On 2016-07-07 23:46, Mik J wrote:
I have a bind DNS that is authoritative for many zones and that same
system is also forwarding.
I plan to split these two functions on two different systems.
Have some of you done this task ? Do you have any guidelines or advices ?
I'm thinking about migrating the forwarding functionality to a new
system with a new IP.
This will avoid changing the IP of the authoritative server on the DNS
at a higher level.
Huh. Oddly, I find changing authoritative servers to be quite trivial in
a well managed network.
1) Bring up the new servers.
2) Update ACLs, firewall rules and scripts/automation as needed, if needed.
3) Update the zonefiles and upstream zone files. If the primary master
moved, make the old primary master a temporary slave, such that you can
update slaves at your convenience.
4) Update any remaining monitoring systems, or client-facing resolvers
that forward, stub, or anything else. Consider why you forward, and
whether it's useful or you're just doing configuration for the sake of
configuration.
5) Wait 2-4x the length of the TTL, and/or monitor traffic levels.
6) Pull down the old servers, clean up after them.
Conversely, changing client facing resolver is a constant pain as there
are always "things" that are hardcoded and not using DHCP, depending on
the complexity of your environment, possibly thousands of things. Plus
there are all the terrible DHCP implementations that renew properly, but
fail to update their local configuration until they're restarted. And
the users? Some of them hardcode their resolver settings (see #3 above,
it's a thing they can configure, therefore some do)
But maybe that's just me -- Plus, my authoritative servers are
relatively simple, other than the master, but renumbering the master
without any other changes is also moderately trivial as updating the
slaves can (and is) scripted.
--
Dave Warren
http://www.hireahit.com/
http://ca.linkedin.com/in/davejwarren
_______________________________________________
Please visit https://lists.isc.org/mailman/listinfo/bind-users to unsubscribe
from this list
bind-users mailing list
bind-users@lists.isc.org
https://lists.isc.org/mailman/listinfo/bind-users
