Menyelesaikan kueri untuk objek yang tidak berada di Microsoft AD Terkelola
Tetap teratur dengan koleksi
Simpan dan kategorikan konten berdasarkan preferensi Anda.
Topik ini menunjukkan cara mengonfigurasi penerusan DNS agar kueri dari
Google Cloud jaringan resmi untuk resource Active Directory yang berada
di domain lain berhasil.
Konteks
Saat menggunakan Google Cloud domain VM yang tergabung ke Managed Microsoft AD,
jika Anda mencoba mencari pengguna atau objek yang tidak berada di jaringan VPC
yang sama, penelusuran akan gagal. Tindakan ini gagal karena konfigurasi Windows default tidak meneruskan kueri ke Managed Microsoft AD domain. Sebagai gantinya, VM tersebut
menggunakan server DNS untuk VPC tempat VM berada. Server DNS ini tidak
memiliki informasi tentang pengguna dan objek Managed Microsoft AD di luar
jaringan VPC, sehingga pencarian gagal.
Penerusan DNS berguna jika Anda perlu me-resolve resource yang berada di luar jaringan VPC dari Google Cloud. Misalnya, jika domain Microsoft AD Terkelola memiliki hubungan kepercayaan dengan
domain target, konfigurasi ini diperlukan.
Sebelum memulai
Sebelum memulai, verifikasi konfigurasi berikut.
Google Cloud VM harus bergabung dengan domain ke
domain Microsoft AD Terkelola.
Server nama target penerusan dapat dijangkau dari dalam jaringan VPC Anda.
Anda dapat menguji apakah server dapat dijangkau dengan langkah-langkah berikut:
Jika Anda menggunakan penerusan DNS pribadi, ada beberapa prasyarat tambahan.
Firewall lokal Anda harus meneruskan kueri dari Cloud DNS. Untuk mengizinkan hal ini, konfigurasikan firewall untuk mengizinkan kueri Cloud DNS dari rentang alamat IP 35.199.192.0/19 di port UDP 53 atau port TCP 53. Jika Anda
menggunakan beberapa koneksi Cloud Interconnect atau tunnel VPN, pastikan
firewall mengizinkan traffic untuk semuanya.
Jaringan lokal Anda harus memiliki rute yang mengarahkan traffic yang ditujukan ke
35.199.192.0/19 kembali ke jaringan VPC Anda.
Domain target tidak berada di jaringan VPC
Untuk mengonfigurasi penerusan DNS dari Google Cloud ke domain lokal
yang tidak berada di jaringan VPC, Anda harus menggunakan zona penerusan. Pelajari
zona penerusan DNS.
Untuk membuat zona penerusan yang me-resolve nama DNS lokal ke alamat IP server DNS lokal, selesaikan langkah-langkah berikut.
Untuk mengonfigurasi penerusan DNS dari Google Cloud ke domain yang dikelola sendiri
yang berada di jaringan VPC,
ikuti langkah-langkah untuk Cloud DNS
yang relevan untuk konfigurasi Anda.
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-08-11 UTC."],[],[],null,["# Resolve queries for non-Managed Microsoft AD objects\n\nThis topic shows you how to configure DNS forwarding so that queries from a\nGoogle Cloud authorized network for Active Directory resources located\nin another domain succeed.\n\nContext\n-------\n\nWhen using a Google Cloud VM domain-joined to Managed Microsoft AD,\nif you try to look up users or objects that are not located on the same VPC\nnetwork, the search fails. It fails because the default Windows configuration\ndoes not forward the query to the Managed Microsoft AD domain. Instead, it\nuses the DNS server for the VPC where the VM is located. This DNS server does\nnot have information about Managed Microsoft AD users and objects outside the\nVPC network, so the lookup fails.\n\nDNS forwarding is useful in any case where you need to resolve\nresources located outside the VPC network from Google Cloud. For\nexample, if the Managed Microsoft AD domain has a trust relationship with the\ntarget domain, this configuration is required.\n\nBefore you begin\n----------------\n\nBefore you begin, verify the following configurations.\n\n- The Google Cloud VM must be domain-joined to the\n Managed Microsoft AD domain.\n\n- The forwarding target name server is reachable from within your VPC network.\n You can test that it is reachable with the following steps:\n\n ### Console\n\n Before you begin, verify that the\n [Network Management API](https://console.cloud.google.com/marketplace/product/google/networkmanagement.googleapis.com)\n is enabled.\n 1. Go to the\n [**Connectivity Tests**](https://console.cloud.google.com/net-intelligence/connectivity/tests)\n page in the Google Cloud console.\n\n\n [Go to the Connectivity Tests page](https://console.cloud.google.com/net-intelligence/connectivity/tests)\n\n 2. Create and run a Connectivity Test with the following values:\n\n - **Protocol**: TCP\n - **Source**: IP address from your Google Cloud VPC\n - **Destination**: IP address of your on-premises DNS server\n - **Destination port**: 53\n\n Learn more about creating and running\n [Network Connectivity Tests](/network-intelligence-center/docs/connectivity-tests/how-to/running-connectivity-tests).\n\n ### PowerShell\n\n In Windows PowerShell, run the following command: \n\n ```\n nslookup domain-name dns-server-ip\n ```\n\n Learn more about\n [`nslookup`](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/nslookup).\n\nIf your target is an on-premises domain, verify the following firewall\nconfiguration.\n\n- The firewall must be configured to allow users from the Managed Microsoft AD domain to access on-premises resources. Learn about [firewall configurations for accessing on-premises resources](/managed-microsoft-ad/docs/firewalls#accessing_on-premises_active_directory_resources_from).\n\nIf you are using private DNS forwarding, there are a few additional\nprerequisites.\n\n- Your on-premises firewall must pass queries from Cloud DNS. To allow\n this, configure the firewall to allow Cloud DNS queries from the\n 35.199.192.0/19 IP address range on UDP port 53 or TCP port 53. If you are\n using multiple Cloud Interconnect connections or VPN tunnels, be sure\n that the firewall allows traffic for all of them.\n\n- Your on-premises network must have a route that directs traffic destined to\n 35.199.192.0/19 back to your VPC network.\n\nTarget domain is not on a VPC network\n-------------------------------------\n\nTo configure DNS forwarding from Google Cloud to an on-premises domain\nthat is not on a VPC network, you should use a forwarding zone. Learn about\n[DNS forwarding zones](/dns/docs/zones/zones-overview#forwarding_zones).\n\nTo create a forwarding zone that resolves the on-premises DNS name to the IP\naddresses of on-premises DNS servers, complete the following steps. \n\n### Console\n\n1. Go to the\n [**Cloud DNS**](https://console.cloud.google.com/networking/dns/zones/) page in the\n Google Cloud console.\n\n\n [Go to the Cloud DNS page](https://console.cloud.google.com/networking/dns/zones/)\n\n2. Create a DNS zone with the following values:\n\n - **Zone type** : **Private**\n - **DNS name**: Target DNS name\n - **Options** : **Forward queries to another server**\n - **Destination DNS servers**: IP addresses of target DNS servers\n\nLearn more about\n[creating DNS forwarding zones](/dns/zones#creating-forwarding-zones).\n\n### gcloud\n\nTo create a new managed private forwarding zone, you should use the\n[dns managed-zones create](/sdk/gcloud/reference/dns/managed-zones/create)\ncommand: \n\n```\ngcloud dns managed-zones create name \\\n --description=description \\\n --dns-name=on-premises-dns-name \\\n --forwarding-targets=on-premises-dns-ip-addresses \\\n --visibility=private\n```\n\nLearn more about\n[creating DNS forwarding zones](/dns/zones#creating-forwarding-zones).\n\nTarget domain is on a VPC network\n---------------------------------\n\nTo configure DNS forwarding from Google Cloud to a self-managed domain\nthat is on a VPC network,\n[follow the steps for Cloud DNS](/dns/docs/zones/zones-overview#forwarding_zones)\nthat are relevant for your configuration."]]
