Configuring DNS server settings for a data center
You may have one or more DNS servers across your data centers. When a virtual machine is migrated from one data center to another, its IP address may change depending on the network settings. You may want the DNS records to be updated, so that the same host name is mapped with different IP address after the migrate or take over operation. To let Resiliency Platform update the DNS records, you need to configure DNS server details in Resiliency Platform for each data center.
While configuring the resiliency group for disaster recovery, you can select the DNS customization option for enabling the DNS record updates.
When you may have one or more DNS servers across your data centers and a virtual machine is migrated from one data center to another, its IP address may change depending on the network settings. Resiliency Platform requires DNS server so that it can resolve IP address and Hostname from DNS server. You may need to register newly assigned IP address to the virtual machine with DNS server so that Resiliency Platform can manage it.
Using the Resiliency Platform console, you can add DNS servers for the data center or remove the settings for servers that were previously added.
Command to generate the keytab file and the privileges required:
Run the below mentioned command on Windows DNS to generate keytab file:
ktpass.exe -princ <User Name>@<DNS DOMAIN> -mapuser <User Name>@<DNS DOMAIN> -pass <User Password> -ptype <Principal Type> -out <Keytab File Name>
-princ : Enter the service principal name in the form <user name>@<DNS DOMAIN> . Provide domain name in capital letters.
-mapuser: Maps the name of the Kerberos principal which is specified by the princ parameter, to the specified user account. Provide domain name in capital letters.
-pass: Enter the password for the principal user name that is specified by the princ parameter.
-ptype: Enter the principal type. KRB5_NT_PRINCIPAL is the recommended principal type.
-out: Enter the name and location where the keytab file should be generated.
Ensure that you have the required privileges in Windows DNS to update Forward and Reverse Lookup zones. Forward and Reverse Lookup zones should have 'Dynamic Updates' setting enabled. Refer to the Microsoft documentation for more details.
See Example of command for Windows keytab file.
Command to generate key and private file, and the privileges required:
Run the below mentioned command on Linux Bind to generate key and private file:
dnssec-keygen -a <Algorithm> -b <Keysize> -n <Name Type> <Key Name>
-a: Enter the encryption algorithm. For TSIG, HMAC-MD5 is mandatory. Algorithm is case-insensitive.
-b: Enter the number of bits in the key. For the HMAC-MD5 algorithm, key size must be between 1 and 512 bits.
-n: Enter the host for TSIG transaction authentication for dynamic updates. Nametype is case-insensitive.
Ensure that you have the required privileges in Bind to update Forward and Reverse Lookup zones. Forward and Reverse Lookup zones should have 'Dynamic Updates' setting enabled. Refer to Linux documentation for more details.
Below is an example of the command:
dnssec-keygen -a HMAC-MD5 -b 128 -n HOST example.com.
To configure DNS server settings for a data center
- Prerequisites
You must have the following information:
Only IP needs to be provided here. Host name does not work.
The domain name should be in ALL CAPS. The user name should not contain domain\username but user name and in same case as the keytab was generated.
FQDN is needed here. Short name does not work.
- Navigate
Settings (menu bar) > Infrastructure > Details View
You can also access this page from the Quick Actions menu > Settings > Manage Asset Infrastructure > Details View
- Expand the data center > Access Profile
- Click the Bind or Windows DNS tab.
DNS servers already added for the data center are listed in the table. You can remove or add a new DNS server.
- To add a new DNS server for the data center click + New DNS.
- Specify the IP address for the DNS server and select the purpose, either Rehearsal or Production.
- Add one or more domains for the DNS server:
Fill in the domain name and the authentication type. For TSIG, browse to the key and private files. For GSSAPI, enter the user name and browse to the keytab file.
Enter a test host name and IP address and select Test. If the test is successful, that is the DNS configuration is validated, the Add button is enabled.
Select Add.
- If you are done adding domains, select Next.
- To remove a DNS server, right-click the required DNS server in the table and select Remove.