1

At our company, we have a coloc at a local datacenter (where we host our public Web Servers) and a Site-to-Site VPN set up between the coloc and our office. We would like to join the servers at the datacenter to our Active Directory.

If I understand correctly, domain joining relies heavily on DNS. I would not like to have the servers at the datacenter resolve their DNS queries across the tunnel to our internal DNS server as this would decrease DNS query performance (and also in cases where the tunnel is down).

Is it possible to have the servers resolve all DNS queries using public DNS servers (Google's, ISP's, etc…) except the ones that are internal to our company? Instead these would be forwarded across the tunnel to our internal DNS Server? Would I need to host a DNS server at the coloc to achieve this functionality? Or is there a simpler way to do this?

After all, is this the correct solution of how I should join our coloc network to our Active Directory?

Christopher Demicoli
  • 143
  • 5

2 Answers2

0

I do not recommend to join your productive web servers located in the data center to your site-local Active Directory Domain! If the link is down or the connection to your office is bad, you risk losing access to those servers!

You could configure DNS forwarding on your data center’s DNS server for your site-local Active Directory domain.

For example, let’s say your Active Directory domain is named example.local and the site-local Active Directory DNS server has the IP address 192.168.0.10. Go to your data center’s DNS server and configure a DNS forwarder for example.local to 192.168.0.10.

Whenever you address a computer in the example.local domain, your data center’s DNS server will forward the DNS request to your site-local Active Directory DNS server.

Now you will be able to join the domain. You might need to configure a domain suffix, if you’d like to omit the domain name and work only by using the host names. That means, that you need to ping server1.example.local, client1.example.com and also join example.local and not only ping server1 and server2 and join example.

Daniel
  • 6,940
  • 6
  • 33
  • 64
0

This is the kind of situation that Read-Only Domain Controllers are intended for. Since it's read-only, you would have to depend on your site-local DC to join the domain, but after that the RODC could handle logins for your colo servers. It would also handle read-only DNS, even when the tunnel goes down.

This feature requires Server 2008 or higher, with a domain functional level of 2003 or higher. (Hopefully that's not an issue, considering that Server 2003 is out of support in July.)

Katherine Villyard
  • 18,550
  • 4
  • 37
  • 59