4

We operate in a two-address model for our production ipv6 network -- we have an internal site-to-site vpn-connected ULA range in fd00::/8, we also have IPv6 external addressing in 2001::/16. We route-advertise both address prefixes to our clients.

My problem is thus. We don't want to necessarily add the external addresses into DNS, which would imply that internal traffic would skirt out the internet instead of routing over our encrypted VPN's. To that end, I'm trying to find a way to configure the machines (hopefully via group policy) in such a way to avoid the 2001::/16 address being published in DNS for the machines.

I tried setting the two route advertisements such that the 2001::/16 address has no preferred lifetime, but does have a valid lifetime. This achieved what I want with DNS (it didn't register that address), but Windows won't use that address now as it considers it deprecated.

So I'm looking for either:

  • A way to configure DNS auto-registration, via GPO, where I can tell the auto-register to not register certain addresses, or
  • A way to cause windows to utilize a deprecated address that still has a valid lifetime, also pushable via GPO.

Any suggestions?

1
  • 1
    I'm not clear why you have two different address prefixes - if you had a single address range it could be used for both site to site VPN traffic as well as external traffic, with suitable routing setup. Maybe there's an IPv6 subtlety I'm not getting here.
    – RichVel
    Aug 26, 2011 at 7:53

1 Answer 1

1

Could you separate the addressing onto different NICs on each computer? AFAIK Windows only allows you to disable DNS registration per NIC - not per IP.

Failing that, you could do periodic cleansing on the DNS server, running a script every few minutes (or as necessary), deleting any records that match the public addressing scheme.

Again failing that, as @RichVel said... why the separate addressing scheme in the first place? Surely if subnetted correctly you could easily have only the public addressing scheme in place and any edge routers forcing internal machines to go via the VPN for connectivity matching the other site? The edge (before the internet) is surely under your control, so make the routing work for you.

4
  • 1
    You and Rich are both quite right; it's rather confusing why we took this approach and we opted to go a different path after this question was posed. All the same, the question still seemed relevant and needing an answer. I think you've come closest to hitting the nail on the head here. Oct 3, 2011 at 19:14
  • Thanks for the update and answer selection. May I ask what approach you went for in the end?
    – Ashley
    Oct 3, 2011 at 19:50
  • 1
    We opted to use external address space, but what we've done is setup high-metric null routes on the routers which prevents intra-site traffic from operating if the dedicated vpn links are down. This way, we avoid the traffic touching the internet in an unencrypted form. Oct 4, 2011 at 18:39
  • Sounds magical. (:
    – Ashley
    Oct 4, 2011 at 18:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .