Summary of whats been going on and the problem

Migrated NT4 domain to AD lastnight using an in place upgrade of the PDC. All is working ok on our main site once we sorted out a DNS issue this morning that was causing PC's to take 5 mins to login.

We have a server at a remote venue that already had 2003 server on it, so lunchtime popped over to run dcpromo to make it a domain controller to help users login more quickly and resolve an issue caused by the fact that the pc's couldnt logon properly because for some reason they couldnt contact the new 2003 dns server. Problem is partway through the dcpromo process it bombed saying it was having problems with ntds. Decided to remove server from domain and try again, this time cant even get that far.

In the end we took the server and drove the 10 miles back to the office and did everything there, dcpromo, install dns and let the whole thing sychronise with the domain. Disconnected and drove all the way back again, reset IP's, DNS, and changed DHCP to point to new dns. Voila clients can now login again and access there resources nice and quickly.

Now for the big problem, its all working except that the new DC cannot contact the main DC's at the office to replicate. The event log seems to be generating RPC related errors. Another thing that may have a bearing is the problem related to dns. If on the remote site I put in the 2 new dns servers, and an old one running on 2k on a desktop XP machine then go to a command prompt and type nslookup, the pc cant connect to the 1st 2 but finds the old one ok.

The remote site is connected via a cisco router, and routed through our checkpoint ng firewall. I can see no packets arriving and being blocked by the firewall log.

I think its a routing issue, and the router is not routing some ports to those new servers. I can access them via their names from the remote site by going \\servername\c$ and the directory is displayed.

Anyone seen anything like this, or can tell me what to look for in the router config. I can access the router, just a rusty when it comes to cisco config.

Network info.

Local main office network is 10.64.0.0 running with a subnet of 255.255.248.0

The remote site has 2 separate networks that operate independently through a vlan'd switch. Hence the router needed at the other end, the actual connection to the main office goes switch > router > les10 circuit > firewall. The firewall is used in this case to stop the .22 network getting onto our main lan as its used by a public cybercafe and routes straight to the internet.

remote network(1) is 10.64.21.0 with a subnet of 255.255.255.0 (office)

remote network(2) is 10.64.22.0 with a subnet of 255.255.255.0 (cybercafe)

It's more likely to be the checkpoint firewall blocking things. It would be unlikely to have access lists on the Cisco blocking stuff.

Do you have a clear-up rule on the Checkpoint at the bottom with logging enabled?

If so , have a trawl through the log and see what's not being allowed through

Do you know what port/protocol AD uses for replication?. I just added some stuff to the first post.

It's dynamic , but you can force a fixed port by changing the registry as per this article

http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx

And this might be of use as well

http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/df20bd3e-9914-4a8d-bd5b-3b987c73a34d.mspx

Just ras'd into work. Looking at the firewall log, I can see some errors but dont know how important they are and if they are related to the issue.

In the screen dump of the log, TRDCTCF1 is the server on the remote site and TDCLGDC02 is tha server in the main office.

Screen dump of event log.

Router access list with one ip removed.

access-list 101 permit ip host 62.137.75.107 any

access-list 101 permit ip host externalfirewallip any

access-list 101 deny tcp any host 213.123.240.156 eq telnet

access-list 101 deny tcp any host 213.123.240.156 eq 2001

access-list 101 deny tcp any host 213.123.240.156 eq 4001

access-list 101 deny tcp any host 213.123.240.156 eq 6001

access-list 101 deny tcp any host 213.123.240.156 eq 9001

access-list 101 deny tcp any host 213.123.240.156 eq 1999

access-list 101 deny tcp any host 217.40.25.142 eq telnet

access-list 101 deny tcp any host 217.40.25.142 eq 2001

access-list 101 deny tcp any host 217.40.25.142 eq 4001

access-list 101 deny tcp any host 217.40.25.142 eq 6001

access-list 101 deny tcp any host 217.40.25.142 eq 9001

access-list 101 deny tcp any host 217.40.25.142 eq 1999

access-list 101 deny tcp any host 10.64.21.1 eq telnet

access-list 101 deny tcp any host 10.64.21.1 eq 2001

access-list 101 deny tcp any host 10.64.21.1 eq 4001

access-list 101 deny tcp any host 10.64.21.1 eq 6001

access-list 101 deny tcp any host 10.64.21.1 eq 9001

access-list 101 deny tcp any host 10.64.21.1 eq 1999

access-list 101 deny tcp any host 10.64.22.1 eq telnet

access-list 101 deny tcp any host 10.64.22.1 eq 2001

access-list 101 permit ip any any

The firewall log shows communication between the two servers being dropped , so that's almost certainly why you are getting the windows error messages.

The access list looks just fine to me.

Odd that the firewall is blocking the connection because the packets are out of sync. I wonder why it's not seeing the first SYN packet? I don't think it's going to be a problem with the server as it managed to work ok on site.

Do you have a laptop with a sniffer so you can capture the traffic from the domain controller and see what's actually being sent out?

Might be able to rig something up tomorrow.

Just to try something, I created another rule on the firewall that said, anything from the remote server to those local DC's, then allow all ports both ways. But those empmap errors are still occuring.

That would seem to confirm that it is the firewall causing the issue.

I've done the checkpoint exams in the last few weeks , so I'm right up there on my theoretical knowledge , but the practical side has yet to be tested

I'll have a bit of a nose round tomorrow if I get time and see if I can find any reference to that error

If you get time that would be good. Looks like the firewall is dropping the syn packet although I cant see where as it doesnt seem to be logging it. I've given up for tonight, will try again during the day tomorrow. Accessing the firewall manager through Terminal services at work, then PC-Duo'd onto my office pc, then VNC'd onto the box is a pain from home.

Not sure if you have checked this forum.

This is a checkpoint forum, you might find some info on

http://www.cpug.org/forums/forumdisplay.php?f=19

or this

http://www.checkpoint.com/services/enterprise/secureknowledge/index.html

OK if you have an account

Just to update this one, I posted a message on the cpug forum. Got a reply, and it works. Basically even though I had added all ports checkpoint still blocks port 135. Had to add it manually , then uncheck a box on the advanced tab and presto it started working.

Hi, sorry I couldn't help that much myself, but I thought someone like czech12 could help, he seems to answer a lot of issues, I am still new to checkpoint and firewalls even though I help look after 200 or so of them!!