You can configure the NetCache appliance for deployment in enterprise environments that require the appliance to authenticate to Microsoft Windows 2000 without using DNS as a name server. For this type of deployment, the appliance does not use the Server Message Block (SMB) over port 139 to maintain its machine account within the Microsoft Windows 2000 domain. (However, it can use the SMB port to authenticate clients. SMB is used for communication between hosts.) Instead, the appliance uses LDAP and Kerberos to maintain its machine account, and it is for this reason that the appliance must know their location.
Given these circumstances, the appliance must be able to locate the Microsoft Windows 2000 Kerberos and LDAP services. Recall that Kerberos is used to authenticate hosts and users (in this case, the NetCache), and LDAP is used to provide generalized access to domain information.
The DNS server stores the locations of these services in special records called Service Location Resource (SRV) records. These records allow a network to register its location and services with DNS, which then queries the records for the location (IP address) of a service when it is required.
This section describes how you can override use of DNS in joining the appliance to the Microsoft Windows 2000 domain by specifying the IP addresses and other information for Microsoft Windows 2000 domain account setup.
Joining the NetCache appliance to a Microsoft Windows 2000 domain without using DNS requires that you identify a set of hosts that export services required to join the domain and authenticate the appliance to it.
Windows 2000 servers can export any of four types of services, shown in the following table. For each of these services, special records are stored in DNS that a Windows 2000 host uses to locate the servers exporting the services it requires. Because DNS is not available, the NetCache must specify information about the hosts as shown in the following table.
Note
Most often all of these services are exported by the same host.
The NetCache appliance authenticates itself to the Microsoft Windows 2000 domain using Kerberos authentication. Kerberos is based on a ticket-granting service, which runs on a Kerberos Key Distribution Center (KDC). The KDC provides session keys for authentication, authenticates the client and server, and grants tickets which assert the user's identity and include other security data. Among the information you must provide are addresses to the KDC and Kerberos password servers to be used.
You can join the appliance to the domain using either the Appliance Manager or the CLI (see Procedures and option descriptions).
To join a Microsoft Windows 2000 domain without using DNS, you must provide the following information.
Copyright © 1994-2002, Network Appliance, Inc. All rights
reserved.
Part No. 210-00370
File: auth16.htm
Last updated: 11/12/02 11:23:17