[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 583
  • Last Modified:

DCpromo across a PIX firewall that is NAT-ting the address.

I am trying to create a new domain.  I have a Firewall with 3 legs.  One to the Internet, one to one lan, one to a different lan.

There is NAT setup, with address forwarding.  On one leg of the PIX, I have addresses 172.17.x.x.  On the other LAN leg, I have 172.31.x.x.  I am natting the 172.17 address to give the local side a address that gets translated to  (not my setup, I have inherited it).  I have setup the firewall to pass ipsec from one lan to the other.
I ran DCPromo on one side (the 172.31 side), and all completed fine.
I tried to join the other side to the domain, and it failed w/ dns errors.
I did setup dns on both servers, and did a zone transfer, and it DID work.
I adjusted the ip address of the A record to match the natted ip address (it's local address on it's side, that translates to the other side)
No dice.

Any idea's on how to make this work?

1 Solution
there is a issue regarding DNS on windows and PIX.
you have to disable UDP querys on your dns server, as it send UDP Packets which are greater then 512 bytes.
o do so, at the command prompt, type: "dnscmd Server Name/Config /EnableEDnsProbes 0"

Featured Post

Windows Server 2016: All you need to know

Learn about Hyper-V features that increase functionality and usability of Microsoft Windows Server 2016. Also, throughout this eBook, you’ll find some basic PowerShell examples that will help you leverage the scripts in your environments!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now