DHCP client address can't pass traffic to DC

[mdedionisio]

OK, here's a strange one. This has been going on for the past several months. Let me describe my network. I have one 2003 DC, one Windows 2000 member server and one 2003 member server. The 2003 DC does all the heavy lifting, i.e, it is the DNS server, the DHCP server, and the Exchange server. Directly on the LAN are about 40 pc's which are all DHCP clients, while the three servers mentioned above have static addresses. We use a 192.168.x.x range. I have a Sonicwall 2040 serving as firewall/VPN device. In the outside world I have 30 remote sites that have tunnels into the Sonicwall, plus a few remote users that use a Sonicwall client on their pc's to gain access to the network. The remote clients get their IP assigned from the DC through the Sonicwall. It is these remote clients that are seeing this odd problem.

Here's what is happening: A remote client will connect to the network and get an address, let's say 192.168.xxx.34, and once connected will not be able to pass traffic to the DC. For example, the client won't be able to see the Exchange server and won't be able to RDP to the DC. The client WILL be able to reach the other member servers and communicate normally with them. I've worked around this by logging off with the particular remote client PC that is having the problem, then logging on with another device so that this second device gets the 192.168.xxx.34 address, then logging on with the original PC and getting the next address, say 192.168.xxx.35. At this point this client can work normally. Ultimately, I have excluded the .34 address in the DHCP server, but after a period of time the problem pops up again with another address, say .37. I now have 4 addresses excluded in my range and wonder how many I'll have to exclude if this goes on forever.

Mark DeDionisio

 

[Teknoratti]

I doubt this is a DHCP/ip address problem. Why do you think it is? If a remote client grabs an ip addres with a host ranger other then 30-39 are they fine? Do you have vlans set for remote users, where remote users stay on there own Vlan, and do you have ACLs set up on the firewall to let traffic out of the vlan to the rest of the network?

Was this ever working before?

 

[mdedionisio]

Teknoratti: It's working NOW. What I'm trying to say is that while it doesn't work when a pc is assigned .34, it does work when the same pc is assigned .35. I currently have four addresses excluded because they don't work. There are no VLAN's, no ACL's, it's a very simple network.

Thanks,

Mark DeDionisio

 

[Teknoratti]

Very strange. any remote host ending in .34 doesnt work. The reason I mention ACLs, and VLANs is b/c access can be restricted per ip range on a firewall / router, managed switch