Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Running an SBS 2008 server for a client, who added a new office. I set up a Windows 2008R2 server at the new office, which was promoted to domain controller and GC (logon) server.

Both servers are connected via VPN and we can ping both over this. However, something is wrong with the AD replication: the logs on both have KCC 1311 errors in eventlog:

The Knowledge Consistency Checker (KCC) has detected problems with the following directory partition.
Directory partition: CN=Configuration,DC=xxxxxxxxx,DC=local There is insufficient site connectivity information for the KCC to create a spanning tree replication topology. Or, one or more directory servers with this directory partition are unable to replicate the directory partition information. This is probably due to inaccessible directory servers.

The Sites and Services setup is correct with the right subnets. If I add sitelink items on one server these get replicated to the remote server's info.. so something is getting replicated! DNS changes also get replicated. So I am confused - IS there a problem or isn't there?

When I tried to set up a DFS root on the SBS box and create a namespace on the remote server (from the SBS console) it fails with "Semaphore timeout".

We also discovered the other day that the 'Remote' site used for remote access and OWA isn't accessible from the new Win2008R2 server:

e.g. ping remote gives the correct IP address and responds: browsing to https://remote.xxxx.local starts but never actually gets through to the remote website (nothing appears on IIS logs). The same site works on the local LAN to SBS and externally from internet locations.

I have tried the various ADutils to test connectivity which all say it's fine.

So something is definitely wrong with the connectivity somewhere but we can't figure out what it is or where it is.

share|improve this question
add comment

1 Answer

It sounds like you may have already, but can you confirm that you've followed the steps detailed here?

What firewalls do you have in place between your servers, and are they reporting any blocked traffic at all between them? That's the most likely culprit (IMO). Is there any NAT in place between the servers?

share|improve this answer
    
Yes that KCC article was the first place I'd tried. REPADMIN /KCC says it's fine on both servers. If I run REPADMIN /REPLSUMMARY it reports "(1256) the remote system is not available". I can ping the server, so it's there, and RPCPING also works fine. I have turned off the remote server firewall so that's not the issue. It's possible I suppose that the VPN is somehow dropping something but I am not sure how to check this. I tried RPCPing but no errors. One possibility we thought might be packet size over the VPN. –  Quango Aug 30 '10 at 8:18
    
Oh forgot to mention there isn't any NAT. The local subnets are numbered differently so that translation wasn't required. –  Quango Aug 30 '10 at 8:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.