Windows 2003 DC fails Knows of Role Holders 1

[Rippley]

I have a site within a 2003 domain. The site's DC's fail when I run DCDiag for KnowsofRoleHolders for Schema Owner & Domain Owner Roles. Both Roles exist in the root domain called for this example (Holdings). Holdings is the parent domain to the one my server's exist in called (HoldingsChild). The HoldingsChild domain spans across VPN connections between 3 site's. The Root Domain exists on a WAN connection and does not exist locally, all traffic to Holdings route's via VPN and Firewall (Firewall's are Checkpoint - Firewall 1 & Sonicwall Pro)

Has anyone encountered this error or does anyone have any idea's, I've been working with mirosoft for the last 3 weeks and have got nowhere.

This is the error I get:
Starting test: KnowsOfRoleHolders
Role Schema Owner = CN=NTDS Settings,CN=LINCOLN,CN=Servers,CN=Atlanta,CN=Sites,CN=Configuration,DC=holdings,DC=com
[LINCOLN] DsBindWithSpnEx() failed with error -2146892976,
Win32 Error -2146892976.
Warning: LINCOLN is the Schema Owner, but is not responding to DS RPC Bind.
[LINCOLN] LDAP bind failed with error 8341,
Win32 Error 8341.
Warning: LINCOLN is the Schema Owner, but is not responding to LDAP Bind.
Role Domain Owner = CN=NTDS Settings,CN=LINCOLN,CN=Servers,CN=Atlanta,CN=Sites,CN=Configuration,DC=holdings,DC=com
Warning: LINCOLN is the Domain Owner, but is not responding to DS RPC Bind.
Warning: LINCOLN is the Domain Owner, but is not responding to LDAP Bind.

 

[technome]

Have you checked both firewall logs?

Check this out on the Minasi site about Cisco fragmentation

http://x220.win2ktest.com/forum/topic.asp?TOPIC_ID=9047&SearchTerms=cisco,fragment

 

[Rippley]

Using the info you provided we enabled fragmented packet handling on our firewall. This has resolved the issue and we can now connect to the Schema Owner and Domain Owner. Thanks for you help.