Inside Windows Server 1002003 [Electronic resources] نسخه متنی

Installing and Configuring DNS Servers

If you have existing NT4 or Windows 2000 DNS servers, you can upgrade them to Windows Server 2003 and preserve your existing server configuration and zone files. If you decide to upgrade, start with the primary DNS server, then upgrade the secondary servers.

Here's a quick checklist to use as a roadmap for your DNS deployment:

• Lay out your DNS domain namespace so you know which zones you need. DNS names affect nearly every aspect of your system, so spend sufficient time with this step so that everyone agrees on the naming conventions.




• Decide how you will integrate Windows DNS into your existing DNS infrastructure. If you use WINS, you also need to decide if you will use WINS forwarding.




• Decide how you will resolve Internet addresses. This can be with root hints by using a forwarder, or a combination of both.




• Decide how you will provide name services for public zones. You can get DNS services from your ISP, place a DNS server in your DMZ, or open a conduit in your firewall for DNS query traffic.




• Decide if you need to support name resolution behind the firewall for outside DNS domains. This includes extranets and network connections from subsidiaries, affiliates, or other trusted organizations. You can use conditional forwarding or stub zones to resolve addresses for these connections.




• Define the locations where you will need DNS servers. Remember that you want to maximize availability and minimize WAN traffic.




• Decide whether you will use standard DNS primary and secondary servers or Active Directory Integrated zones. If you use Active Directory Integrated zones, you must place domain controllers in strategic locations to support name resolution as well as LDAP and Kerberos lookups.




• Decide if you will support dynamic resource record updates. If so, consider integrating your zones into Active Directory so you can take advantage of secure updates.




• Decide how you will configure your DNS servers for special features such as round-robin, netmask prioritization, and name checking.

After you've made your design assessments, use the step-by-step instructions in this section for configuring your servers.

Installing the DNS Service

When you're ready to install the DNS service on Windows Server 2003, follow Procedure 5.7. You'll need the Windows Server 2003 CD-ROM.

Procedure 5.7 Installing DNS Drivers

1. From Control Panel, open the Add/Remove Programs applet.

2. Click Add/Remove Windows Components. The Windows Components Wizard starts with the focus set to the Windows Components window.

3. Highlight Networking Services and click Details. The Networking Services window opens.

4. Select Domain Name System (DNS) and click OK to save the change and return to the Windows Components window.

5. Click Next. The Configuring Components window opens and the drivers begin loading. When the drivers have loaded and the configuration is complete, the wizard displays a successful completion window.

6. Click Finish to close the window and return to the Add/Remove Programs window.

7. Close the Add/Remove Programs window.

At this point, you can begin configuring your zones. There is no need to restart.

Creating a Forward Lookup Zone

The first forward lookup zone you create should be for the root of your DNS namespace. In the Company public namespace used in these examples, the first zone would be for the company.com DNS domain. Follow the steps in Procedure 5.8.

Procedure 5.8 Creating a Forward Lookup Zone

1. From the S

   TART menu, select S

   TART | P

   ROGRAMS | A

   DMINISTRATIVE T

   OOLS | DNS. The DNS console opens. The DNS tree shows the local server and two empty branches for forward and reverse lookup zones.

2. Right-click the Forward Lookup Zone icon and select N

   EW Z

   ONE from the flyout menu. This starts the New Zone Wizard.

3. Click Next. The Zone Type window opens (see Figure 5.11). Leave the default selection at Primary Zone. If you want to create a standard primary zone, uncheck the Store The Zone In Active Directory option.

   Figure 5.11. New Zone WizardZone Type window showing default selection of Primary Zone.

   

4. Click Next. The Zone Name window opens. Enter the name of the zone.

5. Click Next. The Zone File window opens. The zone filename should match the zone name with a .DNS extension. If you have an existing zone file, you can import it at this point with the Use This Existing File option.

6. Click Next. The Dynamic Update window opens. Select your update option. The Allow Only Secure Dynamic Updates option will only be available for Active Directory Integrated zones.

7. Click Next. The wizard displays a completion window.

8. Click Finish to complete the configuration and close the window. The new zone appears as a folder under the Forward Lookup Zones icon in the left pane of the window. When that zone icon is highlighted, the associated resource records are displayed in the right pane (see Figure 5.12).

   Figure 5.12. DNS console showing new forward lookup zone.

   

Creating a Reverse Lookup Zone

The forward lookup zone handles standard queries such as A record and SRV record requests. The reverse lookup zone will handle those few queries where the client knows the IP address and wants a host name. You can get by without creating reverse lookup zones, but they come in very handy for troubleshooting (and I highly recommend installing them). To create a reverse lookup zone, follow Procedure 5.9.

Procedure 5.9 Creating a Reverse Lookup Zone

1. Right-click the Reverse Lookup Zone icon and select N

   EW Z

   ONE from the flyout menu. This starts the New Zone Wizard.

2. Click Next. The Zone Type window opens. Leave the default selection at Primary Zone. If you want to create a standard primary zone, uncheck the Store The Zone In Active Directory option.

3. Click Next. The Reverse Lookup Zone window opens (see Figure 5.13). Under Network ID, enter the network portion of the subnet the zone will service. The examples in this book use the 10.x networks with a 16-bit subnet mask, so the entry shows 10.1 with the last two octets empty. Each unique number in the second octet requires a separate reverse lookup zone.

   Figure 5.13. New Zone WizardReverse Lookup Zone window.

   

4. Click Next. The Zone File window opens. Leave the default setting. The zone filename should match the zone name with a .DNS extension. If you have an existing zone file, you can import it at this point with the Use This Existing File option.

5. Click Next. The Dynamic Update window opens. Select your update option. The Allow Only Secure Dynamic Updates option will only be available for Active Directory Integrated zones.

6. Click Next. The wizard displays a completion window.

7. Click Finish to close the window and return to the DNS console.

After the reverse lookup zones are in place, create a few test host records to make sure the associated PTR records are created successfully. Then, test the zone from a client by pinging the test records and the DNS server.

Configuring Hierarchical Zones

After you have installed your first DNS server and created the first zone, you can configure additional zones to build a hierarchical DNS namespace. For example, you could start with a company.com zone and then configure separate zones for each continent, such as na.company.com and eu.company.com and so forth.

If you use separate zones, you need to configure the name servers to resolve queries between the zones. Plan your configuration around these two situations:

• Queries from DNS clients in a child zone for records in its parent zone. This requires configuring the root hints file.




• Queries from DNS clients in a parent zone for records in a child zone. This requires configuring delegation.

Configuring Root Hints

Queries from DNS clients in a child zone for records in its parent zone are resolved by configuring root hints on the DNS server in the child zone to include an authoritative server or servers in the parent zone.

Start by installing DNS on two servers and creating the zones. The objective of the following steps is to make it possible for a user in the child domain to resolve an address in the parent domain by querying only the DNS server in the child domain. Follow Procedure 5.10.

Procedure 5.10 Configuring Root Hints

1. Open the DNS console.

2. Right-click the DNS server icon and select P

   ROPERTIES from the flyout menu. The Properties window opens.

3. Select the Root Hints tab.

4. Click Add. The Create New Record window opens.

5. Enter the fully qualified DNS name of the root server, with or without the trailing dot, under Server Name.

6. Enter the IP address of the server under Server IP Addresses and then click Add to put it on the list. If the server has multiple IP addresses, you can add each of them to the list. If you prefer that the queries use one of the addresses preferentially, use the Up and Down buttons to adjust the search list.

7. Click OK to retain the changes and return to the Properties window. Make sure that the root server is at the top of the list.

8. Click OK to save the changes and close the window.

9. Test the configuration by pinging a host in the parent domain from a client in the child domain. The ping may take a while, but eventually it will succeed.

Configuring Delegation

The preceding section showed how to get a successful query for a host in a domain higher in the DNS namespace. Getting a successful query for a host lower in the namespace takes a bit more work. Assume, for example, that you are in the company.com DNS domain and you want to ping a server called srv1 in the branch1.company.com DNS domain.

For ping to succeed, the DNS server in the company.com domain must find an A record for the server. But the company.com DNS server only has a copy of the company.com zone file. It must obtain the resource record from a name server in the branch1.company.com domain. This is called

delegation .