Microsoft KB Archive/919218

= A firewall that performs payload inspection may block zone transfers by Windows Server 2003-based DNS servers =

Article ID: 919218

Article Last Modified on 10/11/2007

-

APPLIES TO


 * Microsoft Windows Server 2003, Datacenter Edition for Itanium-Based Systems
 * Microsoft Windows Server 2003, Enterprise Edition for Itanium-based Systems
 * Microsoft Windows Server 2003, Datacenter x64 Edition
 * Microsoft Windows Server 2003, Enterprise x64 Edition
 * Microsoft Windows Server 2003, Standard x64 Edition
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Web Edition

-





SYMPTOMS
Consider the following scenario:
 * A Microsoft Windows Server 2003-based primary Domain Name System (DNS) server hosts several primary zones.
 * A Windows Server 2003-based secondary DNS server hosts the corresponding secondary zones.
 * The secondary DNS server sends out DNS start of authority (SOA) query records to the primary DNS server when the DNS service restarts on the secondary DNS server. All DNS SOA query records use the same 0x6000 DNS ID.
 * An application firewall that examines the ID field in the DNS packet header is located on the network between the primary DNS server and the secondary DNS server.

In this scenario, the firewall may block zone transfers from the primary DNS server to the secondary DNS server.

Note This does not affect manual zone transfers.



Service pack information
To resolve this problem, obtain the latest service pack for Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

Prerequisites
To apply this hotfix, you must have Windows Server 2003 Service Pack 1 (SP1) installed on the computer.

Restart requirement
You do not have to restart your computer after you apply this hotfix.

Hotfix replacement information
This hotfix does not replace any other hotfixes.

File information
The English version of this hotfix has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the Time Zone tab in the Date and Time item in Control Panel.

Windows Server 2003, x86-based versions


STATUS
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the &quot;Applies to&quot; section. This problem was first corrected in Microsoft Windows Server 2003 Service Pack 2.



MORE INFORMATION
When you install the hotfix, the secondary DNS server randomly changes the value in the ID field of the DNS header. Then, the firewall does not drop the packets. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

824684 Description of the standard terminology that is used to describe Microsoft software updates



The third-party products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, regarding the performance or reliability of these products.

Keywords: kbbug kbfix kbqfe kbpubtypekc kbhotfixserver kbwinserv2003presp2fix kbwinserv2003sp2fix KB919218

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.