Active Directory + replication + exchange 2003 + site-to-site VPN Tunnel Scenario

Posted on 2007-10-16
Last Modified: 2008-05-31
Hi Experts,

I need some advise to properly configure the proposed Active Directory Site:

CA Office (existing):
1x Windows 2003 Server as Domain Controller & DNS Server for domain
1x Windows 2003 Server with Exchange 2003 Server, Member Server
1x Windows 2003 Server with Citrix, Member Server
network = 20 users
Firewall = Cisco ASA 5505

Houston Office (Proposed):
4 users from CA moving to TX to expand operations
CA and TX offices will be connected via site-to-site VPN Connection
full access between both sites is preferred.

1x Windows 2003 server, Domain Controller & DNS server, part of domain
1x Windows 2003 server, Exchange 2003 Server
Both servers are installed on VMware ESX server as VMs.
1x Cisco PIX 501

my purpose:
i want to extend the existing domain to houston instead of creating another domain for houston and administer everything based on OUs.

also, i wanted the 4 users who are local to houston to also have their mailboxes reside on the same Exchange server in houston to limit traffic passing through the vpn tunnel.  Therefore i'll have 1 Exchange server in CA that hosts 16 mailboxes and 1 exchange server in Houston that hosts 4 mailboxes.

* Now my question/concerns, is there a better way to configure this scenario?

*Regarding active directory, what is the preffered method to add/configure the additional DC for domain?
*Will the time difference from CA and TX effect replication or any other Active Directory functions between the 2 DCs?

*Lastly, what is the preffered method for AD replication, i.e. RPC, IP, SMTP>

Thanks for the help in advance!
Question by:jetli87
    LVL 48

    Accepted Solution

    1. You will need t VPN link between the PIX and the ASA...this is the first point
    2. Additional DC is easy as, you have no problems doing this. Basically, as long as you have name resolution across the VPN (server points to central DNS servers) when you run dcpromo, you will have the option to make an additional DC, easy as - just follow the wizards
    you will also need to configure sites and services to control replication and authentication, not hard, but essential
    You will also need to make sure that the new DC in the TX site is a Global Catalog
    Once configured and AD is replicated, make the clients in TX look at the TX server for DNS....AD replicated zones will be stored on all DC's
    3. The time difference will be fine, basically, with the situation you have proposed, you will barely need to touch replication schedules as AD traffic is tiny and time is all controlled via server
    4. RPC/IP is the preffered method, SMTP is for when you dont have a static pipe between the two, not very often is it used these days, leave as defaults
    5. Personally, for the sake of 4 mailboxes, i really dont see the need for an extra exchange box, i would just let the mail pass straight through the VPN to your end users, big cost difference

    let me know if you need clarification on anything
    LVL 1

    Author Comment

    thanks for the quick response Jay_Jay...

    yeah i actually didn't think it was too difficult...i actually already configured the additional DC and Exchange box locally so that when i fly out next week to Houston, i just need to ensure the vpn tunnel is up and that DNS entries are correct then everything should work.  As for GC and DNS pointing to TX server, got that checked as well.  As for the additional Exchange box, we had an Extra Exchange server License to use.

    I just wanted validtion from an expert...thanks again!

    LVL 48

    Expert Comment

    wow, you have everything covered already :) nice work!

    your best friend when installing this will be dcdiag as it will play a huge part in confirming repication etc

    good luck and let me know if you need any help

    LVL 1

    Author Comment

    thanks again!

    yeah the only issue i'm having right now is the new DC is having issues with sysvol replication per dcdiag...trying to troubleshoot...if i can't figure it out within the hour, i'll post a new question...
    LVL 48

    Expert Comment

    no problems ill keep an eye out

    Featured Post

    How to improve team productivity

    Quip adds documents, spreadsheets, and tasklists to your Slack experience
    - Elevate ideas to Quip docs
    - Share Quip docs in Slack
    - Get notified of changes to your docs
    - Available on iOS/Android/Desktop/Web
    - Online/Offline

    Join & Write a Comment

    Learn about cloud computing and its benefits for small business owners.
    Synchronize a new Active Directory domain with an existing Office 365 tenant
    This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
    This tutorial will walk an individual through the process of transferring the five major, necessary Active Directory Roles, commonly referred to as the FSMO roles to another domain controller. Log onto the new domain controller with a user account t…

    745 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now