Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have 2 Sharepoint Servers and 1 Fast Server(All Windows 2008 R2) moved From Internal Network To The DMZ layer. Now these 3 servers cannot communicate with the DC & DNS(Windows 2000). All the related ports have been open from the Firewall WatchGuard both ways. But i can ping the DC & DNS. I can access the shared folder on both the DC & DNS.

Login is too slow, When i try to add a domain user to local administrators group, the following error occurs:

Error: RPC Server is Unavailable. Event Log Error: **The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

share|improve this question
    
Which ports did you open? Is there any NAT'ing across either interface? Does the WatchGuard allow you to run a capture? –  sjw Oct 7 '12 at 11:48
    
Application protocol Protocol Ports Active Directory Web Services (ADWS) TCP 9389 Active Directory Management Gateway Service TCP 9389 Global Catalog TCP 3269 Global Catalog TCP 3268 LDAP Server TCP 389 LDAP Server UDP 389 LDAP SSL TCP 636 IPsec ISAKMP UDP 500 NAT-T UDP 4500 RPC TCP 135 RPC randomly allocated high TCP ports¹ TCP 1024 - 5000 49152 - 65535² –  Asim Oct 7 '12 at 12:00
    
Natting is done, with the 2 Public ip to 4 Private Ip's. 88.85.***.** to 172.16.18.2,3,4 & 5/29 where as the internal ip for DC & DNS is 192.168.1.7 & 192.168.1.5 –  Asim Oct 7 '12 at 12:01

1 Answer 1

  1. Use Network Monitor to watch for packet retransmits from a server on DMZ when you try to do something that fails, like add a local admin.
  2. You have increased complexity because your DMZ servers are >= 2008 and your old internal AD boxes are not. 2008 changed RPC port ranges. I see you've listed some in comments, but make sure all ports on both 2003 & 2008 are open both ways.
  3. You should route, not NAT, your DMZ to internal network. NAT will make things harder, if not impossible to get working. Microsoft does have some suggestions on this.
  4. Make this all easier by using IPSec tunneling, but I don't believe it can use NAT either.
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.