1

I Have two sites right next to one another connected using Draytek routers an IPSEC secure vpn tunnel. One site had all the servers the other none. I installed a new DC on the main site them moved it to the new site, now replication has stopped. I can ping everything both ways using fqdn, however replication for AD and DNS is not working

NTFRS - error 13508
AD error 1308
RPC procedure call failed

Forwarders are enabled on both sites, the nic card has a dns suffix for this connection, dns server have themselves listed in the network settings then each other, local firewall is disabled on both dc's,

any pointers?

ipconfig /all output:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : XX-DC4
   Primary Dns Suffix  . . . . . . . : xxxxxxxx.local
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : xxxxxxxx.local

Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : xxxxxxxx.local
   Description . . . . . . . . . . . : Realtek PCIe GBE Family Controller
   Physical Address. . . . . . . . . : A4-1F-72-90-A4-A9
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : 192.168.2.240(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : 192.168.2.1
   DNS Servers . . . . . . . . . . . : 192.168.2.240
                                       192.168.0.254
                                       192.168.0.5
                                       127.0.0.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.XXXXXXX.local:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : xxxxxxxx.local
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:30ec:268b:2b96:5f1a(Pref
erred)
   Link-local IPv6 Address . . . . . : fe80::30ec:268b:2b96:5f1a%16(Preferred)
   Default Gateway . . . . . . . . . : ::
   DHCPv6 IAID . . . . . . . . . . . : 469762048
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-1E-E0-51-CA-A4-1F-72-90-A4-A9

   NetBIOS over Tcpip. . . . . . . . : Disabled
Improve this question
4
  • 2
    Make sure your DNS resolution is correct on both sides. RPC failures can be as simple as not being able to resolve the remote name.
    – Tim Brigham
    Jun 3, 2016 at 17:57
  • could you please tell me what your specifically referring to?
    – user357849
    Jun 3, 2016 at 18:01
  • 1
    @user357849 TimBrigham is saying, "ping DNS name of the other host. If you can't ping the FQHN (fully qualified host name) then you don't have name resolution. If you don't have name resolution, the machines will be unable to communicate.
    – Citizen
    Jun 3, 2016 at 18:20
  • If DNS is working, then configuring subnets and sites in Active Directory Sites and Services is a good next step (unless that's already been done).
    – Todd Wilcox
    Jun 3, 2016 at 18:22

1 Answer 1

Reset to default
0

I can ping everything both ways using fqdn, however replication for AD and DNS is not working - If AD replication used ICMP then that would be great, but since it doesn't then I'd suggest you stop using Ping as an AD replication troubleshooting tool. It's great that Ping tells you there's connectivity between the two DC's but beyond that Ping is pretty useless in this scenario.

Forwarders are enabled on both sites - I don't understand what this has to do with the problem. Forwarders are used to resolve DNS records for domains that your DNS servers are not authoritative for. How you came to think that this is relevant to AD replication is a bit of a mystery.

dns server have themselves listed in the network settings then each other - That's not the best practice recommendation for DNS client settings on a DC. A DC shouldn't use itself first for DNS (unless it's the only DC). Your DC's should be using a partner DC for primary DNS, then themselves for secondary DNS, and then 127.0.0.1 for tertiary DNS.

local firewall is disabled on both dc's - Have you checked the network firewalls between the two DC's to make sure the relevant traffic is being passed between them?

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .