Public DNS in ESXi

[KapsZ28]

I started working at this new company and noticed many of their ESXi boxes have public DNS servers listed.

This is my server.

Where I have internal DNS servers, they are using public. I also noticed they use a public DNS as a secondary DNS on many of their Windows servers. They are not really Microsoft guys, so I am thinking they are just not too familiar with setting up a domain. I know there have been issues with VMware's SSO which is probably due to the DNS.

Any reason you can think of why they would be using public DNS server, or probably just a mistake?

 

[Thuleman]

Any reason you can think of why they would be using public DNS server, or probably just a mistake?

Why a mistake?
If you have a lot of internal systems that require a private DNS then sure, private it all up. It all depends on the implementation/design.

Half of my ESXi machines can access public networks and I do have 8.8.8.8 as my secondary DNS on those. Primary is our internal DNS.

 

[Benzino]

Half of my ESXi machines can access public networks and I do have 8.8.8.8 as my secondary DNS on those. Primary is our internal DNS.

My ESXi is set up similarly. Internal DNS for primary, public for secondary.

 

[KapsZ28]

What is the purpose of having the secondary DNS as public? Are you doing this in case the primary DNS goes offline, you can continue to have internet access?

 

[Benzino]

What is the purpose of having the secondary DNS as public? Are you doing this in case the primary DNS goes offline, you can continue to have internet access?

Correct. Secondary DNS, to my understanding, only kicks in when primary is inaccessible.

 

[KapsZ28]

I've seen issues with that in a Windows Domain. If a PC reaches out to the secondary DNS, it will not authenticate. Any place I have worked they always had multiple internal DNS servers and used those instead of a public DNS address.

I still don't understand why you would want an ESXi server to go directly to a public DNS. If you are using vCenter and SSO, everything needs to authenticate with the Windows Domain, hence using internal DNS servers.

 

[zer0sum]

Really depends on the environment as to whether it is better to have public or private dns servers configured.
What type are the majority of requests?
Is there a caching name server that is internal?

Try testing with namebench to see what is optimal

 

[Thuleman]

I still don't understand why you would want an ESXi server to go directly to a public DNS.

You know, I'd like to thank you for creating this thread in the first place. As you can tell from my first reply my initial reaction was "well, it depends, there's nothing wrong with public DNS".

In my case the ESXi machines which use public DNS as secondary are not part of a domain and they are in publicly routed address space, so public DNS does make sense for me because even if our primary DNS fails the ESXi hosts can still reach each other, vCenter, vCenter them, etc.

BUT

What this thread did is that it made me actually think about ESXi and DNS in general. Why do you need DNS on ESXi at all?

Well, I didn't put too much time into this yet, but there's at least one guy on the Internet who says that you don't need DNS, especially not if you are using 5.x, see: http://www.techshifter.com/2011/08/13/esxi-optimal-dns-setup-none/

I'd be curious what our resident VCDX has to say about this.

 

[KapsZ28]

The only reason I can think of to use DNS on ESXi would be for AD authentication. But typically you log into vCenter, not the host. Plus if you have lockdown mode enabled, then it really wouldn't matter.

 

[KapsZ28]

This is too coincidental. I am talking to a co-worker about an ESXi box that we have in another location. This host is no longer connected to vCenter and nobody remembers the root password. Only two VMs running on the host, but they are important. The server is setup for AD authentication, but whoever set it up only used public DNS addresses. So, it is not hitting AD and I can't authenticate and log in with my AD credentials.

 

[Benzino]

This is too coincidental. I am talking to a co-worker about an ESXi box that we have in another location. This host is no longer connected to vCenter and nobody remembers the root password. Only two VMs running on the host, but they are important. The server is setup for AD authentication, but whoever set it up only used public DNS addresses. So, it is not hitting AD and I can't authenticate and log in with my AD credentials.

Yeah, that was a piece I missed too. If its authenticating to AD then it does need an internal DNS server to connect to AD. That sucks.

 

[zbi192]

DNS on ESXi has nothing to do with VMs. It is used purely by ESXi server itself for various tasks.
The few I can think of are:
- Mounting NFS shares
- Sending syslogs to syslog server
- Sending SNMP traps

It is when your DNS servers are virtualized you hit the trouble.
Let me explain by example of my home lab...
I have 3 esxi severs. My local DNS servers are virtualized and are running on esxi servers themselves.
My VMFS datastores are mounted via NFS, so when I turn my servers on for the first time esxi servers have no way to resolve the name to mount NFS shares (because my virtualized DNS servers are not running yet).
This is where public DNS comes in. I have a public DNS domain and my esxi servers ask 8.8.8.8 for the address of my NAS during boot time.
8.8.8.8 replies to esxi with the internal address of my NAS server and esxi can happily mount NFS datastores and start my local virtualized DNS servers (which are slaves for my domain).
My Master DNS servers are hosted on a VPS which also hosts a couple of websites.
So here is one example of using public DNS for esxi.

P.S. BTW a DNS domain has nothing to do with AD or Microsoft.

 

[Benzino]

I have a Bind server virtualized for my home environment and I point everything to that for primary DNS, but with Google DNS as secondary so my machines can talk to the Internet if my VMware box is offline. I only run my VMware server when I'm actively working on it, so there are times I need DNS when I'm working on other stuff.

P.S. Using .local is great, especially if whatever you tried to use internally for a domain name exists on the Internet too. >< Learned that the hard and stupid way.

 

[Grentz]

At some of my smaller clients we run the secondary DNS as public so if they have server issues they can still browse the internet, get to their email (hosted), etc.

I dont really see the need for ESXi though...

 

[geiger]

Prior to 5.0 HA relied pretty heavily on DNS. If these are standalone hosts this may not have been an issue though.

 

[lopoetve]

Prior to 5.0 HA relied pretty heavily on DNS. If these are standalone hosts this may not have been an issue though.

And hostd - if dns won't resolve, hostd would/will (haven't checked on it in a while) take 45+min to come up.

 

[Deleted member 16178]

This is an epic failure. The ESXi servers should not be going outside for any reason.

 

[zpackrat]

Poor design most likely due to lack of knowledge. I see it often, Windows workstations/servers in an Active Directory environment should not point to a pubic DNS server, neither should your ESXi() hosts. you should have 2 servers minimum with DNS for redundancy and they don't both need to be Domain Controllers. Best practice is to have internal DNS resolve the host names of the ESX(i) hosts. there is no good argument for having public DNS, you can use forwarders then fall back to root hints if you want to use your ISP's DNS servers but they should not be in the IP configuration,period.

 

[KapsZ28]

I think another issue is a lack of security on our public DNS servers. I used a standard QualysGuard scan on one of our pubic DNS servers and on another notable DNS server. The "other" DNS came up with the following.

Summary of Vulnerabilities

Total: 2
Security Risk (Avg):

2.0

Not too bad.



And here is our DNS server.

Summary of Vulnerabilities

Total: 29
Security Risk (Avg):

4.0

Mind you the security risk avg is out of 5.

 

[Thuleman]

It's probably because you have recursion (and possibly forwarding) enabled.
See: http://openresolverproject.org/

Windows workstations/servers in an Active Directory environment should not point to a pubic DNS server

I couldn't even begin to tell you how many payroll hours would be lost each year if we didn't use public DNS as secondary DNS on our workstations. I'd say our primary DNS probably has less than 5 hours of unscheduled outages per year, but 5 hours of downtime is ~15,000 payroll hours. Just as a sweeping generalization that's probably about $750,000 in payroll (including benefits). That seems like a pretty damn good reason to me to use Google's DNS as secondary on AD machines.

 

[KapsZ28]

I couldn't even begin to tell you how many payroll hours would be lost each year if we didn't use public DNS as secondary DNS on our workstations. I'd say our primary DNS probably has less than 5 hours of unscheduled outages per year, but 5 hours of downtime is ~15,000 payroll hours. Just as a sweeping generalization that's probably about $750,000 in payroll (including benefits). That seems like a pretty damn good reason to me to use Google's DNS as secondary on AD machines.

But that is just a poorly setup network. I rarely see a Windows DNS server go down other than scheduled maintenance. And having multiple DNS servers isn't exactly expensive or difficult to maintain. I have multiple ESXi boxes at home each hosting a DNS server. If I shut one down, I don't lose Internet.

The only time I have really seen a public DNS used on a PC would be as the tertiary nameserver. This would usually be a satellite office that is somewhat small. They only have one onsite DNS server and use another sites or HQs DNS as secondary through a site to site connection. If the primary DNS stops working, then it goes to the secondary, but still internal DNS server. If for some reason they lose their site to site connectivity and their primary DNS, then it would use the third DNS server. I believe this scenario is if Internet is of utmost importance and you are worried about DDoS attacks that may take down your Internal DNS.

 

[KapsZ28]

It's probably because you have recursion (and possibly forwarding) enabled.
See: http://openresolverproject.org/.

Recursive is on there, but so are a whole lot of other vulnerabilities.

3 DNS Zone Transfer

2 UDP Constant IP Identification Field Fingerprinting Vulnerability

2 TCP Sequence Number Approximation Based Denial of Service

2 DNS Server Processes Unauthoritative Recursive Queries

And the ones below.

 

[zpackrat]

But that is just a poorly setup network. I rarely see a Windows DNS server go down other than scheduled maintenance. And having multiple DNS servers isn't exactly expensive or difficult to maintain. I have multiple ESXi boxes at home each hosting a DNS server. If I shut one down, I don't lose Internet.

The only time I have really seen a public DNS used on a PC would be as the tertiary nameserver. This would usually be a satellite office that is somewhat small. They only have one onsite DNS server and use another sites or HQs DNS as secondary through a site to site connection. If the primary DNS stops working, then it goes to the secondary, but still internal DNS server. If for some reason they lose their site to site connectivity and their primary DNS, then it would use the third DNS server. I believe this scenario is if Internet is of utmost importance and you are worried about DDoS attacks that may take down your Internal DNS.

This a thousand times over.