Join domain over Pix vpn tunnel

Posted on 2004-10-22
Last Modified: 2008-02-01
Hello all,

Having an issue here.  I am setting up a second domain controller in Canada to our Win2003 domain in the US.
I have setup a  Pix site to site VPN tunnel and it seems to be working fine.  I can ping both networks from either side by IP.
The DC in the US is running AD and DNS.  The DC in Canada cannot join the domain to configure AD and replication yet.
I have pointed the Canada DNS to itself as primary and to the DC in the US as secondary.  I have setup forwarders to their ISPs DNS for internet and added a DNS suffix for the domain name.  Nothing should be blocking traffice on the Pixes because it's my understanding that all ESP traffic from the tunnel is allowed both ways.  What am I doing wrong?  
Question by:rick_me27
    LVL 4

    Expert Comment

    you may want to verify with your ISP, because some don't allow tunneling. I had that issue as well...

    LVL 1

    Expert Comment

    I have had same problem with Windows 2003 AD servers and wanting to join a other location to the AD thrue a VPN. I use SonicWall TZ170 Firewall's in both locations and Netbios traffic was blokked on the VPN tunnel. After allowing this traffic I was able to connect to the remote AD and join it. So you can temporarily allow NetBios traffic on the VPN tunnel.  When this traffic is allowed it's more likely you can join the domain in the other location. After the join process is finished you can disable Netbios traffic again of you want.

    Author Comment

    hmm...  anyone know how to enable netbios traffic on a Pix?   Worth a shot.  
    LVL 79

    Accepted Solution

    Netbios broadcasts cannot be propogated across the VPN tunnel through the PIX.
    If you can ping both ways, you have a simple netbios name resolution issue. With AD, you should be able to join the domain if you point the Ca DC to the US DC as primary DNS....
    Some helpful links:
    Windows 2000 DNS - Diagnosing Name Resolution Problems
    FQDN = Fully Qualified Domain Name

    Windows 2000 DNS - Solving other common DNS problems


    Author Comment

    jeez, I hope it's that simple.  I'm gonna test that and try it right now.

    Author Comment

    Yessssssssssssss.   that worked.  Beating my head for two days on cisco and it's as simple as that.  I should have known.
    Thanks lrmoore
    LVL 79

    Expert Comment

    Glad to help!

    - Cheers!

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone. Privacy Policy Terms of Use

    Featured Post

    How to run any project with ease

    Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
    - Combine task lists, docs, spreadsheets, and chat in one
    - View and edit from mobile/offline
    - Cut down on emails

    Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
    Let’s list some of the technologies that enable smooth teleworking. 
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    875 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now