This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD x subnets

Hi all,

I have one domain controller in the HQ 192.168.0.0/24 and REDs 192.168.1.0/24 in the branches offices, so I write this post here and not in the RED section because I found today the log bellow in the firewall live log..

19:22:32 Default DROP NetBIOS Name Service 192.168.1.132:137 → 192.168.1.255:137 len=78 ttl=128 tos=0x00 srcmac=0d:52:00:9c:4e:85 dstmac=00:53:64:03:e2[:D]e

My problem is that the computers behind the REDs cannot works fine with AD in the HQ, not logon, not access shares etc...

I try everything, I only got join the computers to the domain via djoin (off line join) but its very bad, I try WINS, NetBIOS over TCPIP, LMHOSTS etc...

Anyone have an idea to help ?

thx.

This thread was automatically locked due to age.

Parents

0 vilic over 10 years ago

Also try this lookups from a client in the branch office before and after making the changes to see if there are any differences:

1. DC DNS host record resolution check (FQDN should resolve to 192.168.0.1).
[FONT="Courier New"]nslookup dc.company.com[/FONT]

2. AD DNS SRV record resoultion check (srv record should resolve to FQDN of all DCs in AD...in my example there were two of them).
[FONT="Courier New"]nslookup
set type=SRV
_ldap._tcp.dc._msdcs.company.com[/FONT]
Cancel
Vote Up 0 Vote Down

Cancel
0 Marc M over 10 years ago in reply to vilic

Hi vilic,

I cannot check it now in the branches because all machines are turned-off now because is sunday, but I'll check it again tomorrow..

I just register that I dont know why but always when I request in nslookup the frist lookup is timed-out only in the second lookup I got the resolution... any idea ?

U:\>nslookup
Default Server:  dc.domain
Address:  192.168.0.1

> æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Server:  dc.domain
Address:  192.168.0.1

DNS request timed out.
    timeout was 2 seconds.
*** Request to dc.domain timed-out
> æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Server:  dc.domain
Address:  192.168.0.1

Non-authoritative answer:
Name:    æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Address:  157.7.143.182
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Marc M over 10 years ago in reply to vilic

Hi vilic,

I cannot check it now in the branches because all machines are turned-off now because is sunday, but I'll check it again tomorrow..

I just register that I dont know why but always when I request in nslookup the frist lookup is timed-out only in the second lookup I got the resolution... any idea ?

U:\>nslookup
Default Server:  dc.domain
Address:  192.168.0.1

> æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Server:  dc.domain
Address:  192.168.0.1

DNS request timed out.
    timeout was 2 seconds.
*** Request to dc.domain timed-out
> æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Server:  dc.domain
Address:  192.168.0.1

Non-authoritative answer:
Name:    æ ªå¼ä¼šç¤¾ã‚µãƒ³ãƒ©ã‚¤ã‚º
Address:  157.7.143.182
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 vilic over 10 years ago in reply to Marc M

I just register that I dont know why but always when I request in nslookup the frist lookup is timed-out only in the second lookup I got the resolution... any idea ?

In my experience, it could be related with slow Internet link, or with wrongly configured Forwarder IP address in DC or UTM DNS settings....stick with Bob's DNS best practice guide.

In attached screenshot is a real world example, how DNS resolution works in Windows server when using wrong Forwarders (a few years ago when client's local ISP changed their DNS IP addresses without any notice to their clients....[:)]. At the end "Use root hints if no forwarders are available" option resolved the name of www.google.com after 12s delay and one manual push.
Cancel
Vote Up 0 Vote Down

Cancel