Solved

Exchange over vpn not working.

Posted on 2006-06-22
21
347 Views
Last Modified: 2010-03-19
I just migrated all roles but the infrastructure master role to a new server.  it seems that Outlook 2000/2003 over the vpn is not working.  

i have 2 domains, 1 forest.

DomainA has 2dc's

New DC1 - Holds all roles but IM.  Also is the GC
DC2 - IM

DomainB Has 2 dc's

DC1 - PDC, RID, and IM and a GC
DC2 - (located in remote office) no roles and has a GC

I'm sure something is set wrong here but i'm not sure.  I just made both dc's in domain B GC's to see if that would help the issues.

When i open outlook on the remote server it says " Network problems are preventing connection to the Microsoft Server computer."

thanks,
0
Comment
Question by:lgropper
  • 11
  • 5
  • 4
  • +1
21 Comments
 
LVL 9

Expert Comment

by:NYtechGuy
ID: 16962350

Two things come to mind:

- DNS:  is it configured correctly?  Is DNS running on all servers? Your problem is most likely related to DNS
- can you verify that all ports are opened through the VPN?

Try running NETDIAG and DCDIAG (resource kit tools) on each server and check the results for FAILURES

/Justin
0
 

Author Comment

by:lgropper
ID: 16962580
This is what dcdiag comes back with.

      Starting test: FsmoCheck
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         ......................... DomainA.com failed test FsmoCheck

I assume its looking for our old server? Its not seeing the new one.  But how come?  I transferred all the roles, the old DC is still functional as it runs DHCP... i was going to demote it just no until i get DHCP onto the new box.

Do i need to demote it?

Chad
0
 

Author Comment

by:lgropper
ID: 16962614
Also in Netdiag i got,

Trust relationship test. . . . . . : Failed
    [FATAL] Secure channel to domain 'DomainB' is broken. [ERROR_NO_LOGON_SERVERS]

But again.... server is there and trusts are validated?

0
 
LVL 9

Expert Comment

by:NYtechGuy
ID: 16962615

This could be a DNS issue, as the "SRV" records denoting what server does what, and the IP addresses, are stored in the active-directory integrated DNS zone.

Which servers are DNS servers, and where are the servers looking for DNS resolution?  

Check that the DC/DNS servers have their own IP addresses listed as DNS servers in TCP/IP properties - then at a cmd prompt type "ipconfig/registerdns" (or you can just reboot).

wait 15 mins and check event viewer for errors

/justin
0
 
LVL 9

Expert Comment

by:NYtechGuy
ID: 16962643
PS - i wouldn't demote ANYTHING until you fix this issue.  It will just make it messier

I have a gut feeling that DNS isn't right...

Are there parent/child domains? or just two separate domains that trust each other?
0
 

Author Comment

by:lgropper
ID: 16962673
I'm sure you are right with DNS... just need to track it down.  Let me check your above and i'll get back to you.

2 seperate domains that trust.

Chad
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 16962783
from command line on one of your DCS run 'netdom query fsmo' and it will tell you whatAD 'thinks' the 5 FSMO role holders are.  If any of them in an old offline server you will need to sieze that role back to a DC that is up.
0
 

Author Comment

by:lgropper
ID: 16962784
It seems i cannot ping the remote DC by name only IP from the new DC.  There is an A record point to it. i did a flush and register of the dns.  

Server is up and DNS is running.  I cannot connect to DNS through the new server to the remote either.

something is off.
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 16962844
>>It seems i cannot ping the remote DC by name only IP from the new DC.There is an A record point to it.
are you sure the A record is correct?  
when you do an NSLOOKUP for its FQDN, do you get the correct IP as the response?

>>I cannot connect to DNS through the new server to the remote either.
can you elaberate on exacly what you mean by this?



0
 

Author Comment

by:lgropper
ID: 16963040
Ok, i believe i have created a mess =)

Remote server on DomainB cannot access exchange on local server in DomainA.  It seems there were some records in the hosts file pointing to the DC and exchange server.  I have removed those and want to set it up right through the DNS entries.  

What i meant by not being able to ping was that i could not ping just the name DC1 i would have to put the whole FQDN.

I think i have confused myself...

from the remote server (DomainB) i can ping Exchange.doamainA.com. but when i try and use this for the mail server in outlook i get that cannot resolve name problem.

Chad
0
How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

 
LVL 25

Expert Comment

by:mikeleebrla
ID: 16963142
ok,, well you are correct by removing the host file entries,,, that is a crappy work around for improper DNS setup.

if you can ping it by FQDN, that means the DNS server is setup correctly.... you just need to setup the DNS client (which may also be a dns server) to append dns names with the name of your domain so that it will append DC1 so it will resolve to dc1.domain.com which will resolve (using the DNS server) to the correct IP.

go into the NIC properties of the computer in question, then go to the tcp/ip properties, then go to the DNS tab and in the middle you will see the section where you setup DNS appending.

0
 

Author Comment

by:lgropper
ID: 16963275
Great, i have added the two domains and i can ping servers in each domain with only the name.

Seems i am back to the origanal issue now.... i cannot get the outlook client to work... i still have the following errors,

      Starting test: FsmoCheck
         Warning: DcGetDcName(PDC_REQUIRED) call failed, error 1355
         A Primary Domain Controller could not be located.
         The server holding the PDC role is down.
         ......................... DomainA.com failed test FsmoCheck

and

Trust relationship test. . . . . . : Failed
    [FATAL] Secure channel to domain 'DomainB' is broken. [ERROR_NO_LOGON_SERVERS]

grrrrr.
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 16963303
did you do what is below like i mentioned earlier:

from command line on one of your DCS run 'netdom query fsmo' and it will tell you whatAD 'thinks' the 5 FSMO role holders are.  If any of them in an old offline server you will need to sieze that role back to a DC that is up.

can you ping all of these servers?
0
 

Author Comment

by:lgropper
ID: 16963343
I did and all the roles are on active servers.  2 roles are held on DC1 from domainA (Schema and Domain role owner) and 3 roles are on DC1 from domain B PDC, RID, and IM. Both DC1 and DC2 in domain B are GC's would this cause an issue?
0
 
LVL 25

Expert Comment

by:mikeleebrla
ID: 16963411
hold up... some FSMO roles are per forest, and others are per domain... meaning if you have two domains,, you will have a DC that holds that FSMO role in EACH domain.

see this link that explains this in detail..... i think you are running into this issue since you have multiple domains

http://support.microsoft.com/default.aspx?scid=kb;EN-US;223346
0
 

Author Comment

by:lgropper
ID: 16963476
Yep, i got that.... i layed it out at the top...

i have 2 domains, 1 forest.

DomainA has 2dc's

New DC1 - Holds all roles but IM.  Also is the GC
DC2 - IM

DomainB Has 2 dc's

DC1 - PDC, RID, and IM and a GC
DC2 - (located in remote office) no roles and has a GC

Everything should be inplace and ok? but for some reason the trust is giving an error?  I have validated them and everything.
0
 
LVL 25

Expert Comment

by:Ron M
ID: 16971174
from a client on domain A....   try to resolve   exchangeserver.domainB.com.   You should get an internal address on the B network.  If not, then you are back to troubleshooting DNS.  What are the DNS servers listed on the client ?

You should have two.  Both private DNS server ip's, or one public and one private.

If your using an internal DNS server on Domain A, then you need to create another zone for domainb.com and add a host record for exchange server.  If your trying to use a DNS server on network B, from network A...you need to look at your vpn config on the router.

Try this for testing purposes....

on a client machine....add a host file entry for exchangeserver.  See if you can ping it.  If you can ping it...try setting up the mailbox.

Let me know.
0
 

Author Comment

by:lgropper
ID: 16971453
**from a client on domain A....   try to resolve   exchangeserver.domainB.com.   You should get an **internal address on the B network.  If not, then you are back to troubleshooting DNS.  What are the **DNS servers listed on the client ?

we only have one exchange server on domainA.  the pc's in a remote office are on domainB.  from domain b i am able to ping exchangeserver.domainA.com but when i open outlook i get that error.

I have added an entry in the hosts file for 192.168.100.16 to exchangeserver.  so obviously i am able to ping it with only exchangeserver and not the FQDN.

Its gotta be dns, i'm sure its not configured right.

On the DNS server in the remote office there is only a zone for DomainB, should i be adding domainA as another zone?

then add an MX record?

Chad

0
 

Author Comment

by:lgropper
ID: 16971463
sorry the entry in the hosts file did not work.
0
 
LVL 9

Accepted Solution

by:
NYtechGuy earned 250 total points
ID: 16971916

> On the DNS server in the remote office there is only a zone for DomainB, should i be adding domainA as another zone?

possibly.  Are there people in remote office/domainb that are trying to use Outlook to open a mailbox that lives in domainA exchange server?

What you should do is setup a forwarder on your DNS server for domainA.com.  On the Forwarders tab, click the NEW button type domainA.com.  Once added, highlight that, and enter the IP addresses of domainA.com's AD/DNS servers.  Click Apply/OK, restart the DNS service

/justin
0
 

Author Comment

by:lgropper
ID: 16972033
yes thats exactly it, users in domain B are using outlook to access the exchange srver in domain A but its coming up with name resolving issues.

right now the DNS server in the remote office only has domain B's info. no zone for domainA.  i am able to ping anything in domain A with the FQDN

i have enabled a forwarder to the dns server on Domain A.  Restarted Dns, same issue.

Chad
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

760 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now