
Server:  dc2.domain.local
Address:  10.4.189.11

Name:    domain.local
Addresses:  10.2.189.3
          10.4.189.11
          10.2.189.4
 
j-sta said:
If the only DNS servers configured on the clients are your DCs, and the clients can still resolve external domains when the primary DNS is down, then it's not a DNS issue.

The machine is getting a DNS response from the secondary DNS server.

So, from one of the sites with issues, just for giggles..

from a cmd prompt:

nslookup
server secondary dns
domain.local

Code: 
C:\>nslookup
Default Server:  dc1.domain.local
Address:  10.2.189.3

> server 10.4.189.11
Default Server:  dc2.domain.local
Address:  10.4.189.11

> domain.local
Server:  dc2.domain.local
Address:  10.4.189.11

Name:    domain.local
Addresses:  10.2.189.3
          10.4.189.11
          10.2.189.4
Click to expand...

Here is the results of nslookup.

C:\>nslookup
Default Server: msla-dc.m-m.local
Address: 192.168.30.30

> server 192.168.96.30
Default Server: hln-dc2012.m-m.local
Address: 192.168.96.30

> m-m.local
Server: hln-dc2012.m-m.local
Address: 192.168.96.30

Name: m-m.local
Addresses: 192.168.30.30
192.168.96.30
192.168.1.250
192.168.80.30
192.168.20.30
192.168.70.30
192.168.1.30
192.168.96.28
192.168.10.40
192.168.96.35
192.168.60.30
192.168.11.91

>
 
Are the clients all XP, all Win7, combination? If a combination, does the issue occur on only the XP machines, only Win7 machines, or all?

If only XP machines, may have something to do with the DC Locator Cache and there is a hotfix available for XP and Server 2k3
http://support.microsoft.com/kb/939252/en-us
 
When I saw DNS failover, I thought I'd see a question about DNS. Or failover.

This is just a question about AD, and failure. Properly titling your thread might get you more/better responses.

That said, you could setup OSPF with BFD with your recursives if your routers support it..
 
mwarps said:
When I saw DNS failover, I thought I'd see a question about DNS. Or failover.

This is just a question about AD, and failure. Properly titling your thread might get you more/better responses.

That said, you could setup OSPF with BFD with your recursives if your routers support it..
Click to expand...

I apologize for not including the entire scope of the questioning in the title. Both DNS and failover were part of the questions asked. I wanted to rule out DNS being the issue, as AD relies on it heavily. I also wanted to get feedback from others who might have similar issues.
 
You must log in or register to reply here.
Back
Top