We have 6 different AD sites all connected by IPSec tunnels in a full mesh aside from one office which cannot connect to our data centre for stupid ISP related reasons that are not fixable currently. We have AD integrated DNS and there are two web servers, with public IPs, which replicate the internal address across our AD sites and are accessed via the IPSec tunnels. Since both of these servers are in our DC the site which cannot connect to the DC is unable to access both of these sites.
We need to replicate the rest of our AD DNS to this site, so removing replication is not an option. These sites are also in our primary domain's DNS, and updating them to either use an alternate name, or alternate domain suffix is not a viable option as it will break links for this office.
Is there a way to have this one site use alternate DNS records and not replicate those across AD?
Is my best option to GPO all client/server computers in that site to add the public IP for these two hosts to the local hosts file?
This doesn't need to be a permanent, elegant fix as we will be changing ISPs soon(ish). I just need something that will be stable and reliable for this office for the mid-term future.
To clarify: Toronto and New York can talk to Tokyo, each other and the data centre. Tokyo can talk to Toronto and New York, but not the data centre. We have resources in each site, as well as AD replication, that need to be accessed from all the other sites.
Two of these resources are in our data centre, and have public IPs as well as internal IPs, and use the same hostname internally and externally. That hostname is integrated into our Active Directory DNS. All access from New York and Toronto to these sites is done via the internal IP addresses.
We need Tokyo to access these two hosts via their public IP, not their internal one. We cannot use different hostnames as these sites are heavily integrated into our other applications, communications, etc.