On-Premise to Azure communication: DHCP and DNS issues

Brass Contributor

Hi All,

We have an on premise network, consisting for 3 sites (Site-A, Site-B and Site-C) . Site-B hosts all the server infrastructure consisting of our domain controllers (AD DS), DNS and DHCP services. As part of moving our server infra to Azure, we have  connected our on-prem network to Azure via express route. We, then spun up a domain controller in Azure and moved all the FSMO roles to it. Also, the DC in Azure hosts DNS and DHCP services as well.

IM3.JPG

The plan is to decommission any on-prem server infrastructure that is hosted at Site-B.

To start with the decommissioning process, we want to make sure that the other sites (i.e. Site-A and Site-C) can reach out to the DC|DNS|DHCP server in Azure even if Site-B is offline. For this, we asked our telco provider who manages our network infra (such as routers, express route between on-prem and Azure) to add the IP address of our Azure domain controller to the IP helpers on the routers. In addition, for Site-A and Site-C, we have added the Azure domain controller IP address to the DNS servers in DHCP scopes. 

As a test, when we got our Site-B offline. The result was the devices on Site-A and Site-C weren't getting any of the AD DS, DHCP and DNS services. As soon as Site-B was brought online, the services resumed.

My question is that what is causing the behaviour i.e. all communications and services follow via Site-B?

Thanks in advance.

2 Replies

Sorry I had my network diagram wrong. I had a chat with the networks team this morning and they said that all sites (Site-A, Site-B and Site-C) are connected to the MPLS network which is then connected to Azure via express route.

the rest of the description remains the name as per my original question.

here is the updated\correct network diagram:

IM4.JPG

If nothing is working I'd start by validating the route;

  • tracert xxx.xxx.xxx.xxx
  • check the problematic ones are using the correct DNS servers on connection properties
  • also check the required ports are open site to site. 

https://support.microsoft.com/en-us/help/179442/how-to-configure-a-firewall-for-domains-and-trusts

https://www.microsoft.com/en-us/download/details.aspx?id=24009