Active Directory Site Link Thru 2 Firewalls

[EnemyAce]

This one is a real challange, well for me anyways.

I'm in the process of setting up a new site across town from our Office. I ran dcpromo on a box in the Office, than moved it to the new site. I'd like to have this dc be able to replicate with our Office dc's.

The problem is, both sites have private IP addresses due to NAT enabled firewalls. Is there an easy solution to make this all work? What ports if any will I need to open up on each Firewall.

 

[Haploe79]

Easiest method would be to set up a vpn between sites and make sure both have different private ip ranges. After that, they should appear local and being private won't matter a bit. Should then set up sites after if the vpn is even an option...

 

[PaulGillespie]

I'm trying to do the same thing but i know nothing about site replication etc, do you know where i can get some info on this? i've tried the microsoft site but it didn't help.

Thanks

Paul

 

[EnemyAce]

Thanks for the tip. I did actually attempt to setup a VPN connection between sites but failed. The reason I'm assuming, is that both Private IP ranges we're identical.

Does it matter what machine establishes the VPN tunnel, or does it have to be initiated from the Domain Controller?

 

[Haploe79]

You set up a demand dial vpn on both machines, and make sure they use shared credentials(works well if you create an account just for this purpose). Make sure you don't forget to add them as static routes to get to the other location as well.

As far as site replication, with nothing fancy it isn't that difficult. Just make the 2 sites in AD sites and services, set up a subnet for each and add them to the sites, and make sure the servers are in the correct site.

 

[EnemyAce]

Thanks for all your help. The Demand Dial VPN worked beautifully and I now have both sites connected. I also configured the Site Link in Active Directory, although this may or may not have been done right.

From either Demand Dial VPN box, I can browse and connect to all the Servers on the other end. I'm unable to do this from any of the other Servers however. I'd like to be able to browse and connect to all remote servers from ANY machine on either side.

If I had setup the AD Site Link properly, would I be able to do this? I'd like the remote site to be treated as if the boxes were all on the local LAN.

 

[snipesnab]

You need to make sure that dns is set up correctly. My advice if you are having VPN between 2 sites is to setup each site with its own subnet.

ie. site 1 ip addrtess scheme: 192.168.0.x
site 2 ip address scheme: 192.168.1.x

Make sure that you have a reverse lookup zone entered into dns for each subnet. if the vpn is from firewall to firewall you should have no problem replicating active directory between the sites and browsing between the sights. Make sure that you have the correct ports open and check event viewer for communication errors.

 

[snipesnab]

You need to make sure that dns is set up correctly. My advice if you are having VPN between 2 sites is to setup each site with its own subnet but on the same domain.

ie. site 1 ip addrtess scheme: 192.168.0.x
site 2 ip address scheme: 192.168.1.x

Make sure that you have a reverse lookup zone entered into dns for each subnet. if the vpn is from firewall to firewall you should have no problem replicating active directory between the sites and browsing between the sights. Make sure that you have the correct ports open and check event viewer for communication errors.

You can set the time you would like AD to replicate through sites and services, and it might have been an idea to have run dcpromo over the vpn to make sure that communication is in place.

 

[EnemyAce]

Other than PPTP, what ports need to open?

 

[morpheu5]

We had similar issues and found this to be a good document

http://www.microsoft.com/technet/tr...ol/ad/windows2000/deploy/confeat/adrepfir.asp

 

[EnemyAce]

It looks like the problem may be routing table related. When I do a Route Print on either of the VPN machines, I see paths to the opposite LAN's. None of that information is in the routing table of my client machine for example.

Would this keep me from browsing, or even pinging the remote network? What do I need to do to have the routing table from the demand dial VPN server replicate to all machines on the LAN? Or do I have to manually enter this on each machine?