Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have a PROD site with 2 networks 1.1.1.X/28 and 10.10.10.X/24.
We have DR site with 2 networks 1.1.1.X/28 and 20.20.20.X/24.

The net 1.1.1.X/28 is not the same (you can't reach host on PROD from DR) as we have MPLS and need to have same network on both sites. On both sites we also have some systems with the same IP in 1.1.1.X/28 network.

We also have 3 MS AD controllers: AD1, AD2 on Prod, and AD3 on DR.
AD3 syncs with AD1. On both DC "Site link" configured through net 10.10.10X and 20.20.20.X respectively.
You can reach systems on net 20 from net 10 and back.

Issue: After a wile (1-5 days), errors regarding KCC (ID 1311 & 1865) occur on AD3 and in tow hours on AD1 & AD2 and synchronization from AD3 to AD1 fails.
Than there is no way to resync zones again automatically.

If using replmon or repladmin manually sync zones from AD1 to AD3, than back sync (AD3>AD1) will work also.

Question: What is wrong and how to make read of KCC error, enabling AD3 sync with AD1 without any errors?

share|improve this question
RFC 5737: "The blocks (TEST-NET-1), (TEST-NET-2), and (TEST-NET-3) are provided for use in documentation." If you are intending to use and as example ranges, don't. Use the TEST-NET blocks instead. – Skyhawk Aug 22 '12 at 21:32

What's wrong is easy.

1.1.1.x is a publicly routed network, as is 20.20.20.x. You've assigned a subnet that actually exists in Australia as one of your internal networks, and another subnet that actually exists in Virginia as another internal network.

Fixing the KCC errors may be a lot more involved, because generally it points at an error in your AD Site topology, which I wouldn't even begin to troubleshoot while using a couple publicly-routed subnets as internal networks, honestly, because it opens up way too many possibilities. Even in the general case, though, you haven't provided enough information for anyone to give an informed guess about the root cause. There are a lot of things that can cause these KCC errors, and without knowing more about your AD environment, there's just no way to say what's causing them in your case.

share|improve this answer
The 1.1.1.x and 2.2.2.x is a fake just to show that we have different subnets. I can't post actual naming, but it about C class network alike 192.168.0.X. So do not worry about Australia or Virginia. Just refer to the networks as they are C class. The situation is that can be found on both sites but is not linked. I think KCC fails primary because of that. – Kaim Jul 31 '12 at 6:55
It's not a class C network, classful networking died 20 years ago when VLSM/CIDR became the standard – MDMarra Aug 22 '12 at 21:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.