Forum Discussion
NimbostratusAuthoritative Screening
i have GTMs set up for authoritative screening for internal DNS queries. clients have the pri and sec dns settings pointing to GTM listeners.
Problem encountered is when a client joins the AD domain. It can not. If I change client dns to ad\dns servers, client can join domain without issue.
the zone exists on the GTM. trying to determine if a srv record needs to be created.
am i missing a step here?
22 Replies
steve_88008i see a response from the GTM back to the client with the SRV records.
Cory_50405Noctilucent
But the client isn't receiving the response? This could be due to some device in between performing DNS packet inspection and dropping the response if the packet size exceeds a certain value, or not allowing certain query types. Any firewalls in the data path between your GTM and the client?
- steve_88008
i thought that at first as well. I fired up wireshark and reviewed. wireshark showed the response being returned to the client as well.
the odd thing is if I back up one level SRV records are returned. its only with there is sub domain.
returns SRV records nslookup ->set type=all ->_ldap._tcp.dc._msdcs.abc123.local
returns no srv records, nslookup ->set type=all ->_ldap._tcp.dc._msdcs.test.abc123.local
- Cory_50405But these test.abc123.local queries directly against AD are working? When looking at a tcpdump on the GTM, do you notice any difference between responses returned to the client for _ldap._tcp.dc._msdcs.abc123.local vs. _ldap._tcp.dc._msdcs.test.abc123.local?
- steve_88008
yes against AD they work. no difference in captures between domains via the GTM...
- Cory_50405
If you run a Wireshark capture on the client, do you notice any difference in the queries there?
- steve_88008
nope.
- Cory_50405
So the communications appear to be working as intended (client to GTM, GTM to AD) as far I can tell. The unspecified error is being presented by which application?
- steve_88008
this was discovered when joining a host to the domain. nslookup was used to discover srv were not being returned...
- steve_88008
so... two things..
- someone changed the dns profile i had assigned to the listeners
- source address was not enabled on the dns TCP VIP
- steve_88008
its resolved..
