이 주제에서는 다른 도메인에 있는 Active Directory 리소스에 대한 Google Cloud 승인 네트워크의 쿼리가 성공하도록 DNS 전달을 구성하는 방법을 보여줍니다.
컨텍스트
도메인에 가입한 관리형 Microsoft AD에 Google Cloud VM을 사용하는 경우 동일한 VPC 네트워크에 없는 사용자 또는 객체를 찾으려고 하면 검색이 실패합니다. 기본 Windows 구성은 관리형 Microsoft AD 도메인으로 쿼리를 전달하지 않기 때문에 실패합니다. 대신 VM이 있는 VPC에 DNS 서버를 사용합니다. 이 DNS 서버에는 VPC 네트워크 외부의 관리형 Microsoft AD 사용자 및 객체에 대한 정보가 없으므로 조회가 실패합니다.
DNS 전달은 Google Cloud에서 VPC 네트워크 외부에 있는 리소스를 확인해야 하는 경우에 유용합니다. 예를 들어 관리형 Microsoft AD 도메인이 대상 도메인과 트러스트 관계인 경우 이 구성이 필요합니다.
시작하기 전에
시작하기 전에 다음 구성을 확인하세요.
Google Cloud VM은 관리형 Microsoft AD 도메인에 도메인 가입해야 합니다.
전달 대상 네임서버는 VPC 네트워크 내에서 연결할 수 있습니다.
다음 단계를 통해 연결할 수 있는지 테스트할 수 있습니다.
온프레미스 방화벽은 Cloud DNS의 쿼리를 전달해야 합니다. 이를 허용하려면 UDP 포트 53 또는 TCP 포트 53의 35.199.192.0/19 IP 주소 범위에서 Cloud DNS 쿼리를 허용하도록 방화벽을 구성합니다. 여러 Cloud Interconnect 연결 또는 VPN 터널을 사용하는 경우 방화벽이 모든 연결에 대한 트래픽을 허용하는지 확인합니다.
온프레미스 네트워크에는 35.199.192.0/19로 향하는 트래픽을 VPC 네트워크로 전달하는 경로가 있어야 합니다.
대상 도메인이 VPC 네트워크에 없습니다.
Google Cloud에서 VPC 네트워크가 아닌 온프레미스 도메인으로 DNS 전달을 구성하려면 전달 영역을 사용해야 합니다. DNS 전달 영역에 대해 알아보세요.
온프레미스 DNS 이름을 온프레미스 DNS 서버의 IP 주소로 확인하는 전달 영역을 만들려면 다음 단계를 완료하세요.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2024-12-21(UTC)"],[],[],null,["# Resolve queries for non-Managed Microsoft AD objects\n\nThis topic shows you how to configure DNS forwarding so that queries from a\nGoogle Cloud authorized network for Active Directory resources located\nin another domain succeed.\n\nContext\n-------\n\nWhen using a Google Cloud VM domain-joined to Managed Microsoft AD,\nif you try to look up users or objects that are not located on the same VPC\nnetwork, the search fails. It fails because the default Windows configuration\ndoes not forward the query to the Managed Microsoft AD domain. Instead, it\nuses the DNS server for the VPC where the VM is located. This DNS server does\nnot have information about Managed Microsoft AD users and objects outside the\nVPC network, so the lookup fails.\n\nDNS forwarding is useful in any case where you need to resolve\nresources located outside the VPC network from Google Cloud. For\nexample, if the Managed Microsoft AD domain has a trust relationship with the\ntarget domain, this configuration is required.\n\nBefore you begin\n----------------\n\nBefore you begin, verify the following configurations.\n\n- The Google Cloud VM must be domain-joined to the\n Managed Microsoft AD domain.\n\n- The forwarding target name server is reachable from within your VPC network.\n You can test that it is reachable with the following steps:\n\n ### Console\n\n Before you begin, verify that the\n [Network Management API](https://console.cloud.google.com/marketplace/product/google/networkmanagement.googleapis.com)\n is enabled.\n 1. Go to the\n [**Connectivity Tests**](https://console.cloud.google.com/net-intelligence/connectivity/tests)\n page in the Google Cloud console.\n\n\n [Go to the Connectivity Tests page](https://console.cloud.google.com/net-intelligence/connectivity/tests)\n\n 2. Create and run a Connectivity Test with the following values:\n\n - **Protocol**: TCP\n - **Source**: IP address from your Google Cloud VPC\n - **Destination**: IP address of your on-premises DNS server\n - **Destination port**: 53\n\n Learn more about creating and running\n [Network Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests).\n\n ### PowerShell\n\n In Windows PowerShell, run the following command: \n\n ```\n nslookup domain-name dns-server-ip\n ```\n\n Learn more about\n [`nslookup`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup).\n\nIf your target is an on-premises domain, verify the following firewall\nconfiguration.\n\n- The firewall must be configured to allow users from the Managed Microsoft AD domain to access on-premises resources. Learn about [firewall configurations for accessing on-premises resources](/managed-microsoft-ad/docs/firewalls#accessing_on-premises_active_directory_resources_from).\n\nIf you are using private DNS forwarding, there are a few additional\nprerequisites.\n\n- Your on-premises firewall must pass queries from Cloud DNS. To allow\n this, configure the firewall to allow Cloud DNS queries from the\n 35.199.192.0/19 IP address range on UDP port 53 or TCP port 53. If you are\n using multiple Cloud Interconnect connections or VPN tunnels, be sure\n that the firewall allows traffic for all of them.\n\n- Your on-premises network must have a route that directs traffic destined to\n 35.199.192.0/19 back to your VPC network.\n\nTarget domain is not on a VPC network\n-------------------------------------\n\nTo configure DNS forwarding from Google Cloud to an on-premises domain\nthat is not on a VPC network, you should use a forwarding zone. Learn about\n[DNS forwarding zones](/dns/docs/zones/zones-overview#forwarding_zones).\n\nTo create a forwarding zone that resolves the on-premises DNS name to the IP\naddresses of on-premises DNS servers, complete the following steps. \n\n### Console\n\n1. Go to the\n [**Cloud DNS**](https://console.cloud.google.com/networking/dns/zones/) page in the\n Google Cloud console.\n\n\n [Go to the Cloud DNS page](https://console.cloud.google.com/networking/dns/zones/)\n\n2. Create a DNS zone with the following values:\n\n - **Zone type** : **Private**\n - **DNS name**: Target DNS name\n - **Options** : **Forward queries to another server**\n - **Destination DNS servers**: IP addresses of target DNS servers\n\nLearn more about\n[creating DNS forwarding zones](/dns/zones#creating-forwarding-zones).\n\n### gcloud\n\nTo create a new managed private forwarding zone, you should use the\n[dns managed-zones create](/sdk/gcloud/reference/dns/managed-zones/create)\ncommand: \n\n```\ngcloud dns managed-zones create name \\\n --description=description \\\n --dns-name=on-premises-dns-name \\\n --forwarding-targets=on-premises-dns-ip-addresses \\\n --visibility=private\n```\n\nLearn more about\n[creating DNS forwarding zones](/dns/zones#creating-forwarding-zones).\n\nTarget domain is on a VPC network\n---------------------------------\n\nTo configure DNS forwarding from Google Cloud to a self-managed domain\nthat is on a VPC network,\n[follow the steps for Cloud DNS](/dns/docs/zones/zones-overview#forwarding_zones)\nthat are relevant for your configuration."]]
