dns record for an external bdc

Hello

I have 2 servers called main.ourdomain.local and remote.ourdomain.local both
are domain controllers with dhcp and dns. Main is the gc and has an internal
ip address of 192.168.0.1 and a public address of xx.xx.xx.xx. Remote has an
internal ip address of 192.168.254.1 and a public address of yy.yy.yy.yy.
Both servers have 1 nic card each.

In the DSN i see the 192 records but I need to system to talk to each other
over the internet with out a vpn do to replication.

What do I need to put into the dns so that main can address remote at
yy.yy.yy.yy and visa versa ?

"Hal" <> wrote in message
news:2046DA6A-5BC8-4BEF-9D33-...
> Hello
>
> I have 2 servers called main.ourdomain.local and remote.ourdomain.local
> both
> are domain controllers with dhcp and dns. Main is the gc and has an
> internal
> ip address of 192.168.0.1 and a public address of xx.xx.xx.xx. Remote has
> an
> internal ip address of 192.168.254.1 and a public address of yy.yy.yy.yy.
> Both servers have 1 nic card each.
>
> In the DSN i see the 192 records but I need to system to talk to each
> other
> over the internet with out a vpn do to replication.
>
> What do I need to put into the dns so that main can address remote at
> yy.yy.yy.yy and visa versa ?

You are asking for major security risks for opening up your DCs to the
internet, if you're going to do that why even have a private network, I can
guarantee your DCs are going to come under immediate attack from malicious
users. You need a firewall and a site to site VPN, don't try to do this with
multihomed DCs. All IPs on both your DCs will need to be accessible from
both networks, because there is no way to guarantee which address record DNS
will give out.

--
--
Best regards,
Kevin D. Goodknecht Sr. [MVP]
Hope This Helps

===================================
When responding to posts, please "Reply to Group"
via your newsreader so that others may learn and
benefit from your issue, to respond directly to
me remove the nospam. from my email address.
===================================
http://www.lonestaramerica.com/
http://support.wftx.us/
http://message.wftx.us/
===================================
Use Outlook Express?... Get OE_Quotefix:
It will strip signature out and more
http://home.in.tum.de/~jain/software/oe-quotefix/
===================================
Keep a back up of your OE settings and folders
with OEBackup:
http://www.oehelp.com/OEBackup/Default.aspx
===================================

"Hal" <> wrote in message news:2046DA6A-5BC8-4BEF-9D33-...
> Hello
>
> I have 2 servers called main.ourdomain.local and remote.ourdomain.local both
> are domain controllers with dhcp and dns. Main is the gc and has an internal
> ip address of 192.168.0.1 and a public address of xx.xx.xx.xx. Remote has an
> internal ip address of 192.168.254.1 and a public address of yy.yy.yy.yy.
> Both servers have 1 nic card each.
>
> In the DSN i see the 192 records but I need to system to talk to each other
> over the internet with out a vpn do to replication.
>
> What do I need to put into the dns so that main can address remote at
> yy.yy.yy.yy and visa versa ?


I must agree with Kevin to not put your DC on the internet, and to not multihome it. Multihoming a DC will definitely cause issues with DC and AD functionality.

There are hardware based firewall solutions that offer site to site, as well as secured client access VPN features that you will be better off and much more secure. These solutions are not that expensive at all. Take a look at a Cisco ASA5505. There are competitive products from Netscreen, SonicWall, etc.


--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer


For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right things." - Peter F. Drucker
http://twitter.com/acefekay