Re: Testing RFC 5011 key roll

2015-04-20 Thread Warren Kumari
On Mon, Apr 20, 2015 at 4:33 PM, Evan Hunt e...@isc.org wrote: On Mon, Apr 20, 2015 at 04:17:57PM -0400, Warren Kumari wrote: That page says (for BIND): Note: When using this config file you will probably need to delete

Re: Testing RFC 5011 key roll

2015-04-20 Thread Evan Hunt
On Mon, Apr 20, 2015 at 04:17:57PM -0400, Warren Kumari wrote: That page says (for BIND): Note: When using this config file you will probably need to delete /var/named/21ce078705d04ca6324c1d0313fc08ea99f3cef6389a6744d40bd2d9d0cd7816.mkeys* every time you restart BIND after missing a keyroll.

Re: Testing RFC 5011 key roll

2015-04-20 Thread Warren Kumari
On Mon, Apr 20, 2015 at 3:41 PM, Edward Lewis edward.le...@icann.org wrote: Thanks. rm'd the file and added the timers. (I did that also after sending, so it is the deleting the old file that did the trick.) The start-up lines look good. Got an AD bit again too. (I may have a few more

Confusion about try-tcp-refresh

2015-04-20 Thread Anand Buddhdev
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hello BIND developers, We have some BIND servers configured as slaves for many hundreds of zones, with the master pointing to our distribution master's IPv4 and IPv6 address. One some of these servers, the IPv6 routing was broken, so that when BIND

Re: Confusion about try-tcp-refresh

2015-04-20 Thread Tony Finch
Anand Buddhdev ana...@ripe.net wrote: The BIND 9.10.2 ARM suggests that it is a per-zone setting. Can I also set it in the global options area? Yes. It is mentioned in the options documentation towards the end of ARM section 6.2.16.1. (A useful thing to know about is doc/misc/options which is

Re: Testing RFC 5011 key roll

2015-04-20 Thread Evan Hunt
On Mon, Apr 20, 2015 at 06:42:42PM +, Edward Lewis wrote: Being that I'm working on a laptop (hence on on over the weekend) I've had to recreate the environment today. I'm a bit more puzzled now. There's a separate file that named creates to keep the current managed keys state information

Re: Testing RFC 5011 key roll

2015-04-20 Thread Edward Lewis
Thanks to Evan for the last look and thanks to Jan-Piet for the suggestion to go to 9.10.2. Being that I'm working on a laptop (hence on on over the weekend) I've had to recreate the environment today. I'm a bit more puzzled now. I've built and installed BIND 9.10.2. Using

Re: Testing RFC 5011 key roll

2015-04-20 Thread Edward Lewis
Thanks. rm'd the file and added the timers. (I did that also after sending, so it is the deleting the old file that did the trick.) The start-up lines look good. Got an AD bit again too. (I may have a few more issues as I move this off a laptop on to a regular machine. Right now it helps