3

I have Windows Domain level 2008 R2. There are four GC DC in four different physical locations. I have Kerio-based VPN network for replication and remote administration.

Here is how network configured:

     dc1:
     local IP: 192.168.0.10
     VPN IP: 192.168.1.10

     dc2:
     local IP: 10.10.8.11
     VPN IP: 192.168.1.11

     dc3:
     local IP: 10.10.9.12
     VPN IP: 192.168.1.12

     dc4:
     local IP: 10.10.10.13
     VPN IP: 192.168.1.13

That's simple, replication and all works fine but when running dcdiag on dc3 I have an error:

     A warning event occurred.  EventID: 0x000016AF
     During the past 4.12 hours there have been 216 connections to this Domain 
     Controller from client machines whose IP addresses don't map to any of the
     existing sites in the enterprise. 
     <...> 
     The log(s) may contain additional unrelated debugging information. 
     To filter out the needed information, please search for lines which contain text
     'NO_CLIENT_SITE:'. The first word after this string is the client name 
     and the second word is the client IP address.

Here is netlogon.log lines example:

     05/30 12:07:39 DOMAIN.NAME: NO_CLIENT_SITE: dc2 192.168.1.11
     05/31 09:52:11 DOMAIN.NAME: NO_CLIENT_SITE: dc4 192.168.1.13
     05/31 19:49:31 DOMAIN.NAME: NO_CLIENT_SITE: adm-note 192.168.1.101
     07/01 05:16:26 DOMAIN.NAME: NO_CLIENT_SITE: dc1 192.168.1.10

All VPN-joined computers are generates same log line as above. Computer amd-note is for example administrator's notebook, also have VPN.

Question is should I add new AD site and bind VPN subnet 192.168.1.0/24 with that site?

Improve this question
5
  • 1
    Could you please clarify: you have your DCs connected through a client-to-site VPN ? That means they are, in effect "multi-homed" and, in AD, that's a big issue (not fatal anymore since 2000, but still not recommended). Why exactly aren't you using sit-to-site ?
    – Stephane
    Jul 1, 2013 at 7:41
  • That's not how you're supposed to do it. Like I said, you're, in effect, multi-homing your DCs which will cause all kind of problem. It'll be even more delicate if you have clients also connecting as client-to-site in the same IP subnet. Migrate to a site-to-site VPN and you'll solve all your issues. Creating a new AD IP segment will not help you there: it'll mask the error but you'll continue to have inconsistent AD routing as each VPN client will find itself in two sites at the same time.
    – Stephane
    Jul 1, 2013 at 9:49
  • yes, all remote DCs connected to the main office (where dc1 is) using a client-to-site Kerio VPN client. I was planning to use site-to-site connection. The main reasons I don't: 1)in some cases there is only one physical computer and it has DC role, I cant install Kerio Connect on it to make site-to-site connection and 2) I have a disposal from a company director "do not let anyone from branch office have an access to our internal network"
    – ykyri
    Jul 1, 2013 at 10:28
  • @Stephane sanks for help! now I'll raise the question of the purchase of new equipment to have capacity to run at least one VM to separate DC from physical PC and have ability to install site-to-site connection. this will be the most wise decision.
    – ykyri
    Jul 1, 2013 at 10:39
  • I typically try to handle this kind of issue at the network level: site-to-site VPN with a central firewall for traffic control. It used to be quite expensive but nowadays, you can find VPN endpoints that are very cheap. And with a central firewall (or VPN server, if you want to separate the roles), you can have a much better control of what goes on your wire. If you need additional security, you can always setup IPsec between the DCs.
    – Stephane
    Jul 1, 2013 at 12:21

1 Answer 1

Reset to default
4

DCs should typically be connected only to one network and have only one IPv4 address and one announced IPv6 address (if you are using IPv6 which all good people do). You should never multihome them, as it tends to cause reachability issues and confuse things.

You could certainly create a separate site for this. It would remove the warning and bring you a little closer to BCP, but not all the way.

The correct thing to do is to either route the network containing your DCs on the VPN (removing the need for them to have an additional IP) and add the VPN subnet to your site, or create an additional DC (they are astoundingly inexpensive as VMs), give it an IP on your VPN subnet, and add it to the new VPN site.

That said, these warnings are nonfatal, and will be wholly inconsequential unless your network is very large or has lots of high latency links and the VPN clients would have problems or terrible performance connecting to a DC chosen at random.

Improve this answer
1
  • 1
    Thanks for the answer. I've made decision to reorganize network structure to have ability to use site-to-site connections between main and branch offices. More work now but less troubles in future, I guess.
    – ykyri
    Jul 1, 2013 at 10:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .