Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

as some of you may be aware, I'm currently involved in an on-going saga in getting our servers up and running. As pretty much a newb, I'm slowly making progress, but I've hit a stumbling block.

Here's a bit more about us: We're a website. We've grown too big for our server and hit the ceiling our lowly PowerEdge can handle. For a solution we're adding two servers: One as a Firewall/Router/VPN and one as a Web Application server. The original will be altered to become a DB server.

All three boxes are running Windows Server 2008 R2 and I'm using RRAS to configure it all. All three boxes are DIRECTLY connected (there are no hardware hubs, switches or routers).

This diagram hopefully gives a clearer idea of what I'm talking about (even though it's pretty vague).

alt text

The IP addresses are the static IPs I'm configuring for each network adapter.

Focussing on the "left-hand leg" ( to, we currently have the following setup:


For the adapter facing the Web App server (

  • IP:
  • Subnet:
  • Default gateway: (blank)


For the adapter facing the Firewall/Router (

  • IP:
  • Subnet:
  • Default gateway:

What's odd is that the Web Application server thinks that the connection is an identified network and thus I've been able to set it to Private Network (Work), but on the Firewall/Router it classes the connection to the Web Application server as unidentified Public.

Why would it do this? How can I fix it? What should I put in the (blank) space?

Thankfully the Web Application server is able to get an internet connection through RRAS's NAT on the Firewall/Router, so things appear to be configured correctly so far. Am I going about this the right way?

Thanks for any help or pointers.


Thanks to advice from Massimo and Sim, we've decided to get a switch. Now our configuration looks more like this...

alt text

Thanks again, folks. This has been (and will continue to be) a real learning experience.

share|improve this question
Hmmm. Windows will not allow two network adapters to be enabled at the same time with the same IP address. Does that answer your question? :-/ – Django Reinhardt Nov 25 '09 at 20:16
This is going to be a pain to manage. Why don't you get a simple 4/8 port switch to tie your network together? – Massimo Nov 26 '09 at 10:03
@Django: "A cheap switch wouldn't be able to handle the amount of throughput required" What kind of throughput are you needing? Greater than 1Gb? A Procurve 1800-8G would do nicely if 1Gb is enough for you. It has nice features, a web management interface and it's around $150. You didn't hear this from me, but you could dangle it behind the servers if you really had to. =) – Wesley Nov 26 '09 at 16:59
I absolutely agree. And I must add I think even 100 Mbit would be more than enough for 99% of web applications. The kind of web apps which could need 1 GBit throughput to their database wouldn't fit on a single server. – Massimo Nov 26 '09 at 17:18
@DJango: I know this conversation is straying far from your original question, but permit me to take it just a bit further. Concurrent connections aren't going to be an issue for the switch. The unique concurrent connections will be to the front end RRAS server. The server's internal interfaces would be connected to the switch where there would be no concurrent connection problem. It would simply be a matter of raw throughput, PPS, backplane bandwidth and MAC address table limits, all of which will not come anywhere near being maxed out even on the 1800-8g. – Wesley Nov 26 '09 at 19:07
up vote 4 down vote accepted

This is the same question as "Windows 7, network connection with no default gateway: any way to change the “Unknown network” status?".

Short answer is: this is normal behavior. Unfortunately you won't be able to make the "unidentified network" message go away unless you specify a default gateway on the adapter. The specified gateway must respond to ARP requests (meaning: it must be alive).

share|improve this answer
It's not quite the same, as I'm interested to know if I should be putting something as the default gateway... Do you know? – Django Reinhardt Nov 29 '09 at 21:37
There are ways to make it work with a default gateway specified (playing with route metrics), but you shouldn't. More specifically, you shouldn't have to. – e-t172 Nov 29 '09 at 22:39

To change the network location type you could try:

  • Start the Local Security Policy (secpol.msc)
  • Select Network List Manager Policies
  • Find the network and try and change its type.

If you right click on Network List Manager Policies you can change the networks it displays from Connected Networks to Show All Networks.

Why did this happen? Possibly because the Web Application Server had the Router as its default gateway and hence could identify the network where as the Router didn't have enough information on the Web Application Server and defaulted it to the untrusted public type. Have a read of What settings does Windows use to determine network location?

share|improve this answer
+1 I understand it's the router's internal NI that needs to have its default gateway changed... but to what? Surely the default gateway should be itself, or something? If set the default gateway to then it creates two networks for the same adapter on the Router: One private and one "unidentified" public. How does that work?? – Django Reinhardt Nov 26 '09 at 15:13
The default gateway is itself. – Wesley Nov 26 '09 at 17:00
Thanks for the advice, Nonapeptide, but the network is still listed as "Unidentified" (Public). The only difference is that now pinging from the Firewall/Router returns "Reply from Destination host unreachable." (Although the next three pings all come back fine.) By this logic should the default gateway not be the external facing IP? Or do I have to tell the Router where the "Default" Default Gateway is or something? :) – Django Reinhardt Nov 26 '09 at 18:24
Hmmm. It now seems I get that weird ping reply no matter what I enter. Ugh. – Django Reinhardt Nov 26 '09 at 18:29
Now you know why I dislike Windows's new Network Location Awareness feature. It's to nebulous as to what it does and too quirky to change. Nonetheless, chekc out this article on NLA and see if it applies to you:… and then check out this thred for further info… – Wesley Nov 26 '09 at 19:15

This seems confusing to me because all the network interfaces are on the same network.

I think you should have 4 separate networks for each line in your drawing, if you're insisting on not using hubs or switches. Otherwise you're going to have to put in a static route on your web server to your database server and vice-versa.

share|improve this answer
Thanks for your reply. I've already setup static (persistent?) routes like this (from the Router/Firewall box): DEST: GATEWAY: METRIC: 1 IF: // DEST: GATEWAY: METRIC: 1 IF: ...(where IF = interface number). Could you explain more about your "four networks" solution? Thanks. – Django Reinhardt Nov 27 '09 at 16:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.