This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

W2k Server - BDC through ASL?

Hi all,

so heres the setup:

w2k Server (BDC)  ASL 3.202  w2k Server (PDC)
192.168.100.1 (BDC)  192.168.100.254 (ASL) 10.10.10.254  10.10.10.1 (PDC)

Problem: cant connect an Active Directory PDC and BDC through the ASL.

According to Microsoft you cant create a Trust relationship if one of the Servers is NATed. Reference: KB Article Q263293 and Q172227 (nt4)

Reason: even though the IP address of the Packet is NATed, the NETBIOS Header (which contains the IP address also) is not.

Microsoft offers the solution of building a PPTP connection between the two Hosts. err.. havent quite gotten that to work.

However it seems that I should be able to do Port Forwarding on Ports 137,138, and 139 ONLY and pass the BDC IP to the PDC.  All other ports would/should be MASQed normally.

Has anyone got it to work any which way?

Once again very very  [:S]c.

This thread was automatically locked due to age.

Parents

0 vtanger over 23 years ago

PDC/BDC synchroization happens via MS-RPCs which use two-way communication: tcp/135 and in response a connection tcp/1024:65535 back is opened - very much like active FTP sessions are handled. Unfortunately there is no MS-RPC filter available for the underlying IPtables.

I know W2k/XP use a different RPC (again) request TCP port - somewhere between 500-700, but unfortunately I currently don't recall the exact one.

So unless you can restrict the port usage somehow with some magic Win-Registry hacking, I fear that you'll need to open basically "Any" service between PDC and BDC - both directions. [:O]

Second stumble point: you'll need proper name resolution which for your Windows infrastructure to work properly. As the setup won't allow network broadcasts to relly reach the other side, you'll probably end up having to install one (or more) WINS server(s).
Cancel
Vote Up 0 Vote Down

Cancel
0 oliver.desch over 23 years ago in reply to vtanger

might be interesting:

http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.asp

http://support.microsoft.com/default.aspx?scid=KB;EN-US;q224196&

read you
o|iver
Cancel
Vote Up 0 Vote Down

Cancel
0 Tmor over 23 years ago in reply to oliver.desch

nice VPN article Oliver

I'll let you know how it works out.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Tmor over 23 years ago in reply to oliver.desch

nice VPN article Oliver

I'll let you know how it works out.
Cancel
Vote Up 0 Vote Down

Cancel

Children

No Data