troubleshooting Question

INTER FOREST TRUST, STRANGE FLOW FOR AUTHENTICATION

Avatar of Mattia Minervini
Mattia MinerviniFlag for Italy asked on
NetworkingVPNActive DirectoryPC
4 Comments1 Solution33 ViewsLast Modified:
Hi all
i try to explain our scenario
i have two SITE, SITE "A" and SITE "B" connected in vpn.


On the first SITE "A"
- DOMAIN SERVER MICROSOFT AD "domainRED" with FSMO
- DOMAIN SERVER MICROSOFT AD " domainRED" secondary
- DOMAIN SERVER MICROSOFT AD "domainGREEN" with FSMO

On the second SITE "B"
- DOMAIN SERVER MICROSOFT AD "domainRED" read only domain controller
- DOMAIN SERVER MICROSOFT AD "domainRED" with a second read only domain controller (for redundancy)
- DOMAIN SERVER MICROSOFT AD " domainGREEN" secondary
- ERP SERVER with client server application on "domainGREEN"
- Pc client (about 20) on "domainRED" with client of ERP SERVER

NOTE1
beetwen "domainRED" and "domainGREEN" there is an UNIDIRECTIONAL INTER FOREST TRUST
"domainGREEN" outbound trust on "domainRED"
"domainRED" inbound trust on "domainGREEN"
This configuration is made in order to say :
USER JOHN.domainRED can open ERPFOLDER on ERPSERVER.domainGREEN
and it works


PROBLEM IS:
if we have vpn problem, pc client on SITE "B" failed to open ERP SERVER application on the same SITE
Seems request surf from SITE "B" to SITE "A"!
Seems an authentication problem, but on SITE B we have these 3 server:

- DOMAIN SERVER MICROSOFT AD "domainRED" read only domain controller
- DOMAIN SERVER MICROSOFT AD "domainRED" with a second read only domain controller (for redundancy)
- DOMAIN SERVER MICROSOFT AD " domainGREEN" secondary

just to avoid network request in VPN!
we thought that flow should be:
1) PCCLIENT on SITE "B" launch application ->
 2)read only domain controller on SITE"B" ask for trust  DOMAIN SERVER MICROSOFT AD " domainGREEN" secondary on SITE"B"
3) DOMAIN SERVER MICROSOFT AD " domainGREEN" secondary on SITE"B" replies OK
4) PC CLIENT can start application

Maybe porblem is read controller domain of domainRED ? (better a traditional secondaary domain with global catalogue and so on...?)
or problem can be DOMAIN SERVER MICROSOFT AD " domainGREEN" secondary on SITE"B" is not primary with FSMO?

How can i troubleshoot?
really thanks, sorry for my english, ask me for details
M


-
ASKER CERTIFIED SOLUTION
Mattia Minervini

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 4 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 4 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros