[Autogenerated] Now, Jaden needs to see
what records are already in the primary
server based on just installing DNA Jest.
Then he'll add a secondary server to the
primary and watch the zone transfer via
wire. Shark talk about where these servers
are going to be physically before we start
adding zones we've already seen s primary,
It and s secondary are in Atlanta, and
their IP address range is 10 12.3 dot
zero. Our New York office is where many of
the users are located, including Gabriella
and Jaden. Three IP address range. There
is 10 95.0. They're going to have a stub
zone out in the Chicago Zone. We have a
test bed set up for mobile phone apps.
There. IP address range is 10 22.6 dot
zero and they have a bind. DNS Server, the
DNS server in New York could be another
secondary, but to save the bandwidth of
zone transfers, we're going to make him a
stub server Clients in New York will send
queries to him, and he'll send them to the
authoritative servers for the for the
zone. This saves the bandwidth of zone
transfers and of the additional queries.
If HANA Stubb 01 was not there to cache,
Jaden put a Linux server running Bind
Version nine out in the test bed for
Chicago. He could have made it a stub
server as well, but he decided to make it
a secondary. The network between Atlanta
and Chicago has a lot more bandwidth than
the one between Atlanta and New York. So
Jaden wasn't concerned about the bandwidth
required for the zone transfers. His plan
is to monitor that network utilization and
then revisit his decision. In two months,
we're here at N s primary will be adding
different zones in this demo. So
definitely we're going to start wires
shark. You know that. It's best to be
doing this from a tap or a SPAN, or at
least the command line when you're
capturing from a server. But for the rest
of the demos, all know that you know to do
that and we'll just use wire shark to make
it a bit easier. I'm here at N s primary
one and I'll start a fresh capture and do
a filter for DNS. I'll open up my DNA snap
in and we're going to add a new forward
look up zone. I'll go to the action menu
and click on New Zone. Jane in named it N
s Primary for a reason. It's going to be
the primary zone for global ticket dot
Globomantics dot com. So a select primary
zone here and global ticket Globomantics
dot com Remember, that's a bit of a
mouthful. We're going to call it g t dot g
m dot com. From now on, this is the point
where we're actually creating that
database. It's a flat file, and now we
know what that file is named. If we ever
need to check the configuration we can
look at that file at the command line or
here in our d n a snap in. Now, if we were
creating this zone to work with
Active Directory, we definitely would do
dynamic updates. But my goal in this
course is to focus on DNA's, not
Active Directory, so we won't be using
dynamic updates. Since I'm not allowing
Active Directory dynamic updates. I
certainly don't want to select allow both
non secure and secure dynamic updates.
Just as a personal preference. I don't
want to allow anything that says non
secure in the option, So we're not going
to allow dynamic updates for this
discussion. But remember, in real life we
would set up the firewalls, set up the
security, set up Active Directory and
allow dynamic updates. And on our bind
server, we would do the same thing just
without Active Directory. That way, both
types of DNS servers could have dynamic
record updates coming in from the D. H C P
server, and we would set up the security
to allow for that. I'll hit finish to
complete the Wizard. And now in our
forward look up zone, we've got GT do gm
dot com. Our first record is a start of
authority record. That and the name server
were created automatically. A start of
authority record simply says I am an
authority for this zone. If I double click
on it, it starts with the serial number.
Every time the database changes, that
number will increments. If we ever have a
problem with a zone transfer and somehow
have unexpected data we can look to see
what serial number was sent. And was it
the one expected servers within the zone
use that number when they do zone
transfers to make sure that the data being
received is newer, and therefore the
serial number is higher than the data
they've had before. It lists out the name
of my primary server, then in the S O a
record I have who is the primary server
and his primary. So far, it's the only one
there. And the responsible person. Now
this DNS server was facing the public. We
would actually want to put in a name that
field was originally designed for. When
there were issues with Dina zone
transfers. We knew who to contact to
discuss it. So it should be an email for
that person. Now, in today's environment,
you can imagine how much spam those
addresses receive. That's why most people
use a generic address and then use email
forwarding. The next few fields are for
When does that zone refresh? We're going
to have four DNS servers for our entire
zone. How often do we want those own
transfers to happen? Remember, Jaden's
already a little concerned about the
bandwidth between Atlanta and Chicago. So
how often do we really want to go ahead
and refresh the entire zone? I'm going to
leave it at the default of 15 minutes. The
retry interval is very similar to how d
HTTP does it so well. Refresh the total at
15. If the DNA server does not respond at
our 15 minute refresh time, we we'll try
again after 10 minutes. All of the records
from any zone transfer will expire will
refresh every 15 minutes. But if the
primary Dina server does not respond to
the secondaries, everything leaves. After
24 hours, the database is flushed, the
records and the database expire for the
minimum default. Time to live. This is for
the whole zone. So in Microsoft you only
get to choose one. TT l for the entire
zone in bind will get to pick for every
individual record. The one record we can
deviate from the norm, though, is for the
start of authority record. Now let's look
at the properties for the N s record. Here
is where we could add all four name
servers and their I p addresses. But we're
going to do that when we actually add the
secondary and Stubbs owns. Here's where we
can add the reverse look up zone, and that
way we'll have pointer records pointing
back to the name and IP will be able to
resolve and name to on IP, which is what
everyone thinks of first, but also an IP
to a name. Every time you do that with an
is look up, you're using a pointer record.
I'll add a new primary zone and then a
reverse look up zone. My network IDE is 10
12.3 the domain inverse address .NET arpa
DNS is added. We won't allow dynamic
updates here either. And now we have our
new reverse look up zone. It has the same
start of authority and name server records
that are forwards own did. Now let's add a
new secondary zone on N S secondary. I'll
choose Secondary Zone, put in the same
zone name and now I have to tell the
secondary who he needs to talk to in order
to get his read only copy off the zone
records. I'll put in N s primaries IP
address and we're going to get an error.
Sure, enough, zone not loaded by Deena's
server. What's wrong? We did exactly what
we were supposed to. One thing is missing,
though we never told the primary to expect
the secondary to reach out to him, so we
need to modify the primary. I could have
done that when I was still in the
primaries own configuration, but I wanted
to get the error because remember, we're
still capturing and wire shark, and there
it is. The secondary reaches out to the
primary for the S O a record. And that
part works. However, when it reaches out
to the primary for an a X f R record,
which is a transfer request for all
records and the primary server refuses,
let's fix that. I'll go into the zone
itself. And a Zone transfers tab and I
have two choices. The to any server is not
a choice from a security perspective, so
we're ignoring that. But the second two,
you have only two servers listed in the
name servers tab so we could go ahead and
add are three other DNS servers to the
primary. Or I could click on only to the
following servers and put in their
addresses. I'm going to choose only to the
following servers. I should go ahead and
put all three of them into the name
servers tap because then it will be by
name, and if they're IP addresses change.
I'll still be set, but I'm going to go
ahead and choose the following servers
based on IP addresses. I'll type in the I
P address for the secondary. Tend at 12
dot 3D at six. Tell it Okay, while we wait
for the refresh and the zone transfer,
let's set up the reverse secondary zone.
Look up. We'll do a filter for the IP
address of the secondary so that we can
focus on just the traffic between those
two surf. And there's my packet with the
zone change notification coming from five
going towards 50.6 to let him know the
records have changed. Of course, the
changes that the secondary got added but
now 0.6 replies with his own change
notification response of no error. We know
who the authority is Now. We'll have a
query for the all transfer record. We'll
do a filter for that query type to make it
easier to find them all. You can see where
so many were refused while we were still
getting set up. And there it is are
successful zone transfer, and there it is,
a successful zone transfer for the reverse
look up zone, you'll see that it contains
just these eso a record. So there's RSO, a
record for the zone who the authoritative
name server is. Let's go ahead and save
that filter so we can use it again and
again. Now let's do the same thing for our
stubs own. I'll click. Add New Zone from
the action menu. Go through our Wizard
Click on Stubbs Own same zone name Put in
the I P address of the primary server. Go
ahead and add a stub zone for the reverse
look up zone. We get the error again that
the zone is not loading. We need to add
the stub servers IP address to our
primary. We'll add in 10 95.8 and do a
refresh add in the I. P address of our
stub server. And here is our TCP handshake
to Port 53. I'm going to use the TCP
stream button filter. These UDP and TCP
Stream filter _______ are context
sensitive filters. What I mean by that If
I've clicked on a TCP packet and click on
the TCP Stream filter, it'll filter for
whatever TCP stream or conversation where
shark uses the word stream that I'm on. So
it's specific to what you have clicked
first. Same thing for the UDP stream
filter. I have my TCP three way handshake.
A query for the S O A record for the
reverse zone coming from my stub server
going towards my primary, you can see What
happens first after we set up the new zone
is to do a query for the S O a record just
to verify that 00.5 is actually the
primary. That's what was happening in the
Wizard when it said whether or not it
could validate and then the next request
will be the transfer request. However, now
the zone still isn't loading. Do you see
my mistake? I spelled the zone name wrong.
It should be g t dot g m dot com. Let's
fix that. They're now It should work. And
there's a request for the S o a record and the positive response