DNS - Unexplained Behaviour

[briteeyez]

Hi All

I have two Windows 2003 servers operating within my LAN, each with static IPs (*.*.*.7 -a domain controller and *.*.*.8 -the PDC). The PDC is where we have configured the DNS zone, a copy is being replicated onto the DC

For the PDC, I have the DNS server set to *.*.*.8 (its own address), while for the other DC, I have the PDC's IP. My DHCP service is provided by my Netscreen firewall, and there we have identified the DC's IP as the DNS server.

My problem is that over the last six months we have had a recurring situation where one or both of the machines loses its ability to surf the internet. Investigations show that they are not able to ping externally by IP or by name. We have found that the situation is resolved simply by changing the static IP to some other number within the range.

Why should this be happening? We are not making any changes to the DNS configuration and cannot identify anything which might trigger the loss of this service

 

[Serbtastic]

Do you have the addresses of the DCs excluded in the DHCP scope? Perhaps another machine is being assigned the IP of one of the DCs, and thus knocking both off the network.

 

[briteeyez]

Hi Serbtastic

The addresses are not part of the DHCP scope (*.*.*.101 to 199) and I have checked on the possibility of an IP Conflict however that does not appear to be the case

 

[GlenJohnson]

Any errors in your event logs? When you can't surf the internet, what does ipconfig /all show?

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin/Central Florida feel free to join the Tek-Tips in Chicago, Illinois Forum.
TTinChicago
Johnson Computers

 

[briteeyez]

the ipconfig results show all the correct information. No errors are being posted to the event log. When I place the Ip address of the DC, in the secondary DNS settings on the card, that machine is able to surf. However upon performing this same task on the PDC, it does not yield any result.

Also note that the systems when they are unable to surf they cannot ping the untrusted side of the firewall.

Any other ideas.