1

Background:

We have a single-forest single-domain AD for our little company. We have two geographically separated sites with different subnets. Both sites have been added as sites with appropriate subnets in the Active Directory Sites and Services. The additional domain controllers in the Site1 are working just fine and get replicated automatically with the auto-generated replication topology. All domain controllers are Windows Server 2012. DNS is active directory integrated.

Illustration:

Illustration

Constraints:

There is no MPLS. There is no option for hardware-based VPN like CISCO ASA etc.

What I have tried so far:

  1. Mapped a public static IP to DC1 using my ISP's CPE router (I don't know how that works, but there is a console where I can map a public IP to an internal private IP)
  2. There is no public static IP at Site2. However, as they connect using dial-up, they get a dynamic public IP (which keeps changing every time they connect to Internet)
  3. On both DC1 and DC2 I enabled RRAS. Created Demand-Dial adapters.
  4. On DC2 Demand-Dial adapter I provided the public IP of DC1, and set the static route to 192.168.2.0
  5. On DC1 Demand-Dial adapter I omitted the IP of DC2 (as I do not have a static IP), and set the static route to 192.168.1.0

After this, the connection was made successfully and I could ping both the servers from both ends. I made the Demand-Dial adapters as "persistent" and ping is still working fine.

Problem(s):

  1. I cannot ping other machines in Site2 from Site1 and vice-versa. I was thinking that it was a site-to-site VPN and hence all machines could reach others in the other site. Am I wrong? Anyway, that isn't my requirement as of now. As long as both the servers DC1 and DC2 are able to see each other, its fine for me.
  2. Multiple entries start appearing in both DNS servers for each server. One, the actual internal IP i.e. 192.168.1.x and 192.168.2.x. Second, the VPN allocated IP. Third, the public dynamic IP allocated to DC2 (which keeps on changing everytime and hence entries add up)! This means whenever I ping servers using names, it resolves to a different IP on each connection. I don't really know if this is a problem?
  3. The AD topology however somehow picks up the servers but keeps changing the links. One moment DC2's NTDS settings show DC1, after sometime it changes to ADC3 (another DC in Site1) and whenever I right-click and "replicate now", it says something like "...cannot replicate because it is being moved..".
  4. Most of the times, replication works just fine, But only one-way. From Site1-DC1 to Site2-DC2. Never from Site2-DC2 to Site1-DC1. It says, "RPC server not available".

I have been tearing my hair apart but just cannot understand what's happening. Firstly, is this the right-approach that I am taking for my scenario? If yes, what am I doing wrong?

1

To solve #2 remote the internal DNS IP addresses from the networks for the modem, VPN, and DHCP pool. If those network connections don't get IPs then they won't register themselves in DNS.

3
  • Thank you @mrdanny. But, am a novice. Could you please give me some pointers on how to do that. I mean where? – Abhitalks Mar 19 '14 at 18:30
  • Is this what you are talking about - support.microsoft.com/kb/289735 ? – Abhitalks Mar 19 '14 at 18:47
  • Thanks @mrdanny. It was a DNS issue indeed. The different IPs were causing the problem. I followed the instructions in the link that I mentioned above, and now only one IP is registered and hence the DCs are now able to resolve each other just fine. Thank you for the pointer. – Abhitalks Mar 21 '14 at 12:02
1

There is no option for hardware-based VPN like CISCO ASA etc.

Why? I can get devices for £100 each that would take so much of the work out of this it's ridiculous. You've got an ISP supplied router that "you don't know how that works", and another unspecified modem at Site 2, your DC2 has a public and private IP... It's grossly overcomplicated.

  1. Get Static IP at each site
  2. Install your own router at each end
  3. Configure IPSEC site-to-site VPN between the routers

That's it.

1
  • Thank you @BlueCompute. (1) Regarding "you don't know how that works", I am not much of a network guy. I just know how to use the console. (2) Your advice makes sense and is my fallback option if this company doesn't agree on MPLS. However, right now I need to get the AD replication going rather than waiting for procurement approvals (which somehow take a long time here irrespective of budget). So, I started with whatever I already have at my disposal i.e. Windows RRAS. – Abhitalks Mar 20 '14 at 11:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.