Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is a rough outline of my network

DC1 ----> Firewall1 ---> VPN ---> WAN <--- Firewall2 <--- DC2

--First DC--
DNS: /

--Second DC--
DNS: /

Both are connected through two Endian firewalls that have a GW-to-GW VPN enabled. All ports are open and can browse \\SYSVOL and \\SYSVOL from both.

DC1's DNS [Apollo DNS]

DC2's DNS [Zeus DNS]

So, I'm trying to figure out why DC2 has the correct DNS information, but DC1 (Apollo) didn't get updated.

If I add a user to AD, it also only replicates one way. A user added to DC1, shows up in DC2, but not the reverse.

DNS records also only seem to replicate from DC1 to DC2. If I add a record to DC1 (Apollo), it eventually shows up in DC2 (Zeus).

Any advice?

** Edit - Fixed NETLOGON error 5781 by changing DNS, still having one way replication issues.

** Edit 2 - dcidag /test:dns /v passes on both machines. nslookup on DC1 has no idea what is, even if I set the DNS server to DC2.

share|improve this question
In the process of taking the VPN out of the equation to test that. If I can get it to work across a single firewall, then I'll know it's a problem with the routing through the VPN as opposed to some Windows configuration. – Kyle Johnson Mar 17 '13 at 21:17
So I added a separate network to one of my Firewalls and installed DC2 behind it. This worked without any issues, so there is obviously some routing issues between the VPN of the two firewalls. – Kyle Johnson Mar 17 '13 at 22:47

If you have Active Directory Sites and Services setup correctly with both sites and both subnets and if you have each DC in its respective site then this is perfectly normal. Intersite replication only occurs every 180 minutes.

share|improve this answer
I have two subnets and two sites setup. They are both connected through the "DEFAULTIPSITELINK" ... Each site has the server that is in the correct subnet. I can right-click and "Replicate Now" on DC2, but DC1 fails because with "The following error occured during the attempt to synchronize naming context dev.local from Domain Controller DC2 to Domain Controller DC1: The naming context is in the process of being removed or is not replicated from the specified server. The operation will not continue." – Kyle Johnson Mar 17 '13 at 21:11
My issue is that it seems to only replicate one way inbound from DC1. When I added DC2 to the domain, DC1's DNS records didn't get updated even though dcdiag /test:dns /v passes on both servers. DC1 seems to not think that DC2 exists... – Kyle Johnson Mar 17 '13 at 22:01
up vote 1 down vote accepted

The VPN is the issue in this situation. Some of the routing is not being done properly from DC2 to DC1.

I am going to close this question.

share|improve this answer
At least it appeared to be a VPN issue. I did some testing on a non-VPN'd firewall with different subnets and it seemed to work okay. – Kyle Johnson Mar 20 '13 at 3:51

Use the SAME DNS server order on both DC1 and DC2

share|improve this answer
I was following a best practice for multiple DCs by staggering their IP. However, changing didn't help either. – Kyle Johnson Mar 17 '13 at 11:48
-1 This is wrong. Very wrong. – MDMarra Mar 17 '13 at 14:39

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.