Setup Domain Trust for internal networks fail

I have two domains that for the life of me, I cannot set up a trust between the two. I have tried setting up conditional forwarding, stub zone, zone transfer method and nothing works. nslookup does not resolve the second domain nor does the ip address resolve in the New Zone Wizards.

My main domain that will hold all of the resources are Windows 2003 domain controllers and the new domain is using Windows Server 2008r2. Am I having so much trouble because they are different server platforms? Could it be because during dcpromo I selected 2008 for domain compatibility? I didnt think that would matter if I am just creating the trust, but I could see why it would be if thats the case.

Thanks.
Luis_RomeroAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

 
Justin YeungSenior Systems EngineerCommented:
did you set "IP" allow on your DNS server to allow zone transfer.

and do it from scratch, are you able to ping the DCs on the primary domain from the secondary?
0
 
Luis_RomeroAuthor Commented:
Yes I did. And yes, when doing it from scratch I can ping the DCs FQDN. At this point I am more interested in using stub zones though.
0
 
Justin YeungSenior Systems EngineerCommented:
only 3 things is needed.

domain name
FQDN of the DNS server
IP of the DNS server

as long as you can ping it........ and I assume you can nslookup by using server on the other domain you should be good to go (make sure no firewall or network issue via port 53)

example
nslookup somename other_dc_servername
0
Making Bulk Changes to Active Directory

Watch this video to see how easy it is to make mass changes to Active Directory from an external text file without using complicated scripts.

 
Luis_RomeroAuthor Commented:
Thats the problem, I can ping, but nslookup wont resolve. The two domains are within our company firewall, so I dont see why I am unable to get this working...
0
 
Justin YeungSenior Systems EngineerCommented:
even you try to nslookup www.google.com (OtherDCFQDNname or IP)

by using the other dns server. do you have dns proxy set to only all certain ip for dns lookup on your network?

another word, does all the DNS traffic sent to your FW and then back to your DC for lookup?
0
 
Luis_RomeroAuthor Commented:
If I do www.google.com it resolves fine and there are no proxies. And our dns resolves on our servers, not our firewall.
0
 
Luis_RomeroAuthor Commented:
The rules on our firewall for dns is to block incoming dns and allow dns going out.
0
 
Justin YeungSenior Systems EngineerCommented:
from 2nd domain dc
do nslookup
server primary domain dc ip or fqdn name
lookup primary domain machine

does it resolve?
0
 
Luis_RomeroAuthor Commented:
If I do nslookup using the ipaddress, it shows correctly. If I do it using the FQDN, it times out after a couple seconds.
0
 
Justin YeungSenior Systems EngineerCommented:
that's normal since you domain doesn't know how to resolve that name.

but IP works. that's good enough.

now try to setup the stub zone, and add the IP of other domain as a forwarder under DNS.
0
 
Luis_RomeroAuthor Commented:
Adding the IP of the other domain still fails to validate under Forwarders and stub zone setup... it does resolve the server name though...
0
 
Justin YeungSenior Systems EngineerCommented:
yes you DNS doesn't resolve that name, then it will try it via the forwarder.

what if you add the primary domain DNS server as the forwarder, does it resolve it afterward?

you can do the trick by adding an A record. and then try again.
0
 
Luis_RomeroAuthor Commented:
If I add the primary domain controller as a forwarder onto the new domain, no. It fails to validate.
If I add the DC that I am working on into the forwarders, then it validates fine.
0
 
Justin YeungSenior Systems EngineerCommented:
add an reverse A record than it will resolve it
0
 
Luis_RomeroAuthor Commented:
Same thing, doesnt resolve or validate with the reverse lookup added.
0
 
Luis_RomeroAuthor Commented:
{removed}
0
 
Justin YeungSenior Systems EngineerCommented:
after you add the reverse lookup IP, and if you lookup the ip, does it return the pointer name?
0
 
Luis_RomeroAuthor Commented:
this is from the primary domain's DC...

C:\Documents and Settings\Administrator>nslookup
Default Server:  xxxx.mm.com
Address:  10.1.1.1

> server 10.1.2.10
Default Server:  mpdc1.2.1.10.in-addr.arpa
Address:  10.1.2.10

> server mpdc1.mp.local
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Can't find address for server mpdc1.mp.local: Timed out
> server 10.1.2.10.mp.local
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Can't find address for server 10.1.2.10.mp.local: Timed out
>
0
 
Justin YeungSenior Systems EngineerCommented:
so you don't have the record on the DNS server.
0
 
Luis_RomeroAuthor Commented:
I do, under the reverse lookup zone, zone 2.1.10-in-addr.arpa, I have a A record for mpdc1 which points to the domain controller. mpdc1 : 10.1.2.10. It is also listed in my Forwarders tab. This is on the main domain's DC.
0
 
Justin YeungSenior Systems EngineerCommented:
C:\Documents and Settings\Administrator>nslookup
Default Server:  xxxx.mm.com
Address:  10.1.1.1

> server 10.1.2.10
Default Server:  mpdc1.2.1.10.in-addr.arpa
Address:  10.1.2.10

> server mpdc1.mp.local <------ just lookup the name by not using that as lookup server
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Can't find address for server mpdc1.mp.local: Timed out
> server 10.1.2.10.mp.local <-------------------- you just type the name not server xxxxx
DNS request timed out.
    timeout was 2 seconds.
DNS request timed out.
    timeout was 2 seconds.
*** Can't find address for server 10.1.2.10.mp.local: Timed out
>
0
 
Luis_RomeroAuthor Commented:
I have found the issue. It seems that this server that is hosting my virtual domain environment is in a dmz and no one told me. I added a second network card that ties directly into the other domain, and did the same on the other network and was able to establish a domain trust. Thank you everyone who contributed to this exhausting and painful process!
0

Experts Exchange Solution brought to you by ConnectWise

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
 
Justin YeungSenior Systems EngineerCommented:
good that you found the root cause.
0
 
Luis_RomeroAuthor Commented:
I resolved my own issue.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.