- For individual users
- Instant access to solutions
- Ask your tech questions
- Start your 30-day Free Trial
Main Topics
Browse All TopicsI experienced a communication anomoly yesterday, and have no explanation for it. Problem solved now after rebooting server; however, I'd like to know the specific cause and a better solution than rebooting the server if I encounter the problem again...
A lot of info to follow, so please consider the environment and all factors before responding.
Environment details relevant to problem.
Branch Office 1:
Juniper SSG5 Firewall connected to DSL for backup and local Internet access
Juniper SSG5 Firewall responsible for DHCP
Juniper SSG5 doubles as backup VPN connection to HQ if MPLS drops offline
Cisco 1811 Router connected to MPLS T1, BGP routing across MPLS
Cisco 1811 is default gateway
Cisco 1811's default gateway is Juniper SSG5
Cisco 1811 has static routes defined to Corporate HQ
Approximately 40 desktops and laptops (all XP) in branch
Primary DNS points to 2003 DC in Corporate HQ
Secondary DNS points to backup DC in Corporate HQ
Terciary DNS points to 4.2.2.1
--Note-- I promoted the branch's 2003 server to a DC yesterday, and it's running DNS, but I haven't updated the DHCP scope to include the local DNS server yet...
Corporate HQ:
Cisco 1811 Router connected to two bonded MPLS t1's, BGP routing across MPLS
Exchange 2007 Server
Exchange 2007 Server connected to Internet via port forwarding from HQ firewall
Exchange 2007's default gateway is HQ firewall
Exchange 2007 Server has static and persistent routes defined to communicate with branch offices
Exchange 2007 Server only accepts inbound connections from internal hosts and Internet Hosted anti-spam servers
Problem + Circumstance:
I replaced the SSG5 in the branch yesterday and shortly thereafter several hosts could not communicate with the Exchange server.
My guess was "it's a DHCP problem" becuase the new SSG5 was doling out addresses now and didn't have the list of assigned addresses from the previous SSG5 (however, I didn't notice any address conflicts.)
Both SSG5's are the same model, firmware rev and had the same configuration
Tests:
I WAS able to ping the Exchange server from the affected hosts "BY IT'S HOSTNAME"
I WAS able to ping the affected hosts from the Exchange server
I cleared the DNS cache on the Exchange Server
I added Exchange server to local hosts file (likely overkill, but I was reaching here...)
I was NOT able to connect to Exchange via outlook, OWA, RDP or network share (logged in as an administrator I tried 'start ->run->\\exchangeserver\c$
I tried to telnet to exchange server's RDP port (eg. telnet exchangeserver 3389) NOTHING
I performed a tracert to and from Exchange server to verify the correct route path was being used (primary path = MPLS, backup path = VPN over Internet) and confirmed packets in both directions were following the correct path.
After much frustration, I removed the new SSG5 and returned the previous SSG5 to service... still no luck (even after releasing and renewing IP addreses.)
Ultimately I rebooted the Exchange server and all was well.
Oddly, a similar problem occured with connections to my primary DC in HQ (which behaved correctly after rebooting as well.)
Note - I WAS able to access Exchange services AFTER rebooting it and BEFORE rebooting the DC.
Note - I WAS always able to ping to and from the Exchange server to the affected clients when the Exchange services weren't available.
Thoughts?
I know that was a lot of information to digest... ;-}~
I will be out of town for approximately 36 hours, so I may not reply until Monday unless my hotel has Internet services available.
Thank you,
FHMC
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
Business Accounts
Answer for Membership
by: technicasolutionsPosted on 2009-11-07 at 14:32:46ID: 25768385
You were hit by the "IPSec running in Block mode" MS bug.
CurrentCon trolSet\Se rvices\Tcp ip\Paramet ers\Reserv edPorts
---------- ---------- ----------
\CurrentCo ntrolSet\S ervices\Tc pip\Parame ters] 00,34,00,3 3,00,33,00 ,2d,00,31, 00,34,00,3 3,00,34,00 ,\ ,00,2d,00, 33,00,33,0 0,34,00,33 ,00,00,00, 33,00,33,\ ,33,00,38, 00,39,00,0 0,00,34,00 ,35,00,30, 00,30,00,\ ,00,00,00, 34,00,38,0 0,37,00,37 ,00,2d,00, 34,00,38,\ ,38,00,39, 00,39,00,2 d,00,34,00 ,38,00,39, 00,39,00,\
It is a consequence of adding the MS08-037 security update designed to prevent DNS spoofing.
The update changes the way the DNS server allocates the UDP source port for DNS queries.
On an SBS server by default we set the MaxUserPort value in the registry to 60000 or 65536 depending on the version of SBS.
The MaxUserPort value causes the DNS server to pick UDP source ports in the range of 1024 to 60000, or 65536.
The MaxUserPort is set on the SBS server by Exchange and ISA server. DNS by default will randomly pick 2500 ports
when the service starts up, a port conflict will occur if the DNS server allocates a port that is required by another service
and that service will fail once it requests that static UDP port.
So far we have seen issues with AUTD, IPSEC,
and IAS but there may be other services that will have a conflict.
If the IPSEC port gets srewed then your server is unresponsive to much TCP/IP
The ReservedPorts registry key can be used to exclude ports from the pool the DNS server uses. The reserved
ports registry key is described in '812873 How to reserve a range of ephemeral ports on a computer that is running
Windows Server 2003 or Windows 2000 Server'
HKEY_LOCAL_MACHINE\SYSTEM\
the following registry file reserves:
1433-1434 (SQL)
3343-3343 (Cluster service)
3389-3389 (Terminal Services)
4500-4500 (IPSec)
4877-4878 (private)
4899-4899 (private)
--------------------------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM
"ReservedPorts"=hex(7):31,
00,00,33,00,33,00,34,00,33
00,38,00,39,00,2d,00,33,00
2d,00,34,00,35,00,30,00,30
00,37,00,38,00,00,00,34,00
00,00,00,00