TechNote: Using the Double-Take Software DNS Failover (DFO) Utility

Transcription

1 TechNote: Using the Double-Take Software DNS Failover (DFO) Utility The DNS Failover (DFO) utility is a console-based application that takes configuration information passed in from the command line and uses that information to determine how to update DNS records. The DFO utility works by using Microsoft Windows Management Instrumentation (WMI) calls to the DNS WMI Provider on a Windows -based DNS server in order to update DNS resource records during the Double-Take failover and failback processes. In addition to managing DNS record updates within the context of Double-Take failover and failback processes, the DFO utility also provides an encryption mechanism to manage credentials so that users are not limited to DNS modification schemes that require impersonation (such as DNSCMD). For the DFO utility to be used automatically as part of the failover and failback processes, it must be configured ahead of time. The Double-Take Availability Application Manager and Full Server Failover products automatically configure the DFO utility using the common settings and parameters. For more information about the information needed to configure the DFO utility, refer to the DNS section in the Double-Take Availability User's Guide. About TechNotes This document is a Double-Take Software technical note. A technical note provides supplementary documentation and best practices for using Double-Take Software products. Note: Because no two environments or configurations are exactly the same, you will probably need to implement additional or different steps than what is documented here in order to make the solution work in your environment. Requirements The DFO utility must be installed or copied onto the machine where it will be run, which is typically the target server. The DFO utility is installed automatically with many Double-Take Software products. The CAPICOM.DLL file needs to be registered if encryption services will be used. The DNS WMI provider needs to be on the DNS server. The DNS WMI provider is installed automatically on Windows 2003 and later. If your DNS server is running Windows 2000, the DNS WMI provider must be installed manually. Appropriate permissions must be assigned. For more information, see the Double-Take Availability User's Guide. How the DFO utility works The DFO utility performs DNS resource record modifications by connecting to the DNS namespace (root\microsoftdns) on the DNS server using WMI. The WMI connection can be made using passed credentials or impersonation if the account running the DFO utility has permissions to perform all DNS-related activities. Passed credentials can be encrypted using Microsoft s CAPICOM dynamic link library with DFO specifying the triple DES encryption algorithm with the maximum key length available (168). By providing reliable encryption, the DFO utility allows you to avoid storing secure passwords in script files. During normal operations, clients needing to connect to application or file servers use DNS to locate the server on the network (see Figure 1).

2 Figure 1: Server name resolves using DNS Failover If the source experiences a failure or an extended outage, clients will need to be redirected automatically to the target server (which was preconfigured to protect the source server). In these cases, the DFO utility can help make the network redirection portion of failover transparent to end users. 2

3 Figure 2: Failover process initiates update of DNS records 3

4 Figure 3: After failover, clients are redirected to the target How the DFO utility modifies A type DNS resource records The DFO utility is able to modify five DNS resource record types: A, AAAA, CNAME, MX, and PTR. There are minor differences between the processes to failover different resource record types, but overall there are enough similarities to focus on one type, the host record or A type. Note: The differences between modifications for A type records and other record types are listed following the detailed description of A type records. 1. The DFO utility builds and executes a focused WMI query to retrieve a collection of matching source DNS resource records from the DNS server. For example: SELECT * FROM MicrosoftDNS_AType WHERE IPAddress= The DFO utility iterates through the returned collection and modifies any matching resource records. a. The DFO utility spawns an instance of the WMI DNS resource record object to call the modify method. b. The DFO utility sets the parameters such that the target IP address is the input parameter. c. The DFO utility executes the modify method on the WMI DNS record object. 3. The DFO utility locks the DNS resource record in Active Directory so that the source computer account is unable to modify the record outside of the DFO utility. This is done to prevent modification of the resource record to point back to the source machine until the failback process is initiated by the user through the DFO utility. 4

5 a. The DFO utility denies permission to modify the Active Directory object representing the DNS entry. b. The DFO utility gets the DNS resource record object in Active Directory. c. The DFO utility reads the security descriptor and gets the DACL. d. The DFO utility adds the ACE ACCESS_DENIED type for the passed-in trustee name (for example, source computer account, cluster administrator account, and so on) to deny access to the Write All Properties permission. 4. The DFO utility logs the results of the actions performed/attempted. Other DNS resource record types Other record types require different queries and input parameters. Additionally, CNAME, MX, and PTR record types do not execute the Active Directory object locking routines that A and AAAA type records require for failover. AAAA type Except for the query difference, this record type is identical to the A type record. SELECT * FROM MicrosoftDNS_AAAAType WHERE IPAddress= 21DA:D3:0:2F3B:2AA:FF:FE28:9C5A CNAME type This type does not have Active Directory object locking to prevent updates during failover. SELECT * from MicrosoftDNS_CNAMEType WHERE PrimaryName="sql1.doubletake.com MX type This type does not have Active Directory object locking to prevent updates during failover. SELECT * from MicrosoftDNS_MXType WHERE MailExchange="mail1.doubletake.com PTR type Instead of modifying the source record, the PTR type deletes the source PTR record and create a new PTR record by using previous source PTR text record information, substituting the target FQDN for the source FQDN, and calling the CreateInstanceFromPropertyData() method on the DNS server. This type does not have Active Directory object locking to prevent updates during failover. SELECT * from MicrosoftDNS_PTRType WHERE PTRDomainName="sql1.doubletake.com Failback During failback, the same mechanisms that were used during failover are used, except that the original source-related records are modified to point to the original source. (During failover, the source records were modified to point to the target IP address or name, depending on the record type.) Also, during failover the A and AAAA type DNS resource records are modified in DNS and then locked in Active Directory; during failback, those record types are unlocked in Active Directory and then modified in DNS. Figure 4 shows the server-side changes during failback. 5

6 Figure 4: After failback, clients are redirected to the original source Related documentation The following sections in the Double-Take Availability User's Guide contain additional information that explain how to use the DFO utility: DNS, which contains details about how to use the Windows DNSCMD command and the Dobule- Take Availability DFO utility. Non-Microsoft DNS, which explains options for how to update host records on the source at failover. Getting help Double-Take Software offers professional services on a fee basis to assist you in identifying the best practices for implementing a solution in your environment. Visit for more information Double-Take Software, Inc. All rights reserved. Double-Take, Balance, Double-Take Cargo, Double-Take Flex, Double-Take for Hyper-V, Double-Take for Linux, Double-Take Move, Double-Take ShadowCaster, Double-Take for Virtual Systems, GeoCluster, Livewire, netboot/i, NSI, sanfly, TimeData, TimeSpring, winboot/i, and associated logos are registered trademarks or trademarks of Double-Take Software, Inc. and/or its affiliates and subsidiaries in the United States and/or other countries. Microsoft, Hyper-V, Windows, and the Windows logo are trademarks or registered trademarks of Microsoft Corporation in the United States and/or other countries. All other trademarks are the property of their respective companies. Revision published May