MagicalArmchair's questions

Background:

We have a new Lenovo System x3650 Type 8871 server. Specs below:

• Lenovo System x x3650 M5 8871EMG 2U Rack Server
• 1 x Intel Xeon E5-2650 v4 Dodeca-core (12 Core) 2.20 GHz - 2 Processor Support - 16 GB Standard/768 GB TruDDR4 Maximum RAM
• 12Gb/s SAS RAID Supported, Serial ATA Controller
• Gigabit Ethernet
• RAID Level: 0, 1, 10
• 1 x 750 W - Matrox G200eR2 16 MB Graphic Card
• Lenovo RAM Module - 16 GB - DDR4 SDRAM - 2400 MHz DDR4-2400/PC4-19200 - 1.20 V - ECC - Registered
• CL17 - 288-pin - DIMM Lenovo Gen3 - Hard drive - 1.2 TB - hot-swap - 2.5 - SAS 12Gb/s - 10000 rpm - for Flex System x280 X6 Compute Node -System x35XX M5, x3850 X6, x3950 X6 System x 750W High Efficiency Platinum AC Power Supply

It is running the Lenovo Customized Image ESXi6.5 (based on ESXi 6.5 Vmkernel Release Build 5146846). We have two RAID 10 datastores set up on the server, each datastore consisting of 4 HDs.

Question:

We need to monitor the status of the RAID array, however, the Storage Monitor (found in Host/Monitor/Hardware/Storage) in VMWare vSphere web client tells us:

"The Small Footprint CIM Broker Daemon (SFCBD) is running, but no data has been reported. You may need to install a CIM provider for your storage adapter."

VMWare (whom we have Production Support with) tell us the CIM provider isn't included in the customised image, and that CIM provider must come from Lenovo. Lenovo (who answer as IBM support? Go figure) came back to us and told us they needed logs (DSA report or the IMM service data) from the machine that require us to shut the whole host down - this is a production host, we want to avoid that if we can.

For this system, can somebody please direct us to what CIM provider we need to install for it to report to VMWare correctly?

We are upgrading our single 2003 domain controller (DC1) to two 2012 R2 controllers (DC2 in Sevenoaks and DC3 in Manchester (different site in Sites and Services for Manchester)). DCpromo (the wizard anyway) went through without a hitch on both new servers. I went to demote DC1 and it suggested there were no valid DCs on the domain and that it would be a mighty bad idea.

On closer inspection I noticed that DC2 and DC3 had no SYSVOL or NETLOGON shares.

Running a DCDiag on DC2 showed the following error:

Starting test: Advertising
   Warning: DsGetDcName returned information for \\mfb-dc1.mortgages4business.local, when we were trying to reach
   MFB-DC2.
   SERVER IS NOT RESPONDING or IS NOT CONSIDERED SUITABLE.
   ......................... MFB-DC2 failed test Advertising
Starting test: FrsEvent
   There are warning or error events within the last 24 hours after the SYSVOL has been shared.  Failing SYSVOL
   replication problems may cause Group Policy problems.

repadmin /showrepl shows no errors on DC2. So I'm thinking DNS, you can find the ipconfig for DC2 here, and the ipconfig for DC1 here - everything points to DC1, the 2003 box, which is what I want for replication purposes until SYSVOL etc are created successfully.

On DC2 there are no directory services errors at all, on DC1 things are a little more unhappy - every 15 minutes there is a batch of 12 errors and warnings created.

Four of these (1865 warnings): "The Knowledge Consistency Checker (KCC) was unable to form a complete spanning tree network topology. As a result, the following list of sites cannot be reached from the local site." Four 1311 errors (more of the same). Four 1566 errors: "All domain controllers in the following site that can replicate the directory partition over this transport are currently unavailable. Site: CN=Manchester..."

If I run DCDiag on DC1, I get some replication errors - these relate to DC3 though (the server on the other network).

     [Replications Check,MFB-DC1] A recent replication attempt failed:
        From MFB-DC3 to MFB-DC1
        Naming Context: DC=DomainDnsZones,DC=mortgages4business,DC=local
        The replication generated an error (1256):
        The remote system is not available. For information about network troubleshooting, see Windows Help.
        The failure occurred at 2015-03-14 00:45:12.
        The last success occurred at 2015-03-13 22:00:11.
        1 failures have occurred since the last success.

     [Replications Check,MFB-DC1] A recent replication attempt failed:
        From MFB-DC3 to MFB-DC1
        Naming Context: CN=Schema,CN=Configuration,DC=mortgages4business,DC=local
        The replication generated an error (8524):
        The DSA operation is unable to proceed because of a DNS lookup failure.
        The failure occurred at 2015-03-14 00:45:15.
        The last success occurred at 2015-03-13 21:45:09.
        1 failures have occurred since the last success.
        The guid-based DNS name 4b35c4ab-6da8-40c5-8a74-4f8ee6e12954._msdcs.mortgages4business.local
        is not registered on one or more DNS servers.

All servers can ping each other and DNS looks good. All three servers have _msdcs.mortgages4business.local registered.

Edit: In DC3s logs, under file replication logs, I find: The File Replication Service is having trouble enabling replication from mfb-dc1.mortgages4business.local to MFB-DC3 for c:\windows\sysvol\domain using the DNS name mfb-dc1.mortgages4business.local. FRS will keep retrying. So perhaps my DNS theory isn't far wrong - mad thing is I can pin mfb-dc1...

What am I missing? Is this something to do with the other site? It can't replicate to DC3 so it gives up and doesn't replicate to the local DC2?

Background

We currently have two networks, one in London, and one in Brighton. We use Office 365 for email, Lync and Sharepoint, so there is no Exchange server. Both offices are connected by a VPN.

• London is a larger office of 50 users and is on range 192.168.0.0 (255.255.255.0) on a EFM line.
• Brighton is a small office of 5 users and is on range 192.168.16.0 (255.255.255.0) on BT infinity.

Brighton currently has an old 2003 Small Business Server on their own domain, this means they cannot log on to our London domain when they visit, and visa versa – the domain controller in London is also a 2003 server box.

On Friday, we will be promoting a new 2012 R2 Domain Controller in London. As part of this process I want to remove the Brighton domain entirely and bring the Brighton network into the London domain.

We have new a server for Brighton that is to do DHCP, DNS and file server roles on the 192.168.16.0 network. I want all Active Directory and Group Policy functions to be delegated from this server in Brighton to our new domain controller in London.

The questions

• How will the DNS server in Brighton locate Active Directory Services in London on the different IP range? Is there an SRV record we need to set up to tell the server where to get AD and GP services?
• Would DC replication be a better way to go here? Is it even applicable or just for DR and HA purposes? Would replication give the added bonus of added redundancy (re the answer in this question). I would only want to managed the Brighton offices users from the DC in London (No IT function in Brighton).
• Finally, is the above approach sound – we are not doing anything daft with the above strategy?

In my httpd.ini I redirect all traffic from "example.co.uk" to "www.example.co.uk", the below works fine for this:

RewriteCond %HTTPS off 
RewriteCond Host: (?!^www.example.co.uk)(.+) 
RewriteRule /(.*) http\://www.example.co.uk/$2 [I,RP]

I have a bunch of microsites which also use this website, say "www.foobar.co.uk", set in the Host Headers of IIS 6. With the above rules, "www.foobar.co.uk" ends up at "www.example.co.uk"!

Is there a RewriteCond I can do against the request to make sure that the request is for "example.co.uk" to not capture the microsites and rewrite those? Or even better, a way I can take any request, be it "example.co.uk" or "foobar.co.uk" and just wack a www in front of it?

Thanks for your help.

We have two sites, a large Southern site and a small Northern site, that have a VPN between them defined on two Cisco PIX Firewalls. Over this VPN Shoretel IP phone traffic travels as well as all other network traffic. We recently switched the smaller Northern office to Bt Infinity (fiber) and all systems worked perfectly, that is, they worked perfectly until last week. Note, nothing change on that day.

Traffic coming down the VPN from Manchester works on all fronts, apart from for the telephone system. Our tame telephone engineers from Shoretel tell us this is all due to the telephone system packets having the DF (do not fragment) bit switched on on their traffic and a required payload of 1472, and with the IPSec overhead, 1472 will not fit down the lines MTU.

If I do a ping MTU test from our Southern office to our Northern office I get the following:

C:\>ping <NorthernOfficeServerIP> -f -l 1472

Pinging <NorthernOfficeServerIP> with 1472 bytes of data:
Reply from <OutsideInterfaceOfSourthernPixIP>: Packet needs to be fragmented but DF set.
Packet needs to be fragmented but DF set.

The VPN setup on the PIX is as follows:

sysopt connection permit-ipsec
crypto ipsec transform-set chevelle esp-des esp-md5-hmac
crypto map transam 1 ipsec-isakmp
crypto map transam 1 match address 101
crypto map transam 1 set peer <Peer IP> 
crypto map transam 1 set transform-set chevelle
crypto map transam interface outside
isakmp enable outside
isakmp key ******** address <Peer IP> netmask 255.255.255.0
isakmp keepalive 10
isakmp nat-traversal 20
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption des
isakmp policy 1 hash md5
isakmp policy 1 group 1
isakmp policy 1 lifetime 86400

The first thing I tried on the PIX was to get it to clear the DF flag on the packets as below:

pix(config)# crypto ipsec df-bit clear-df outside

Unfortunately, this just gives:

ERROR: unrecognized usage: [no] crypto ipsec { transform-set | security-association} ... Type help or '?' for a list of available commands.

But then our PIX firmware is quite venerable, the show ver gives me:

Cisco PIX Firewall Version 6.3(5)
Cisco PIX Device Manager Version 3.0(4)

Compiled on Thu 04-Aug-05 21:40 by morlee

chathampix up 14 hours 54 mins

Hardware:   PIX-506E, 32 MB RAM, CPU Pentium II 300 MHz
Flash E28F640J3 @ 0x300, 8MB
BIOS Flash AM29F400B @ 0xfffd8000, 32KB

I have tried altering the MTU size on the PIX, I've had the Outside interface at 1500, 1492 (8 bytes for PPP) and BTs recommendation of 1458 to try and mitigate the problem. The 56 byte overhead of the VPN means that the packets with the DF bit set at 1472 bytes will always be dropped by the VPN.

Does anyone know the equivalent command for "pix(config)# crypto ipsec df-bit clear-df outside" for a PIX with this firmware? Or do you have any other ideas??

UPDATE:

The show crypto ipsec sa for the Northern PIX is below:

interface: outside
    Crypto map tag: transam, local addr. <NorthernOutsideInterfaceIP>

   local  ident (addr/mask/prot/port): (192.168.16.0/255.255.255.0/0/0)
   remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
   current_peer: <SouthernOutsideInterfaceIP>:500
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 107592, #pkts encrypt: 107592, #pkts digest 107592
    #pkts decaps: 114302, #pkts decrypt: 114302, #pkts verify 114302
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 8, #recv errors 0

     local crypto endpt.: <NorthernOutsideInterfaceIP>, remote crypto endpt.: <SouthernOutsideInterfaceIP>
     path mtu 1492, ipsec overhead 56, media mtu 1492
     current outbound spi: 4ada0b77

     inbound esp sas:
      spi: 0xe7c2815(243017749)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 1, crypto map: transam
        sa timing: remaining key lifetime (k/sec): (4516828/21982)
        IV size: 8 bytes
        replay detection support: Y


     inbound ah sas:


     inbound pcp sas:


     outbound esp sas:
      spi: 0x4ada0b77(1255803767)
        transform: esp-des esp-md5-hmac ,
        in use settings ={Tunnel, }
        slot: 0, conn id: 2, crypto map: transam
        sa timing: remaining key lifetime (k/sec): (4598687/21980)
        IV size: 8 bytes
        replay detection support: Y


     outbound ah sas:


     outbound pcp sas:

And the MTU for the Southern PIX and Northern PIX is:

mtu outside 1500
mtu inside 1500

The MTU is automatically set less the 8 bytes for PPP by the PIX I believe.