Home / user-145357

gmazoyer's questions

Martin Hope
gmazoyer
Asked: 2018-06-02 05:13:22 +0800 CST
  • 0

I'm currently trying to setup a DHCP server to use it in a ZTP environment. My first goal is to be able to upgrade my Juniper devices automatically based on the hardware.

What I'm really trying to achieve is to dispatch the proper JUNOS software to the proper Juniper hardware. For example, a MX104 should download an MX104 targeted image and an EX4550 should download an EX4550 targeted image.

Until now, I have setup a DHCP server successfully with ISC's one. But that pretty simple until here.

Now I'm trying to play with classes and pools to match vendor-class-identifier set set it to the proper pool.

My DHCP server configuration is the following:

option domain-name "example.com";
option domain-name-servers 8.8.8.8, 8.8.4.4;
option domain-search "example.com";

set vendor-string = option vendor-class-identifier;
option ztp-file-server code 150 = { ip-address };
option space ztp-ops;
option ztp-ops.image-file-name code 0 = text;
option ztp-ops.config-file-name code 1 = text;
option ztp-ops.image-file-type code 2 = text;
option ztp-ops.transfer-mode code 3 = text;
option ztp-ops-encapsulation code 43 = encapsulate ztp-ops;

class "juniper-mx10003" {
  match if substring(option vendor-class-identifier, 0, 15) = "Juniper-mx10003";
}

subnet 10.24.0.0 netmask 255.255.0.0 {
  default-lease-time 600;
  max-lease-time 86400;
  option routers 10.24.0.1;
  range 10.24.254.0 10.24.254.254;
  # Address pool(s)
  pool {
    range 10.24.253.0 10.24.253.10;
    allow members of "juniper-mx10003";
    option ztp-file-server 10.24.1.2;
    option ztp-ops.transfer-mode "http";
    option ztp-ops.image-file-name "/junos-vmhost-install-mx-x86-64-18.1R1.9.tgz";
  }
}

And I have a Juniper configuration for my MX10003 like the following:

system {
    root-authentication {
        encrypted-password "YEAH"; ## SECRET-DATA
    }
    syslog {
        user * {
            any emergency;
        }
        file messages {
            any notice;
            authorization info;
        }
        file interactive-commands {
            interactive-commands any;
        }
    }
}
interfaces {
    fxp0 {
        unit 0 {
            family inet {
                dhcp {
                    vendor-id Juniper-mx10003;
                }
            }
        }
    }
}

When booting or clearing and requesting a lease, the MX is asking for an IP address but this is one of the range from 10.24.254.0 to 10.24.254.254 which is assigned and not from 10.24.253.0 to 10.24.253.10.

I tried dumping the DHCP exchanges with dhcpdump and here is what it finds:

  TIME: 2018-06-01 15:07:50.357
    IP: 0.0.0.0 (d8:18:d3:1e:a9:66) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         1 (DHCPDISCOVER)
OPTION:  60 ( 15) Vendor class identifier   Juniper-mx10003
OPTION:  51 (  4) IP address leasetime      86400 (24h)
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.297
    IP: 10.24.1.2 (0:c:29:8:a6:dd) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 2 (BOOTPREPLY)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 10.24.254.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         2 (DHCPOFFER)
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  51 (  4) IP address leasetime      86400 (24h)
OPTION:   1 (  4) Subnet mask               255.255.0.0
OPTION:   3 (  4) Routers                   10.24.0.1
OPTION:   6 (  8) DNS server                8.8.8.8,8.8.4.4
OPTION: 119 ( 30) Domain Search             0a6c75786e657477 .example
                                            6f726b0269       .com.
OPTION:  15 ( 13) Domainname                example.com
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.302
    IP: 0.0.0.0 (d8:18:d3:1e:a9:66) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 1 (BOOTPREQUEST)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 0.0.0.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  55 ( 14) Parameter Request List      3 (Routers)
                                             51 (IP address leasetime)
                                              1 (Subnet mask)
                                             15 (Domainname)
                                              6 (DNS server)
                                             66 (TFTP server name)
                                             67 (Bootfile name)
                                            120 (SIP Servers DHCP Option)
                                             44 (NetBIOS name server)
                                             43 (Vendor specific info)
                                            150 (???)
                                             12 (Host name)
                                              7 (Log server)
                                             42 (NTP servers)

OPTION:  50 (  4) Request IP address        10.24.254.0
OPTION:  53 (  1) DHCP message type         3 (DHCPREQUEST)
OPTION:  60 ( 15) Vendor class identifier   Juniper-mx10003
OPTION:  51 (  4) IP address leasetime      86400 (24h)
---------------------------------------------------------------------------

  TIME: 2018-06-01 15:07:51.398
    IP: 10.24.1.2 (0:c:29:8:a6:dd) > 255.255.255.255 (ff:ff:ff:ff:ff:ff)
    OP: 2 (BOOTPREPLY)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: 52cccd10
  SECS: 0
 FLAGS: 7f80
CIADDR: 0.0.0.0
YIADDR: 10.24.254.0
SIADDR: 0.0.0.0
GIADDR: 0.0.0.0
CHADDR: d8:18:d3:1e:a9:66:00:00:00:00:00:00:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         5 (DHCPACK)
OPTION:  54 (  4) Server identifier         10.24.1.2
OPTION:  51 (  4) IP address leasetime      86400 (24h)
OPTION:   1 (  4) Subnet mask               255.255.0.0
OPTION:   3 (  4) Routers                   10.24.0.1
OPTION:  15 ( 13) Domainname                example.com
OPTION:   6 (  8) DNS server                8.8.8.8,8.8.4.4
---------------------------------------------------------------------------

Did anybody try to do the same thing? Maybe there something obvious that I am missing?

debian
Martin Hope
gmazoyer
Asked: 2016-05-09 15:02:33 +0800 CST
  • 4

I have a problem when trying to transfer a full zone from a PowerDNS server to a Bind9 one. The weird part is that there are several zones on the PowerDNS server which serves as a hidden master (with a MySQL backend) but only one zone is failing to be transfered to the Bind9 server.

The two servers are running Ubuntu 16.04 LTS. With:

  • Bind9 version = 9.10.3.dfsg.P4-8ubuntu1
  • PowerDNS version = 4.0.0~alpha2-3build1

The Bind9 slave zone is configured like this:

zone "example.net" {
    type slave;
    file "/var/lib/bind/slaves/db.example.net";
    masters {
          10.0.0.1;
    };
};

And the DNS zone from PowerDNS is:

% sudo pdnsutil show-zone example.net
This is a Master zone
Last SOA serial number we notified: 2016050801 == 2016050801 (serial in the database)
Zone is not actively secured
Metadata items: None
No keys for zone 'example.net.'.

% sudo pdnsutil list-zone example.net
example.net.    10800   IN  MX  10 mx1.example.org.
example.net.    10800   IN  MX  50 mx2.example.org.
example.net.    10800   IN  NS  ns1.example.org.
example.net.    10800   IN  NS  ns2.example.org.
example.net.    86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...

Note the difference between .net and .org in this output. And here is the PowerDNS output in the log while trying to provide the zone to Bind.

May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May  9 00:44:14 hdns01 pdns[40494]: AXFR of domain 'example.net.' failed: not authoritative

And the corresponding logs given by Bind.

May  9 00:44:14 rdns01 named[32973]: zone example.net/IN: refresh: unexpected rcode (REFUSED) from master 10.0.0.1#53 (source 0.0.0.0#0)
May  9 00:44:14 rdns01 named[32973]: zone example.net/IN: Transfer started.
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: connected using 10.0.0.2#55376
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: failed while receiving responses: NOTAUTH
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer status: NOTAUTH
May  9 00:44:14 rdns01 named[32973]: transfer of 'example.net/IN' from 10.0.0.1#53: Transfer completed: 0 messages, 0 records, 0 bytes, 0.004 secs (0 bytes/sec)

So Bind9 is saying that the server is not authoritative. That's weird. So lets use dig to make things a little bit clear.

% dig @10.0.0.1 example.net. SOA          

; <<>> DiG 9.10.3-P4-Ubuntu <<>> @10.0.0.1 example.net. SOA
; (1 server found)
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47002
;; flags: qr aa rd; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; WARNING: recursion requested but not available

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1680
;; QUESTION SECTION:
;example.net.           IN  SOA

;; ANSWER SECTION:
example.net.        86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400

;; Query time: 2 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:53:51 CEST 2016
;; MSG SIZE  rcvd: 104

Seems pretty authoritative to me. So after that I tried to do an AXFR with dig. And surprise it works...

% dig -t axfr example.net @10.0.0.1

; <<>> DiG 9.10.3-P4-Ubuntu <<>> -t axfr example.net @10.0.0.1
;; global options: +cmd
example.net.        86400   IN  SOA ns1.example.org. hostmaster.example.org. 2016050801 28800 7200 604800 86400
...
;; Query time: 73 msec
;; SERVER: 10.0.0.1#53(10.0.0.1)
;; WHEN: Mon May 09 00:56:42 CEST 2016
;; XFR size: 58 records (messages 3, bytes 1952)

I don't know where to look anymore.

Thanks for your help.

UPDATE:

Logs from a packet capture:

1   0.000000    10.0.0.2    10.0.0.1    DNS 82  Standard query 0xe0dd SOA example.net OPT
2   0.002902    10.0.0.1    10.0.0.2    DNS 82  Standard query response 0xe0dd Refused SOA example.net OPT
6   0.004506    10.0.0.2    10.0.0.1    DNS 97  Standard query 0x205c AXFR example.net
8   0.006432    10.0.0.1    10.0.0.2    DNS 97  Standard query response 0x205c Not authoritative AXFR example.net

PowerDNS logs from a successful manual AXFR:

May  9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' initiated by 10.0.0.2
May  9 08:19:51 hdns01 pdns[40494]: AXFR of domain 'example.net.' allowed: client IP 10.0.0.2 is in allow-axfr-ips
May  9 08:19:52 hdns01 pdns[40494]: AXFR of domain 'example.net.' to 10.0.0.2 finished

PowerDNS config file:

#################################
# allow-axfr-ips    Allow zonetransfers only to these subnets
#
allow-axfr-ips=127.0.0.0/8,::1,10.0.0.2

#################################
# also-notify   When notifying a domain, also notify these nameservers
#
also-notify=10.20.1.78,10.0.0.2

#################################
# daemon    Operate as a daemon
#
daemon=yes

#################################
# include-dir   Include *.conf files from this directory
#
# include-dir=
include-dir=/etc/powerdns/pdns.d

#################################
# launch    Which backends to launch and order to query them in
#
# launch=
launch=

#################################
# master    Act as a master
#
master=yes

#################################
# setgid    If set, change group id to this gid for more security
#
setgid=pdns

#################################
# setuid    If set, change user id to this uid for more security
#
setuid=pdns

And the MySQL backend config part inside the /etc/powerdns/pdns.d/ directory.

# MySQL Configuration
#
# Launch gmysql backend
launch+=gmysql

# gmysql parameters
gmysql-host=127.0.0.1
gmysql-port=
gmysql-dbname=pdns
gmysql-user=MYUSER
gmysql-password=MYPASSWORD
gmysql-dnssec=yes
# gmysql-socket=
ubuntu domain-name-system bind powerdns