I have 2 Sharepoint Servers and 1 Fast Server(All Windows 2008 R2) moved From Internal Network To The DMZ layer. Now these 3 servers cannot communicate with the DC & DNS(Windows 2000). All the related ports have been open from the Firewall WatchGuard both ways. But i can ping the DC & DNS. I can access the shared folder on both the DC & DNS.

Login is too slow, When i try to add a domain user to local administrators group, the following error occurs:

Error: RPC Server is Unavailable. Event Log Error: **The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following: a) Name Resolution failure on the current domain controller. b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

  • Which ports did you open? Is there any NAT'ing across either interface? Does the WatchGuard allow you to run a capture? – sjw Oct 7 '12 at 11:48
  • Application protocol Protocol Ports Active Directory Web Services (ADWS) TCP 9389 Active Directory Management Gateway Service TCP 9389 Global Catalog TCP 3269 Global Catalog TCP 3268 LDAP Server TCP 389 LDAP Server UDP 389 LDAP SSL TCP 636 IPsec ISAKMP UDP 500 NAT-T UDP 4500 RPC TCP 135 RPC randomly allocated high TCP ports¹ TCP 1024 - 5000 49152 - 65535² – Asim Oct 7 '12 at 12:00
  • Natting is done, with the 2 Public ip to 4 Private Ip's. 88.85.***.** to,3,4 & 5/29 where as the internal ip for DC & DNS is & – Asim Oct 7 '12 at 12:01
  1. Use Network Monitor to watch for packet retransmits from a server on DMZ when you try to do something that fails, like add a local admin.
  2. You have increased complexity because your DMZ servers are >= 2008 and your old internal AD boxes are not. 2008 changed RPC port ranges. I see you've listed some in comments, but make sure all ports on both 2003 & 2008 are open both ways.
  3. You should route, not NAT, your DMZ to internal network. NAT will make things harder, if not impossible to get working. Microsoft does have some suggestions on this.
  4. Make this all easier by using IPSec tunneling, but I don't believe it can use NAT either.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.