Designing Advanced Name Resolution

Module 7: Designing Advanced Name Resolution
Module Overview
Optimizing DNS Servers Designing DNS for High Availability and Security
Designing a WINS Name Resolution Strategy

Designing WINS Replication
Lesson 1: Optimizing DNS Servers

Disabling Recursion Deleting and Modifying Root Hints
Optimizing DNS Server Response

Optimizing DNS Server Functionality Optimizing Active Directory Integrated Zones
DNS Troubleshooting Tools

Discussion: Optimizing DNS Performance
Disabling Recursion
Disable recursion to limit name resolution to a specific server, or as a failover for another DNS server
Benefit: You will reduce the load on the DNS server Consequence: You will not be able to resolve names outside of your own zone
Deleting and Modifying Root Hints
Delete root hints on servers that do not need to communicate with DNS servers that are authoritative for the root domain Modify root hints if the root domain is internal Update root hints when DNS servers that are authoritative for the root domain change
Optimizing DNS Server Response

To improve DNS server response time:
Disable Local Subnet Prioritization Used when multiple records match a request
Arranges the query response, so that the records closest to the client subnet are first
Disable Round-robin rotation Used when multiple records match a request Rotates the order of responses for load balancing Install sufficient memory to cache all DNS zones
in memory
Optimizing DNS Server Functionality

To optimize zone transfer:
Modify depending on how often your DNS data changes
Modify if more frequent updates are not required

Use incremental zone transfers
To reduce network traffic, use caching-only servers:

Use caching-only servers if you have a slow WAN link Configure caching-only servers to perform recursive queries
Optimizing Active Directory Integrated Zones

Select an appropriate application partition:
ForestDNSZones replicates to all domains DomainDNSZones replicates within a domain _msdcs subdomain is in ForestDNSZones by default
To optimize AD integrated zones:

Optimize Active Directory performance
Use Active Directory sites

Place logs and the Active Directory database on dedicated partitions
DNS Troubleshooting Tools
DNS troubleshooting tools are:

NSLookup DNScmd DNSLint
Discussion: Optimizing DNS Performance

What can you do to optimize DNS server performance?
Lesson 2: Designing DNS for High Availability and Security

Guidelines for Designing DNS Availability Using Load Balancing for DNS Servers
DNS Security Risks

DNS Security Policies Discussion: Guidelines for Designing DNS Security
Guidelines for Designing DNS Availability
Have at least two DNS servers authoritative for each zone Place DNS servers in separate subnets or sites
Locate at least one DNS server per Active Directory site

Configure clients with two DNS servers
Using Load Balancing for DNS Servers
Load Balancing:
Provides availability and scalability for DNS resolution Requires all DNS servers on the same subnet Does not protect against failed network links Is suitable for a centralized implementation of DNS
DNS Security Risks

DNS Attack Footprinting Description
Building a diagram of DNS infrastructure by
capturing data such as computer names and IP addresses it unavailable for normal use
Denial-of-service
Flooding a DNS server with queries to make
Data modification
Falsifying records in DNS to falsify servers
or redirect email messages
Redirection
Supplying false responses to external
queries by a DNS server to corrupt the cache with false information
DNS Security Policies

Security level Description
Default configuration
Low
Use when there is no concern about DNS data Typically used when there is no external
connectivity
Disables dynamic update and limits zone transfers
Medium
Available without running on domain controllers Internet resolution is performed through a proxy Includes medium level security measures
High
Must run on domain controllers to use ADintegrated zones and secure dynamic updates
Discussion: Guidelines for Designing DNS Security

What are the best practices for securing DNS servers?
Lesson 3: Designing a WINS Name Resolution Strategy

Options for NetBIOS Name Resolution Scenarios Requiring Multiple WINS Servers
WINS Fault Tolerance

DNS GlobalNames Zone
Options for NetBIOS Name Resolution

Broadcast
Suitable only for a single subnet
LMHOSTS
Suitable for small environments Reduces broadcast traffic Requires static IP addresses
WINS
Suitable for organizations of all sizes
Reduces broadcast traffic Does not require static IP addresses
Scenarios Requiring Multiple WINS Servers
Scenarios requiring multiple WINS servers:

WAN links could be overloaded by WINS requests Requirement for redundancy to improve availability More than 10,000 clients
WINS Fault Tolerance

Plan for fault tolerance:
Determine the maximum allowable downtime of the WINS server Use a secondary WINS server for redundancy
Configure clients for fault tolerance:

Clients should point to the local WINS server Clients should point to the secondary WINS hub for redundancy
DNS GlobalNames Zone

GlobalNames zone:
Is designed to help retire WINS by resolving single-label names
Should be created as an AD integrated zone Can be enabled on Windows Server 2008 DNS servers May simplify management of DNS suffixes
Is where CNAME records are statically created
Lesson 4: Designing WINS Replication and Integration

Selecting a WINS Replication Type Selecting a Partner Replication Method
Selecting a WINS Replication Topology

Guidelines for Interoperability with DNS
Selecting a WINS Replication Type

Push replication:
Replicates after a specified number of changes
Batching reduces network traffic
Pull replication:
Replicates after a specified period of time Ensures that all changes are replicated
Selecting a Partner Replication Method

Automatic partner configuration:
Uses multicasts to automatically configure replication partners Is best suited to three WINS servers or less
Manual partner configuration:

Allows complete flexibility in design
Results in better scalability
Selecting a WINS Replication Topology

A hub-and-spoke design:
Must be manually configured Minimizes replication time
WINS Server (Push/Pull Partner)
Central WINS Server
Hub-and-Spoke Design
Guidelines for Interoperability with DNS
Do not use extended characters in NetBIOS names Consider using only DNS for name resolution Configure DNS for WINS Lookup and WINS Reverse Lookup
Lab: Designing Advanced Name Resolution

Exercise 1: Optimizing DNS Servers Exercise 2: Designing High Availability for Name
Resolution
Exercise 3: Designing WINS Exercise 4: Implementing a GlobalNames Zone
Logon information
Virtual machine User name Password
NYC-DC1, LON-DC1
Administrator Pa$$w0rd
Estimated time: 70 minutes
Beta Feedback Tool

Beta feedback tool helps: Collect student roster information, module feedback, and course evaluations. Identify and sort the changes that students request, thereby facilitating a quick team triage. Save data to a database in SQL Server that you can later query. Walkthrough of the tool
Beta Feedback
Overall flow of module: Which topics did you think flowed smoothly, from topic to topic? Was something taught out of order? Pacing: Were you able to keep up? Are there any places where the pace felt too slow? Were you able to process what the instructor said before moving on to next topic? Did you have ample time to reflect on what you learned? Did you have time to formulate and ask questions? Learner activities: Which demos helped you learn the most? Why do you think that is? Did the lab help you synthesize the content in the module? Did it help you to understand how you can use this knowledge in your work environment? Were there any discussion questions or reflection questions that really made you think? Were there questions you thought werent helpful?

Designing Advanced Name Resolution

Uploaded by

Copyright:

Available Formats

Designing Advanced Name Resolution

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Designing Advanced Name Resolution

Uploaded by

Copyright:

Available Formats

Module 7: Designing Advanced Name Resolution

Designing a WINS Name Resolution Strategy

Lesson 1: Optimizing DNS Servers

Optimizing DNS Server Response

DNS Troubleshooting Tools

Deleting and Modifying Root Hints

Optimizing DNS Server Response

Optimizing DNS Server Functionality

Modify if more frequent updates are not required

To reduce network traffic, use caching-only servers:

Optimizing Active Directory Integrated Zones

To optimize AD integrated zones:

Use Active Directory sites

DNS Troubleshooting Tools

DNS troubleshooting tools are:

Discussion: Optimizing DNS Performance

Lesson 2: Designing DNS for High Availability and Security

DNS Security Risks

Guidelines for Designing DNS Availability

Locate at least one DNS server per Active Directory site

Using Load Balancing for DNS Servers

DNS Security Risks

Flooding a DNS server with queries to make

Falsifying records in DNS to falsify servers

or redirect email messages

Supplying false responses to external

queries by a DNS server to corrupt the cache with false information

DNS Security Policies

Disables dynamic update and limits zone transfers

Discussion: Guidelines for Designing DNS Security

Lesson 3: Designing a WINS Name Resolution Strategy

WINS Fault Tolerance

Options for NetBIOS Name Resolution

Scenarios Requiring Multiple WINS Servers

Scenarios requiring multiple WINS servers:

WINS Fault Tolerance

Configure clients for fault tolerance:

DNS GlobalNames Zone

Is where CNAME records are statically created

Lesson 4: Designing WINS Replication and Integration

Selecting a WINS Replication Topology

Selecting a WINS Replication Type

Batching reduces network traffic

Selecting a Partner Replication Method

Manual partner configuration:

Selecting a WINS Replication Topology

WINS Server (Push/Pull Partner)

Central WINS Server

WINS Server (Push/Pull Partner)

WINS Server (Push/Pull Partner)

WINS Server (Push/Pull Partner)

Guidelines for Interoperability with DNS

Lab: Designing Advanced Name Resolution

Exercise 3: Designing WINS Exercise 4: Implementing a GlobalNames Zone

Virtual machine User name Password

Estimated time: 70 minutes

Beta Feedback Tool

You might also like