Example 2 – HA Pair for Internal DNS and DHCP
For the Infoblox-550 Appliance
33
BIND Server at ISP Site (ns2.corp100.com, 2.2.2.2)
1.
Open the named.conf file using a text editor and change the recursion and allow-recursion statements to allow
recursive queries from 1.1.1.8 (the NAT address of ns3).
options {
zone-statistics yes;
directory "/var/named/named_conf";
version "";
recursion yes;
listen-on { 127.0.0.1; 2.2.2.2; };
…
allow-recursion { 1.1.1.8; };
transfer-format many-answers;
};
2.
After editing the named.conf file, restart DNS service for the change to take effect.
Windows 2000/2003 Server at ISP Site (ns2.corp100.com, 2.2.2.2)
1.
Click
Start
->
All Programs
->
Administrative Tools
->
DNS
.
2.
Right-click
ns3
, and then select
Properties
->
Advanced
.
3.
On the
Advanced
page in the
ns3 Properties
dialog box, clear the
Disable recursion
check box.
4.
To save the configuration change and close the
ns3 Properties
dialog box, click
OK
.
Task 2.9
Modify the Firewall and Router Configurations
Configure the firewall and router in your internal network to allow the following DHCP, DNS, and NTP traffic:
•
To allow messages to pass from the DHCP clients in the DMZ—the web, mail, and FTP servers—to ns3 in the
Server network, configure policies and DHCP relay agent settings on the firewall.
•
To forward DHCP messages from DHCP clients in the MGT and Dev networks to ns3 in the Server network,
configure relay agent settings on the router.
•
To translate the private IP address of ns3 (10.1.4.10) to the public IP address (1.1.1.8) when forwarding DNS
queries from ns3 to ns2, set a MIP (mapped IP) address on the firewall.
•
To allow DNS queries from ns3 to ns1 and ns2 and NTP traffic from ns3 to the NTP server, configure firewall
policies.
Firewall
For example, enter the following commands on a Juniper firewall running ScreenOS 4.x or later:
DHCP Relay Configuration
set address trust ns3 10.1.4.10/32
set interface ethernet2 dhcp relay server-name 10.1.4.10
set policy from dmz to trust ns1 ns3 DHCP-Relay permit
DNS Forwarding
set interface ethernet1 mip 1.1.1.8 host 10.1.4.10
set policy from trust to untrust ns3 ns2 dns permit
set policy from trust to dmz ns3 ns1 dns permit
NTP
set policy from dmz to untrust ns1 ntp_server ntp permit
