I have been scratching my head on this one for weeks, I have now decided to ask the question.

We have an SBS domain with 2 hypervisors, one runs 3 File Server, one run the SBS server itself. We also have a Cisco ASA 5510 firewall.

Remote users connect into the network using the VPN client, this works great for e-mail and SOME servers. For example we have a handful of different hardware server with static addresses clients can access through the VPN no problem. But when a remote user tries to access one of these 3 FS's it cannot find the host. When I try pinging the VM's it times out, although I can ping another VM that lives on the same hardware. I have compared all NIC/Virtual Switch settings nothing wrong!

So I have then decided it may be a firewall/policy issue, so for testing I have disabled all of the Windows firewalls on the servers, I have also done a RSoP to see what GPO's are applied to the machine, and nothing out of the ordinary.

So @ this point I am stuck, so I have tried to debug ICMP packets incoming to the Cisco firewall, the pings from the remote subnet hit the firewall but dont get through it.

Any ideas, I am maybe just not seeing the wood for the trees.....Could it be I need to configured some static routes (but other servers work without this)......do I need to configure RRAS for stable routing between two subnets?

Any help would be muchly appreciated.

  • Since your problem appears to be with resolving and accessing internal resources, why are you using Ping as a troubleshooting tool and why are you trying to debug ICMP traffic through the firewall? Using ping in this scenario is a Red Herring. Ping is way over-utilized in troubleshooting network problems. Even if you get Ping working how is that going to be relevant to the problem? Focus on the core problem and don't confuse the problem by throwing unneccessary variables into the process. – joeqwerty Dec 2 '12 at 17:56
  • Agreed, but in all my IT career ping is the tool to confirm there is basic connectivity between two devices, so if it is not working surely nothing else can work. You could argue and say it's not internal as the problem only occurs for remote users. – bettsy583 Dec 2 '12 at 18:13
  • Tracert would be a better tool in this scenario. You may get so distracted trying to troubleshoot why ping isn't working that you overlook things like routing and name resolution. – joeqwerty Dec 2 '12 at 18:17

I'd like to know if the problem is "can't find the host" (name resolution) or "can't reach the host" (routing / firewalling). Have you monitored either the client or server from a network perspective? MS SysInternals' Process Monitor is useful in situations like this. If you do use it, remove one of the default filters that hides anything involving "System". Without doing this, you won't see SMB/CIFS traffic. You can also turn off registry and file system monitoring. Plus tell it to drop filtered events (under the filter menu) - without this, the swap file get swamped with event data.

  • Cheers Simon, sorry for the bad clarification. It cannot resolve names with DNS, and it cannot find the hosts with bare IP's. Whats makes it more odd, if you do a reverse lookup of the FQDN it can resolve to the correct address. I have configured a GlobalNames zone to support single-label name resolution. – bettsy583 Dec 2 '12 at 16:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.