DNS server in DMZ or Inside?
I'm currently using a Win2003 server as my DMZ on the inside of the network. It's also the server I use as my Domain Controller.
I am reviewing some of my policies and considering some changes. Is it best to have my DNS servers on the Inside or on the DMZ?
Roland
It is not clear to me from your post what the usage of the DNS server is, and that would influence where you place the server. If the DNS server is only accessed by internal users then placement on the inside is fine. But if the DNS server is also access by anyone outside then I believe that you should place the DNS server in the DMZ.
HTH
Rick
Similar Messages
-
DMZ - DNS Server, Mail Server, Web Server, FTP Server
Hi,
I am looking at a router to support around 20-30 people. I have a DNS Server, Mail Server, Web Server, FTP Server (all on one box (PC). I was wondering how everyones experiences with DMZ and port forwarding have been with these protocols with Airport and supporting a group of this size? Do you forsee issues? Will the new Airport handle these requirements better?
ThanksA record for mail.mydomain.com going for ip 199.99.99.999
MX record for mail.mydomain.com with destionation as mail.mydomain.com
That doesn't quite make sense. There must be an A record for "server.mydomain.com" or you wouldn't be able to reach it at all. You want the MX record to point to that. -
Need help with ASA 5512 and SQL port between DMZ and inside
Hello everyone,
Inside is on gigabitEthernet0/1 ip 192.9.200.254
I have a dmz on gigabitEthernet2 ip 192.168.100.254
I need to pass port 443 from outside to dmz ip 192.168.100.80 and open port 1433 from 192.168.100.80 to the inside network.
I believe this will work for port 443:
object network dmz
subnet 192.168.100.0 255.255.255.0
object network webserver
host 192.168.100.80
object network webserver
nat (dmz,outside) static interface service tcp 443 443
access-list Outside_access_in extended permit tcp any object webserver eq 443
access-group Outside_access_in in interface Outside
However...How would I open only port 1433 from dmz to inside?
At the bottom of this message is my config if it helps.
Thanks,
John Clausen
Config:
: Saved
ASA Version 9.1(2)
hostname ciscoasa-gcs
domain-name router.local
enable password f4yhsdf.4sadf977 encrypted
passwd f4yhsdf.4sadf977 encrypted
names
ip local pool vpnpool 192.168.201.10-192.168.201.50
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 123.222.222.212 255.255.255.224
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.9.200.254 255.255.255.0
interface GigabitEthernet0/2
nameif dmz
security-level 100
ip address 192.168.100.254 255.255.255.0
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
interface GigabitEthernet0/5
shutdown
no nameif
no security-level
no ip address
interface Management0/0
management-only
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
ftp mode passive
dns server-group DefaultDNS
domain-name router.local
object network inside-subnet
subnet 192.9.200.0 255.255.255.0
object network netmotion
host 192.9.200.6
object network inside-network
subnet 192.9.200.0 255.255.255.0
object network vpnpool
subnet 192.168.201.0 255.255.255.192
object network NETWORK_OBJ_192.168.201.0_26
subnet 192.168.201.0 255.255.255.192
object network NETWORK_OBJ_192.9.200.0_24
subnet 192.9.200.0 255.255.255.0
access-list outside_access_in extended permit icmp any4 any4 log disable
access-list Outside_access_in extended permit udp any object netmotion eq 5020
access-list split standard permit 192.9.200.0 255.255.255.0
access-list VPNT_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source static inside-network inside-network destination static vpnpool vpnpool
nat (inside,outside) source static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24 destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
object network netmotion
nat (inside,outside) static interface service udp 5020 5020
nat (inside,outside) after-auto source dynamic any interface
access-group Outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 123.222.222.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.9.200.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet 192.9.200.0 255.255.255.0 inside
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption aes128-sha1 3des-sha1
webvpn
enable outside
anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 2 regex "Windows NT"
anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3 regex "Intel Mac OS X"
anyconnect enable
tunnel-group-list enable
group-policy SSLVPN internal
group-policy SSLVPN attributes
dns-server value 192.9.200.13
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value split
default-domain value router.local
group-policy VPNT internal
group-policy VPNT attributes
dns-server value 192.9.200.13
vpn-tunnel-protocol ikev1 l2tp-ipsec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value VPNT_splitTunnelAcl
default-domain value router.local
username grimesvpn password 7.wersfhyt encrypted
username grimesvpn attributes
service-type remote-access
tunnel-group SSLVPN type remote-access
tunnel-group SSLVPN general-attributes
address-pool vpnpool
default-group-policy SSLVPN
tunnel-group SSLVPN webvpn-attributes
group-alias SSLVPN enable
tunnel-group VPNT type remote-access
tunnel-group VPNT general-attributes
address-pool vpnpool
default-group-policy VPNT
tunnel-group VPNT ipsec-attributes
ikev1 pre-shared-key *****
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:36271b5a1b9382621e14c3aa635e2fbb
: endHi Vibor. Apologies if my comment was misunderstood. What I meant to say was that the security level of the dmz interface should probably be less than 100.
And therefore traffic could be controlled between DMZ and inside networks.
As per thr security level on the DMZ interface. ....... that command is correct. :-) -
Static translation from dmz to inside on Asa 8.6
Recently upgraded to an Asa 5512x from a pix 515e. I have an Ipswitch secure MoveIT server on the dmz1 interface that needs to be accessed from both the inside and outside interfaces. I have setup a static nat from the outside to the dmz1 and it works, I can also connect from the inside interface. Now I need the MoveIT server to access the DNS server and email server on the inside interface so it can send notifications. On the pix I just created a static from the inside to the dmz1 using its own IP address - static (inside,dmz1) 192.168.1.7 192.168.1.7 net mask 255.255.255.255. I would then add the access-list to allow. How would I set this up with the Asa 8.6 commands?
Sent from Cisco Technical Support iPad AppHi,
The default operation of the new ASAs/Softwares is that you dont configure NAT if you dont need one.
So if you for example have the following interfaces
outside
lan1
lan2
dmz
If you want the lan1, lan2 and dmz to communicate between eachother with the actual IP addresses, you dont configure any type of NAT between them (even the ones that you used to do with the old software with the "static" commands)
Only situations where I have configured Twice NAT is when I have configured a L2L VPN or there is migrated some old 8.2 or below software Policy NAT.
So to my understanding you would probably have a new type of Static NAT for the dmz1 server towards outside
object network DMZ-STATIC
host 192.168.1.7
nat (dmz1,outside) static x.x.x.x dns
For the same server to communicate with other networks behind the firewall (LAN networks) you shouldnt really need any addiotional NAT configurations. Only have the access-rules permit the traffic if it already doesnt do so.
You can always post some configurations if you want someone to take a look through them.
- Jouni -
How to config firewall if accessing from dmz to inside lan
Hi everyone,
Hope you can help on this.
We have a ASA with IOS 8.44. We just configured a dmz zone. Now we try to access a share of a windows server in INSIDE interface from another windows server in dmz, So on the server in DMZ, I will type \\INSIDE_Server\SharedName (or \\ip_of_inside server\SharedName) to access the share.
On the firewall, I open tcp port 137, 138, 139, and 445 to allow from DMZ to access to Inside server. But I failed. So what do I need to configure so that I can complete my task?
Also, we have some internal DNS in INSIDE interface. How do I make my DMZ server to use the inside DNS servers for dns resolution?
Hope you can help. Thank you!
Takami ChiroHi Jcarvaja,
Thank you very much. Finally I could run the command for the troubleshoot. And the following is the result:
esult of the command: "packet-tracer input dmz2 udp 172.20.0.49 1025 10.10.0.9 53"
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.10.0.0 255.255.0.0 inside
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: DROP
Config:
access-group dmz2_acl in interface dmz2
access-list dmz2_acl extended deny ip any 10.0.0.0 255.0.0.0
Additional Information:
Result:
input-interface: dmz2
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
So to do so...does it mean I need to allow tcp 53 from dmz that server to inside the DNS server?
Thank you very much again... -
Internal DNS server and NAT routing issue.
Hi -- I am not terribly experienced with DNS and I am running into an issue that I can't seem to resolve. My company.com DNS information is hosted by an outside ISP for email, web, etc... but I have configured an A record there to point to the public IP to my mac os x server (server.company.com).
We have a cisco router configured with one to one NAT from the public IP to the internal IP for our server in a 192.168.15.x subnet. The same router is running DHCP and and NAT on that subnet under a different public IP provided by our ISP.
Our server is running DNS with recursion and has a "company.private" zone set up for internal services and machine names. Thus, the server is accessible via "server.company.com" from the outside and "server.company.private" from the private LAN.
The problem is that I would like to be able to access some services simply via "server.company.com" both inside and outside the private network. Now, accessing the "server.company.com" services from the private lan does not work because the name resolves to the external IP and the external IP cannot be used internally due to NAT.
Is there a way to configure my internal DNS server to respond with the appropriate private address when receiving a query only to "server.company.com" and forward requests on for anything else on "company.com"?
I know that I could manually duplicate all entries for our domain from my ISP and host the same entries for internal clients, but it would be much easier to only have our server handle requests for itself. The server is running OS X Server 10.4.11.
ThanksIs there a way to configure my internal DNS server to respond with the appropriate private address when receiving a query only to "server.company.com" and forward requests on for anything else on "company.com"?
Ordinarily, no. Once your server thinks it is responsible for a zone (e.g. company.com) then it will answer all queries for that domain and never pass them upstream. Therefore you'd have to replicate all the zone data, including all the public records, and maintain them both.
The one possible exception to this (I haven't tried) is to create a zone for server.company.com that has your internal address. In theory (like I said, I haven't tried this), the server should respond to 'server.company.com' lookups with its own zone data and defer all other lookups (including other company.com names since they're not in a zone it controls). Might be worth trying. -
Install SCCM client to server in DMZ: "MP does not exist"
Hi,
I’d need to put a management point/distribution point in a DMZ.
Therefore I wanted to make sure this MP/DP works before I move it to this DMZ and I:
*configured a Windows 2012 R2, (name: “DMZ01”) server with the prereqs*removed this server DMZ01 from the actual domain*added a DNS entry from DMZ to which I can connect successfully
*added a network access account in order to push the sccm client
*added correct boundary group
Now when I try to deploy an SCCM client to it, I get a failure in the ccmsetup log saying MP does not exist:
Failed to load mdmregistration.dll with error 0x8007007e
ccmsetup
27/04/2015 10:54:48 932 (0x03A4)
Failed to load mdmregistration.dll. Continue deployment.
ccmsetup
27/04/2015 10:54:48 932 (0x03A4)
An MP does not exist on this machine. ccmsetup
27/04/2015 10:54:48 932 (0x03A4)
My questions:
*should I use the management point affinity here to force finding the management point?
*what about the domain certificate (that’s gone now since it isn’t domain joined anymore)? How to deal with this/revive this?
Please advise.
J.
Jan HoedtOk, thanks.
Note: there is no trust between the DMZ domain and the domain in which the "main" sccm server exists.
What are the options there? F.e. could we use Mutual authentication just as with a Mac
https://technet.microsoft.com/en-us/library/jj591553.aspx#BKMK_ManualCertifcateInstallation
Jan Hoedt -
Hi,
is it possible to use novell-named on OES 2 Linux to create split-horizon DNS server? Something like this: Two-in-one DNS server with BIND9 | HowtoForge - Linux Howtos and Tutorials. What I want to achieve is "to resolve to internal IPs when you are inside and external IPs when you are outside".
We have some services (web applications, Groupwise messenger etc.) which can be accessed from the LAN using private addresses and which are also visible from the public network (Internet).
Currently we have Netware 6.5 with DNS Proxy binded to internal address and some hostnames bound to internal IP addresses inside hosts file (and therefore resolved by DNS Proxy with private addresses for LAN clients) and named bound to public IP and serving DNS requests from public network. But we'd like to migrate everything from Netware to OES 2 Linux.
Any help is much appreciated!
BrunoOriginally Posted by joharmon
Just found this:
Is Views for DNS Supported or Possible on NetWare or OES?
Bad news but thanks for your answer!
Bruno -
DNS Server Infrastructure Design
Good day IT Folks,
Currently I'm on the planning stage of designing DNS infrastructure of our company. I've read a lot of reading materials available online about DNS. According to what I've gathered, two (2) DNS server is the minimum and three (3) is the recommended for the
usual set up of DNS. What I want to my DNS infrastructure is to have two (2) DNS servers for my LAN (internal network) and one (1) DNS for my LAN-to-Internet connection (external network).
The two (2) DNS servers will resolve LAN request and will forward requests to the another one (1) DNS server if internet-related sites is requested. I would like to ask for your help to give me insights how am I going to do this, where to start and what
are the things I should consider.
Thanks.
akosijesyang - the conquerorYou could go with a secure design such as the following (click on it to open a larger image in a new page):
See if the following threads help:
Technet Thread: Problem with Windows 2008 R2 Dns Server getting SERVFAIL resolving one domain, 1/18/2012
Includes a secure DNS forwarder in the DMZ image
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/b00fc041-ba44-45b6-a8a1-a00374a20edf
Technet Thread: DNS Structure to rebuild efficiently - Question about the resolution process, 10/27/2011
Includes a secure DNS forwarder in the DMZ image
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/3a5fb6ac-6ab7-45b1-abab-e0d928a7e06c
Good discussion on DMZ secured resolver design, and the use of "Unbound DNS Resolver (http://unbound.net/) to use on your DMZ DNS server instead of Windows DNS. (Note: IMHO, for AD, I would rather use Windows DNS. - Ace)
Technet Thread: W2003 DNS cache snooping vulnerability for PCI-DSS compliance, 10/10/2011
http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/67e9189b-606a-40d2-9944-8b4c7d084017/
And dealing with internal and external names:
Can't Access Website with Same Name (Split Zone or no Split Brain)
Published by Ace Fekay, MCT, MVP DS on Sep 4, 2009 at 12:11 AM 1278 0
Note - In an AD same name as the external name (split zone) scenario, if you don't want to use WWW in front of URL, such as to access it by
http://domain.com, then scroll down to "So you don't want to use WWW in front of the domain name"
http://msmvps.com/blogs/acefekay/archive/2009/09/04/split-zone-or-no-split-zone-can-t-access-internal-website-with-external-
name.aspx
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights. -
Hi guys,
i am hoping if anyone can reply to my query below.
We have got a new batch of servers and they reside on a separate VLAN 192.168.45.x 255.255.255.0
Those servers are required to be registered on the DNS server located on the remote site (SITE 2). Please refer to the attached diagaram. We also have a DNS server in our LAN but these new servers will need to be in the domain in SITE 2
Can anyone advise if need anythin else other than the following ACLs in the ASA firewall
Access-list inside extended permit udp 192.168.45.0 255.255.255.0 host 10.10.100.150 eq 53
Access-list inside extended permit tcp 192.168.45.0 255.255.255.0 host 10.10.100.150 eq 53
Thanks
jayThe ACL entries above will allow DNS queries across the provider link from your local site. We are assuming matching entries allow the communications on the remote and and that routing etc. is all in place..
You asked however about needing to be "registered" on the DNS server and in the domain. Also your diagram mentions the server is a DHCP server and you show it configured with the helper-address in your local core switch. DHCP uses TCP ports 67 and 68. When you say domain if you are talking about a Windows domain that is another set of ports. -
UC520 - DNS server error - Low memory
Has anyone else hit this issue:
006125: Nov 7 12:30:21.132 PST: %DNSSERVER-3-UDPDNSOVERLOAD: Low available memory: dropping <id# 37428> from <cli 192.168..x.x>.
Using a UC520.
Issue seen in following IOS:
uc500-advipservicesk9-mz.151-4.M5
uc500-advipservicesk9-mz.151-4.M4b
No issue with:
uc500-advipservicesk9-mz.151-2.T4
Using the UC520 as a DNS server/forwarder for a small number of hosts < 10 to resolve inside IP's for internal applications.
UC520 will eventually stop resolving DNS requests.
Thanks.Hi Mike,
What else are you running on the UC520? VPN, Applications, SSL? If possible could you post a sanitized version of your config as well?
Thank you,
Jason Nickle -
Hello I have a cisco 1821 router acting as remote access for vpnclients, LAN LAN VPN device and also
LAN router. All in one.
My LAN has a 192.168.23.0/24 addressing, and router has 2 IP Addresses, one on public IP on the public interface Fa0/1
and 192.168.203.1 on the private interface Fa0/0
I set up it as a name server for local LAN:
ip dns server
ip host pc10 192.168.203.10
ip host pc83 192.168.203.83
ip host c1821 192.168.203.1
I did this so that local PC on my lan can have a resolution for local addresses since I do not have a DNS server inside my line
and I do not have a Active Directory infrastructure.
on the public IP interface my router can be queried for LOCAL IP resolution for my lan 192.168.203.0/24, I Tryed from outside using dig command.
I Wanted to prevent this. I cannot use an ACL because I would prevent DNS queries to work in general. trying to resolve
an external IP Address from inside my lan, I just want the router to refuse DNS resolution for any query coming to external interface,
while I Want to allow only queries coming form my local lan to internal interface.
is this possible in some way ?
thank you
RiccardoYou are asking your IOS device to act as a split-DNS server, providing RFC1918 addresses on internal interfaces, and global address (or no addresses) on the public inetrface.
Look at the "ip dns view" command so you can present differnt DNS responses by interface.
This article may help:
http://www.nil.com/ipcorner/RouterDNS/ -
Moving from Exchange 2007 to 2013 (leaving the DNS Server for it's own dedicated server)
Hello! I am quite new to Exchange and Server management in general. I will do my best to explain my situation.
I am looking to move my Exchange server off of our DNS server. When we installed them on the same server, we did not have the funds to buy 2 separate servers. I am told that it is best to separate the two. I have followed the Microsoft instructions for installing
the prerequisites for Exchange 2013 on a 2012 R2 server, and i am at the point where it wants me to configure AD LDS. As I have active directory running on the current server, I was a little hesitant to just install it without understanding what i am doing.
After the AD LDS is configured, I believe i can move forward with installing Exchange 2013 (all 3 roles will be hosted on the new server), export the mailboxes from 2007 server and import them into the new Exchange 2013 server. After 2013 is up and stable,
I plan on removing 2007 from the old server (DNS server).
What are my next steps after importing the mailboxes? Am i missing important details that I need to change or migrate?
My biggest fear is that nothing works after the installation and moving the mailboxes over. For that case, it makes sense to keep 2007 installed as a fallback for when my installation fails and all i have lost is just my time :)
Current Server:
Windows Server 2008 Standard (64 bit)
1. Roles: Active Directory, DNS, IIS
2. Software: Exchange 2007
New Server:
Windows 2012 R2 Server
1. Roles: ???
1. Software to install: Exchange 2013
Thank you for any help you can provide!These are good resources, but i am still caught up with the active directory issue. Am I able to keep the old Domain/DNS/Active directory on it's current server and move Exchange 2007 off onto a new server (with Exchange 2013)?
In the first example, he is moving everything (domain controller, exchange, users, etc) onto a different server and decommissioning it.I've been told that it would be better practice to keep the domain and exchange on 2 different servers. Is this true?
I go to run commands like:
.\setup /PrepareAD /OrganizationName: orgname /IAcceptExchangeServerLicenseTerms
on the new exchange server, as a prerequisite and it doesnt recognize the command - even after following the steps before. Is this because the new server is not a domain controller? does it have to be? What are the best practices for setting up a server(s)
with exchange + domain controller?
Thanks for responding. -
I originally posted this question to the community section and was advised to post it here. Please bear with me as this will be a long post. I'm including the scenarios involving this reoccurring issue, the trouble shooting steps I've already
taken and the results of several diagnostic tools and logs.
I have a Sony VAIOS VPCEBB33FM lap top since 2011. I have had this issue on an off for a long time. I'm at my wit's end. Any new insights or suggestions would be greatly appreciated.
Scenario Details
1) Some times it's on and off through out the day, sometimes it won't work all day, and once in a while it will work fine for the entire day.
2) I've had this issue across several wireless services, Clear Network accessed with WiMax, Library Wi-fi, Comcast cable internet using wireless router and Wi-fi, and Comcast Xfinity Wi-Fi, to name a few examples.
3) Other devices in the household or library will work with no problems such as my smart phone or my roommates' laptops or desktop computers.
4) Once in a while, the built-in wireless adapter is not found and I have to reinstall the driver. Also the diagnostic tool has had to reset my adapter on an increasing basis.
5) I had my hard drive replaced in December 2014 and my system restored from the System Restore disks that came with it when I bought the laptop. Even though I've been online on an infrequent basis it worked just fine for a while. Now that
I've been online a bit more I'm having the same issues again.
Below are my attempts at trouble shooting so far but I still have not been able to consistently resolve my DNS issues
1) Restarting my adapter
2) Turning off my laptop and removing the power supply for 5-10 minutes before turning it back on.
3) Using the IP Config in Command Prompt
ipconfig /flushdns
ipconfig /registerdns
ipconfig /release
ipconfig /renew
4) Using the NetSh reset in Command Prompt and restarting my laptop
netsh int ip reset c:\resetlog.txt
netsh winsock reset
ipconfig /flushdns
[restart laptop]
5) Configuring the TCP/IP in several settings
Select Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
I have used the following settings:
a) Obtain an DNS server address automatically
b) OpenDNS
208 67 222 222
208 67 220 220
c) Google DNS
8 8 8 8
8 8 4 4
6) Updating the driver for my Intel Centrino(R) Advanced-N 6250 AGN and Intel Centrino(R) WIMAX 6250 from the Intel website previous having my laptop wiped clean in 2014. It still did not resolve the issue. My laptop
manufacturer as not come up with an driver update for my adapter since 2010. I haven't tried to update the adapter driver from Intel's website since having my laptop repaired due to the fact that Intel strongly recommending using the manufacturer's updates
instead and frankly it didn't make much of a difference when I did it the first time.
7) The last one I've tried as of today is going into Services and changing the start up type to automatic for the following:
Computer Browser [changed from manual to automatic]
DHCP Client [already set to automatic]
DNS Client [already set to automatic]
Network Connections [already set to automatic]
Network Location Awareness [changed from manual to automatic]
Remote Procedure Call (RPC) [already set to automatic]
Server [already set to automatic]
TCP/IP Netbios helper [already set to automatic]
Workstation [already set to automatic]
...and I'm still having DNS issues.
My only guessing are that my laptop came with a lemon adapter that needs to be replaced, some advanced setting(s) that I'm not aware off, or my firewall/anti-virus is interfering. I've used Symmantic Anti-virus and Firewall in the past and currently
Avast Anti-Virus with Microsoft Network Firewall. I've had DNS issues with both anti-virus/firewall set ups.
Below are the results from the diagnostics and tests that I've ran.
Windows Network Diagnostics
Your computer appears to be correctly configured, but the device or resource (DNS server) is not responding Detected Detected
Contact your network administrator or Internet service provider (ISP) Completed
Windows can't communicate with the device or resource (DNS server). The computer or service you are trying to reach might be...
Details about network adapter diagnosis:
Network adapter Wireless Network Connection driver information:
Description . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6250 AGN
Manufacturer . . . . . . . . . : Intel Corporation
Provider . . . . . . . . . . . : Intel
Version . . . . . . . . . . . : 13.2.1.5
Inf File Name . . . . . . . . . : C:\Windows\INF\oem17.inf
Inf File Date . . . . . . . . . : Monday, June 14, 2010 9:05:44 AM
Section Name . . . . . . . . . : Install_MPCIEX_GEN_6250_AGN_2x2_HMC_WIN7_64_MOW
Hardware ID . . . . . . . . . . : pci\ven_8086&dev_0087&subsys_13018086
Instance Status Flags . . . . . : 0x180200a
Device Manager Status Code . . : 0
IfType . . . . . . . . . . . . : 71
Physical Media Type . . . . . . : 9
Informational Diagnostics Information (Wireless Connectivity)
Details about wireless connectivity diagnosis:
Information for connection being diagnosed
Interface GUID: 70a0781d-6329-45e4-8d7c-34aeca294c39
Interface name: Intel(R) Centrino(R) Advanced-N 6250 AGN
Interface type: Native WiFi
Connection incident diagnosed
Auto Configuration ID: 1
Connection ID: 1
Connection status summary
Connection started at: 2015-03-07 19:57:14-186
Profile match: Success
Pre-Association: Success
Association: Success
Security and Authentication: Success
List of visible access point(s): 22 item(s) total, 22 item(s) displayed
BSSID BSS Type PHY Signal(dB) Chnl/freq SSID
60-02-92-C6-D3-E8 Infra <unknown> -62 11 HOME-C7D4-2.4
60-02-92-A1-75-E0 Infra <unknown> -58 6 HOME-B917-2.4
00-1D-D5-D5-34-F0 Infra <unknown> -73 6 HOME-34F2
60-02-92-A1-75-E1 Infra <unknown> -58 6 (Unnamed Network)
06-1D-D5-D5-34-F0 Infra <unknown> -78 6 xfinitywifi
C4-27-95-C9-C4-2D Infra <unknown> -57 1 HOME-C42D
02-1D-D5-D5-34-F0 Infra <unknown> -74 6 (Unnamed Network)
00-0D-97-07-E0-79 Infra g -75 6 (Unnamed Network)
00-1D-CF-2A-44-C0 Infra <unknown> -86 6 HOME-44C2
02-1D-CF-2A-44-C0 Infra <unknown> -86 6 (Unnamed Network)
F8-E4-FB-3C-87-A2 Infra <unknown> -89 6 YVNM7
06-1D-CF-2A-44-C0 Infra <unknown> -87 6 xfinitywifi
0C-F8-93-7A-13-50 Infra b -87 6 PKennedy
06-F8-93-7A-13-50 Infra b -89 6 xfinitywifi
02-F8-93-7A-13-50 Infra b -87 6 (Unnamed Network)
E0-88-5D-C8-A9-DC Infra <unknown> -80 1 HOME-A9DC
E2-88-5D-C8-A9-DD Infra <unknown> -79 1 (Unnamed Network)
16-CF-E2-43-0B-30 Infra <unknown> -88 1 xfinitywifi
60-02-92-F0-A8-C0 Infra <unknown> -90 11 HOME-96A6-2.4
60-02-92-C6-D3-E9 Infra <unknown> -63 11 (Unnamed Network)
02-1D-D4-EB-87-00 Infra <unknown> -88 11 (Unnamed Network)
06-1D-D4-EB-87-00 Infra <unknown> -88 11 xfinitywifi
Connection History
Information for Auto Configuration ID 1
List of visible networks: 13 item(s) total, 13 item(s) displayed
BSS Type PHY Security Signal(RSSI) Compatible SSID
Infra <unknown> Yes 63 Yes HOME-C7D4-2.4
Infra <unknown> Yes 70 Yes HOME-B917-2.4
Infra <unknown> Yes 43 Yes HOME-34F2
Infra <unknown> Yes 70 Yes (Unnamed Network)
Infra <unknown> No 40 Yes xfinitywifi
Infra <unknown> Yes 71 Yes HOME-C42D
Infra g No 43 Yes (Unnamed Network)
Infra <unknown> Yes 28 Yes HOME-44C2
Infra <unknown> Yes 20 Yes YVNM7
Infra b Yes 21 Yes PKennedy
Infra <unknown> Yes 33 Yes HOME-A9DC
Infra <unknown> Yes 35 Yes (Unnamed Network)
Infra <unknown> Yes 16 Yes HOME-96A6-2.4
List of preferred networks: 3 item(s)
Profile: xfinitywifi
SSID: xfinitywifi
SSID length: 11
Connection mode: Infra
Security: No
Set by group policy: No
Connect even if network is not broadcasting: No
Connectable: Yes
Profile: HTC Portable Hotspot 9F50
SSID: HTC Portable Hotspot 9F50
SSID length: 25
Connection mode: Infra
Security: Yes
Set by group policy: No
Connect even if network is not broadcasting: No
Connectable: No
Reason: 0x00028002
Profile: belkin.332
SSID: belkin.332
SSID length: 10
Connection mode: Infra
Security: Yes
Set by group policy: No
Connect even if network is not broadcasting: No
Connectable: No
Reason: 0x00028002
Information for Connection ID 1
Connection started at: 2015-03-07 19:57:14-186
Auto Configuration ID: 1
Profile: xfinitywifi
SSID: xfinitywifi
SSID length: 11
Connection mode: Infra
Security: No
Pre-Association and Association
Connectivity settings provided by hardware manufacturer (IHV): No
Security settings provided by hardware manufacturer (IHV): No
Profile matches network requirements: Success
Pre-association status: Success
Association status: Success
Last AP: 06-1d-d5-d5-34-f0
Security and Authentication
Configured security type: Open
Configured encryption type: None
802.1X protocol: No
Key exchange initiated: Yes
Unicast key received: No
Multicast key received: No
Number of security packets received: 0
Number of security packets sent: 0
Security attempt status: Success
Connectivity
Packet statistics
Ndis Rx: 2068
Ndis Tx: 2543
Unicast decrypt success: 0
Multicast decrypt success: 0
Unicast decrypt failure: 0
Multicast decrypt failure: 0
Rx success: 3954
Rx failure: 0
Tx success: 537
Tx failure: 4
Tx retry: 2
Tx multiple retry: 2
Tx max lifetime exceeded: 0
Tx ACK failure: 18
Roaming history: 0 item(s)
InformationalDiagnostics Information (Wireless Connectivity)
Details about wireless connectivity diagnosis:
For complete information about this session see the wireless connectivity information event.
Helper Class: Auto Configuration
Initialize status: Success
Information for connection being diagnosed
Interface GUID: 70a0781d-6329-45e4-8d7c-34aeca294c39
Interface name: Intel(R) Centrino(R) Advanced-N 6250 AGN
Interface type: Native WiFi
Result of diagnosis: There may be problem
Network Connection details from Command Prompt (some info hidden for security reasons)
Connection-specific DNS Suffix:
Description: Intel(R) Centrino(R) Advanced-N 6250 AGN
Physical Address: 00-23-15-54-19-B8
DHCP Enabled: Yes
IPv4 Address: 192.168.X.XX
IPv4 Subnet Mask: 255.255.XX.X
Lease Obtained: Saturday, March 07, 2015 7:57:14 PM
Lease Expires: Saturday, March 07, 2015 8:24:44 PM
IPv4 Default Gateway: 192.168.X.X
IPv4 DHCP Server: 192.168.X.X
IPv4 DNS Servers: 75.75.75.75, 75.75.76.76
IPv4 WINS Server:
NetBIOS over Tcpip Enabled: Yes
Link-local IPv6 Address: fe80::b8de:3ac9:e166:XXX%XX
IPv6 Default Gateway:
IPv6 DNS Server:
Results of Ping and Trace Route in Command Prompt
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Windows\system32>ping 127.0.0.1
Pinging 127.0.0.1 with 32 bytes of data:
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
Ping statistics for 127.0.0.1:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 0ms, Maximum = 0ms, Average = 0ms
C:\Windows\system32>ping www.youtube.com
Pinging youtube-ui.l.google.com [173.194.121.6] with 32 bytes of data:
Reply from 173.194.121.6: bytes=32 time=24ms TTL=55
Reply from 173.194.121.6: bytes=32 time=19ms TTL=55
Request timed out.
Request timed out.
Ping statistics for 173.194.121.6:
Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
Approximate round trip times in milli-seconds:
Minimum = 19ms, Maximum = 24ms, Average = 21ms
C:\Windows\system32>ping 74.125.239.34
Pinging 74.125.239.34 with 32 bytes of data:
Request timed out.
Request timed out.
Reply from 74.125.239.34: bytes=32 time=3286ms TTL=50
Request timed out.
Ping statistics for 74.125.239.34:
Packets: Sent = 4, Received = 1, Lost = 3 (75% loss),
Approximate round trip times in milli-seconds:
Minimum = 3286ms, Maximum = 3286ms, Average = 3286ms
C:\Windows\system32>ping www.hotmail.com
Pinging dispatch.kahuna.glbdns2.microsoft.com [65.55.157.204] with 32 bytes of data:
Reply from 65.55.157.204: bytes=32 time=111ms TTL=237
Request timed out.
Request timed out.
Reply from 65.55.157.204: bytes=32 time=1537ms TTL=237
Ping statistics for 65.55.157.204:
Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
Approximate round trip times in milli-seconds:
Minimum = 111ms, Maximum = 1537ms, Average = 824ms
C:\Windows\system32>ping 207.46.11.236
Pinging 207.46.11.236 with 32 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.
Ping statistics for 207.46.11.236:
Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
C:\Windows\system32>tracert www.youtube.com
Tracing route to youtube-ui.l.google.com [173.194.121.5]
over a maximum of 30 hops:
1 19 ms 13 ms 17 ms xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
2 13 ms 13 ms 27 ms ae-14-32767-ar03.newcastle.de.panjde.comcast.net [68.85.192.205]
3 20 ms 26 ms 21 ms he-5-10-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.94.249]
4 18 ms 34 ms 22 ms he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
5 19 ms 18 ms 18 ms 50-248-116-190-static.hfc.comcastbusiness.net [50.248.116.190]
6 35 ms 18 ms 18 ms 209.85.249.217
7 21 ms 19 ms 19 ms 72.14.233.93
8 * * * Request timed out.
9 * 2509 ms 677 ms iad23s25-in-f5.1e100.net [173.194.121.5]
Trace complete.
C:\Windows\system32>tracert 74.125.239.34
Tracing route to nuq04s19-in-f2.1e100.net [74.125.239.34]
over a maximum of 30 hops:
1 54 ms 23 ms 12 ms xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
2 22 ms 19 ms 17 ms ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
3 19 ms 19 ms 18 ms he-5-14-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.166.121]
4 18 ms 18 ms 18 ms he-0-15-0-0-cr01.350ecermak.il.ibone.comcast.net[68.86.85.74]
5 19 ms 18 ms 22 ms 50-248-116-190-static.hfc.comcastbusiness.net [50.248.116.190]
6 22 ms 36 ms 19 ms 209.85.249.217
7 26 ms 23 ms 25 ms 209.85.143.112
8 * * * Request timed out.
9 * * * Request timed out.
10 972 ms * * 216.239.51.97
11 148 ms 97 ms 95 ms 216.239.46.241
12 324 ms 130 ms 432 ms 209.85.246.252
13 * * * Request timed out.
14 1403 ms 101 ms 126 ms nuq04s19-in-f2.1e100.net [74.125.239.34]
Trace complete.
C:\Windows\system32>tracert www.hotmail.com
Tracing route to dispatch.kahuna.glbdns2.microsoft.com [65.55.157.144]
over a maximum of 30 hops:
1 13 ms 13 ms 25 ms xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
2 13 ms 15 ms 13 ms ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
3 20 ms 19 ms 17 ms he-5-13-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.95.145]
4 17 ms 20 ms 20 ms he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
5 17 ms 18 ms 38 ms as8075-2-c.ashburn.va.ibone.comcast.net [173.167.58.82]
6 18 ms 18 ms 36 ms ae4-0.ash-96cbe-1a.ntwk.msn.net [207.46.36.172]
7 * * * Request timed out.
8 * 2191 ms 35 ms ae0-0.atb-96cbe-1b.ntwk.msn.net [191.234.81.167]
9 * * * Request timed out.
10 * * * Request timed out.
11 86 ms 84 ms 84 ms ae4-0.lax-96cbe-1a.ntwk.msn.net [191.234.83.150]
12 86 ms 86 ms 87 ms ae9-0.by2-96c-1a.ntwk.msn.net [207.46.42.176]
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 87 ms 84 ms 85 ms origin.by173w.bay173.mail.live.com [65.55.157.144]
Trace complete.
C:\Users\C.Cunningham>tracert 207.46.11.236
Tracing route to origin.by181w.bay181.mail.live.com [207.46.11.236]
over a maximum of 30 hops:
1 16 ms 16 ms 19 ms xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
2 18 ms 13 ms 13 ms ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
3 21 ms 19 ms 21 ms he-5-12-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.95.141]
4 18 ms 21 ms 18 ms he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10 * * * Request timed out.
11 * * * Request timed out.
12 * * * Request timed out.
13 * * * Request timed out.
14 * * * Request timed out.
15 * * * Request timed out.
16 * * * Request timed out.
17 * * * Request timed out.
18 * * * Request timed out.
19 * * * Request timed out.
20 * * * Request timed out.
21 * * * Request timed out.
22 * * * Request timed out.
23 * * * Request timed out.
24 * * * Request timed out.
25 * * * Request timed out.
26 * * * Request timed out.
27 * * * Request timed out.
28 * * * Request timed out.
29 * * * Request timed out.
30 * * * Request timed out.
Trace complete.
Results of Intel WiFi Manual Diagnostics
Test Name Test Result Test Summary
Hardware Test Passed Wireless Hardware is enabled
Driver Test Passed Diver is loaded. NETwNs64 Version 13.3.0.24
Radio Test Passed Radio is ON
Scan Test Passed There are 25 Networks available to connect
Association Test Passed Associated
Authentication Test Passed Authenticated
Signal Test Passed Signal Quality: Poor
Ping Test Failed No Reponse: default gateway, DHCP server
I hope this information is enough to get to the root of this problem once and for all. Please let me know if you any other information such as event logs or statistics.
Thanks in advance.Results of Intel WiFi Event View Log (I deleted some lines since there were basically repeats of the same messages)
#Event Source Time
Error Severity Domain
User Description
45 EvtEngine
3/8/2015 20:40 Success
Connection SYSTEM
iAMT - Failed to read Windows Events Log
46 S24EvMon
3/8/2015 20:41 Information
AppDriver
SYSTEM
Getting List of adapters.
47 S24EvMon
3/8/2015 20:41 Information
AppDriver
SYSTEM
Intel adapter(s) found.
156 S24EvMon
3/8/2015 20:47 Information
Driver SYSTEM
AddToExclude 06:1d:d5:d5:34:f0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_AUTH_FAILURE
157 S24EvMon
3/8/2015 20:47 Information
Driver SYSTEM
ATC 06:1d:cf:2a:44:c0 xfinitywifi 6 RSSI=-88
158 S24EvMon
3/8/2015 20:47 Error
Driver SYSTEM
AssociationFailure 06:1d:cf:2a:44:c0 xfinitywifi 6 CNCT_GENERAL_FAILURE
159 S24EvMon
3/8/2015 20:47 Information
Driver SYSTEM
AddToExclude 06:1d:cf:2a:44:c0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
160 S24EvMon
3/8/2015 20:47 Information
Driver SYSTEM
ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-79
161 S24EvMon
3/8/2015 20:47 Success
Driver SYSTEM
RxAuthSuccess 06:1d:d5:d5:34:f0 6
162 S24EvMon
3/8/2015 20:47 Success
Driver SYSTEM
RxAssocResp 06:1d:d5:d5:34:f0 6 -77
163 S24EvMon
3/8/2015 20:49 Information
TCP/IP SYSTEM
VoIP: Got link down - deleting flows .
164 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-88
165 S24EvMon
3/8/2015 20:49 Error
Driver SYSTEM
AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
166 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
AddToExclude 06:1d:d4:eb:87:00 xfinitywifi 11 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
167 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-89
168 S24EvMon
3/8/2015 20:49 Error
Driver SYSTEM
AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
169 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
AddToExclude 06:1d:d4:eb:87:00 xfinitywifi 11 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
170 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-90
171 S24EvMon
3/8/2015 20:49 Error
Driver SYSTEM
AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
172 S24EvMon
3/8/2015 20:49 Information
Driver SYSTEM
ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-82
173 S24EvMon
3/8/2015 20:49 Success
Driver SYSTEM
RxAuthSuccess 06:1d:d5:d5:34:f0 6
174 S24EvMon
3/8/2015 20:49 Success
Driver SYSTEM
RxAssocResp 06:1d:d5:d5:34:f0 6 -81
175 S24EvMon
3/8/2015 20:50 Information
Driver SYSTEM
AddToExclude 06:1d:d5:d5:34:f0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_AUTH_FAILURE
176 S24EvMon
3/8/2015 20:50 Information
Driver SYSTEM
ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-79
177 S24EvMon
3/8/2015 20:50 Success
Driver SYSTEM
RxAuthSuccess 06:1d:d5:d5:34:f0 6
178 S24EvMon
3/8/2015 20:50 Success
Driver SYSTEM
RxAssocResp 06:1d:d5:d5:34:f0 6 -80
179 S24EvMon
3/8/2015 21:03 Information
Driver SYSTEM
RoamTrigger 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-81 MisBcn=8 RSSITh=-85 Roam Other Reason
186 S24EvMon
3/8/2015 21:21 Information
General
SYSTEM
DeviceIoCtrlS24NDIS: (2) Failed to send OID 0xff100055 to driver. Error - 31
187
S24EvMon
3/8/2015 21:21 Information
General
SYSTEM
DeviceIoCtrlS24NDIS - Dot11ExtNicSpecificExtension failed (31) -
DNS Server problems with ASA 5505
Hi guys,
we setup a new ASA 5505 which is mainly used as our VPN gateway. The ASA is configured and controlled by our ISP (and this is where the problem starts )) and they somehow cannot manage to get the VPN settings really working.
So, here is our problem.
our machines(Windows 7) are configured to get the network settings through DHCP (Windows 2012 Server).
Before I connect with AnyConnect to our VPN gateway, the DNS Server setting in the network settings for the adapters(IPv4) are set to 'dynamic'
When I now connect, this setting is changes to a statc entry (which is our DNS server).
When disconnecting, it is not reverted back, which means I have to do this always manually.
What I do not understand is the fact, that the DNS server is set for all the adapters, shouldtn't it be only set to the anyconnect adapter?.
The interesting thing is, that when I connect to a different ASA, this does not happen. The ISP is now saying, that the machines are configured exactly the same and that they cannot reproduce, but I can't believe this.
This issue shows up at every machine which connects to our vpn, so it is not only a single machine which might be misconfigured.
Do you have any idea what might cause this issue?
btw, the second ASA (which works) is from our partner company, so we cannot simply copy the config
THanks in advance
PatrickNice to see someone from BT has addressed your issue
I have this exact same problem, seems completely bizarre, I'm pretty sure I had the same problem with the original home hub (i have the latest one now). Can you confirm whether the problem does affect anyone with a bt home hub and not just the one that the dyndns is pointing at? I'll try and confirm by hitting your domain from my home connection.
Maybe you are looking for
-
IPad as remote for Apple TV First Gen
After installing the "Remote" app on my iPad 2, the instructions then direct you to "turn on Home Sharing on your apple tv." There is no such option on my apple tv settings. Am I even able to control my old apple tv with an iPad? Please advise.
-
Hello experts... Can any body have the step by step process for how to deply the par files? please let me know if you have any weblogs? Thanks padma
-
Routine in InfoPackage for flatfile loading
Hi Friends, Can you give be possiblesolution for my scenario. I am getting a flatfile from a Third Party source and I am loading the data into a Cube. Recently, we have identified that we are getting duplicate data in the file for the same week.And I
-
Class filter, in need of
I'm looking for a class filter. Do you know of one? Do you have any pointers for designing one? I'm thinking it would work like this: You've got a big set of classes. These classes implement various interfaces- some implement one, some implement seve
-
Migration Assistant to an Intel Mac?
Will it be possible to transfer things like current user settings from my current mac to a new intel mac? Anyone whose done this, please let me know.... Thanks, -David