--- title: "show dhcp_gss_tsig" canonical: "https://docs.infoblox.com/space/nios86/35758795/show%20dhcp_gss_tsig" format: markdown --- The` show dhcp_gss_tsig` commands provide information about an Infoblox DHCP server that is configured to send GSS-TSIG authenticated DDNS updates to an AD integrated DNS server. You can use these commands to verify your configuration and troubleshoot potential issues. You can also test whether the appliance can communicate with the Key Distribution Center (KDC) and the DNS server. # Syntax `show dhcp_gss_tsig config show dhcp_gss_tsig keytab` ` show dhcp_gss_tsig test dns {ns-ip}` ` show dhcp_gss_tsig test kdc {kdc-ip} {principal}` | **Argument ** | **Description** | | --- | --- | | `config` | Displays configuration information and runs tests to verify the configuration. | | `keytab` | Displays information about the keytab file that is in use by the appliance. | | `test dns` | Tests the configuration by verifying that the destination DNS server is reachable. You must enter the IP address of the destination DNS server. | | `test kdc` | Tests the configuration by obtaining a test Ticket Granting Ticket (TGT)) from the configured KDC. You must specify the following:
- IP address of the AD domain controller that hosts the KDC for the domain - The Kerberos principal you specified when you generated the keytab file, in the following format: *username/instance*@*REALM* - *username/instance*: The AD user name for the NIOS appliance and the FQDN of the appliance. This entry must be the same on the AD domain controller and the Infoblox appliance. - *REALM*: The Kerberos realm in uppercase. | # Examples ## Displaying GSS-TSIG configuration information and run a test The` show dhcp_gss_tsig config` command displays the following information: - Whether DHCP and GSS-TSIG dynamic DNS updates are enabled on the appliance - The system time in UTC - Information about the KDC, principal, and domain After it displays information, the appliance can test if it can obtain a TGT from the KDC and provides information about that transaction. Note that the TGT is for test purposes only and does not affect the data used by DHCP and DNS. It can also test the external zones that are supposed to receive the DDNS updates as follows: - Verify if the external zones specified in the member's network view match the member's domain - Query the name server IP address for the address of the FQDN from the DNS principal - Query the name server for the SOA of the zone. It displays a warning if the name server does not respond or if the result does not list the FQDN from the DNS principal as authoritative. `Infoblox > ``show`` ``dhcp_gss_tsig`` ``config` ` System time: Tue Oct 21 16:01:43 UTC 2008` ` D` `HCP GSS-TSIG configuration for this member: ` `KDC address                  10.34.123.4` ` KDC IP                       10.34.123.4` ` Member principal         jdoe/anywhere@CORP100.LOCAL` ` Member domain                CORP100.LOCAL` ` GSS-TSIG                     enabled` ` DDNS updates                 enabled` ` DHCP service                 enabled ` ` ` `Test KDC using member configuration? (y or n): y` ` Requesting TGT for jdoe/anywhere@CORP100.LOCAL from KDC 10.34.123.4... ` `Successfully obtained test TGT.` ` Credentials cache: FILE:/tmp/krb5_cache.18338 ` `       Principal: jdoe/anywhere@CORP100.LOCAL` `   Cache version: 4` ` Server: krbtgt/CORP100.LOCAL@CORP100.LOCAL Client: jdoe/anywhere@CORP100.LOCAL` ` Ticket etype: arcfour-hmac-md5, kvno 2 ` `Ticket length: 957` ` Auth time: Oct 21 12:00:52 2008` ` End time:Oct 21 13:00:52 2008` ` Ticket flags: initial, pre-authenticated ` `Addresses: addressless` ` Successful test. Test TGT destroyed. ` ` ` `This member is configured to update the following zones: ` `corp100 on 10.34.123.4 as dns/ns-corp100.CORP100.local ` ` ` `Test configured zones? (y or n): y ` ` ` `Next zone is corp100 on 10.34.123.4. ` `Test this zone? (y or n): y` ` Testing external zone corp100 on NS 10.34.123.4... ` `DNS principal is dns/ns-corp100.corp100.local.` ` Derived FQDN is ns-corp100.corp100.local. ` `FQDN resolves to nameserver IP.` ` SOA for corp100 has MNAME ns-corp100.corp100.local. ` `Nameserver is authoritative for zone.` ` Zone corp100 appears valid.` ## Displaying information about the keytab The` show dhcp_gss_tsig keytab` command displays the current keytab. `Infoblox > ``show`` ``dhcp_gss_tsig`` ``keytab` ` Vno Type Principal` ` 7 des-cbc-md5 jdoe/instance@CORP100.LOCAL` ## Verifying the DNS server The `show dhcp_gss_tsig test dns` command verifies the destination DNS server by performing a reverse lookup of the IP address. `Infoblox > ``show`` ``dhcp_gss_tsig`` ``test`` ``dns`` ``10.34.123.4` ` Querying DNS server 10.34.123.4... ` `Server responded. ` `Probable DNS principal: dns/ns-corp100.corp100.local` ## Obtaining a test TGT from the KDC When you use the show dhcp_gss_tsig test kdc command, the appliance tries to obtain a TGT from the KDC using the specified principal. It provides information about the transaction and upon successful completion, deletes the test TGT. `Infoblox > ``show`` ``dhcp_gss_tsig`` ``test`` ``kdc`` ``10.34.123.4`` ``jdoe/instance@CORP100.LOCAL` ` Requesting TGT for jdoe/instance@CORP100.LOCAL from KDC 10.34.123.4...` ` Successfully obtained test TGT. ` ` ` `Credentials cache: FILE:/tmp/krb5_cache.12000 ` `       Principal: jdoe/instance@CORP100.LOCAL` `     Cache version: 4 ` ` ` `Server: krbtgt/CORP100.LOCAL@CORP100.LOCAL Client: jdoe/instance@CORP100.LOCAL` ` Ticket etype: arcfour-hmac-md5, kvno 2 ` `Ticket length: 957` ` Auth time: Oct 21 12:30:01 2008` ` End time:Oct 21 13:30:01 2008` ` Ticket flags: initial, pre-authenticated ` `Addresses: addressless ` ` ` `Successful test. Test TGT destroyed.`