0

I have a Windows Server 2012 R2 box with the Hyper-V role installed which is also Domain Controller. The server is in a DMZ area of the network, and the only other Windows box is a Server 2012 R2 virtual machine on the same server. The server also hosts a Web Proxy VM which is the network gateway.

The issue I have is that every time the server is booted, because the Web Proxy VM is not yet started, the server can't find the gateway IP and doesn't identify it's own network adapter as 'Domain', it is instead labelled as 'Public'. Disabling and re-enabling the NIC corrects this issue, but can't be done remotely as RDP ports are not open for 'Public' networks, necessitating a trip to the server room.

What is the best way to get the server to re-evaluate the network it is connected to such that it identifies it as 'Domain' and applies the correct firewall rules, within a reasonable time after boot but such that the Web Proxy VM has had time to boot also?

1
  • 1. Install a second Hyper-V host that you can migrated the virtual machines to when you need to reboot this host, and vice versa. 2. Allow RDP inbound in your Public firewall rule for your specific ip address or internal network. This will ensure that you can RDP to the host regardless of the network/firewall profile in use.
    – joeqwerty
    Aug 12, 2016 at 15:27

1 Answer 1

2

It's not a particularly good practice to have management access to a host server depending on services provided by a guest VM in this way. Otherwise what happens if you need to stop/restart/reconfigure that VM while connected via the gateway it is providing? You'd probably be better off with a separate management NIC.

Anyway, that said, the service that makes the determination of what firewall profile to load is the "Network Location Awareness" service. Restarting that will have the same effect as disabling/re-enabling the NIC in this case so you could perhaps schedule a net stop nlasvc, net start nlasvc (and the dependent services like the network list service) to run after you think the guest VM has had time to boot.

Otherwise enable RDP through the Public firewall profile to ease troubleshooting. If the server is in the DMZ then the DMZ firewall should be keeping the internet out and prevent it becoming a security hole.

1
  • Thanks for the pointer towards the Network Location Awareness Service, I'll look at scheduling that for a restart 10 minutes after boot. Management of the Hyper-V host will actually be via IP KVM in the near future, so the RDP isn't going to be an issue long term, but I appreciate it's not a great setup where a reboot can prevent further access!
    – Earl Sven
    Aug 15, 2016 at 10:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .