morleyc's questions

I have 3 x Mikrotik RB951Ui-2HnD router board (RB) running 6.31 with wlan1 bridged with ethernet 2.

STP is disabled on the RB bridge (protocol mode set to None).

I have a HP ProCurve 2520-24-PoE switch (flat, no config) connecting to the RB951's (I have tried with the ProCurve having Spanning Tree both enabled and disabled, plus with Mikrotik bridge set to RSTP and also None, makes no difference).

Using a number of DELL Windows 8.1 clients i connect to the access point and Windows spins connecting saying it is taking longer than usual. Clients connecting via Ethernet cable get an IP address instantly.

If i set my WiFi NIC on the Windows machine to a correct IP statically I am not able to ping the server, or the router, until about 60 to 90 seconds after connecting... so seems my packets are being blocked. During this time of no connectivity to the wider network, I am able to ping and connect to the RB.

If i log in to the RB on winbox from the laptop whilst i am unable to connect, from the terminal on RB i am able to ping the server and gateway.

Other times when I connect it is instantly connected, no pattern for it.

This is so simple yet has me stumped - any ideas what on earth is going on and how to diagnose?

Is there a compatibility problem or some kind of spanning tree in effect?

Config below from Mikrotik (the HP ProCurve is default blank):

/interface bridge
add admin-mac=4C:5E:0C:03:9B:3F auto-mac=no name=bridge-local protocol-mode=\
    none
/interface ethernet
set [ find default-name=ether1 ] name=ether1-gateway
set [ find default-name=ether2 ] name=ether2-master-local
set [ find default-name=ether3 ] master-port=ether2-master-local name=\
    ether3-slave-local
set [ find default-name=ether4 ] master-port=ether2-master-local name=\
    ether4-slave-local
set [ find default-name=ether5 ] master-port=ether2-master-local name=\
    ether5-slave-local
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-b/g/n country=\
    "united arab emirates" disabled=no distance=indoors l2mtu=1600 mode=\
    ap-bridge ssid="Sales" wireless-protocol=802.11
/ip neighbor discovery
set ether1-gateway discover=no
/interface wireless security-profiles
set [ find default=yes ] authentication-types=wpa2-psk eap-methods="" mode=\
    dynamic-keys supplicant-identity=MikroTik wpa-pre-shared-key=change!me! \
    wpa2-pre-shared-key=change!me
/ip ipsec proposal
set [ find default=yes ] enc-algorithms=aes-128-cbc
/ip pool
add name=dhcp ranges=192.168.88.10-192.168.88.254
/interface bridge port
add bridge=bridge-local interface=ether2-master-local
add bridge=bridge-local interface=wlan1
/ip address
add address=192.168.1.201/24 comment="default configuration" interface=\
    ether2-master-local network=192.168.1.0
/ip dhcp-client
add comment="default configuration" dhcp-options=hostname,clientid disabled=\
    no interface=ether1-gateway
/ip dns
set allow-remote-requests=yes servers=8.8.8.8,8.8.4.4
/ip dns static
add address=192.168.1.201 name=router
/ip route
add distance=1 gateway=192.168.1.254
/system clock
set time-zone-autodetect=no
/system identity
set name=Mikrotik
/system leds
set 5 interface=wlan1
/system package update
set channel=current
/tool mac-server
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add interface=wlan1
add interface=bridge-local
/tool mac-server mac-winbox
set [ find default=yes ] disabled=yes
add interface=ether2-master-local
add interface=ether3-slave-local
add interface=ether4-slave-local
add interface=ether5-slave-local
add interface=wlan1
add interface=bridge-local
/tool romon port
add

We have a HP ProCurve 2530-24-PoE (J9773A) switch, recently I had a user who plugged in an Apple wireless hardware device to the network - whenever it was connected I got a ton of broadcast warnings from the switch, intermittent bouts of packet loss and switch CPU usage went through the roof.

I removed his device and all is fine... given the entire office went down and no body could work every time it was plugged in I wasn't able to find the root cause other than something to do with the Apple hardware config. I can only assume he has setup as a client bridge to connect to the WiFi and caused a loop back via the Apple Ethernet port!

I have spanning-tree enabled on the HP ProCurve, but this didn't stop the network going down.

I am looking at stopping this happening again (and further more lock users from connecting their own unauthorized access-points/switches to the network) and seen the following recommended commands to harden against loops here https://cs.uwaterloo.ca/cscf/reports/CNAG/2009/ProCurve%20Best%20Practices.pdf:

loop-protect 1-24
spanning-tree 1-24 root-guard
spanning-tree 1-24 bpdu-protection
spanning-tree 1-24 admin-edge-port
loop-protect 1-24

Question 1 - Can one sleep easy at night with those commands or anything I should be aware with the above?

Question 2 - Will the above commands stop people messing with the network and connecting their own hardware, or are any other commands needed?

Question 3 - If we have our own authorized wireless devices, would bpdu-protection stop the bridging of clients on the wireless access point, and should we leave this off on the ports that are connected to our wireless access points?

Question 4 - We have a voice VLAN setup and specified as voice:

vlan 69
   name "DATA_VLAN"
   untagged 1-24
   no ip address
   exit
vlan 70
   name "VOICE_VLAN"
   tagged 1-24
   no ip address
   qos dscp 101110
   voice
   exit

The phones plug in to the switch, and computers to the back of the phone. Similair to question 3, how will bpdu-protection affect the fact I have a PC behind each phone (so essentially 2 MAC addresses per port). Does the fact the voice is specified in the voice vlan 70 allow for and take care of this?

I have a running service with logon user credentials using a service account in AD.

If I change the service account password in AD users and groups but not on the service startup/logon details would the service still run? Or does the password only get checked during startup of the service?

Or does the service need to log on to the domain controller every x number of hours?

Update - I am using Windows Authentication to communicate between two machines running services with WCF over the network.

As an example I have 3 DFS servers all on different sub-nets each with an authoritative initial share on each (\\svr1\accounts, \\svr2\sales, \\svr3\hr).

I have enabled replication on all servers (mesh) so that I have the 3 shares on each server (i.e. svr1 would have the 3 shares accounts, sales and hr, and the same for the other 2 servers).

Since there are multiple source shares for each folder, how does the client know the share to connect to (we would want to connect to the local file server as opposed to the one over the slow VPN).

How does DFS-R work in the above scenario? I see two possibilities:

1. Can i use the root namespace i.e. \\mydomain.local\file\accounts and have it redirect automatically to the local server (based on latency, or active directory site subnets)

2. Or do i have to point it manually to the local server i.e. \\svr1\accounts (at the expense of svr1 going down I loose connectivity)?

If it is the first possibility, is there any configuration that needs to be made?

I went to DFS Management and added a created a New Namespace.

For the namespace server, I specified my Primary Domain controller (netbios name: primarydc).

For the namespace, I enter Files.

I use a domain-based namespace (Windows Server 2008 mode).

Namespace server: primarydc.

Preview of the namespace is \\mydomain.corp\Files

I got an error saying \\mydomain.corp\files: The namespace server \\primarydc\Files cannot be added. The system cannot find the path specified.

Now when i browse the network shares on the \\primarydc, I see a shared folder named Files exists, but when i double click it i get an error from Explorer The system cannot find the path specified.

I cannot try again with the same DFS name Files as it says there is already a file share called Files on the primarydc.

How can i remove this file share and go back to a clean state so i can start again?

Any things I should check for that could have caused the initial setup to fail in the first place?

Is there any way which I can create the active directory domain corp.domain.com without first creating domain.com AD DCs?

Or to put another way, can corp.domain.com be the root of the forest?

I have a Production network in VMM 2012 that has a trunk from the managed ProCurve switch (running VLANs) to the guest VM nic. The connection from switch to Hyper-V guest network is a trunk carrying VLANs 69 and 200. I initially created the Fabric Logical Network as below.

Viewing the same machine as a self service user, I am unable to select the VLAN and can only select the adapter. I understand self service users cannot set VLANs.

So I instead went back and created the VLANs under the same network site:

I then added a new VM Network. Below is a screenshot of the Data subnet being added, i repeated for Server and Voice subnets so each had their own VM network:

Then when adding a new VM as a guest, I see the site is in the drop down list (one and only one site is listed here, in this case Data_0). Selecting this automatically ticks the VLAN with the correct ID:

With the above, i would need to add a separate VM Network for each site. Whilst this extra work isn't a problem, I need to check:

1. Is this is the correct way of doing things (adding one VM network per network subnet)?

2. For the VM Guest hardware NIC properties, why is there a drop down list for the VM Subnet when I can only add one site to a VM network anyway?

3. For the VM Subnet properties of the VM Network, is it normal to not be able to add more than one VM subnet to a VM Network?

On my Avaya ERS2550T switch each port can be set with a native/primary VLAN I can assign other secondary (depending on the mode) VLANs that will be associated with this port.

I can configure ports as:

• tagAll (trunk)
• untagAll (access)
• tagPvidOnly
• untagPvidOnly

I have seen similar port options on different switches. As I understand, VLANs are used to segregate collision domains in to separate subnets.

The thing I do not understand is, if we had VLANs 10, 20 and 30, which are each their own IP subnet, why would we want to untag all of these on a port as this would create a collision of different subnets on the same physical port.

So in summary, why does the untagAll (access) mode exist, and in what scenarios would it be useful to assign more than one VLAN to a port that is operating in this mode?

Doing my first server to iSCSI target and I thought i would be off to a running start by teaming my NIC on the server (conventional 802.3ad team).

However, from many online sources I see this is NOT recommended and MPIO should be used instead (there was no specific sizing in this recommendation and seemed to apply from a 3 node cluster to large clusters of tens of nodes and above).

I know MPIO is better as it aggregates transfers over independent routes (whereas conventional NIC team would be to the same switch), this aside is there any other reason (risk of data corruption) for Microsoft and training material state to use MPIO instead of teaming?

I had followed the instructions here http://support.microsoft.com/kb/230306 to remove a child domain that wasn't needed and whose DC had crashed.

I removed the child domain called ae, and kept the other child domain called deva.

This was done about 1 week ago, when I Find in Active Directory Users and Computers I can see the ae domain listed at the top just above Entire Directory (whereas it used to be a sub folder under the main domain as a child domain) :

How can i remove this please?

Today we went from Windows 2003 SBS to Windows Server 2012 Standard. I did the following:

1. Joined 2012 server to the SBS 2003 domain
2. Installed Active Directory Domain Services (aka dcpromo) on the server
3. Transferred all roles to new server within fsmo maintenance under ntdsutil
4. I then removed the old Windows Server 2003 SBS server

Everything seemed to be working OK until I saw errors with group policy not appling due to missing group policy folders - on closer inspection I had no SYSVOL or NETLOGON folders!

I then ran I ran the Authoritative FRS restore procedure using the D4 flag on the new 2012 server (at this point, the 2003 SBS was already removed):

1. In the Command box, type net stop ntfrs.
2. Locate the following subkey in the registry: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NtFrs\Parameters\Backup/Restore\Process at Startup
3. In the right pane, double click BurFlags.
4. In the Edit DWORD Value dialog box, type D4 and then click OK.
5. Run net start ntfrs

I checked \fkdxbsvr1\ in Windows Explorer and could now see the SYSVOL share, but still no NETLOGON share.

I saw the following eventlog error regarding a missing file in sysvol share:

Log Name:      System
Source:        NETLOGON
Date:          27/03/2013 18:40:41
Event ID:      5706
Task Category: None
Level:         Error
Keywords:      Classic
User:          N/A
Computer:      FKDXBSVR1.mydom.local
Description:
The Netlogon service could not create server share C:\Windows\SYSVOL\sysvol\mydom.local\SCRIPTS.  The following error occurred: 
The system cannot find the file specified.

So I created the folder called scripts under C:\Windows\SYSVOL\sysvol\mydom.local\SCRIPTS and restarted netlogon, and the NETLOGON share then appeared.

My questions are as follows:

1. Why could netlogon not create the scripts folder during startup? I didn't read any KB about creating a folder manually, but seems to have worked - is this good or a fudge?
2. Anything else I should check for? I need convincing that the migration is OK without any other hidden errors.
3. What did I do wrong in the migration for the above strangeness to start happening?

Additional background information if needed

sysvol directory listing before I added scripts folder

dcdiag dump

I am scripting a remote rsync setup, and need to add a remote server to the local known_hosts file to avoid getting prompted wit the below when the script is first ran:

The authenticity of host '[hostname] ([IP address])' can't be established. RSA key fingerprint is [key fingerprint]. Are you sure you want to continue connecting (yes/no)?

As per Can I automatically add a new host to known_hosts? I have tried (with a fresh known_hosts file):

ssh-keyscan -H [hostname],[ip_address] >> ~/.ssh/known_hosts
ssh-keyscan -H [ip_address] >> ~/.ssh/known_hosts
ssh-keyscan -H [hostname] >> ~/.ssh/known_hosts

But this does not work, I am always prompted to accept the finger-print.

When I do let ssh add this for me, the key hash is very different in the know_hosts file.

What else should I do to troubleshoot this issue?

I have just started using Bacula and it is great, one tutorial I read recommended putting full backups in a different pool (disk) to incremental backups.

What would the benefit of sperating full and incremental backups like this be?

What pool would Bacula right to if it was using the incremental schedule (and incremental pool) but upgraded the backup to full as it couldnt find the previous full backup?

I am accessing the built in SharePoint 2010 on SBS2011 via Microsoft Office Excel and Word (opening a file from WebDAV http file mapped drive in Explorer).

When saving a file, I get prompted from within Microsoft Office 2010 Word/Excel for credentials - entering the correct credentials just prompts the window again.

Clicking cancel allows me to go to My computer -> mapped drive and save the file.

I am able to browse the SharePoint site via Internet Explorer without an issue and I am not prompted for a password when doing so, I presume this means Windows authentication is working via the SharePoint URL being in the intranet list.

I have also check that the sharepoint url is in the trusted intranet sites list.

Anything else I should look in to?

One of my customers Outlook keeps hanging he is blaming our exchange server but i strongly suspect it is related to a 30GB and 20GB archive data pst files he has attached.

We have hundreds of other customers and no one else complains so i dont believe its the exchange server.

PST scanfix tool reported corruptions on these and apparently were fixed.

Customer is not prepared to archive off the messages with larger attatchments to his file system so we can merge remaining mail to his ost exchange mailbox (his inbox limit is 25GB).

He now wants exchange removed and going back to POP3 but i strongly suspect the hanging problem will remain.

Couple of questions:

If Microsoft consider 5GB a large pst size what is their definition of 50GB of pst files?

What is the actual limit of pst files that outlook can handle but remain stable?

Why does pst corruption occur?

What else can be done to stop outlook crashing?

I have an out of the box SBS2011 install which is fully patched and updated.

During SBS2011 installation did not give me the option of putting a .com and has instead setup my domain name with a local extension, i.e. mydomain.local

From an external mail perspective, users use the domain extdomain.com.

I have installed a third-party SAN certificate on my server with the names:

1. myserver
2. myserver.mydomain.local
3. remote.extdomain.com
4. autodiscover.extdomain.com.

If I can help it don't actually want my server to live on the internet, I only want people to access internally over the VPN (which works fine they can send and receive email OK).

What is driving me nuts is in Outlook 2010 the certificate error popup as the domain registrar is responding to the autodiscover.extdomain.com with a holding page so Outlook thinks it is valid!

How can I disable this check in Outlook, or is there anything I can do if i open the IIS port up on the firewall and have a valid autodiscover page?

How can i account for I have an autodiscover.mydomain.local website but not an autodiscover.extdomain.com site in IIS?

I have the following AD configuration:

rootca (standalone not domain connected)

• mydom.local
  • dc1.mydom.local
  • svr1.mydom.local
  • subca.mydom.local(enterprise subordinate CA)
  • other.mydom.local
    • dc1.other.mydom.local
    • svr1.other.mydom.local

I can register webserver certificates OK for svr1.mydom.local, however I log into svr1.other.mydom.local with the child domain administrator and I get the following error:

Permissions on the certificate template do not allow the current user to enroll for this type of certificate (0x80094012)

I think this must related to permissions however I am not sure how to proceed - what is the best practice to allow child domain administrators to request certificates from the subordinate CA located in the parent domain?

My inf file is below:

[NewRequest]
Subject="CN=svr1.other.mydom.local"
Exportable=TRUE
KeyLength=2048
KeySpec=1
MachineKeySet=TRUE
[EnhancedKeyUsageExtension]
OID=1.3.6.1.5.5.7.3.1 ; Server Authentication
OID=1.3.6.1.5.5.7.3.2 ; Client Authentication
[RequestAttributes]
CertificateTemplate = WebServer

and i am running the following commands on svr1.other.mydom.local as [email protected] below:

certreq -new c:\svr1.inf c:\svr1.req
certreq -submit c:\svr1.req c:\svr1.cer ; I get the error here

I have a software development machine that will be accessed remotely via RDP, it is a virtual machine running as a guest in Hyper-V.

A hardware firewall is in place to prevent internet access or files to be transferred off the subnet.

Is it possible to restrict the file transfer and other mechanisms of copying data?

I'm running Windows 2008 R2 enterprise and open to all ideas including 3rd party software.

We have the following AD topology:

• ourcompany.com
  • east.ourcompany.com
  • west.ourcompany.com

We are looking to install Exchange in the root ourcompany.com. Are there any issues that we need to be aware of if for users in the child domains east and west?

Can the users in the child domains use the exchange server the same way as the users in the root domain?

I am connecting to a ASA5505 at from home to the head-office using L2TP VPN.

Head-office then connects to a other-office via a site-to-site IPSEC tunnel.

When in the head-office (192.168.100.0/24) I can ping/access remote-office (192.168.200.0/24) OK.

When connected remotely to head-office, I can ping/access head-office OK from the road-warrior laptop.

My problem is that when connected remotely from home to the head-office I cannot ping/access the other-office subnet

On the home laptop the L2TP VPN connection is set to route all traffic to the VPN connection using the HQ as the internet gateway I can confirm this works.

I cant do traceroute (I get timeouts) as my policy doesnt allow and not sure how to enable this properly on the ASA.

Any ideas what is wrong, config is below:

names
name 192.168.200.0 othersite
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.100.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 34.35.36.3 255.255.255.252
!
same-security-traffic permit intra-interface
access-list inside_nat0_outbound extended permit ip 192.168.100.0 255.255.255.0 othersite 255.255.255.0
access-list inside_nat0_outbound extended permit ip any 192.168.100.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.100.0 255.255.255.0 othersite 255.255.255.0
access-list DefaultRAGroup_splitTunnelAcl_1 standard permit 192.168.100.0 255.255.255.0
access-list outside_in_acl extended permit icmp any any echo-reply
access-list outside_in_acl extended permit tcp any interface outside eq smtp
ip local pool VPNLAN 192.168.100.210-192.168.100.240 mask 255.255.255.0
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 192.168.100.0 255.255.255.0
nat (outside) 1 192.168.100.0 255.255.255.0
static (inside,outside) tcp interface smtp 192.168.100.3 smtp netmask 255.255.255.255
access-group outside_in_acl in interface outside
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
 dns-server value 192.168.100.3
 vpn-tunnel-protocol l2tp-ipsec
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl_1
tunnel-group DefaultRAGroup general-attributes
 address-pool VPNLAN
 default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
 pre-shared-key *****
tunnel-group DefaultRAGroup ppp-attributes
 no authentication chap
 authentication ms-chap-v2
tunnel-group 40.35.36.122 type ipsec-l2l
tunnel-group 40.35.36.122 ipsec-attributes
 pre-shared-key *****