I have a set of several offices joined using various combinations of IPsec VPNs and an MPLS network. The majority of sites form a mesh arrangement using the VPNs, but site B only has a single IPsec VPN to site A - site B cannot reach any of the other sites (sites C, and D).
Sites A, C, and D all share an Active Directory domain, say "companya.com". Domain controllers for companya.com are located in all three sites, and are all running Windows Server 2012 R2.
Site B runs its own Active Directory domain - say "companyb.com". Domain controllers for companyb.com are located solely in site B. One runs Windows Server 2019, the other runs Windows Server 2012 R2.
We have established a two-way trust between the AD domains companya.com and companyb.com. This was achieved using a conditional forwarder in the AD DNS servers for companyb.com, pointing to both domain controllers on site A for companya.com; in addition, we set up a stub zone in companya.com to point to both domain controllers on site B for companyb.com.
As expected, both domain controllers in site A can reliably contact a domain controller in site B. However, both domain controllers in site B can only reliably contact domain controllers in site A - because we deployed a conditional forwarder, sometimes DNS lookups for SRV records describing domain controllers in site B return results for sites C and D, which site B cannot access at all. This is causing sporadic errors such as "The system cannot contact a domain controller to service the authentication request. Please try again later."
I need to ensure that when domain controllers in companyb.com perform lookups to find domain controllers on companya.com, that only domain controllers in site A are returned.
I have tried:
- Configuring an AD Site for site B, using the subnet to which the companyb.com domain controllers are connected. However, I don't think this works because there is nothing configured in DNS to specify that site B should only be served results for site A.
- Replacing the conditional forwarder on DCs in companyb.com with a stub zone. The same problem persisted, except worse because the stub zone caused lookups against DNS servers in sites C and D, which are unreachable.
- Manually adding a primary AD-integrated zone for companya.com on companyb.com's DNS servers, and adding records all pointing to domain controllers on site A:
- Multiple A records for companya.com.
- Multiple _gc._tcp.companya.com records.
- Multiple _ldap._tcp.companya.com records.
- Multiple _kerberos._tcp.companya.com records.
I am not able to build IPsec tunnels between site B, and sites C and D, nor am I able to route traffic to sites C and D via the existing tunnel from site B to site A.
I suspect that Windows Server 2016's DNS policies feature might help this situation but I don't have access to DCs running Windows Server 2016. I also suspect I may have missed some records when I manually set up a DNS zone om companyb.com's servers.
Any insight would be appreciated.