0

My servers have two NICs, one for LAN and the other for management. Those are separate VLANs.

I have disabled registration of management NIC in DNS. There are no records in DNS with management network IPs. I even cleared Client for Microsoft Networks and File and Printer Sharing check-boxes in management adapter properties.

Yet, in firewall logs, I still see clients trying connect to server management IP, ports 389, 445 etc. Strangest behavior is the server itself, LAN IP trying to connect to self management IP port 389.

Yes, the firewall blocks all of these requests, but I want to configure this properly and eliminate such requests which is nothing but noise in firewall logs.

Environment is mixed of Windows Server 2012, 2016 both core and regular. Windows 10 and 8.1 clients.

UPDATE

Management network is for remote administrative access such as SSH, RDP, monitoring tools etc. I do not want any domain related activities coming/going via management network, those must stay in LAN. Ideally management VLAN will be a physical separate LAN on other hardware.

Configuration for NICs look like this:

Ethernet adapter mgmt:

Connection-specific DNS Suffix  . :
Link-local IPv6 Address . . . . . : fe80::c1a6:4b40:beb0:a627%22
IPv4 Address. . . . . . . . . . . : 192.168.1.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :


Ethernet adapter domain:

Connection-specific DNS Suffix  . :
Link-local IPv6 Address . . . . . : fe80::48a3:e974:bc0d:837%16
IPv4 Address. . . . . . . . . . . : 192.168.10.5
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.10.1
  • For the management NICs are they assigned an IP address in the same subnet as the LAN? Are you using VLANs? – user5870571 Jul 18 at 12:28
  • Yes, separate VLANs. Sorry, I forgot to clarify this. – liepumartins Jul 18 at 12:41
  • Would you please add the interface and switch VLAN configs? You should not be seeing requests from the LAN VLAN to the management VLAN. – user5870571 Jul 18 at 12:43
  • I don't understand what value the management NIC has and why you configured the server with a management NIC. Why do you need a separate NIC to manage the server? Dual/multi-homed Domain Controllers are not recommended. – joeqwerty Jul 18 at 12:44
  • Check your vlan configuration. the x.x.10,x network should be isolated from the x.x.1.x network. they should not be able to talk to each other, no ping, nothing... – Larryc Jul 18 at 14:10
0

You need to use the PublishAddresses registry value on the domain controller and specify the desired IP address for registration.

https://alasdaircs.wordpress.com/2012/07/17/a-little-active-directory-dns-server-magic/

Key: HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters  
Value: PublishAddresses  
Type: REG_SZ  
  • It appears to have mostly helped. However attempts to management IP port 445 is still ongoing. PublishAddresses does not work for SMB? – liepumartins Jul 29 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.