Site to Site VPN w/ nt 4 & 2000 servers cant trust

[jdeaner]

CONFIGURATION FOR VPN BETWEEN 2 SERVERS PIX TO PIX


2K NT 4.0
SERVER1-----PIX1----HUB/ROUTER-----PIX2-----SERVER2
10.1.X 10.2.X

I have verified that I am able to create a domain trust when bypassing both the PIX'x. When the PIX's are hooked back up, can see packets crossing but no trust allowed.


I have set up an IPSEC tunnel between two PIX 515's. I am able to Ping both the IP's of the Servers behind each of the PIX's, but I am not able to create a trust between them. I have also tried doing a trust between two NT 4 machines but the same results (domain cannot be contacted). I can tell from the PIX that the tunnel has been created and have verified that packets are crossing the VPN. If I set up IIS on one of the servers, I am able to reach server1's web page through the 2 PIX's from server2. I believe the PIX may be filtering my packet information which is needed for the trust but I'm not sure. Listed below is one of the PIX settings:

nameif ethernet0 outside security0
nameif ethernet1 inside security100
hostname Maui-PIX-01
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
names

access-list 101 permit ip 10.1.1.0 255.255.255.0 172.16.1.0 255.255.255.0
pager lines 24
logging on
no logging timestamp
no logging standby
no logging console
no logging monitor
no logging buffered
no logging trap
no logging history
logging facility 20
logging queue 512
interface ethernet0 auto
interface ethernet1 auto
mtu outside 1500
mtu inside 1500


ip address outside 192.168.1.52 255.255.255.0

ip address inside 10.1.1.1 255.255.255.0
no failover
failover timeout 0:00:00
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
arp timeout 14400

nat (inside) 0 access-list 101

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00 conn 1:00:00 half-closed 0:10:00 udp 0:02:00
timeout rpc 0:10:00 h323 0:05:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
AAA-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable

sysopt connection permit-ipsec
no sysopt route dnat


crypto ipsec transform-set chevelle esp-des esp-md5-hmac

crypto map transam 1 ipsec-isakmp

crypto map transam 1 match address 101

crypto map transam 1 set peer 172.22.112.12


crypto map transam 1 set transform-set chevelle


crypto map transam interface outside


IPSec tunnel.
isakmp enable outside

isakmp key SAMEKEYONBOTH address 172.22.112.12 netmask 255.255.255.255


isakmp identity address


isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 1000
telnet timeout 5
terminal width 80


What am I missing? NetBios & WINS have been installed and I also tried using LMHosts.

 

[yizhar]

HI.

> NetBios & WINS have been installed and I also tried using LMHosts ...
It still seems like a name resolution issue.
How exactly did you try?

Try with LMHOSTS on both servers, using #PRE + #DOM paramters (and rebooting the server afterwards).

Try with WINS configured and verified to be working.
I suggest WINS on each server with proper replication between them.

Make sure that each server can ping the other domain using computer name AND using domain name.

Verify that trust relationship over VPN is actualy what you're looking for. Maybe other solutions like TS on each side can work better for you, depending on your organization needs and plans.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[jdeaner]

Thanks, for the information. It had to do with an installation of NT 4 server. After re-install plus service packs update for NT 4, I was able to trust using LMHOSTS.

-Jason