PIX 501 & Windows 2000 Server

[userice]

I have a Windows 2000 Server behind a PIX 501 Firewall. When I tried to logon to the domain, it took a long time to logon. However, if I disconnect the PIX, then everything works fine. Can someone help me?

 

[yizhar]

HI.

I did not get the whole picture.

Anyway, make sure that all servers and clients use the DNS server of the W2K domain controler and *not* the ISP DNS server.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[userice]

The Problem was with the PIX
I had alias (inside) 192.168.1.xx 210.181.y.zzz 255.255.255.255
After I took it out, everything works fine. Does anyone know how to use "alias"?

 

[yizhar]

HI.

This is because of proxy arp.
The pix answers ARP requests on behalf of the server 192.168.1.xx and this is bad because it prevents connections to the real server.

The best solution is not to use "alias" at all, and use internal DNS server with manual reconfiguration as needed.

The other option is to use alias, but disable proxy-arp on the inside interface:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/ab.htm#65183

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/cmdref/s.htm#34006

(BTW - when you add the alias command for manipulating DNS resolution, it will not take effect on workstations until you reboot them or until the DNS cache expires).

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar