Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

In our environment, most Windows Servers are dual-homed.

The first NIC, called 'Public' is the one:

  • used by the servers to communicate with Active Directory
  • with a default gateway set
  • via which the applications should be exposed
  • via which the RDP connections should be established

The second NIC, called 'Management' is mainly used to take backups and for monitoring purposes.

Both NICs are in separate (and symmetric) private VLANs. For example: - Domain controllers: 10.2.0.0/24 - Public: 10.2.1.2/24 with default gateway set to: 10.2.1.1 (pfSense firewall interface) - Management: 10.2.2.2/24, no default gateway set (10.2.2.1 being the pfSense firewall interface)

Currently, we do the following: - the first NIC registers itself in DNS (FQDN, for example someserver.ourdomain.local) - the second NIC does not register itself in DNS and we manually create forward & reverse records in a separate zone, for example: someserver.mgt.ourdomain.local

What we would like to achieve is to enable DNS registration for the second NIC so that we don't have to manually create the records in DNS.

We have added 'mgt.ourdomain.local' in the list of allowed DNS suffixes (msDS-AllowedDNSSuffixes) as described here

This allows us to define the 'DNS Suffix for this connection' value in the IPv4 settings of the second NIC (management). That, combined with 'Use this connection's DNS suffix in DNS registration' almost does what we want.

It successfully registers 'someserver.mgt.ourdomain.local', but the problem is that it also registers 'someserver.ourdomain.local'.

And thus, we have two DNS entries for someserver.ourdomain.local and we would like to avoid that.

Is there a registry setting that could stop the machine's DNS suffix to be registered and to only register in DNS using the suffix specified at the adapter level?

share|improve this question
    
It sounds like the NICs are still connected to the same LAN. If that's correct, have you considered teaming the NICs and eliminating all this unnecessary complexity? –  John Gardeniers Jun 7 '11 at 5:45
    
The NICs are connected to two different firewalls. The idea is to only let the 'management' interface communicate with the DNS Servers (which happen to be AD-integrated) and also to be accessible for the backup solution. The security guys want to put network segregation in place. Both NICs are on different (and symmetric) private VLANs –  dSebastien Jun 7 '11 at 5:51
1  
I don't know that there's a way to do this. The options you've selected register the connection name in addition to the full computer name. I'm not sure the link that HampusLi posted will do the trick as it looks like it disables dynamic registration completely per NIC, which isn't what you're looking for if I'm understanding your question correctly. –  joeqwerty Jun 7 '11 at 11:36

2 Answers 2

You can disable Dynamic DNS per nic in the registery.

Set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\[Interface name]\DisableDynamicUpdate to 1

Read http://support.microsoft.com/kb/246804 for details.

share|improve this answer
    
I've tried this setting, but from my understanding it completely disables DNS registration for the adapter? –  dSebastien Jun 7 '11 at 13:17
1  
@dSebastien: Yeah, it sounds like you need "selective" name registration, which I'm not sure is possible. –  joeqwerty Jun 7 '11 at 23:23
    
I've got informed via a guy at Microsoft that it is by design. Another customer requested a product modification but Microsoft decided not to implement it for various reasons. It's too bad, I would've been happy with a patch and a registry setting to configure ;-). It may be a sign that the design we're trying to implement is wrong... –  dSebastien Jun 7 '11 at 23:29

Could you not just create a zone in DNS for hostname of the NIC and specify the IP there. That way it wont be recycled at all.

Al

share|improve this answer
    
I'm not sure I understood you correctly, but it's what we do now, we create the records manually and these are indeed not scavenged, but we would like to avoid the manual operation. –  dSebastien Jun 7 '11 at 7:54
    
OK I understand now, I presume the 2nd NIC is on a different IP range to the 1st seeing as it has it's own PIX? –  Alex Wilden Jun 7 '11 at 8:11
    
Yes sorry I forgot to detail that, I'll edit my question. Both NICs are in different IP ranges –  dSebastien Jun 7 '11 at 8:15
    
I'll have a look around but I think you would need to assign the machine a static IP on the 2nd NIC, or have another DNS server that only handles requests on the 2nd NIC internally which then forwards all requests over to the DNS server for the 1st NIC (and vice versa) –  Alex Wilden Jun 7 '11 at 8:18
    
Both NICs have static IPs, we're not fond of using DHCP for servers. Another DNS server is not really an option. –  dSebastien Jun 7 '11 at 8:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.