pix and dns queries

[blackrabbit]

I'm beating my head on the wall about this one. We just ctarted moving to a 2003 server ad with xp clients. we were on nt4 domain. We switched one building to the new domain and started making them use roaming profiles. That building has avpm tunnel from thier 501 to our 515. Logging in from there takes almost 5 min over a 1.5 MBps t1. But form main office where the DC/DNS server is take seconds.

The remote computers are getting dhcp via thier pix and yes they are pointing to our DNS server. I've looked at everything and now I'm starting to think that maybe the pix is cauing problem with the DNS resolution from the remote site during login while the client tries to find the DC. I'm at my wits end. I've tried a few things that have sped up the login a little,mine take about 2 min now instead of 5 min. Our profiles are less than 3 meg. Just though I'd ask if there is something i have to set in the pix to allow dns resolution through the tunnel to our main dns server.

 

[chicocouk]

One thing I've seen in similar circumstances that slowed down login A LOT over a vpn was how many security groups the users were in. Try creating a test user, pop them in a single windows security group, and see if that logs in any faster than your other users. If so, try to minimise the amount of security groups the users belong to. I did have a technet article explaining why, but can't find it at the moment. The general gist is that during login the users credentials have to be checked against each security group to determine their rights, and this seems to generate network traffic for some reason. I've seen users take half an hour to log in over a vpn on top of a 512meg adsl connection. Took the user out of all the security groups, logged in almost as quickly as if they were on the lan.

Alternatively you may be onto something with the DNS idea, 2003 server support EDNS0, whereas NT servers didn't. I *think* xp clients do too. So your fixup dns statement may be blocking dns down the vpn. I mentioned that issue a bit more in another post, the links might be useful:

http://www.tek-tips.com/viewthread.cfm?SQID=827561&SPID=35&page=3

Best of luck mate

chico

CCNA, MCSE, Cisco Firewall specialist, VPN specialist, wannabe CCSP