I'm not used to doing NAT on Cisco devices, and I'm tasked with bringing in traffic being sent to a public address that is routed to our gateway. I would like to NAT the traffic from our gateway (a Cisco 2901 router running IOS 15.0) to a private address.

From what I've read, I think this might work but I have a feeling I'm missing something.

interface GigabitEthernet0/1.1
ip address 63.145.168.58 255.255.255.252
ip nat outside

interface GigabitEthernet0/0.1
ip address 10.2.0.3 255.255.0.0
ip nat inside

ip nat inside source static udp 10.0.1.40 5060 72.165.117.130 5060 extendable

72.165.117.130 is one of our private (MPLS) WAN addresses that routes to 63.145.168.58. I'm trying to forward traffic sent to that address to an internal device at 10.0.1.40.

Is that all there is to creating a one-to-one NAT, or am I missing something?

I'm having some trouble trying to figure out the technical details of the below design; specifically in the area of the redundant load-balancers.

The web servers are running Windows Server 2003 R2 64 and serve .NET applications via IIS. The database servers are running Windows Server 2008 Enterprise 64 in a SQL Server Failover Cluster with SQL Server 2008. There are currently two web servers and two database servers.

What I am looking to accomplish:

• Automatic redundant fail-over if a load-balancer goes down.
• The ability to seamlessly take a web server out of the load-balanced mix for maintenance without interrupting users. I'm not sure how possible this is because of the way our applications work - users tend to say logged into the application for their entire shift.
• The ability to scale up web servers, as needed (does not need to be done live).

This is a pure-Microsoft shop; so unfortunately the standard Linux tools are not available to us.

What I have tried:

• Microsoft NLB (Network Load Balancing Service): this works relatively well for a simple solution and is quite cost-effective since it just runs on the web servers, but I have yet to find a way to make this service meet the above requirements. Every time we have tried to take a system out of the load-balanced mix, clients making requests to the load-balanced url/ip are still trying to get directed to the offline machine. This can create huge problems, especially considering that our users will be submitting customer payments through these systems. Maybe we're doing something wrong here...

The design:

So, given all of the above, is Microsoft NLB the only answer? Or are there better tools available for our situation?

Edit 4/21/11

Thanks for the quick feedback. Just to clarify a few points:

• These are intranet web servers. They don't touch the Internet. Ever.
• Convincing my boss to let me deploy a pair of Linux servers wouldn't be too difficult. She isn't the roadblock to a Linux environment - it's our staff. Their only skill-set is Windows. It would kill my social life to start deploying Linux servers in our data center. ;-)
• I'm ultimately searching for the "Microsoft way" of load-balancing web servers, while at the same time providing redundancy in the load-balancing subsystem. If that really is Microsoft's NLB service, well... maybe I should start a new question about that. :)
• I'm open to hardware load-balancers if that is a better (or only) solution.

Our Exchange server is running Exchange Server 2003 Standard on the Windows Server 2003 platform. We're dealing with the mail store size issue, where if the mail store goes over the limit, it gets dismounted.

While we are working with the powers-that-be on a policy that will prevent this happening in the future, I would like to see if it is possible to re-mount the mail store via the Windows CLI. I'm already monitoring the Event Logs and alerting on mail store warnings and dismounts - I'm just tired of getting up at 5am to manually re-mount the store while the political wars ensue.

My alerting tools have the ability to execute a batch script when an alert is generated. I would greatly prefer a native CLI option. I'm not too keen on running some random vbscript found on the Internet and I don't really care to spend my time debugging someone else's code. PowerShell might be an option, if it can be triggered from the CLI.

We have WSUS pushing updates out to our user's workstations, and things are going relatively well with one annoying caveat: there seems to be an issue with a pop-up being displayed in front of some users informing them that their machine will be rebooted in 15 minutes, and they have nothing to say about it:

This may be because they did not log out the prior night. Nevertheless, this is a bit too much and is very counter-productive for our users.

Here is a bit about our environment: Our users are running Windows XP Pro and are part of an Active Directory Domain. WSUS is being applied via Group Policy. Here is a snapshot of the GPO that is enforcing the WSUS rules:

Here is how I want WSUS to work (ideally - I'll take whatever can get me close):

I want updates to automatically download and install every night. If a user is not logged in, I would like the machine to reboot. If a user is logged in, I would like their machine not to reboot, but instead wait until the next "installation period" where it can perform any other needed installations and reboot then (provided the a user account is not still logged in). If a user is to be prompted for reboot, it should only happen once per day (if possible), but every time they are prompted, they must have a way to postpone the reboot.

I do not want users to be forced to restart their computer whenever the computer thinks it should happen (unless it's after an update installation and there are no logged in users). That doesn't seem productive to force a system restart in the midst of a person's workday. Is there something that I can do with the GPO that would help make WSUS less intrusive? Even if it gave the user an option to Restart Later - that would be better than what is happening now.

edit

The goal is to be able to automatically download and install updates every night, and rebooting the machine only if there are no users logged on when the machine wants to reboot. If Windows has to nag the user about rebooting, this is perfectly fine - as long as they have an option to postpone that reboot.

edit

It turns out, we have some deadlines set on some updates (SP3, Client-Side Extensions, etc.), and with the post found below, some light has been shed on the situation:

http://forums.techarena.in/server-update-service/255722.htm

I'm trying to gather a list of all e-mail addresses being used by our Exchange 2003 system, which includes not only the normal user addresses, but distribution groups and aliases as well. I also need the output formatted like: [email protected] - although, we only have one domain, so even if I can get the user part, that would work.

I don't care about account-association here, I really just need a list of addresses.

How can I go about doing an export of all smtp e-mail addresses from Exchange 2003, including distribution group and alias addresses in the [email protected] format?

I would prefer something that can be accomplished via the command line so that it can be generated by a script, but it would be just as useful if there is a way to do this manually (read: point and click) as well.

Any ideas? I don't see anything within System Manager that can do this, and my searching isn't turning up anything that can fulfill all the above requirements.

Solved

This is how I'm using the accepted answer:

@echo off

ldifde -f c:\temp\ldifde-dump.txt -l proxyaddresses
find "@" < c:\temp\ldifde-dump.txt > c:\temp\email-addresses.txt
del c:\temp\ldifde-dump.txt

This produces c:\temp\email-addresses.txt, which, although it contains a little extra garbage characters, it can easily be parsed out with a search & replace in Notepad++.

Is it possible to configure a Windows Server 2000 OS to synchronize it's clock to a domain controller if it's not on the domain? If so, how would I go about doing that?

Just to be clear:

• I can't join the machine to the domain.
• The Windows Time service is running on the Server 2000 box.
• All other servers and workstations properly sync their time to the domain controller already.

Our environment:

• Exchange Server 2003 Standard, single instance, running on Windows Server 2003 Standard.
  • configured to not send/receive mail with attachments larger than 10 MB.
  • NDRs are not enabled.

The issue:

When an external sender sends an email with an attachment larger than 10MB, Exchange, as configured, does not receive the message. However, the sender of that message does not receive any notifications from his own mail server that the message could not be delivered due to attachment size.

However, if an external user tries to send an email to a non-existent user, they do receive a message from their mail server indicating that the user does not exist.

Why is that, and is there anything I can do about it? It would be nice if the sender received notification that the attachment file size exceeds our limits and their message was never received...

Update

The Exchange server has a SpamAssassin box in front of it... could that have something to do with it?

Here is one of the last lines from SpamAssassin's logs when searching for my test e-mails:

mail postfix/smtp[19133]: 2B80917758: to=, relay=10.0.0.8[10.0.0.8]:25, delay=4.3, delays=2.6/0/0/1.7, dsn=2.6.0, status=sent (250 2.6.0 Queued mail for delivery)

My assumption is that Spam Assassin thinks the message is OK and is forwarding it off to Exchange.

Update

I've verified that Exchange is receiving the message and generating an NDR. However, delivery of NDRs are disabled to prevent Backscatter. Is there something that I can do to get Exchange to send a bounce message to the sending mail server (or verify that message is being sent) so the sending mail server can notify its sender of the bounce?

Environment:

• Exchange: Server 2003 Standard SP2 x86 + Exchange 2003 Standard
• Domain Controllers: Active Directory, Windows 2000 Functional Level, hosted on Server 2008 Enterprise x86
• Workstations run Windows XP Pro with Outlook 2003 (greater majority)

Situation:

I have a few users that want to manage their own distribution groups through their Outlook client. How can I give these users rights to add/remove from these specific Distribution Groups from Outlook?

I've inherited an Exchange server that looks like it has never been cared for: no backups, running out of disk space, huge mail store, huge mailboxes, stores dismounting for being over the store size limit... you name it, I'm dealing with it.

I've got this a bit more under control, but we still have the disk space issue. The system itself has room for three more drives, which I have pitched up the chain to management. It's likely to be approved but until then, I still have a problem.

My problem is that we have very little disk space left and I need to keep this system running until I can get those drives. I've been forced to turn on circular logging to keep Exchange running, but that will only last so long. I can't do an offline degrag to shrink the size of the mail or public folders stores because both stores have grown too large.

Public Folders aren't used very much by anyone, but from what I've been reading, you can't just dismount and delete the Public Folders store because Exchange system data is stored there. Is this true? Can I really not dismount and delete the Public Folders store? It would give us about 30GB of disk space back, which we really need (still not enough to do an offline degrag, but will get us through until those drives get approved, ordered, and installed).

I'm open to other suggestions/options, if there are any.

The current system is running 3 disks in a RAID 5, then partitioned in Windows with an OS volume and an Exchange volume (ugh). The OS volume has disk space issues of its own, but is manageable. The Exchange volume has about 1GB disk space left, with approximately 125GB being consumed by the Exchange install + data + logs.

My plan, while not ideal but still better than what we currently have, is to bring in 3 x 300 GB disks running RAID 5 and get the data stores moved to that volume. That would give me the extra space I need to do an offline defrag of the stores (should I need to) to keep this server running for another year or two until we completely replace it.

Until I can get there, however, I need some disk space. So my question again: Can I safely dismount, archive, and delete the Public Folders store? Or will that really take Exchange offline?

We have a single-domain forest, and a handful of different file servers. One file server in particular has me worried: it is hosting a lot of important data on independent disks and no backup has ever been done. It's also running Windows XP Pro.

I've already taken steps to bring in a backup system (not just for this server, but a larger solution). My problem is really to do with setting up this system for redundancy - I need that data to stay online, or at least be very quickly recoverable (waiting for backups to restore is going to be too slow).

The current system setup (after a few maintenance windows) has 3, 1TB SATA drives. C is the system volume. Volume F contains all of the shared directories, and volume E is completely empty. No money is going to be spent on this box, so what I want to do is move all the shared directories to the OS volume as a temporary backup while I delete both the E and F partitions, mirror the disks in Disk Management, format the mirrored volume, and copy the shares back onto the now-mirrored volume.

My question is this: are there any tools to help me copy the shares to other volumes and automatically re-create the share at the new physical location with the share/ntfs security permissions intact or am I stuck doing this manually?

Update

So it turns out that XP doesn't support mirrored disks anyway. Bleh. Not used to dealing with XP performing server roles...

Decided it would be best to schedule a backup to retain copies of the data on the open disk until management can figure out a budget for a real file server.

We are running Exchange 2003 Standard in-house. The Director of Operations has just let two staff members go, and would like e-mail sent to their addresses sent to him. Here is what I have done so far:

The two staff member's Active Directory accounts have been disabled.

Their mailboxes have been deleted and purged from Exchange.

I've added their e-mail addresses as SMTP aliases to the Director's Active Directory account.

However, when trying to e-mail these addresses, I get a local "NDR" telling me that the mail account doesn't exist. I've used aliasing extensively (just never for this reason) to provide additional e-mail addresses for employees (such as when they get married and change names, or need temporary mail addresses, etc.), so this is not new to me. However, I don't understand why this isn't working.

Is it because these addresses used to be associated with an Active Directory account and Exchange has yet to purge them from the GAL? The old accounts are still showing in the current GAL, but if I look in System Manager > Recipients > All Global Address Lists > Default Global Address List > Properties > Preview, the two accounts in question do not show up.

Do I just have to wait until the next update interval? Is there a way to force this update to happen?

Update:

Upon further research, I'm able to send these e-mails while using a client that isn't running in cached mode, and they end up being sent to the primary address for the account they are assigned to. Trying to send to these former addresses while using cached mode results in the message being rejected. Pretty positive this has something to do with the GAL on these cached mode clients. The clients we are using are Outlook 2003, 2007 and 2010 and it is policy to use cached mode on all Outlook clients.

We are in the midst of planning a re-cabling of the building and installing new switches. A few different designs have been proposed, and one such design puts our core switches at the heart of our network in such a way that even if one goes down completely, the other can carry on.

The idea is that there are 2 core switches, and 6 edge switches (to connect all of our endpoints). This proposal uses fixed-port switches. All of our servers would connect to both the cores, and each of our 6 edge switches would connect to both the cores. In this way, if core A goes down, core B is still physically connected to all servers and edge switches keeping data flowing without interruption.

The proposed design trunks various RJ45 ports, citing the backplane as a single point of failure.

My assumption was that we were going to stack the 6 edge devices, at the very least, and run a few lines of fiber using those mini-gBIC adapters to the cores... but I'm being told that if we stack all 6 edge switches and there is a problem with the backplane then all 6 switches are going to go "down". Under the proposed design, if an edge switch has a problem, only devices connected to that switch will be affected.

What is the probability of a switch backplane having an issue as compared to a standard ethernet port?

Does this proposal make sense and REALLY provide the redundancy it assumes?

Can't we just stack those 6 edge switches, and run two fiber lines via some mini gbic modules on one of them and call it a day? I thought that if a switch in a stack has a problem, the other switches could still "work around" it.

Our organization is a bit different than most. During certain times of the year, we grow to thousands of employees, and during off-times, less than a hundred. Over the course of a few years, many thousands of people have come and gone in our offices, and left their legacy behind in the form of all sorts of unwanted, unapproved, (and sometimes unlicensed) software installs on our desktops.

We are currently installing redundant domain controllers and upgrading current servers, all running Windows Server 2008 Enterprise, and will eventually be able to run a pure 2008 DC network. With that in mind, what are our options in being able to lock down users, such that they cannot install unauthorized software on systems without the assistance (or authorization) of the IT group?

We need to support approximately 400 desktops, so automation is key. I've taken note of the Software Restrictions we can implement via Group Policy, but that implies that we already know what users will be installing and attempting to run... not quite so elegant.

Any ideas?