-
Title
When a Domain Controller (DC) goes offline or is unreachable, what does Authentication Services do? How does it determine what DC to talk to? -
Description
This knowledge article is to describe the behaviour of Authentication Services when a domain controller (DC) goes offline or is unreachable.
How does Authentication Server determine what domain controller to communicate to?
Will Authentication Services failover to another domain controller when the one it is talking to goes offline?
How to Increase DC fail over speed during DNS/AD outage?
-
Resolution
If the Domain Controller (DC) goes offline, Authentication Services will automatically failover to another available DC.
When Authentication Services needs to connect to a new DC, it examines the DCs it knows about, and selects an available DC using the following:- Vas.conf realms section after the failed DC.
- Random in-site DC.
- Random out of site DC.
If no new DC can be found, QAS goes into "disconnected mode", where it will try every 30 seconds to find an available DC to communicate with.
Additional Information:
In scenarios where DNS becomes slow or unavailable we become dependent on the operating system to move to the secondary DNS server efficiently. Since we are making those calls to the OS and if DNS is slow then there are some timeout settings within QAS in the man pages (i.e., the man page for vas.conf). The settings are set as "efficient: by default:1. mscldap-timeout =
Default value: 1
This option controls the timeout when performing a MSCLDAP ping against Active Directory Domain Controllers to determine site membership. In environments with long latencies, you may want to increase the default timeout. This timeout determines how long the VAS API should wait for any response from the available set of Domain Controllers for a given domain. However, when modifying this value, careful attention should be made with respect to other timeout settings. For example, a mscldap-timeout that equals vascache-ipc-timeout could affect the ability of vasd to resolve objects within the IPC timeout period.
2. server-unreachable-retry-max =
Default value: 1
Domain Controller Unreachable Threshold. Once a VAS client determines that it cannot reach a specific domain controller it is marked as unreachable for a period of time. During this period you are guaranteed not to attempt to connect to the unreachable domain controller.3. kdc_timeout =
Default value: 3This option controls the timeout value for waiting for a response from a KDC. You may need to increase the default value for environments that have high latency connections to Active Directory Domain Controllers. Note that when use-tcp-only is true (the default), a single attempt to connect using TCP is made. If use-tcp-only is false, the first UDP connection attempt will time out based on this value, and remaining attempts will be done using TCP. The following example shows how to increase kdc_timeout to 5 seconds.[libdefaults]kdc_timeout = 54. max_retries =
Default value: 3This option controls how many attempts to contact each KDC will be made when trying to communicate. Note that retries are only performed when use-tcp-only is false, but the max_retries value is used to determine the total timeout for a TCP connection. When use-tcp-only is false, the first attempt will be performed using UDP; if no response is received from the KDC, the connection will automatically try the remaining max_retries with TCP. The following example shows how to decrease the max_retries to 2.[libdefaults]max_retries = 2
Commands to troubleshoot issue:
1. 'vastool status dc' will provide status information about known domain controllers in the forest. If the -d domain option is not used, all DC's in the forest will be checked. -p will perform a MSCLDAP ping. -u will perform a generic authenticated ldap search. -a will perform an anonymous ldap search, however, post 2000 Active Directory DC's do not allow any anonymous search and this ability is often disabled in most environments. If no options are specified, all tests will be performed.
2. 'vastool info servers'
Servers type = DC, domain = cs-unix.ca, site = Halifax:dc-03.cs-unix.ca
dc-01.cs-unix.ca
dc-02.cs-unix.ca
3. 'vastool info cldap dc-03.cs-unix.ca'Server IP: 10.4.66.88
Server Forest: cs-unix.ca
Server Domain: cs-unix.ca
Server Hostname: dc-03.cs-unix.ca
Server Netbios Domain: CS-UNIX
Server Netbios Hostname: DC-03
Server Site: Halifax
Client Site: Halifax
Flags: GC LDAP DS KDC CLOSE_SITE WRITABLE
Query Response Time: 0.0024 seconds