• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 274
  • Last Modified:

Active Directory + replication + exchange 2003 + site-to-site VPN Tunnel Scenario

Hi Experts,

I need some advise to properly configure the proposed Active Directory Site:

CA Office (existing):
1x Windows 2003 Server as Domain Controller & DNS Server for fictiousCA.com domain
1x Windows 2003 Server with Exchange 2003 Server, Member Server
1x Windows 2003 Server with Citrix, Member Server
network = 20 users
Firewall = Cisco ASA 5505

Houston Office (Proposed):
4 users from CA moving to TX to expand operations
CA and TX offices will be connected via site-to-site VPN Connection
full access between both sites is preferred.

1x Windows 2003 server, Domain Controller & DNS server, part of fictiousCA.com domain
1x Windows 2003 server, Exchange 2003 Server
Both servers are installed on VMware ESX server as VMs.
1x Cisco PIX 501

my purpose:
i want to extend the existing fictiousCA.com domain to houston instead of creating another domain for houston and administer everything based on OUs.

also, i wanted the 4 users who are local to houston to also have their mailboxes reside on the same Exchange server in houston to limit traffic passing through the vpn tunnel.  Therefore i'll have 1 Exchange server in CA that hosts 16 mailboxes and 1 exchange server in Houston that hosts 4 mailboxes.

* Now my question/concerns, is there a better way to configure this scenario?

*Regarding active directory, what is the preffered method to add/configure the additional DC for fictiousCA.com domain?
*Will the time difference from CA and TX effect replication or any other Active Directory functions between the 2 DCs?

*Lastly, what is the preffered method for AD replication, i.e. RPC, IP, SMTP>

Thanks for the help in advance!
  • 3
  • 2
1 Solution
1. You will need t VPN link between the PIX and the ASA...this is the first point
2. Additional DC is easy as, you have no problems doing this. Basically, as long as you have name resolution across the VPN (server points to central DNS servers) when you run dcpromo, you will have the option to make an additional DC, easy as - just follow the wizards
you will also need to configure sites and services to control replication and authentication, not hard, but essential
You will also need to make sure that the new DC in the TX site is a Global Catalog
Once configured and AD is replicated, make the clients in TX look at the TX server for DNS....AD replicated zones will be stored on all DC's
3. The time difference will be fine, basically, with the situation you have proposed, you will barely need to touch replication schedules as AD traffic is tiny and time is all controlled via server
4. RPC/IP is the preffered method, SMTP is for when you dont have a static pipe between the two, not very often is it used these days, leave as defaults
5. Personally, for the sake of 4 mailboxes, i really dont see the need for an extra exchange box, i would just let the mail pass straight through the VPN to your end users, big cost difference

let me know if you need clarification on anything
jetli87Author Commented:
thanks for the quick response Jay_Jay...

yeah i actually didn't think it was too difficult...i actually already configured the additional DC and Exchange box locally so that when i fly out next week to Houston, i just need to ensure the vpn tunnel is up and that DNS entries are correct then everything should work.  As for GC and DNS pointing to TX server, got that checked as well.  As for the additional Exchange box, we had an Extra Exchange server License to use.

I just wanted validtion from an expert...thanks again!

wow, you have everything covered already :) nice work!

your best friend when installing this will be dcdiag as it will play a huge part in confirming repication etc

good luck and let me know if you need any help

jetli87Author Commented:
thanks again!

yeah the only issue i'm having right now is the new DC is having issues with sysvol replication per dcdiag...trying to troubleshoot...if i can't figure it out within the hour, i'll post a new question...
no problems ill keep an eye out
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Creating Active Directory Users from a Text File

If your organization has a need to mass-create AD user accounts, watch this video to see how its done without the need for scripting or other unnecessary complexities.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now