1

First, some background: We have two sites connected via a FortiGate IPSEC VPN. They are each set up on different subnets - our main site is 192.168.2.x, and our second site is 192.168.0.x. We have a server (S01) running Windows Server 2008 Standard FE that is set up as our primary domain controller, Exchange, and DNS server; as well as DHCP for that site.

At our second site, we have a server (S02) running Windows Server 2008 that was originally just a file server, as well as DHCP for that site. I wanted to convert S02 to a domain controller to act as a backup in case the main server went down or internet connection was lost. So I ran dcpromo, and successfully converted S02 to a domain controller.

Now, I am having a problem: A few days after initial setup, I can't ping or connect to S01 from S02 any more, and vice versa. Both IP address and name fail for pinging or browsing shared folders. I also can’t ping devices on the 192.168.2.x subnet from S02 by name, but IP addresses work. However, I can ping devices on the 192.168.0.x subnet from S01 by either name or IP, except for S02 itself. Running repadmin /showrepl on S02 gives the last successful sync about 2 days after initial setup.

I don't have any problems pinging any IP addresses from different devices - e.g. I can ping S01 and S02 from computers at both of our sites. I just can't ping the servers from each other.

Windows firewall is disabled on both servers, and I tried disabling the antivirus (ESET File Security) with no effect.

Both domain controllers are showing up in Active Directory. Running nltest /dclist:domainname.local gives me my two server as domain controllers, with S01 as primary. I can log on to both servers with Active Directory Explorer. My dns settings are 192.168.2.5 (S01) & 192.168.0.5 (S02) on both servers. DHCP services are still separate, since each server is providing IP addresses within different subnets.

I initially thought that something was messed up on the DNS side, but that wouldn't explain why I can't ping via IP address. Does anyone have any ideas?

  • Connectivity issues will lead to replication issues which can lead to DNS resolution issues. I would focus on the connectivity issues before taking on the other issues. Is the VPN configured to pass ICMP traffic? Have you reviewed the logs to verify ICMP is not being dropped by the VPN? – Clayton Sep 22 '16 at 19:45
  • Yes, ICMP traffic can go through the VPN. I can successfully ping both S01 & S02 from computers at either of our sites. At least, I assume if pings can go through, that means the rest of ICMP traffic can as well. – ChrisN Sep 22 '16 at 21:34
0

I assume Fortigate is blocking traffic from DC's. Check firewall configs on fortigate. Unblock all trafic between DC's and then do in backwards and block all the traffic that is not needed between DC's

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.