Active Directory Replication Troubles.

[irvmic]

We have 3 DC's in a domain.

2 of the DC's are at site 1.

1 of the DC's is at another site 2 (other physical location as well).

Our wan connection is not direct. It goes through a firewall at our ISP. The problem I am having is getting the replication to run. It just refuses saying there isn't enough info for the KCC to run it's course. However I am suspecting that it has something to do with the firewall in the middle.

I say this because if I move the server to location 1 and just change the ip address it work immediatly.

So what do I need to make sure is open in the firewall?
What ports and protocols do I need?
Is there any tools that can sort of check that enough connectivity is going through the firewall for a replication to theoreticly work?

Also I have heard that it is possible to use IPSEC / PPtP /VPN to replicate but can't find a nice how-to.

Would be very grateful for some help.

Michael

 

[TechyMcSe2k]

The easiest way to resolve this issue is to have 2 Cisco Pix firewalls. One at Site 1 and one at Site 2. Then create a site link between the two sites(pix to pix connection). This is otherwise considered a constant-VPN. This is a trusted tunnel between the two sites and will not be interrupted by the ISP firewall. Besides, your ISP will not open up their Firewall for anything. They will tell you to set up a VPN. The setup for the Cisco PIX are straight forward. Through the Web-Based PDM, they have a wizard to walk you through it. Hope this helps!

Cliff, CCNA/MCSE/MCSA 2000
Network Administrator

 

[JockFrog]

Hi Michael,

What type of firewall are you running?

If you can easily set up your rules base try simply Source(DC1) to destination (DC2) with all the information needed IP's etc and allow ANY type of TCP/IP traffic.

Usually you can see what traffic is being dropped with a tracker type log, this will probably indicate UDP xxx port numbers. Compare the before and after logs to see what has passed okay and vice versa.
Remember, don't leave the rule/filtering wide open and try and verify the port No's and protocol with the aim of tuning DC communication only.

Hope this long way helps you see more clearly what's doing what.