topic Re: cannot synchronize BIND9 with WIN2000 DNS AD in Operating System - Linux

cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 08:21:52 GMT

hi

I cannot synchronize BIND9 with WIN2000 DNS from Active Directory.
I've created on linux a slave Zone for domain.net, but get following error message:

Nov 7 13:29:38 ns1 named[1055]: transfer of 'domain.net/IN' from 192.168.1.10#53: failed while receiving responses: REFUSED
Nov 7 13:29:38 ns1 named[1055]: transfer of 'doamin.net/IN' from 192.168.1.10#53: end of transfer

I have BIND version 9.2.4

knows someone why WIN2000 DNS refused the zone transfer ?

kind regards
chris

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Alexander Chuzhoy — Mon, 07 Nov 2005 08:37:29 GMT

Go to your windows server.
click on start,then choose run
type dnsmgmt.msc
expand the relevant zone.
Right click on it and choose properties.
Then go to "zone transfers" tab
and check the "allow zone transfer" ,while to any server is selected,or you can specify an IP of servers to which allow the zone transfer.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Ivan Ferreira — Mon, 07 Nov 2005 09:10:33 GMT

In the Windows DNS console you must enable:

"bind secondaries"

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 09:45:41 GMT

thanks,

but cannot find "bind secondaries" option on
the Windows DNS console.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Ivan Ferreira — Mon, 07 Nov 2005 10:08:43 GMT

It's in the avdanced tab:

See:

http://informit.staging.informit.mttech.com/content/images/chap3_0789730146/elementLinks/03fig09.jpg

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 10:11:55 GMT

"allow zone transfer" is to any server

"bind secondaries" is enabled,

but still doesn't work and I get the same error messages.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Alexander Chuzhoy — Mon, 07 Nov 2005 10:16:00 GMT

Check if you can reach the dns server on port 53?
telnet dnserver 53

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 10:43:43 GMT

telnet dnserver 53 is working

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Alexander Chuzhoy — Mon, 07 Nov 2005 11:06:11 GMT

see if the user (under which dns is working) is allowed to create files in place that's specified in named.conf file.

Besides what version of linux is it?
If it's redhat 4 or fedora 3 or higher then the files should be created in /var/named/chroot/var/named
by default and not in /var/named

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 13:02:52 GMT

local dns server SLAVE: debian sarge with BIND version 9.2.4

remote dns server MASTER: WIN2000 Active Directory

should I create a windows user on linux ?

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Ivan Ferreira — Mon, 07 Nov 2005 13:18:14 GMT

Please check the logs on the DNS console to see if there is any clue. Post any relevant messages.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Mon, 07 Nov 2005 13:38:11 GMT

the logs on linux:

Nov 7 19:29:39 ns1 named[1055]: transfer of 'domain.net/IN' from 192.168.1.10#53: failed while receiving responses: REFUSED
Nov 7 19:29:39 ns1 named[1055]: transfer of 'doamin.net/IN' from 192.168.1.10#53: end of transfer

I don't have any others logs.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Steven E. Protter — Mon, 07 Nov 2005 13:52:47 GMT

Windows isn't playing nicely with Linux. You need to get it to allow the zone transfer. You might do better posting this to windows, since that is where the work needs to be done.

SEP

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Ivan Ferreira — Mon, 07 Nov 2005 14:33:24 GMT

I mean the "Windows" DNS console logs.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

'chris' — Tue, 08 Nov 2005 05:48:23 GMT

but howto check WIN2000 console logs ?
sorry about that, but I'm not WIN2000 specialist.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Ivan Ferreira — Tue, 08 Nov 2005 06:16:50 GMT

You are not a windows expert, good for you!!! ;)

To access DNS logs, use start, programs, administrative tools, DNS.

Click the DNS server, event viewer, DNS events.

Re: cannot synchronize BIND9 with WIN2000 DNS AD

Thomas Bianco — Tue, 08 Nov 2005 10:36:49 GMT

it sounds like you don't have the secondary listed as a NS in the domain on the windows 2000 side. make sure it's listed then check the server properties in the DNS console and enable transfers to all listed name servers

of the references before:
bind secondaries is required for bind 4.x, bind 9 supports the transfer method, but it's probably a good idea to turn it on anyways http://www.microsoft.com/technet/community/columns/profwin/pw0101.mspx

allowing transfers to all servers will probably fix your issue, but it leaves an open door.

lastly, if this is an active directory integrated domain, you cannot have a bind secondary.