Link to home
Start Free TrialLog in
Avatar of FASP
FASPFlag for United States of America

asked on

Network problem fixed but not sure why

I recently installed a Sonicwall TZ 210.  My network consists of cable modem --> TZ 210 --> Dell Powerconnect 2748 managed switch --> everything else.

I have 2 servers running, (1 is SBS2003 which is the dc, dns server, print server, and does exchange and another windows 2003 server which just does sql.)  I have 2 networked printers and approx. 25 workstations running XP pro.
All these exist on a single domain with class c private ip address on a /24 subnet.  The servers and the printers have static ip.  

The problem I was experiencing was that the workstations that ran applications which utilized the sql server were throwing errors pertaining to a brief loss of connectivity.  I did some packet sniffing on wireshark using port mirroring on my switch and didn't see anything really unusual.  I starting doing ping -t to the TZ 210, my switch, both servers, my printers, and several random workstations and constantly monitoring that to find that intermittently the ping to everything would time out once or twice then normal traffic would resume except for a printer which would continue to timeout for 30 sec to a min usually. It was not one specific printer, both did it at differerent times.  

The Dell switch is less than two months old so I began to suspect a jabbering nic or a bad cable.  Systematically,  I disconnected everything attached to my switch one thing at a time and continued to watch those ping -t's from multiple locations to isolate the cause.  Considering this dropping of network packets was only happening once every 2-3 hours this was a VERY time consuming and frustrating task.  I checked the data rate on the nics, etc and all configurations and found nothing.  

To make a long story short, none of this fixed the problem.  I then took the sql server and moved it from my switch to one of the extra ethernet ports on the TZ 210 and I noticed that the workstations running the applications using sql were no longer throwing those errors.  I continued to monitor the pings as I described above and nothing had changed and I was still getting the packets dropped periodically.  I then too the SBS2003 and moved it from the switch to its own ethernet port on the TZ 210 and my network problems disappeared.

I'm totally confused here.  While I'm grateful the problem is fixed I want to know why.  The ethernet ports the 2 servers are on and the LAN port on the TZ 210 are still the same subnet, etc and would still be the same broadcast domain right?  I"m not sure what moving it to its own physical port but keeping it in the same LAN fixed.  

On a side note I checked every port on the switch and had 0 collisions, 0 jabbers, 0 CRC or Align errors, etc.  

Any insight into this would be appreciated.
ASKER CERTIFIED SOLUTION
Avatar of harbor235
harbor235
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of FASP

ASKER

I'll narrow the scope of the question down a little.  It would help me to understand what exactly would change in my network when I took the server off the switch, (which connects to the Sonicwall UTM device via the LAN ethernet connection,) and put it on its own ethernet connection off the Sonicwall UTM while still residing on the same LAN.  

I had already posted here numerous times about this problem with captures, etc, etc ad nauseum.  It would  help me tremendously now to just know what something simple like that would change. Even assuming a network that was working right.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of FASP

ASKER

A little more info: single domain, 192.168.1.xxx ip scope with /24 subnet so very basic.  SBS does dhcp and the printers are outside the range of the assigned scope.  Anything else with a static ip has that address reserved.  I didn't find any duplicate ip address.  I'm not sure what network configuration could be incorrect.  Everything has the sonicwall TZ 210's static ip as its gateway, the sbs as dns, subnets all correct, etc.  Very simple and easy and never found anything there.  All the nics are set to auto detect, flow control is off.  I'm not using anything fancy on the managed switch like storm control, etc.  I'm just not seeing anything obvious, my network is probably very simple compared to what some of  you work with.  If it was a jabbering nic or a bad cable on the server(s) I would think just moving physical ports but having it in the sam lan wouldn't fix it.

If i move the server from the sonicwalls extra ethernet port and plug it back in my dell switch the problem resumes.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of FASP

ASKER

Its just one switch, a Dell Powerconnect 2748, connected to the Sonicwall by cat5.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of FASP

ASKER

Here are some screenshots from the Dell powerconnect switch of what I thought you would be interested in seeing.  Some additional info not shown:  jumbo frames are disabled.  Every port is by default on vlan1 on the switch.  There is currently no port mirroring or storm protection enabled on it.
ipaddressing.jpg
Avatar of FASP

ASKER

this is the switch address table.  The TTL set to 600 (which is 10 min. I think.)
addresstable.jpg
Avatar of FASP

ASKER

This is the switch interface configuration.
interfaceconfig.jpg
Avatar of FASP

ASKER

If you are interested, this is a screenshot of the Sonicwall interace screen
SWinterfaces.jpg
Avatar of FASP

ASKER

a screenshot of the Sonicwall's portshield interface screen.
SWportshieldgroups.jpg
Avatar of FASP

ASKER

The Sonicwall's network zones
SWzones.jpg
Avatar of FASP

ASKER

I really appreciate your help.  I'm glad my problem is fixed but it really bothers me that I can not figure out why.  I can provide you with screenshots of any information you require.
Avatar of FASP

ASKER

Not really a specific solution offered but awarded points for your effort.
I have a similar problem.  I just replaced a Netgear FVS318 with a Sonicwall TZ210 as an "upgrade" in being able to manage threats on my Network.   The Internet Modem connects to the TZ210 on firewall X1 and then the firewall connects to through it's X0 Lan Port to a Dell Powerconnect 5424 which is connected to a Dell 5212.  My network runs mostly connect to the Powerconnect 5424.  My domain controller runs Windows 2000 Server SP4 and is my file server and print server.  My application server runs Windows 2000 Server SP4 terminal services.  I have about 25 other clients running Windows 2000 professional or Windows XP Professional.

Using the TZ210, I cannot get Backup Exec 12.5 remote agents to install or to complete backups.  My "interface server" running Windows XP Pro loses connectiviity and shuts off interface services, and a separate "drug and drug-drug interaction" dataserver (Windows 2000 Pro) gets very slow.

Taking the TZ210 out and replacing it with the Netgear FVS318, all these problems go away.

I am new here, so I'm sorry if it is bad etiquette to post to a closed thread.