CAS array internal DNS IP address best practice

Hi, Just a question about a best practice approach for DNS and CAS arrays.
I have an Exchange 2010 Org. I have two CAS/HUB servers and two MBX servers. My external DNS (mail.mycompany.biz) host record points to a public IP address which is NAT'd to the internal IP address of my NLB CAS cluster. I maintain a split brain
DNS. Should the internal DNS entry for mail.mycompany.biz also point to the public IP address or should it point to the internal IP address of the NLB cluster?

A few comments:
The reason you have split DNS is to do exactly these sort of things: inside users hit the inside IP and outside users hit the outside IP. You'll have to look at your overall network design to see if it makes sense for users to take this shortest route
to the services, or if there is value in knowing all users simply take the same path.
You should not be using the same DNS name for your web services (e.g. OWA) as you are for your CAS array. This can cause very long connection delays on Outlook clients, not to mention overall confusion in your design. Many orgs will use something
like "outlook.domain.com" for the Client Access Array and "mail.domain.com" for the web services. Only the later of these two need to be exposed to the internet.
Keep in mind, Exchange 2013 dramatically changes this guidance. There is no more CAS array, and the
recommended design is to use dedicated namespaces for each web service.
Mike Crowley | MVP
My Blog --
Planet Technologies

Similar Messages

Management IP Address : best practices ?

Hi,
What are the advantages to assign the mgmt IP @ to service profil rather to blade server ?
Can we do the both ?... and in what puropose ?
what are the best practices for specific use ?
many thx in advance for you feedback.
Nicolas.

The ability to assign the IP address to the SP was done at the request of users. This allows the KVM IP adddress to follow the SP (and OS associated with that SP). Customers wanted to know that KVM IP was also associated with there OS.
The IP associated to the blade can be used at any time for a KVM session. An IP address associated with the SP can only be used while the SP is associated with a blade.
Both can be used. I dont believe there is a best practice for their assignment.
Thank You,
Dan Laden
Cisco PDI Data Center
Want to know more about how PDI can assist you?
http://www.youtube.com/watch?v=4BebSCuxcQU&list=PL88EB353557455BD7
http://www.cisco.com/go/pdihelpdesk

Hyper-V Static MAC Address Best Practice

Hi guys,
Looking for some advice please..
We have several VM's running within a 6 node cluster that run an application which keeps losing it's license whenever the LAN MAC changes i.e. when the VM moves to a new node.
The obvious solution is to set these VM's with a STATIC MAC address however I have a few questions.
1. Is there a 'private' range I can use to ensure that we never see any conflicts?
2. What's the best way to implement this change? simply power off each machine and manually edit the settings or can I use SCVMM?
3. Will the VM's lose there current network card settings? static ip etc?
4. Will VM's set with a static MAC still fail over to other nodes?
Many thanks for your help
Robbie

For an answer you're much better off posting in the Hyper-V forum here:
https://social.technet.microsoft.com/Forums/en-US/winserverhyperv/threads
This forum is for Virtual Server 2005, no similarities to Hyper-V.

Planning for CAS Array with DAG intergation on Exchange 2010

We currently have 2 Exchange servers and have plans to add 2 more servers so it will be 2 servers with DAG and 2 servers with CAS array
Here is our current setup: EX01 has HUB, CAS and MAILBOX roles EX02 has MAILBOX only with DAG configured between 2 servers.
Should I install another Exchange (EX03) with Mailbox role and remove it from EX01 and then have another EX04 to setup CAS array? What is the best practice ?
alex serdyukov

Hi,
In your case, you can install another Exchange (EX03) with Mailbox role and remove Mailbox role from EX01 and then have another server EX04 to setup CAS array.
Then you can deploy DAG using server EX02 and EX03, and add server EX01 and EX04 to CAS array.
Best regards,
Belinda Ma
TechNet Community Support

Best Practice For SAP CRM Case Management

Hi,
Could someone please point to best practices for CRM Case Management. I have lokked all over and I found all the best practices except for case management.
Your assistance will be appreciated.
Martin

Hi Martin,
I was just working on case management and there is no best practice documentation but the following link was most helpful.
http://help.sap.com/saphelp_nw04/helpdata/en/5c/5d79287a9afc47a62e5197b582cc97/frameset.htm
Let me know if you need further assistance.

Best Practice Document required for MDM

Hi All,
I am currently working on MDM and need best practice document so that I can create a prototype for the customer.
In case SAP is not having any Best Practice doc, please share if you have any similar doc used or created for your project.
It would help me to create good prototype.
Thanks in advance,
Vikas

Hello Vikas
More information about SAP MDM Best Practices you can find there:
http://ecohub.sdn.sap.com/irj/ecohub/solutions/sitamdm
and there
http://www.sdn.sap.com/irj/scn/shop?rid=/media/uuid/904351ff-3583-2c10-79a2-dc56735b5ec9
Regards
Kanstantsin Chernichenka

Best Practice for BEX Query "PUBLISH to ROLE"?

Hello.
We are trying to determine the best practice for publishing BEX queries/views/workbooks to ROLEs.
To be clear of the process I am referring: from the BEX Query Designer, there is an option QUERY>PUBLISH>TO ROLE. This function updates the user menu of the selected security role with essentially a shortcut to the BEX query. It is also possible to save VIEWS/WORKBOOKS to a role from the BEX Analyzer menu. We have found ROLE menus to be a good way to organize BEX queries/views/workbooks for our users.
Our dilemma is whether to publish to the role in our DEV system and transport to PROD,... or if it is ok to publish to the role directly in the PROD system.
Publishing in DEV is not always possible, as we have objects in PROD that do not exist in DEV. For example, we allow power users to create queries directly in PROD. We also allow VIEWS and WORKBOOKS to be created directly in PROD. It would not be possible to publish types of objects in DEV.
Publishing in PROD eliminates the issues above, but causes concerns for our SECURITY team. We would be able to maintain these special roles directly in PROD.
Would appreciate any ideas, suggestions, examples of how others are handling this BEX publish-to-role process.
Thank you.
-Joel

Hi Joel,
Again as per the Best Practices.Nothing to be created in PRD,even if we create them in PRD for Power users its assumed as temprory and can be deleted at any time.
So if there are already deviations then you can go for deviations in this case as well but it wont be the Best Practice.Also in few cases we have workbooks created in PRD as they cud nt be created in DEV due to various reasons...in such cases we did not think of Best Practice ,we had a raised an OSS on this aswell.
In our Project,we have done everything in DEV and transported to PRD,in case there were any very Minor changes at query level we have done in PRD and immedialtely replicated the same in DEV so that they are in SYNC.
rgds
SVU

FWSM interface monitoring and best practices documentation.

Hello everyone
I have a couple of questions regarding vlan interface monitoring and best practices specifically for this service module.
I couldn’t find a suggestion or guideline as for how to define a VLAN interface on a management station. The FWSM total throughput is 5.5gbs and the interfaces are mapped to vlans carried on trunks over 10gb etherchannels. Is there a common practice, or past experience, to set some physical parameters to logical interfaces? "show interface" command states BW as unknown.
Additionally, do any of you have a document addressing best practices for FWSM? I have this for other platforms and general recommendations based on newer ASA versions but nothing related to FWSM.
Thanks a lot!
Regards
Guido

Hi,
If you are looking for some more command to check for the throughput through the module:-
show firewall module <number> traffic
Also , I think as this is End of life , you might have to check for some old documentation from Cisco on the best practices.
http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/prod_white_paper0900aecd805457cc.html
https://supportforums.cisco.com/discussion/11540181/ask-expertconfiguring-troubleshooting-best-practices-asa-fwsm-failover
Thanks and Regards,
Vibhor Amrodia

Soa 11g best practices

Is there some Oracle doc describing best practices for SOA Suite 11g
Thanks - casey

THANKS - looks like a great series of articles.
Am also looking for a document that specifically address Best Practices for 11g SOA in the same vein as for 10g.
Thanks - Casey

Creating a cas array for exising prd mailbox servers

Hi
one of the production site in current environment , mbx databases rpcclientaccess server set as individual cas servers .
we want to point these databases to a cas array ,NLB is already created now remaining is cas array and point the database to cassarry fqdn.
I just want to know when we do this change , any client re-configuration is required or automatically redirection will happen to cas arary from outlook client.
Regards

I just want to know when we do this change , any client re-configuration is required or automatically redirection will happen to cas arary from outlook client.
Hi,
I'm afraid that you need to manual re-configuration from outlook client.
I recommend you refer to the following article:
Demystifying the CAS Array Object - Part 2
5.A CAS array object should not be configured after creating Exchange Server 2010 databases
The profile will not update itself because the client will not receive an
ecWrongServer response from CAS. It will not receive this response because any CAS is a valid connection point for any mailbox database via RPC (over TCP) so clients can survive datacenter switchover/failover events without being reconfigured and all
an admin has to do is flip the CAS array object DNS record to point to a surviving pool of CAS. Currently the only way to fix mailbox profiles would be a manual profile repair within Outlook, by publishing an Office PRF file via GPO (not going to work for
non-domain joined machines), or by decommissioning the CAS server named in the users’ profiles so the endpoint is no longer available. This last option should (test test test!!) trigger a full profile repair by Autodiscover in Outlook 2007 or Outlook 2010.
Outlook 2003 is only repairable with a profile repair or a PRF file. Autodiscover will not as of this article’s writing update a profile to a new server name as part of the normal Autodiscover process which updates the Outlook Anywhere configuration and discovers
EWS URLs for other features such as OOF Management, Free/Busy, and Inbox Rules management.
Hope this helps!
Thanks.
Niko Cheng
TechNet Community Support

Best practices of having a different external/internal domain

In the midst of migrating from a joint Windows/Mac server environment to a completely Apple one. Previously, DNS was hosted on the Windows machine using the companyname.local internal domain. When we set up the Apple server, our Apple contact created a new internal domain, called companyname.ltd. (Supposedly there was some conflict in having a 10.5 server be part of a .local domain - either way it was no worries either way.) Companyname.net is our website.
The goal now is to have the Leopard server run everything - DNS, Kerio mailserver, website, the works. In setting up the DNS on the Mac server this go around, we were advised to just use companyname.net as the internal domain name instead of .ltd or .local or something like that. I happen to like having a separate local domain just for clarity's sake - users know if they are internal/external, but supposedly the Kerio setup would respond much better to just the one companyname.net.
So after all that - what's the best practice of what I should do? Is it ok to have companyname.net be the local domain, even when companyname.net is also the address to our external website? Or should the local domain be something different from that public URL? Or does it really not matter one way or the other? I've been running companyname.net as the local domain for a week or so now with pretty much no issues, I'd just hate to hit a point where something breaks long term because of an initial setup mixup.
Thanks in advance for any advice you all can offer!

Part of this is personal preference, but there are some technical elements to it, too.
You may find that your decision is swayed by the number of mobile users in your network. If your internal machines are all stationary then it doesn't matter if they're configured for companyname.local (or any other internal-only domain), but if you're a mobile user (e.g. on a laptop that you take to/from work/home/clients/starbucks, etc.) then you'll find it a huge PITA to have to reconfigure things like your mail client to get mail from mail.companyname.local when you're in the office but mail.companyname.net when you're outside.
For this reason we opted to use the same domain name internally as well as externally. Everyone can set their mail client (and other apps) to use one hostname and DNS controls where they go - e.g. if they're in the office or on VPN, the office DNS server hands out the internal address of the mail server, but if they're remote they get the public address.
For the most part, users don't know the difference - most of them wouldn't know how to tell anyway - and using one domain name puts the onus on the network administrator to make sure it's correct which IMHO certainly raises the chance of it working correctly when compared to hoping/expecting/praying that all company employees understand your network and know which server name to use when.
Now one of the downsides of this is that you need to maintain two copies of your companyname.net domain zone data - one for the internal view and one for external (but that's not much more effort than maintaining companyname.net and companyname.local) and make sure you edit the right one.
It also means you cannot use Apple's Server Admin to manage your DNS on a single machine - Server Admin only understands one view (either internal or external, but not both at the same time). If you have two DNS servers (one for public use and one for internal-only use) then that's not so much of an issue.
Of course, you can always drive DNS manually by editing the zone files directly.

Best practice for Global Address?

Good Morning,
I am new to Cisco firewalls and would like to know what is the best practice for creating an external ip address and port into my network and then redirecting that to a specific machine. I am thinking of using a global ip address and then only allowing this type of traffic to talk to the specific destnation and on that specific port. Is this the correct course of action? Or os there a better or more effecient way of allowing this process using ADSM.
Troy
Message was edited by: Troy Currence

Hi,
Basically when you are attempting to allow traffic from the external public network to some of your servers/hosts you will either use Static NAT or Static PAT
Static NAT is when you bind a single public IP address to be used by only one internal host. This is usually the preferred option if you can spare a single public IP address for your server, meaning you probably have a small public subnet from your ISP.
Static PAT is when you only allocate certain ports on your public IP address and map them to a local port on the host. This is usually the option when you only have a single public IP address that is configured on your ASAs external interface. Or perhaps in a situation when you just want to conserver your public IP addresses even though you might have a few of them.
In Static NAT case you configure the Static NAT and use the interface ACL to allow the services you require.
In Static PAT you only create a translation for a specific port/service so only connections to that port are possible. Naturally you will also have to allow those services/ports in the interface ACL just like with Static NAT.
Again if you can spare the public IP addresses then I would go with Static NAT or if you only have a single or few IP addresses you can consider Static PAT (Port Forward) also.
I dont personally use ASDM for configurations but can help you with the required CLI format configurations. These can actually be done through ASDM also from the Tools -> Command Line Interface menus at the top.
Hope this helps
- Jouni

DNS pointing to both internal and external addresses

I am currently going through the very helpful lynda.com OS X Server 10.5 videos to set up an Advanced Server from the ground up.
DNS was set up first and for the most part everything has gone for me just like Sean shows in the movies.
Our company's domain name is automaticduck.com so I have been setting up DNS records for our internal network to some of the machines, for example the Xserve I'm configuring is called duckxserve.automaticduck.com and it points to the proper internal IP address. I set up my MacBook Pro OS X Client system to use the new DNS server on duckxserve and while it works for getting around the internal network now I'm having problems connecting to outside addresses on our domain such as www.automaticduck.com and support.automaticduck.com. If I remove the internal Xserve from my client's DNS servers list I am able to get out again.
I thought I would be smart and add A NAME records to my internal DNS server with the external IP addresses, however this didn't change anything, I still couldn't get out to them.
We are NOT hosting our own web site and email etc., we have DNS set up through our web host with A NAME, C NAME and MX records for various servers that are exposed to the outside world.
My intention based on my understanding was that with the setup of this internal Xserve running DNS it would simply serve DNS records to the internal network. How can my set up my internal DNS to it does not conflict with my ability to get out to our outside public addresses?
Message was edited by: Wes Plate

Antonio Rocco wrote:
Add your ISP DNS Addresses to the forwarders section and that should be it.
Thank you for the reply, Tony.
If I set up the forwarders section* can I just not include information about our automaticduck.com servers that are not on our internal network? It seems to me (not that I know anything about this) that if our internal DNS server does not know about www.automaticduck.com or support.automaticduck.com then requests for those addresses should get passed on to our ISP's name servers*, right?
*68.238.128.12, 68.238.64.12
This doesn't work like I thought it would.
I have my client set up to use my new internal DNS server's IP address for a DNS server and I am able to get to the local machines defined therein (like http://wesworkg5/ ), however I cannot get to my outside sites... www.automaticduck.com or support.automaticduck.com (I can't even get to discussions.apple.com for some reason).
I can get to other outside sites that I've never been to before (so I know they have to get looked up), like whitehouse.gov or harvard.edu or almondjoy.com
The DNS log doesn't show me anything, maybe it isn't supposed to in a case like this.
Whatcha think? Thank you so much.

Best Practice on Not Exposing your internal FQDN to the outside world

Exchange server 2010, sits in DMZ, internet facing. The server is currently using the Default Receive Connector. This exposes the internal fqdn to the outside world (ehlo). Since you should not (can't) change the FQDN on your Default Receive connector, what
is the best practice here?
The only solution I can see is the following:
1. Change the Network on the Default Receive Connector to only internal IP addresses.
2. Create a new Internet Receive Connector port 25 for external IP addresses (not sure what to put in Network tab?) and use my external FQDN for ehlo responses (e.g. mail.domain.com)
3. What do I pick for Auth and Permissions, TLS and Annoymous only?
Michael Maxwell

Yes, it fails PCI testing/compliance. I shouldn't be able to see my internal server and domain. I understand that is the recommendation, but my client doesn't want to host in the cloud or go with a Trend IHMS (trust me I like that better, but its
not my choice). I have to work with the deck of cards dealt to me. Thanks, just want a solution with what I have now.
Michael Maxwell
Understand. I wont go into the value of those tests :)
If the customer is really concerned about exposing the internal name, then create a new receive connector with a different FQDN ( and corresponding cert) for anonymous connections as you mention above. Know that it also means internal clients
can connect to the server on port 25 as well if you dont have the ability to scope to set of ip addresses ( i.e. a SMTP gateway).
The internal names of the servers will also be in the internet headers of messages sent out:
http://exchangepedia.com/2008/05/removing-internal-host-names-and-ip-addresses-from-message-headers.html
http://www.msexchange.org/kbase/ExchangeServerTips/ExchangeServer2007/SecurityMessageHygiene/HowtoremoveinternalservernamesandIPaddressesfromSMTPheaders.html
Twitter!:
Please Note: My Posts are provided “AS IS” without warranty of any kind, either expressed or implied.

Best Practice: Storing an array in MySQL

Hi,
I'm working on an app that uses Flex 2, Coldfusion and MySQL.
I'd like to store an array (or in this case an ArrayCollection)
into my db. I'm not totally sure if I can do this. I read something
about PHP having an implode command but I'm wondering what the best
practice would be for trying to get an array into MySQL via
ColdFusion.
I'd be grateful for any advice.
Novian

Thanks, mike_the_maven.
I'm not familiar with that tag but I'll definitely look into.
I'm also wondering about potentially storing my ArrayCollection as
a BLOB in MySQL. Any thoughts about this approach?
Thanks.
Novian

CAS array internal DNS IP address best practice

Similar Messages

Maybe you are looking for