Trouble adding domain user and pinging

You need to set the client's DNS server to point to internal DNS server, not your gateway. It has to look up the SRV records to find a DC.

All your client machines should point to your internal DNS server. You can then configure your internal DNS server to forward DNS requests to your gateway (if you prefer) or just let it resolve external queries on its own. I typically forward requests to my ISP's DNS servers.

How is your IP 192.168.1.1 and your gateway 192.168.1.254? I assumed the gateway was always lower than your IP. Never really thought about it or tested it. But this just doesn't make sense to me.

dynamik wrote: »

You need to set the client's DNS server to point to internal DNS server, not your gateway. It has to look up the SRV records to find a DC.

All your client machines should point to your internal DNS server. You can then configure your internal DNS server to forward DNS requests to your gateway (if you prefer) or just let it resolve external queries on its own. I typically forward requests to my ISP's DNS servers.

Your DC should also be pointing to itself for DNS. You then set up forwarding in your DNS server to your other gateway/DNS server.

leefdaddy

rwwest7 wrote: »

How is your IP 192.168.1.1 and your gateway 192.168.1.254? I assumed the gateway was always lower than your IP. Never really thought about it or tested it. But this just doesn't make sense to me.

Wow... and you have your mcse and ccent...

rwwest7 wrote: »

How is your IP 192.168.1.1 and your gateway 192.168.1.254? I assumed the gateway was always lower than your IP. Never really thought about it or tested it. But this just doesn't make sense to me.

It's completely arbitrary. Most people either use the first or last address in a subnet, but you could put it anywhere in between as well. As long as you put in the IP for the correct device, nothing else matters (though it may make things a bit more difficult to keep track of).

rwwest7 wrote: »

Your DC should also be pointing to itself for DNS. You then set up forwarding in your DNS server to your other gateway/DNS server.

Only if your DC is also running DNS; you can have them on separate servers

You clarification was correct though. I was just stressing that he should configure DHCP to hand out the internal server for his other machines as well. I assume his servers are static.

OK dynamik, so I set my client's DNS IP to my Server's IP address (192.168.1.1, and this machine is also my DC and DNS), and while it does look like it was about to work (it took much longer to make a decision before failing), it still failed. I think I've isolated it as a DNS setup issue on my server, which leads me to ask, how do I get my internal DNS server to forward DNS requests to my gateway so my ISP can deal with DNS resolution? Btw, here's the new failure message I got:

The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain EAD.local:

The error was: "This operation returned because the timeout period expired."
(error code 0x000005B4 ERROR_TIMEOUT)

The query was for the SRV record for _ldap._tcp.dc._msdcs.EAD.local

The DNS servers used by this computer for name resolution are not responding. This computer is configured to use DNS servers with the following IP addresses:

192.168.1.1

Verify that this computer is connected to the network, that these are the correct DNS server IP addresses, and that at least one of the DNS servers is running.

For more information on how to correct this problem, click Help.

Somehow, when setting up DC's in the past, I never encountered this problem. DNS set itself up just fine and I guess I never really thought DNS requests weren't already automatically forwarded to default gateway.

You don't need to setup forwarding; that just allows you to offload DNS query processing/traffic to something else. Server 2003 will resolve queries just fine on its own. Even if that were setup incorrectly, it wouldn't matter here since you'd only need internal DNS records anyway.

That sounds like a basic connectivity problem. Can you access file shares, web pages, or anything else on the server? You said it's responding to pings, correct?

Regarding your original ping question, I would assume that your Tablet has the firewall on, which is why it will not respond to pings.

I turned off the Windows firewall on both the tablet and server, but the server still couldn't ping the tablet, while the tablet had no trouble pinging the server. They're on the same subnet, 192.168.1.x, with the tablet being host .52 and the server host .1. And the server has no problem connecting to the Internet, while the Tablet doesn't connect to the Internet anymore once I changed it's DNS address to point to my internal DNS addy from my server (192.168.1.1).

I think it has to be a connectivity issue, but aside from replacing all the Cat5 cables, I'm not sure what else to do. However, I have been getting dropped packets; at one point last week I would consistently get dropped packets when pinging my server from my tablet, but worst case it was 25% lost packets. It would always be the first packet too, which was weird. I had the same problem with dropped packets when I was pinging the server from my Vista laptop. Loss rate was about 25%.

Also, my tablet and server are both statically configured, while my Vista laptop that has the exact same problems pinging, is DHCP configured with the following ipconfig /all:

Windows IP Configuration

   Host Name . . . . . . . . . . . . : laptop1
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Broadcast
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
   DNS Suffix Search List. . . . . . : gateway.2wire.net

Wireless LAN adapter Wireless Network Connection:

   Connection-specific DNS Suffix  . : gateway.2wire.net
   Description . . . . . . . . . . . : Atheros AR5B91 Wireless Network Adapter
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : *edited*
   IPv4 Address. . . . . . . . . . . : 192.168.1.67(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Saturday, August 01, 2009 2:48:45 PM
   Lease Expires . . . . . . . . . . : Sunday, August 02, 2009 2:48:45 PM
   Default Gateway . . . . . . . . . : 192.168.1.254
   DHCP Server . . . . . . . . . . . : 192.168.1.254
   DHCPv6 IAID . . . . . . . . . . . : 218112607
   DHCPv6 Client DUID. . . . . . . . :*edited*

   DNS Servers . . . . . . . . . . . : 192.168.1.254
   NetBIOS over Tcpip. . . . . . . . : Enabled

Ethernet adapter Local Area Connection:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Broadcom NetLink (TM) Gigabit Ethernet
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 6:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 7:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : 6TO4 Adapter
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 12:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : *edited*

   Link-local IPv6 Address . . . . . : *edited*
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

Tunnel adapter Local Area Connection* 13:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.gateway.2wire.net
   Physical Address. . . . . . . . . : *edited*
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Since your client and server are on the same subnet, why are you using a router to talk? Or does this 2Wire router have switch ports that they're both connected to?

Since the servers packets don't come back, it leads me to believe the laptop doesn't know where to send them back to and thus you're using a router. Router interfaces should each be on different subnets though, as it's one of their main jobs to segment broadcast domains. If they are on a switch, you shouldn't be having these problems. Different subnets = different Gateway's so either the client or the server has the wrong gateway.

Can you show us a 'route print' for both the client & server if they're connected to a router?

An 'arp -a' if connected to a switch built in to the Router?

The only thing confusing me is how the server could be getting online if the gateway is wrong...unless there is a static default route in place on the router or the Server?

Can you show us the config of the router?

I don't think this is a DNS issue but to prove it, can you try 'ping -a enterpri-twm2d5'? Also, what comes up when you type 'ipconfig /displaydns'?

Oh and your packet loss in my estimation is probably due to something interfering with your wireless channel. If B/G try using Ch 1, 6 or 11. If I remember right, those are the non-overlapping channels. Otherwise, try A (5Ghz) instead.

The 2wire is a Qwest (possibly other ISPs as well) device that is an all-in-one unit. For all intents and purposes, it's just a switch in this scenario. There're all on the same subnet, so routing shouldn't factor into the equation.

It may certainly be a wireless problem. I'd plug it in to eliminate that possibility. While 1, 6, and 11 don't overlap, another device (i.e. a neighbor) transmitting on the same channel will cause interference, as will things like microwaves, 2.4ghz phones, etc.

Do you have another machine (or virtual machine) that you can use to try to connect to the domain? That will help determine whether the problem lies with your DC or the specific configuration on that machine.

You really only need to point the DNS to your internal DNS server and provide the correct credentials, and you should be set. There's not a lot involved with this process.

Also, I wouldn't worry a great deal about the first packet being lost. Sometimes it takes a bit to find the proper path, and it may time out before that happens. If subsequent ones are returned, there shouldn't be a problem. It's still odd that that's happening on your LAN (which should respond very quickly), so you may indeed be looking at some sort of wireless problem.

OK, so I used an old WinXP Pro desktop via Cat5e to eliminate the possibility of it being an 802.11 issue. I was not able to ping the WinXP Pro desktop from my server, same way I wasn't able to ping my two laptops (connected wirelessly) from my server. It has to be a DNS issue from the server end. But just for kicks, here's my "route print" from the server and wifi laptop I'm trying to add to my domain:

SERVER

F:\Documents and Settings\Administrator.ENTERPRI-TWM2D5>route print

IPv4 Route Table
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x10003 ...*edited* ...... Realtek RTL8168/8111 PCI-E Gigabit Ethernet
NIC
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.1.254      192.168.1.1     20
        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1
      192.168.1.0    255.255.255.0      192.168.1.1      192.168.1.1     20
      192.168.1.1  255.255.255.255        127.0.0.1        127.0.0.1     20
    192.168.1.255  255.255.255.255      192.168.1.1      192.168.1.1     20
        224.0.0.0        240.0.0.0      192.168.1.1      192.168.1.1     20
  255.255.255.255  255.255.255.255      192.168.1.1      192.168.1.1      1
Default Gateway:     192.168.1.254
===========================================================================
Persistent Routes:
  None


CLIENT:

C:\Documents and Settings\Administrator>route print
===========================================================================
Interface List
0x1 ........................... MS TCP Loopback interface
0x2 ...*edited* ...... Intel(R) PRO/100 VE Network Connection - Packet
Scheduler Miniport
0x3 ...*edited*...... Intel(R) PRO/Wireless 2200BG Network Connection
- Packet Scheduler Miniport
===========================================================================
===========================================================================
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0    192.168.1.254     192.168.1.3       25
        127.0.0.0        255.0.0.0        127.0.0.1       127.0.0.1       1
      169.254.0.0      255.255.0.0      192.168.1.3     192.168.1.3       20
      192.168.1.0    255.255.255.0      192.168.1.3     192.168.1.3       25
      192.168.1.3  255.255.255.255        127.0.0.1       127.0.0.1       25
    192.168.1.255  255.255.255.255      192.168.1.3     192.168.1.3       25
        224.0.0.0        240.0.0.0      192.168.1.3     192.168.1.3       25
  255.255.255.255  255.255.255.255      192.168.1.3     192.168.1.3       1
  255.255.255.255  255.255.255.255      192.168.1.3               2       1
Default Gateway:     192.168.1.254
===========================================================================
Persistent Routes:
  None

I think it could be a local security database issue, because I have a password set up on my laptop (local, independent of my server), maybe somehow that does not allow me to add my laptop to the domain? It's an SP3 WinXP laptop. Firewalls disable on both the WinXP Pro SP3 laptop and WinXP Pro SP3 desktop.

Also, I used channel 11 when I set up my WPA network, so that shouldn't be a problem, and I don't have cordless phones anywhere here so interference from that would be impossible (though I have no clue about my neighbors). Also, my router is a 2Wire 2700HG-B, essentially acting as the switch as dynamik said.

Here's an arp -a from the server and wifi laptop:

SERVER

 

F:\Documents and Settings\Administrator.ENTERPRI-TWM2D5>arp -a

 

Interface: 192.168.1.1 --- 0x10003

  Internet Address      Physical Address      Type

  192.168.1.254         *edited*              dynamic

 

CLIENT


C:\Documents and Settings\Administrator>arp -a

Interface: 192.168.1.3 --- 0x3
  Internet Address      Physical Address      Type
  192.168.1.254         *edited*     dynamic

OK According to the Route print from your server, the Default route (0.0.0.0 0.0.0.0 192.168.1.254 192.168.1.1) is pointing to 192.168.1.254. That's why the server can get online, it's pointing to the correct gateway for anything it doesn't have a route for, e.g. public IP addresses.

The problem here is this entry:
192.168.1.0 255.255.255.0 192.168.1.1 192.168.1.1

Your server thinks that anything in the 192.168.1.0 subnet needs to be directed to its own interface, which doesn't have routes so the packets are discarded.

Take the Gateway out of your server NIC cards TCP/IP settings and leave it blank. Since your using a switch on the same segment(subnet), you don't need it. After this you should be able to ping the client from the server and if you can do that, you'll be able to join the tablet to the domain.

^ I left the gateway blank for both the server and client and still can't ping the client from the server, but I can (still) ping the server from the client. When I left the gateway blank for the server it immediately was unable to connect to the Internet, btw. Here's the route print and ipconfig for the server when I left the gateway blank:

F:\Documents and Settings\Administrator.ENTERPRI-TWM2D5>route print

 

IPv4 Route Table

===========================================================================

Interface List

0x1 ........................... MS TCP Loopback interface

0x10003 ... *edited*.... Realtek RTL8168/8111 PCI-E Gigabit Ethernet

NIC

===========================================================================

===========================================================================

Active Routes:

Network Destination        Netmask          Gateway       Interface  Metric

        127.0.0.0        255.0.0.0        127.0.0.1        127.0.0.1      1

      192.168.1.0    255.255.255.0      192.168.1.1      192.168.1.1     20

      192.168.1.1  255.255.255.255        127.0.0.1        127.0.0.1     20

    192.168.1.255  255.255.255.255      192.168.1.1      192.168.1.1     20

        224.0.0.0        240.0.0.0      192.168.1.1      192.168.1.1     20

  255.255.255.255  255.255.255.255      192.168.1.1      192.168.1.1      1

===========================================================================

Persistent Routes:

  None

F:\Documents and Settings\Administrator.ENTERPRI-TWM2D5>ipconfig

Windows IP Configuration

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . : 192.168.1.1

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . :

Like I said earlier, the gateway, routes, etc. aren't going matter since both machines are on the same subnet.

^ Yeah, well, any other suggestions just let me know. Perhaps you have some DNS suggestions for the server? I have the following checkboxs/radials checked for DNS under the TCP/IP properties settings:

Append primary and connection specific DNS suffixes (radially checked)
Append parent suffixes of the primary DNS suffix (box checked)
Append these DNS suffixes (unchecked)
Register this connection's addresses in DNS (box checked)
Use this connection's DNS suffix in DNS registration (unchecked)

I appreciate the help dynamik.

Try running dcdiag and netdiag on the server (you need to install the support tools).

Hmm, well that stinks.

I understand where Dynamik is coming from but I still think it's a network problem since the Tablet can ping the server but not vice versa. I mean, you're only pinging IPs right? If so then there's no DNS involved here at all.

Obviously you'll need to put the gateway back in since w/o it, the Default Route disappeared. You'll need that for Internet Access.

I noticed though that on the Server, your only arp entry was:
Interface: 192.168.1.1 --- 0x10003

Internet Address Physical Address Type

192.168.1.254 *edited* dynamic

Can you try manually entering in an ARP entry for the laptops 192.168.1.3 IP Address onto the server {arp -s 192.168.1.3 XX-XX-XX-XX-XX-XX}? What does a ping result in then?

Is the 2wire switch configurable? If so, can you verify that there isn't a configuration in it that could be preventing normal switch behavior?

dynamik
Exotic Dancer+
Registered Member

When did this happen? Is the job really going that poorly? heh

undomiel

Out of curiosity can the tablet ping the desktop and vice versa via ip? Only the server can't ping either of them by ip? Does the server get back responses from the gateway if you try to ping it? Is there anything in the 2wire that would be isolating clients? Any chance you have a hub lying around that you could try putting the server and the desktop on to see if they can ping each other through that? Once you have traffic going back and forth everything else should cascade into place. Definitely make sure those Windows firewalls are off.

I'm not saying it's absolutely not a network problem, but when all devices are on the same subnet, there's no routing/layer-3 activity involved. It's not going to hit the default gateway or anything else since it knows it's on the same subnet (this is what the subnet mask is for). It could be some sort of layer-2 problem, such as interference with the wifi, incorrectly cached arp values (though that cache expires fairly quickly, so that's unlikely to be a problem after this amount of time), etc.

undomiel, I am able to ping my gateway from the server, Tablet, Vista laptop, and WinXP Pro desktop. I am able to ping my server from my Tablet, Vista laptop, and desktop. However, the Tablet, Vista laptop, and desktop cannot ping each other. I get messages of "Request timed out" each and every time and each computer. I get the same "Request timed out" messages when trying to ping the tablet, vista laptop, and desktop from my server. And yes, I'm only pinging using the IP address, not a name.

I have no reason to believe my 2wire router is isolating anything, but I'll do a test with a hub or switch as soon as I can. My 2Wire 2700HG-B (version 4.25.19) has the following hardware firewall settings:

Checking the box allows the associated traffic type through the firewall.

[b]Outbound[/b]
HTTP (checked)
HTTPS (checked)
FTP (checked)
Telnet (checked)
SMTP (checked)
DNS (checked)
NetBIOS (unchecked)
POP3 (checked)
IMAP (checked)
NNTP (checked)
IRC (checked)
H323 (checked)
All Other Protocols (checked)
	
[b]Inbound[/b]
Remote Management (checked)
NetBIOS (unchecked)

[b]Check to detect the types of attacks below:[/b]
	Excessive Session Detection (unchecked)
	TCP/UDP Port Scan (checked)
	Invalid Source/Destination IP address (checked)
	Packet Flood (SYN/UDP/ICMP/Other) (checked)
	Invalid TCP Flag Attacks (NULL/XMAS/Other) (checked)
	Invalid ICMP Detection (checked)
	Miscellaneous (checked)

Also, I'm having trouble finding updated Server 03 downloads on MS' website for the dcdiag tools and such. They only have Win2K.

dynamik wrote: »

I'm not saying it's absolutely not a network problem, but when all devices are on the same subnet, there's no routing/layer-3 activity involved. It's not going to hit the default gateway or anything else since it knows it's on the same subnet (this is what the subnet mask is for). It could be some sort of layer-2 problem, such as interference with the wifi, incorrectly cached arp values (though that cache expires fairly quickly, so that's unlikely to be a problem after this amount of time), etc.

Well color me embarassed. I'm about as useful as an ashtray on a Harley.

Seriously though, Dynamik is right about the Subnet Mask. Because they match the traffic would never involve the gateway. My thinking was that multiple gateways would cause a problem. Also, I'm not super familiar with Route print results but it looks like it's normal to have an entry with the subnet your computer is on with a gateway/interface of the PCs IP address. Since this points to the loopback address I'm not sure what it's for but oh well.

I think there's something going on with the switch though. Have you ever used this switch before w/o problems?

Aw, there's nothing to feel bad about. I think you're a lot like me and you hope problems are more complex than they actually are. Who doesn't want a challenge, right?

Plus, you clearly have much better analogies!

As far as the actual problem is concerned, I'd definitely go with dcdiag and netdiag as the next steps for troubleshooting.

dynamik wrote: »

Only if your DC is also running DNS; you can have them on separate servers

You clarification was correct though. I was just stressing that he should configure DHCP to hand out the internal server for his other machines as well. I assume his servers are static.

He doesnt have them on seperate servers, he has his router setup as his DNS server.

If the ipconfig /all from your domain controller shows a router as it's only DNS entry then something is very very wrong and a lot of things won't work. Like SRV records perhaps.

leefdaddy wrote: »

Wow... and you have your mcse and ccent...

Like I said, I never really thought about it. It's just that every network I've ever came accross (including the networks on the CCENT and Microsoft exams) had the gateway setup as the first available IP in the range. This was my first time seeing it any other way, I apoligize.