• RSS
  • Twitter
  • FaceBook

Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

HELP! I can join domains but not create domain controllers across subnets!

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA 2006 Firewall] >> Access Policies >> HELP! I can join domains but not create domain controllers across subnets! Page: [1]
Login
Message << Older Topic   Newer Topic >>
HELP! I can join domains but not create domain controll... - 6.Nov.2009 5:56:13 PM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
Hi Everyone,

I'm using ISA Server 2006 Enterprise on Windows Server 2003 R2 Enterprise.

My ISA server has 3 NICs:
192.168.20.100 to the WAN (Internet)
192.168.10.1 to the first subnet
192.168.0.1 to the second subnet.

This server ("ISA-SERVER") is also running DHCP and managing the scopes for the 10 and 0 subnets.

I have set up and tested static routes to allow communication across subnets.  Communication via IP addresses works flawlessly.

Here is my basic issue:

I have 3 domain controllers on the 0 subnet, and I'm trying to add a 4th DC but on the 10 subnet.  I am able to join machines on the 10 subnet to the domain without any issues, but trying to promote the machines to domain controllers (via DCPROMO) always fails.  I also get an RPC Error or a remote procedure call failed error (essentially the same thing, right?)

If I try to add another DC on the 0 subnet, it works without any issues.

If I add the DC while on the 0 subnet, then physically rewire it on to the 10 subnet, replication stops working.

So, apart from just being able to join a domain, other common tasks such as DCPROMO and replication are not functioning.

In my ISA server access rules, my very first rule is from Internal Networks & Localhost to (again) Internet Networks & Localhost.  All protocols are allowed.  No protocol is being blocked (as far as I can tell.)  Yet, RPC only fails when attempting to do it across subnets.

The confusing this is that I created an analogous set up using virtual machines, and it worked just fine.

I even re-installed the OS on the 4th domain controller, but that didn't help.

I'm almost certain it's a firewall issue, but I can't be sure since, to my knowledge, I've not blocked a single port when it comes to communication between the 0 and 10 subnets.

Any help on troubleshooting this problem would be GREATLY appreciated!

TIA.

< Message edited by waqqas31 -- 6.Nov.2009 5:57:26 PM >
Post #: 1
RE: HELP! I can join domains but not create domain cont... - 6.Nov.2009 6:10:04 PM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
Hi,

This may help:

http://blog.msfirewall.org.uk/2009/02/resource-guide-for-microsoft-active.html

Also, it may be worth checking if the traffic is being blocked by the RPC filter; disabling the option for "Strict RPC compliance" should indicate this.

You may also want to look at the Flood Mitigation alerts to see if this feature is blocking traffic (I have seen that before with AD comms) the real time logs may also who "quota exceeded" entries to indicate this...

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to waqqas31)
Post #: 2
RE: HELP! I can join domains but not create domain cont... - 6.Nov.2009 10:10:37 PM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
Hi Jason,

Thanks for your quick response!

I've had the "Strict RPC Compliance" option unchecked since almost the beginning, so I'm afraid my solution doesn't lie there (well, not completely, at least.)

When you say "Flood Mitigation Alerts", are you referring to the Monitoring --> Alerts options in ISA Server 2006?  I don't see an item by that title/name, per se.

Do you know of any easily obtainable utilities or better yet, utilities built-in to Windows Server 2008 R2 that can help me quickly diagnose which ports are blocked?  I've tried googling for one, but they're either convoluted or for linux!

TIA!

(in reply to Jason Jones)
Post #: 3
RE: HELP! I can join domains but not create domain cont... - 7.Nov.2009 7:22:17 PM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
Portqrygui has a default list which can be handy:

http://www.microsoft.com/downloads/details.aspx?familyid=8355e537-1ea6-4569-aabb-f248f4bd91d0&displaylang=en

However, you should be able to see what is being blocked by looking at the real-time information in the logging tab...

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to waqqas31)
Post #: 4
RE: HELP! I can join domains but not create domain cont... - 10.Nov.2009 9:10:02 PM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
Hi JJ,

Thanks a bunch for suggesting PortQry.  It's refreshing to know that Microsoft wasn't leaving people out in the cold with "trivial" problems such as mine!

The summary of my results is that the queries between DC's that replicated successfully (DC2 and DC3) differed in the following ways (ports) from DC's that did not replicate successfully (DC2 and DC5).  DC5, of course, failed to run DCPROMO to completion, as the subject of this thread indicates.

Here are the differences:

Source        Port    Dest1            Ret Code 1    Dest2            Ret Code 2
192.168.0.102    135    192.168.0.103    0x00000000.    192.168.10.11    0x00000000.
192.168.0.102    137    192.168.0.103    0x00000000.    192.168.10.11    0x00000000.
192.168.0.102    138    192.168.0.103    0x00000002.    192.168.10.11    0x00000002.
192.168.0.102    139    192.168.0.103    0x00000000.    192.168.10.11    0x00000000.
192.168.0.102    3268    192.168.0.103    0x00000000.    192.168.10.11    0x00000002.
192.168.0.102    3269    192.168.0.103    0x00000000.    192.168.10.11    0x00000002.
192.168.0.102    389    192.168.0.103    0x00000001.    192.168.10.11    0x00000001.
192.168.0.102    42    192.168.0.103    0x00000001.    192.168.10.11    0x00000002.
192.168.0.102    445    192.168.0.103    0x00000000.    192.168.10.11    0x00000000.
192.168.0.102    53    192.168.0.103    0x00000000.    192.168.10.11    0x00000000.
192.168.0.102    636    192.168.0.103    0x00000000.    192.168.10.11    0x00000002.
192.168.0.102    88    192.168.0.103    0x00000002.    192.168.10.11    0x00000002.


(in reply to Jason Jones)
Post #: 5
RE: HELP! I can join domains but not create domain cont... - 10.Nov.2009 9:11:17 PM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
The question now is, why are these ports being blocked when I configured ISA to let all local traffic flow without restrictions?

TIA!

(in reply to waqqas31)
Post #: 6
RE: HELP! I can join domains but not create domain cont... - 11.Nov.2009 3:51:37 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
Look at strict RPC compliance and potential flood mitigation blocking...

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to waqqas31)
Post #: 7
RE: HELP! I can join domains but not create domain cont... - 11.Nov.2009 9:38:48 AM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
How can I *completely* disable RPC compliance?  The way I've done it so far is to select "Configure RPC" on a particular rule and disable it there, but I also saw it in one of the System Policies, though I'm not sure I want to fool around with those.

As for the flood mitigation, I was unable to find any options with that name.  Can you point me in the right direction?

Thanks again!

(in reply to Jason Jones)
Post #: 8
RE: HELP! I can join domains but not create domain cont... - 11.Nov.2009 11:05:32 AM   
waqqas31

 

Posts: 7
Joined: 6.Nov.2009
Status: offline
JJ, you are the MAN!

I found the options for Configuring Flood Mitigation and I added my new would-be DC to the list for "Custom" settings.

I also disabled RPC Compliance only on the rule for Internal network traffic.

The PortQry results now match those for the two DC's on the same subnet and the new DC ran DCPROMO without any hiccups whatsoever.

Thanks so much!

(in reply to waqqas31)
Post #: 9
RE: HELP! I can join domains but not create domain cont... - 12.Nov.2009 10:43:59 AM   
Jason Jones

 

Posts: 4663
Joined: 30.Jul.2002
From: United Kingdom
Status: offline
quote:

ORIGINAL: waqqas31

JJ, you are the MAN!

I found the options for Configuring Flood Mitigation and I added my new would-be DC to the list for "Custom" settings.

I also disabled RPC Compliance only on the rule for Internal network traffic.

The PortQry results now match those for the two DC's on the same subnet and the new DC ran DCPROMO without any hiccups whatsoever.

Thanks so much!


Cool , I experienced the same problem with FM when working with a customer - a good indication in the logs is a reference to "QUOTA EXCEEDED" in the result code.

Cheers

JJ

_____________________________

Jason Jones | Forefront MVP | Silversands Ltd
My Blogs: http://blog.msedge.org.uk/ and http://blog.msfirewall.org.uk/

(in reply to waqqas31)
Post #: 10

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA 2006 Firewall] >> Access Policies >> HELP! I can join domains but not create domain controllers across subnets! Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts