LDAP Bind/Connect Failed over TCP (ok over UDP)

[damber]

I have a network with various subnets and on subnet 1 I have an Active Directory server providing LDAP. on subnets 2 and 3 I can connect to this ok using the ldp.exe command in Windows. However, when trying to connect to this from subnet 4 using ldp.exe and the default TCP connection it fails to return anything (error 94), however if I select the option to make it connectionless (UDP) then it works fine...??

The connection travels through an ISA server / Router to get to the LDAP Server, however this is set to allow all communications for these subnets, and allows other subnets to work fine (as they route through this too) - and can itself bind with the LDAP server

Can anyone shed some light on what this might be ?

Thanks
Damian

 

[bcastner]

http://support.microsoft.com/kb/320903

 

[damber]

Thanks for the link bcastner, though the server is already fully patched - it was built only yesterday and has had all the patches MS has to offer applied via the windowsupdate site.

I think you might be on the right track with the Kerberos authentication though - do you have any other ideas?

Thanks in advance,
Damian

 

[damber]

Bit of an update:

I have now tested the server in question in each of the subnets - and it works in these areas, so it appears to just be this subnet that was at fault, so I have changed the IP range for this and it still has the same problem. I have also changed the hardware switch for this area, as I thought by some remote chance it could be this, though this also didn't make a difference. And I've also moved other servers into the subnet in question - these also cannot run dcdiag correctly due to the LDAP issue.

Can anyone tell me what this could be, I've tried running Network Monitor on the router/ISA Server, but couldn't see any LDAP packets being sent, only a DNS lookup for the FQDN parameter of dcdiag.

It can't be the computer account in the domain, as it works in the different subnets, just not in this one.

I have looked through every bit of detail I can on the Router/ISA server to see what is different about this subnet, but cannot determine what it is. It may just be my understanding of this, but it is a little odd.

Anyone got any ideas ???

I would really appreciate some fresh thoughts...

Cheers
Damian