?
Solved

Active Directory Replication Issues Over Site-to-Site SonicWall VPN

Posted on 2011-10-20
7
Medium Priority
?
1,359 Views
Last Modified: 2012-05-12
Hello,

I have two SonicWall firewalls set up at two different sites with a site-to-site VPN set up. I am able to ping resources on either network and there appears to be no bad connection between them or error logs/dropped packets etc. I have two DC's, both are normal (not Read Only) DCs, one at each site, one domain. They are both 2008 R2, both are DNS servers and global catalogs. On the second site, when DCPROMOing the server, everything was successful and it pulled all the usernames and group policies just fine. Sites and services has been set up correctly.

My problem is, is that they don't seem to be replicating any changes now. The VPN is still connected and solid. DNS is resolving correctly and I have used portqry to test all AD ports and they are all open.

There are no content filtering or IPS services enabled for the VPN zone (however they are enabled for the WAN link) I would assume that the Sonicwall would not filter anything for its own VPN.

MTU is set to 1500 on both firewalls. The logs's NAT discovery reports there are no NAT devices in between the devices on the VPN.

Repadmin /showrepl on both servers reports that they are replicating correctly.

I created a user account on server1 that did not replicate to server 2, but I am able to authenticate that user account on computers in server2's LAN. (The clients in server2's LAN have server1 listed as a secondary DNS server after Server2)


So I am not an expert by any means, and I am not sure what to check next. These servers need to be replicating on a consistant basis and need to be exact mirrors.

Thanks in advance!
0
Comment
Question by:paulrausch
  • 3
  • 3
7 Comments
 
LVL 29

Accepted Solution

by:
pwindell earned 2000 total points
ID: 37002313
Everything would work with only one DNS listed in the TCP/IP Specs and it isn't supposed to matter which one is listed.  Now I am not saying to only use one,...I'm just saying that it would work with only one listed.  

It is most likely one of these two:

1. It is working fine and you aren't waiting long enough.   The Replication Rate is slowed way way way down across site links than the nearly instant replication you see when the DCs are in the same site together.

2.  There is something wrong in the Site configuration that you have not noticed is there.
0
 
LVL 2

Author Comment

by:paulrausch
ID: 37002444
It is very possible I'm being impatient, its been a couple hours since I've created the users. The site in the Philippines does not have the fastest internet connection though it is stable.

Are you referring to Sites and Services? If so, are there any common mistakes I should look for? I've created a subnet and a site. During DC promo, the utility picked out the correct subnet and site for the server. In the NTDS Settings, I see that each are referencing each other for replication. I have not changed any settings in sites and services NTDS settings. I just created the site and subnet. Is there something I missed?

Thanks for your reply!
0
 
LVL 16

Expert Comment

by:JammyPak
ID: 37002487
In AD Sites and Services, select one of the DCs in the left pane and expand and click on ntds settings. in the Right pane you should see the other DC listed. Right click on it and choose 'replicate now'

often helps speed things up when you're waiting for replication over a wan
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
LVL 29

Expert Comment

by:pwindell
ID: 37002522
Yes I meant Sites & Services. I can't think of anything specific that would be wrong in it beyond maybe a typo or something. I just put that out there as something to double check.

I don't run Sites & Services here to be able to get a visual of the GUI,...but there is a Replication Rate in there.  The fastest it can be is every 15 minutes (or was it 5?  heck I can't even remember that now).  But your current setting may be much longer,...it could even be set to "once a day".  So you need to check that.  The actual WAN speed is totally irrelevant,...it just needs to be stable.   But don't do any file replication (beyond just login scripts) over a WAN Link like that.

Remember that any changes you make to the Sites & Services on your side will not change on the other DC until Replication actually takes place to update the setting.
0
 
LVL 2

Author Comment

by:paulrausch
ID: 37002567
You were right pwindell. I was being impatient. This was my first site-to-site VPN and it happened to be on the other side of the world. It replicated after about 1 and half hours. Is there a way to speed this up other than decreasing the replication time (it was 15 minutes)

Also JammyPak, thanks for the tip! This did speed it up.


Thanks to all of you!
0
 
LVL 29

Expert Comment

by:pwindell
ID: 37002617
If it is set to 15 minutes then it is going to try every 15 minutes.  If it took longer than that I don't know what to tell you other than "we live in an evil world".

Check it periodically by making a simple change in some AD object and see how long it takes to be recognized on the other side.  Look for consistency.  Also remember that it is not 15 minutes from the change you make,...it is 15 minutes from the last replication.  At least that is how I have always interpreted that to be.

I think the Event Logs also report every time replication completes, so you can look at the time stamp on the log entry and compare the time gap between entries..
0
 
LVL 2

Author Comment

by:paulrausch
ID: 37003115
Thank you, I'll do some fiddling.
0

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Resolving an irritating Remote Desktop connection that stops your saved credentials from being used.
In the absence of a fully-fledged GPO Management product like AGPM, the script in this article will provide you with a simple way to watch the domain (or a select OU) for GPOs changes and automatically take backups when policies are added, removed o…
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

839 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question