DNS, DHCP, and Name Resolution Questions

Approach (brief)
Create an SVI on the L2 switch for VLAN 20 so clients have gateway, trunk to router carrying VLAN 20, and configure router-on-a-stick subinterface with ip helper-address pointing to the DHCP server.

Switch SVI / VLAN config

interface Vlan20
 description Clients-VLAN-20
 ip address 10.20.20.1 255.255.255.0
 no shutdown

interface GigabitEthernet1/0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk

Router (router-on-a-stick) subinterface

interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 10.20.20.254 255.255.255.0
 ip helper-address 10.0.0.10   ! forwards DHCP & other UDP services
 no shutdown

Why ip helper-address / behavior to check when no lease

• DHCP uses UDP: client -> server uses source UDP 68 dest UDP 67; server replies src 67 dst 68.
• Router relay receives client broadcast (DHCPDISCOVER) and unicasts to 10.0.0.10 with giaddr = 10.20.20.254; server uses giaddr to allocate correct subnet.
• If clients get no address check:
  • Is trunk up and VLAN 20 allowed between switch and router?
  • Is SVI up and correct IP/mask?
  • ACLs or firewall blocking UDP ports 67/68 on path to 10.0.0.10.
  • Confirm helper configured on correct subinterface and that server responds to giaddr subnet.
  • Use packet captures / debug:
    • On router: debug ip dhcp server packets / debug ip packet detail to see forwarded UDP 67.
    • On server: check received packet source and giaddr.
  • Check ARP: router must ARP for client when replying (if relay, server reply returns to router which forwards to client).
• Optional: consider DHCP Relay Agent Information (option 82) if server expects it; can disable or configure appropriately.

Situation & goals (brief)
Design DNS for hybrid cloud so internal-only services remain private, public services resolvable externally, and service discovery supports dynamic services securely.

Key concepts

• Split-horizon DNS: Maintain separate internal and external zones with same names but different records; internal views include private IPs and SRV records, external view exposes public A/AAAA or proxied endpoints.
• Forwarding: Internal DNS servers forward unknown queries to upstream (e.g., cloud DNS or ISP). Use stub/forwarders to reduce recursion and improve performance.
• Conditional forwarding: Route queries for specific domains (on-premises, cloud VPC) to the authoritative DNS in that environment—useful for .internal.company or cloud.local zones.
• Service discovery: Use SRV records or a service registry (Consul/Eureka) for dynamic ports/IPs; registries integrate with DNS (DNS interface or DNS-SD) for health-aware responses.

Design (practical)

• On-prem DNS cluster runs split-horizon views: internal zone with private records + SRV for services; external authoritative DNS (managed DNS provider) holds public records.
• Conditional forwarders: on-prem DNS forwards cloud-specific zones to cloud VPC DNS (or Private Hosted Zone) and cloud DNS forwards on-prem zones over secure DNS peering.
• Service registry for dynamic services: deploy Consul with ACLs and mTLS; expose service entries into internal DNS via Consul DNS interface. Use SRV for protocols needing port discovery.
• Security: DNS over TLS/HTTPS between sites or DNS forwarding over IPsec/VPN; DNSSEC externally; RBAC and ACLs on registries; restrict zone transfers (AXFR) to authorized servers; firewall rules to permit only trusted resolvers.

Example flow
Client queries db.internal.company → internal view returns private A and SRV via local DNS/Consul. External client queries api.company.com → public DNS returns load balancer IPs. Cross-site lookup for svc.cloud.local → conditional forward to cloud VPC DNS over secure peering.

Trade-offs

• Split-horizon adds operational complexity and risk of drift—automate with IaC.
• Registries add reliability and security overhead but enable health-aware discovery.

This design keeps internal services private, exposes only intended services publicly, and provides scalable, secure service discovery across hybrid environments.