RV130W Site to Site between 5 sites with SBS 2012 R2 and RRAS Active
We have a client who is openning up their 5th location. Currently 3 locations have 1 to 3 computers at each location and are connecting VPN connections on each computer to RRAS on the SBS 2012 server at central location. The new location will have 3 PC's, 2 laptops and a printer. We purchased 5 RV130W's with the Idea to set up Site to Site VPN for all 5 locations. This is something which we wanted to start with the new location and complete the other locations over a period of a few days.
The problem we ran into while configuring the new location is that the site to site VPN from new location to central location is not working correctly. We believe that the current installation or RRAS at the central location is interfering with the VPN traffic. The tunnel is created fine and we are able to ping from both subnets. We were able to join one computer to the domain over the tunnel but after a few restarts the computer no longers recognizes it is part of a domain. And, we can't join another computer to the domain using the http://servername/connect procedure. Using WireShark we noticed that the TCP traffic on port 389 is constantly in "TCP retransmission". When we try to connect to http://servername/connect the handshake between the client and server completes but hangs right after the Get request and then the connection is closed with RST/ACK.
We truly don't believe that there is anything wrong with the implementation of the VPN tunnel. We are just wondering why is it that traffic specific to domain functionality just hangs. Does anyone have any ideas or thoughts?
Re: RV130W Site to Site between 5 sites with SBS 2012 R2 and RRAS Active
Thanks @Flavio Miranda for your response but the issue is not related to AD replication.
I was able to find the problem and replicate it predictively. I just have not been able to find the root cause. The problem lies in whenever the router is updated with changes or restarted while the computers are connected to the router and the tunnel connected. What happens to the computers is that the Network Type goes from Domain network to Public network. Although the tunnel is still connected and I can ping to and from the central location, neither computer can authenticate with the domain. I will have to restart the network interface in order for the Network Type to change back to Domain network and then the computers can authenticate with the domain. The kicker is that the computer I'm using to make the changes to router will not have it's Network Type change to Domain network even if I restart the computer. I have to restart the server in order to have this computer's Network Type go back to Domain network. I don't know if restarting the network interface on the server will fix the problem since I'm connected to the server via RDP and don't think there is an easy way to remotely restart the network interface on the server.
Later I will test to see if a computer is affected if it is off when the router updated or restarted. I will also test configuring the router from a computer not joined to the domain to see if all computers reconnect to the domain after restarting the network interface.
It would be great if anyone can try to replicate this in their own lab. Thanks.
This document gives several answers on frequently asked questions for PFRv3 channel state behavior.
Q1: What are all the channel operational states from a BR (border role) perspective and what are the rules/conditions to be in each st...
The need was to reach an host inside a LAN through a VPN connection managed by the LAN gateway (Cisco 1921).
The LAN gateway performs NAT and there was a dedicate nat rule for the host i wanted to reach through VPN.
I couldn't connect to the hos...
We have 3 identical switches configured by someone else and would like to claim some of the Gigabit ports(G1/G2/G3/G4) for use on servers. When we try to change the wiring and configuration, we run in to connectivity issues. Attached is a des...