Solved

Join an AWS EC2 instance to an existing domain via Amazon Virtual Private Cloud VPN

Posted on 2014-02-24
6
2,630 Views
Last Modified: 2014-11-12
I have a project group that wants to set up some temporary compute instances on AWS. Easy enough.  The trick is they want the instances to be connected to our domain so users can authenticate normally and there is no differentiation in their experience when using these systems.  I've never joined a machine to the domain through a VPN connection, but I know it's possible

We've set up a VPC with a 10.x.x.x/24 CIDR block, traffic can pass through and I can remote to the instances I've created there.  When I attempt to join the domain, it errors out, stating it cannot contact the AD DC.  I've checked firewall settings, had ITSEC check out the VPN and can't find the problem.  Can anyone help?
0
Comment
Question by:Bighoppa
  • 3
  • 2
6 Comments
 
LVL 24

Accepted Solution

by:
smckeown777 earned 167 total points
ID: 39885270
Going to ask the stupid question first...on the AWS instances have you set the DNS entries to point to your AD server? Should have a single primary DNS entry and remove the secondary one and see if that works...

Since you have connectivity normally when you can't join a domain its a dns related issue
0
 

Author Comment

by:Bighoppa
ID: 39885858
Yeah, DNS is set in the VPC options to our name servers, and I also hard-coded them into the VMs for good measure.  Can't get any traffic from them to the DNS.  Going to work with the security team and have them check the firewall rules again.
0
 
LVL 38

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 333 total points
ID: 39887194
I just did this with a rackspace vm using the sonicwall global vpn client. No problem, so it is possible.

BTW once you have it up, you probably want to mess with the weight and priority
http://technet.microsoft.com/en-us/library/cc816890(WS.10).aspx
http://technet.microsoft.com/en-us/library/cc794710(WS.10).aspx
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:Bighoppa
ID: 39895301
Finally got it working.  Looks like one of the firewall guys fat-fingered the port rules.  Got them corrected last night and joined the VM to our domain this morning.
0
 
LVL 38

Assisted Solution

by:Aaron Tomosky
Aaron Tomosky earned 333 total points
ID: 39895331
Good to hear. Don't forget to uncheck "register this connection in DNS" for all the non VPN nics. Ip4 and ipv6
0
 
LVL 38

Expert Comment

by:Aaron Tomosky
ID: 39895936
one last thing, this was new to me, might be old hat to you:
server manager -> tools -> active directory sites and services
add a site for your remote stuff seperate from default-first-site and make subnets for all the sites. I called my remote site "vpn" and assigned it a /32 network (one ip) for the vpn box. this keeps it out of the rotation better than turning down the weight and priority (but I left those settings set as well).
0

Featured Post

How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

Join & Write a Comment

If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
This Micro Tutorial will explain how to export DynamoDB tables in Amazon Web Services.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now