Solved

Network issues - potentially DNS?

Posted on 2010-11-25
27
1,275 Views
Last Modified: 2012-06-27
Trying to do some trouble shooting here....  Office with two servers running SBS2003 - one the main server is primary DC, DNS server etc....  the other runs Exchange 2003.

Internet provided by Telco (Cisco modem); Firewall is Fortinet 80C.

Approximately 60 users in the office

For the last four or five days users have been experiencing what looks like a loss of internet connectivity - in particularly the connection to the Exchange server has been dropping or very slow.  Browsers seem to have slow connections or can't "connect" to some sights.

At first since both preferred and alternate DNS where our ISPs I assumed potentially a problem with their DNS servers and set our alternate DNS to  a public Google DNS server.

Nothing in the event logs is raising flags with me but pinging our gateway from either server yields mixed results (main server is better - with three out of four or four out of four connections most of the time).  

Trying to ping our main server from the Exchange server however is showing mostly 1 or 2 out 4 ping transactions completing successfully most of the time.

Any ideas?  Am I looking at a DNS issue (and where do I start digging?) or could it be something as simple as a failing NIC or faulty ethernet cable on one of the boxes?

I'm open for suggestions.....!
0
Comment
Question by:Lisaa_G
  • 11
  • 11
  • 4
  • +1
27 Comments
 
LVL 22

Accepted Solution

by:
Matt V earned 100 total points
ID: 34215317
Where are you configuring these external DNS servers?  All internal workstations and servers should point to the internal DNS only, which can then do it's own root lookups.

You also have the option of specifying forwarders on the internal DNS to do root lookups.

Regardless, make sure ALL internal systems point ONLY to the Active Directory DNS server.
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34215321
>>"Office with two servers running SBS2003 "
Are these using the same domain name? You cannot do this and generally because of DHCP you cannot have 2 SBS servers on the same network with different domain names.

As for DNS all internal servers and PC's should point to your internal DNS server ONLY. You should not add anything else such as an ISP or even a router as an alternate. This addresses internal DNS name resolution. For external DNS you need to add your ISP or public DNS server to the SBS as a forwarder which should be done by running the CEICW (Connect to the Internet wizard.
0
 

Author Comment

by:Lisaa_G
ID: 34215403
ISPs DNS servers are specified on the firewall; all servers. internal PCs point to main server as DNS server.

Yes both servers are on the same domain - the main one is the domain controller - the second is our mail server (Exchange 2003).

Mislead you (getting confused between locations) - running Server 2003 - not SBS 2003 (sorry).
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34215408
I am not sure what you mean by "ISP's DNS servers are specified on the firewall"
ISP's DNS addresses should be placed in the DNS management console under forwarders (not forward lookup zones).
0
 

Author Comment

by:Lisaa_G
ID: 34215441
System tab / Network / Options / DNS Settings on Fortigate 80C  - primary DNS is set to our ISP; alternate to Google.

Trying to log into server now to check forwarders
0
 

Author Comment

by:Lisaa_G
ID: 34215444
Having trouble connecting to server remotely - may have to verify on site in the morning
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34215477
The client PC's point to your server for DNS, which is correct, so they will never check the router, which again is correct. This is why the ISP's DNS server's IP's need to be added as forwarders. When the server cannot resolve the name, it will forward the request to the next 'higher up' DNS server which is the ISP.

Let us know how you make out when you gain access.
--Rob
0
 
LVL 22

Assisted Solution

by:Olaf De Ceuster
Olaf De Ceuster earned 100 total points
ID: 34215740
What firmware are you running on the Fortigate 80C? Try 4-MR2.
If you are running DNS on server please point the 80C to the Server 2003 for primary DNS and use forwarders on the Server 2003 DNS. I've seen this behaviour many times on Fortigates doing DNS.
You will have everything pointing to the server 2003 DNS and let it do external DNS.
(Not the 80C)

Also if your ping rate is only 50% between Servers you should update NIC's, check switch and connections.
Hope that helps.
Olaf
0
 

Author Comment

by:Lisaa_G
ID: 34217233
Fortigate is running 4-MR2.  Will change DNS settings.

I'm going to grab some new cables, nics and a spare switch from another office and head in for further diagnostics - will keep you all posted - thanks for the help!
 
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34217434
olafdc if the clients and servers point to the server for DNS will the Fortigate DNS settings even matter? Agreed though they should point to the server.
0
 

Author Comment

by:Lisaa_G
ID: 34218211
Alright - forwarders on the 2003 Server

Forwarders look good - first one on the list is our gateway; then our ISP's DNS server - I've just added one for Google's DNS.

Proceeding to Firewall to change DNS settings there and then I'll monitor.
0
 
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 300 total points
ID: 34218266
You don't want the gateway as a forwarder, just the ISP's and make sure they are current.
0
 

Author Comment

by:Lisaa_G
ID: 34218280
Ok - going to make that change now...

Firewall DNS settings are now pointing back to server .
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 

Author Comment

by:Lisaa_G
ID: 34218301
OK - removed gateway as forwarder.
0
 
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 300 total points
ID: 34218317
and?  is there an improvement? You may want to run ipconfig /flushdns  (or reboot) on the PC's and possibly even server where you have been having issues.
0
 

Author Comment

by:Lisaa_G
ID: 34218343
Since problems have been intermittent I'll watch for awhile to be sure.  Ping commands between servers and between servers and gateway are no showing no lost packets.

nslookup queries are returning good results.

I'm going to do the rounds now since I'm on site to see the users who have had the most difficulty 9at least those who have complained most loudly and run the ipconfig /flushdns.

I'm feeling optimistic!!!  
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34218377
Sounds good so far.
0
 

Author Comment

by:Lisaa_G
ID: 34218977
Just lost internet again at our main reception desk....  the problem now seems isolated to the front of the office - proceeding to check hardware connections....
0
 
LVL 77

Assisted Solution

by:Rob Williams
Rob Williams earned 300 total points
ID: 34219144
When you loose internet can you confirm you can still access a web page by IP such as Google  http://173.194.43.104
This will confirm that DNS is the issue, or perhaps not.
0
 

Author Closing Comment

by:Lisaa_G
ID: 34219466
Hope you don't mind sharing the points - wish I could assign more.  You collectlively led me through to the solution.

RobWill - thanks for sticking with me right through the process - your last comment in particular isn;t something I would have thought of trying and is a handy diagnostic step.

Thank you all!
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34219494
You are very welcome, glad to assist and no problem at all with point allocation. I hope all is "resolved" :-)
Cheers!
--Rob
0
 
LVL 22

Expert Comment

by:Olaf De Ceuster
ID: 34219944
Hi Rob,
Fortigate has a little function on its wan interface saying: "override Internal DNS". If that's set wrongly (And it is out of the box) you can have all sorts of strange behaviour. In short yes it does matter.
Glad you're OK LIsaa and thanks,
Olaf
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34219996
Sorry I didn't realize that, very good information to have. How does it work? If the client and server are using the Server for DNS, does it block the outgoing DNS requests to the forwarder?
0
 
LVL 22

Expert Comment

by:Olaf De Ceuster
ID: 34220923
Yep and all internet traffic becomes intermittent.
Ipconfig/renew on workstations actually fixes it for a while and Windows 7 seems to be most affected.
Mind you, haven't seen the issue since Firmware 4-Mr2
Olaf
0
 
LVL 77

Expert Comment

by:Rob Williams
ID: 34222673
Thanks olafdc. That is good information to have should I have to deal with one of these routers.
--Rob
0
 

Author Comment

by:Lisaa_G
ID: 34245454
Thanks Olafdc - I'm going to have another look at those firewall settings.  We haven't been dropping connections in the last two days but I'm getting lots of complaints about the "internet seeming slow" - maybe there is a bit more tweaking I can do!

0
 
LVL 22

Expert Comment

by:Olaf De Ceuster
ID: 34245530
Is your modem in bridge mode? I should be.
Slow internet is usually Modem related.
Power Cycle modem?
Olaf
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Suggested Solutions

Resolve DNS query failed errors for Exchange
If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now