Child DC cannot Replicate to Parent DC, because of connection errors. MS PortQryUI shows that ports 3268 and 3269 are not listening,

Question

I started a support case with Microsoft to help me with raising the our domain Forest level because i received a message stating that there were Windows 2000 PDC still listed in the database. These PDCs were removed years ago. The tech saw all of the problems
i was having with domain replication so that is where he started. running the MS PortQryUI shows that ports 3268 and 3269 are not listening, (TCP port 3268 (unknown service): NOT LISTENING) when run FROM a Child domain controller against the Parent
Domain controller. Between the 2 Child domain controllers these ports are listening.
The Windows firewall is not running on any of the controllers, i removed a virus protect client from all of the servers, although i didn't enable the firewall there either, but these ports are still not listening on the Parent DC.
I need help debugging this. I am not very familiar with network sniffers so if i need to run one i'll need some guidance. This DC only has one NIC, all IP addresses are static, all servers are setup like this. All servers are in the same subnet, on the same
lan, on the same cisco switch, there shouldn't be anything blocking this port from starting.
I looked over other post that show this same problem, but they don't give a solution. If i am not using the Windows firewall why wouldn't these ports be open?
Any ideas? web searches are all over the map on trying to find the reason for this.
Bobby

Answer 1

Try running the below command on the DCs that you think have the ports blocked or all the DCs.
netdiag /test:ipsec /debug > c:\dcname-ipseclog.log
Open that from the C drive and see if there is anything saying block or filters. 
Also, just for kicks have you disabled the firewall service on the DCs? 
And just for kicks have you tried enabling firewalls ports on all the DCs?  The KB is below
http://support.microsoft.com/kb/555381/en-us
Step 1 - netdiag results
Step 2 - disable the firewall service on all DCs if step 1 was negative
Step 3 - enable the firewalls on all DCs per KB 555381 if step 2 doesn't work
Let us know how it goes!
If it answered your question, remember to “Mark as Answer”.
If you found this post helpful, please “Vote as Helpful”.
Postings are provided “AS IS” with no warranties, and confers no rights.
Active Directory: Ultimate Reading Collection