Multiple network connections on a Windows 2008 domain controller (private network for NAS)

Question

I have a Windows 2008 server connecting to an iSCSI target on an OpenSolaris box (yay ZFS!). I'd like to create a private network between the 2 boxes that is totally separate of my Windows domain.

What is the best way to configure the additional network adapter on the Windows machine so it doesn't think the new subnet is part of the Windows domain? I want to make sure Windows doesn't magically start spewing active directory communications over the private wire and that it doesn't start poisoning the DNS with IPs from the private network.

Answer 1

The correct way of achieving this is by unbinding the Microsoft protocols from the iSCSI interface. Go to the properties of the Network Connection and deselect the check boxes for "Client for Microsoft Networks" and "File and Printer Sharing for Microsoft Networks".

See screenshots: Before, After.

Answer 2

Would it be possible to configure the firewall on that specific interface to filter outgoing active directory traffic, after taking the steps outlined by therulebookman?

Answer 3

Probably the easiest method would be to use a “Public Link/Private Link” configuration similar to clustered servers. The public link would be the connection to your Windows domain, and the private link would connect to the NAS. The trick in this situation is to configure the private link with a completely dissimilar IP address from the subnet used in you Windows domain. For example if your Windows network runs on the 10.0.0.0 subnet, you might use the 192.168.0.0 subnet for the private link. You also want to use the bare minimum amount of information when configuring the connection. You should only need the IP address and the subnet mask.

Two other methods you could use are:

• Implement an IPSec policy.
• Add persistent routes to the windows routing table.

With either of these methods you would be specifying that any traffic bound for the 10.0.0.0 subnet must use 10.x.x.x (insert actual IP address of public link here), and any traffic bound for the 192.168.0.0 subnet must use 192.168.x.x (insert actual IP address of private link here). All of these methods can be used together if you want to ensure additional safeguards to prevent cross-contamination.

Answer 4

A lot of these steps would be quite a bit of overkill!

From my own experience, all I've needed to do to segregate the traffic is just keep a default gateway off of the second (SAN) NIC. Windows Server 2008 is smart enough to recogniza the "Domain" network and route all domain traffic accordingly. If you look at the NIC status, when WS2K8 is doing it's thing, the domain NIC will actually display the DN of the Domain Network. Your SAN NIC will say "Unidentified".

Answer 5

Since this has zero answers, I'll give what I remember. Seems like Windows network stack is smart enough to route that traffic by knowing which adapter has an IP address on that subnet. Also, you can leave DNS blank on the private connection under TCP/IP settings under properties. You can also go into advanced from there and delete the domains it searches for. This will at least optimize data flow, and I believe this is how we have it set up going from server 2003 to a Dell md3000i. I haven't noticed anything crazy on the traffic monitor and there is a good bit of data running through there. hope that helps.

Tim made an excellent point I forgot which is leave off the gateway. So in other words, like he said, just use a IP and subnet mask. But windows fills in some other stuff on its own and I like to get rid of that stuff too. Another thing you can do to optimize traffic is to delete all but "TCP/IP" from the connection properties on the SAN connection.

Answer 6

I have a similar situation but have chosen NFS running on a W2K8R2Ent server. Are there any other considerations I should know that have not already been mentioned in this thread? Would the unbinding still apply for NFS as it does here for iSCSI? The second NIC on my server is on a separate subnet with no assigned default gateway (as mentioned above), I am still having trouble even testing to see if there is a connection to this NIC on the 2nd subnet.