Skip to main content

Active Directory forest with same name as root DNS zone and browsing to site with same name



Related to this previous question of mine about why it's a bad idea to use the root domain name as your Active Directory forest's name...



I have an employer, whom I will refer to as ITcluelessinc, for the purposes of simplicity (and honesty). This employer has an externally hosted website, www.ITcluelessinc.com, and a few Active Directory domains. Being clueless about IT, many years ago, they set themselves up on an Active Directory forest named ITcluelessinc.prv, and performed unspeakable atrocities against it. These unspeakable atrocities eventually caught up with them, and with everything collapsing around them, they decided to pay someone a huge chunk of money to "fix it ," which included migrating off the horribly broken ITcluelessinc.prv forest.




And of course, being clueless about IT, they didn't know good advice when they heard it, accepted the recommendation to name their new AD forest ITcluelessinc.com, instead of the sane advice they also got, and started putting stuff on it. Fast forward to a few hours ago, and we have a company with most of its stuff joined to and using the old ITcluelessinc.prv Active Directory forest, with a fair amount of newer stuff joined to and/or using the ITcluelessinc.com forest. To make this work together relatively seamlessly, I've used conditional forwarders in DNS to send the ITcluelessinc.com traffic over to ITcluelessinc.prv, and vice-versa.



enter image description here



(The corp.ITcluelessinc.com and eval.ITcluelessinc.com domains are properly named domains I came in and set up later, and are not relevant just yet.)



Back to a few hours ago, and a non-technical employee of ITcluelessinc has noticed that she can't browse to www.ITcluelessinc.com from her workstation (inside the ITcluelessinc corporate network) and decided that this is a problem, so she contacts VIP employee of ITcluelessinc, who decides this must be resolved most Ricky-tick. Typically, not a huge deal, add an A record for www under the DNS zone for ITcluelessinc.com, and you can browse the site, so long as you don't try the naked link.



enter image description here




So, it seems like it's all setup properly. Forwarders, www host entry in DNS, and yet, clients using the ITcluelessinc.prv domain controller as DNS servers get a connection timeout when trying to browse to www.ITcluelessinc.com, instead of the webpage that I get from my home network.



Does anyone have any thoughts as to how I can allow internal clients of the ITcluelessinc.prv domain to browse www.ITcluelessinc.com, given the presence of the ITcluelessinc.com Active Directory forest and the conditional forwarders it needs? Or, alternately, is anyone [else] convinced that the only way to make it work is to get rid of the ITcluelessinc.com Active Directory forest?



It does seem like the setup I have now should work, but it's clearly not, and I have no idea where I'd procure a testing environment this messed up to experiment with. And for what it's worth, I've somewhat politely suggested that the only way to fix this is migrate to the properly-named forests I set up, and when that's not a good enough answer, plan to host a mirror of the website on all our ITcluelessinc.com domain controllers until that breaks everything.


Answer



If the clients are resolving the hostname properly then you've got another problem. DNS is out of the picture once the hostname is resolved by the client.



Some things to think about:





  • Are clients using any kind of HTTP proxy to access the Internet? Does the proxy have the correct DNS information available?


  • What's the DNS cache look like on the client after a failed access attempt? Are you seeing the right IP address cached for the hostname?


  • What's actually happening on the client? Are you seeing a connection stuck in SYN_SENT state to the correct server IP address, TCP port 80?


  • Are there any firewall rules that might relate to blocking access to the website's address?




This smells like a firewall / proxy / cache / filter problem, not a DNS problem.



Unfortunately, there's nothing really compelling I can say about getting rid of the badly-named Active Directory domain. It's unfortunate that they chose to do that route, but technically this can work. (I hate this kind of bad naming practice, too... "vile", I believe, is how I've referred to it in the past... Wish I had some good advice to forward a domain-rename argument to you...)



Comments

Post a Comment

Popular posts from this blog

linux - iDRAC6 Virtual Media native library cannot be loaded

When attempting to mount Virtual Media on a iDRAC6 IP KVM session I get the following error: I'm using Ubuntu 9.04 and: $ javaws -version Java(TM) Web Start 1.6.0_16 $ uname -a Linux aud22419-linux 2.6.28-15-generic #51-Ubuntu SMP Mon Aug 31 13:39:06 UTC 2009 x86_64 GNU/Linux $ firefox -version Mozilla Firefox 3.0.14, Copyright (c) 1998 - 2009 mozilla.org On Windows + IE it (unsurprisingly) works. I've just gotten off the phone with the Dell tech support and I was told it is known to work on Linux + Firefox, albeit Ubuntu is not supported (by Dell, that is). Has anyone out there managed to mount virtual media in the same scenario?
Post a Comment
Read more

ubuntu - Monitoring CPU, Mem, disk, on a single server

I've been looking for a simple starter solution for monitoring my [currently] single server hosted solution. Other than Nagios and similar, are there other good (simple) solutions people are using? Answer Everything depends on what you want. For example Munin is very simple, you can install and configure it in less then 10 minutes (on one server), it can sends alarms, make graphs from monitoring cpu, mem. apache connections, eaccellerator, disk io and many many more (it has many plugins). But if you are planning in future get some more machines, munin may not be enough. For example in munin you cant monitor state of individual processes, can't monitor changes in files (for security purpose). So if you wanna only see what is the utilization of basics parameters on your server and don't plan to buy some more servers Munin is what you are looking for, but if you wanna be alarmed when some of your service is down, take more control on what is happeninig on...
Post a Comment
Read more

hp proliant - Smart Array P822 with HBA Mode?

We get an HP DL360 G8 with an Smart Array P822 controller. On that controller will come a HP StorageWorks D2700 . Does anybody know, that it is possible to run the Smart Array P822 in HBA mode? I found only information about the P410i, who can run HBA. If this is not supported, what you think about the LSI 9207-8e controller? Will this fit good in that setup? The Hardware we get is used but all original from HP. The StorageWorks has 25 x 900 GB SAS 10K disks. Because the disks are not new I would like to use only 22 for raid6, and the rest for spare (I need to see if the disk count is optimal or not for zfs). It would be nice if I'm not stick to SAS in future. As OS I would like to install debian stretch with zfs 0.71 as file system and software raid. I have see that hp has an page for debian to. I would like to use hba mode because it is recommend, that zfs know at most as possible about the disk, and I'm independent from the raid controller. For us zfs have many benefits, ...
Post a Comment
Read more