1

I have a system (SYSTEMX) that is connected to our network through a VPN. Periodically the VPN gets disconnected and SYSTEMX loses its connection to the network. When this occurs I usually easily find out from a log generated during a nightly task that fails as a result of the sytem being offline.

I ping the system "ping SYSTEMX" and get timeouts as expected. Reconnect the VPN and it is good to go.

Two times however the log has had different results as a new system (SYSTEMSTEALTH) will come in and resolve to the same IP address that SYSTEMX was given.

I ping "ping SYSTEMX" and lo and behold responses come in.

When I do an "nslookup SYSTEMX" and "nslookup SYSTEMSTEALTH" both names resolve to the same IP address.

I am not an expert on network topology however it seems to me that upon distributing a new DHCP lease there should be communication to the name server to remove stale entries for that address to prevent this type of scenario.

Does anyone have any suggestions or are able to clarify a way to prevent this from occuring? I am working with my IT deptartment to resolve this issue, their current stance is that it is fine as SYSTEMX is not on the network SYSTEMSTEALTH comes in after and all is good. However being able to "ping SYSTEMX", connect to it, file share to it using admin shares; this does not seem right to me since SYSTEMX is really SYSTEMSTEALTH.

Thank you for your help.

2
  • Do you know what kind of VPN solution your company is using? This is a common problem when people are using a third party VPN system that runs its own DHCP service rather than passing requests through to your normal DHCP/DNS servers.
    – sclarson
    Jul 9, 2009 at 16:15
  • We are using a cisco asa 5500 or something of the sort. I believe that the admin has an address range for it to distribute but there are not many DHCP settings he has. I am working with him to set up some type of pass through to our normal dhcp servers. Jul 9, 2009 at 23:27

6 Answers 6

2

What's happening is the VPN solution is registered a new PTR record every time a new connection is granted. This can also happen in any environment where dynamic DNS updates are permitted, BTW. So when you query based on IP, there are multiple PTR records because, as has been pointed out, the old ones haven't been cleaned up. So when you nslookup based on IP, you're getting one of the PTR records, which may not correspond to the correct computer name.

As has been mentioned, if the DNS server is set to scavenge, eventually the old PTR records will clean up, though this takes time. For instance, it could a few weeks in a default Windows Server 2003 DNS configuration (once scavenging is turned on).

And like what has already been mentioned, we found that by doing DHCP reservations was the way to go in those cases where it truly mattered to us. In cases where it didn't, we would ping the IP, verify it, then do an nbtstat -a IP address to see what Windows system was truly responding on that IP.

1

The DNS entries will get cleaned up but it can take time for these changes to replicate depending on how complicated your topology. In this scenario it would make sense to set up a reservation to ensure that your IP address for SYSTEMX is reserved for that machine only.

1

This is a common problem with remote access solutions. Pass through DHCP is supposed to take care of this problem, but it is often not used due to being less reliable than using the built in DHCP of a VPN product. Many of these built in products do not tell appropriate DNS entries to be removed when a client disconnects.

To help with this some people have added ipconfig /registerdns to the end of their logon scripts that execute upon successful VPN connection, however this still does not remove an old bad entry. I do not know of a third party that solves this problem currently, and as a result I usually have a customer confirm their IP address.

1

The best option may be to provide static IP addresses via dhcp to your SYSTEMX so that it always comes back on the same address. It should stop the other machines from using this IP too.

Do test it however as some VPN setups aren't smart when requested DHCP leases.

1

For sure it is a very common problem. There is a white paper on this subject on Synergix website www.synergix.com. Basically, the idea is to have the client machine do the self-management by removing any of their previoulsy registered entries. This way you don't have to readjust the DNS Scavenging Interval to whatever you may have set it to. The software Active Directory Client Extensions by Synergix will do this job elegantly.

DD

0

I know this is an old post, but did anyone try unchecking "Register this connection's address in DNS" under advanced TCP/IP options of the network adapter created by the VPN client?

1
  • Welcome to server fault! Because of the Q&A format, the order of answers in time is not preserved, and so there aren't threads. However, if you have an answer (which stands alone and isn't a discussion item), feel free to post one no matter how old the question. Dec 24, 2013 at 17:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .