Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a Windows 2008 server connecting to an iSCSI target on an OpenSolaris box (yay ZFS!). I'd like to create a private network between the 2 boxes that is totally separate of my Windows domain.

What is the best way to configure the additional network adapter on the Windows machine so it doesn't think the new subnet is part of the Windows domain? I want to make sure Windows doesn't magically start spewing active directory communications over the private wire and that it doesn't start poisoning the DNS with IPs from the private network.

share|improve this question
    
Interesting. I hope to learn something! –  tomjedrz May 27 '09 at 18:04

5 Answers 5

The correct way of achieving this is by unbinding the Microsoft protocols from the iSCSI interface. Go to the properties of the Network Connection and deselect the check boxes for "Client for Microsoft Networks" and "File and Printer Sharing for Microsoft Networks".

Before:

enter image description here

After:

enter image description here

share|improve this answer
    
I did this and now the machine shows up in our DNS (running on the same machine) on both the private addr. and LAN addr. How can I keep the private address from showing up in our DNS forward lookup zone? –  Sysadminicus Aug 26 '09 at 19:51
    
Go into the Advanced TCP/IP properties of the iSCSI connection, and untick the box that says "Register this connection's IP addresses in DNS". –  John Röthlisberger Sep 9 '09 at 11:00
    
PS. Making the changes as instructed in my response to your question didn't cause the two IP addresses to show up in DNS. –  John Röthlisberger Sep 9 '09 at 11:03

Would it be possible to configure the firewall on that specific interface to filter outgoing active directory traffic, after taking the steps outlined by therulebookman?

share|improve this answer

Probably the easiest method would be to use a “Public Link/Private Link” configuration similar to clustered servers. The public link would be the connection to your Windows domain, and the private link would connect to the NAS. The trick in this situation is to configure the private link with a completely dissimilar IP address from the subnet used in you Windows domain. For example if your Windows network runs on the 10.0.0.0 subnet, you might use the 192.168.0.0 subnet for the private link. You also want to use the bare minimum amount of information when configuring the connection. You should only need the IP address and the subnet mask.

Two other methods you could use are:

  • Implement an IPSec policy.
  • Add persistent routes to the windows routing table.

With either of these methods you would be specifying that any traffic bound for the 10.0.0.0 subnet must use 10.x.x.x (insert actual IP address of public link here), and any traffic bound for the 192.168.0.0 subnet must use 192.168.x.x (insert actual IP address of private link here). All of these methods can be used together if you want to ensure additional safeguards to prevent cross-contamination.

share|improve this answer

A lot of these steps would be quite a bit of overkill!

From my own experience, all I've needed to do to segregate the traffic is just keep a default gateway off of the second (SAN) NIC. Windows Server 2008 is smart enough to recogniza the "Domain" network and route all domain traffic accordingly. If you look at the NIC status, when WS2K8 is doing it's thing, the domain NIC will actually display the DN of the Domain Network. Your SAN NIC will say "Unidentified".

share|improve this answer

Since this has zero answers, I'll give what I remember. Seems like Windows network stack is smart enough to route that traffic by knowing which adapter has an IP address on that subnet. Also, you can leave DNS blank on the private connection under TCP/IP settings under properties. You can also go into advanced from there and delete the domains it searches for. This will at least optimize data flow, and I believe this is how we have it set up going from server 2003 to a Dell md3000i. I haven't noticed anything crazy on the traffic monitor and there is a good bit of data running through there. hope that helps.

Tim made an excellent point I forgot which is leave off the gateway. So in other words, like he said, just use a IP and subnet mask. But windows fills in some other stuff on its own and I like to get rid of that stuff too. Another thing you can do to optimize traffic is to delete all but "TCP/IP" from the connection properties on the SAN connection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.