DNS server in DMZ or Inside?

I'm currently using a Win2003 server as my DMZ on the inside of the network. It's also the server I use as my Domain Controller.
I am reviewing some of my policies and considering some changes. Is it best to have my DNS servers on the Inside or on the DMZ?

Roland
It is not clear to me from your post what the usage of the DNS server is, and that would influence where you place the server. If the DNS server is only accessed by internal users then placement on the inside is fine. But if the DNS server is also access by anyone outside then I believe that you should place the DNS server in the DMZ.
HTH
Rick

Similar Messages

  • DMZ - DNS Server, Mail Server, Web Server, FTP Server

    Hi,
    I am looking at a router to support around 20-30 people. I have a DNS Server, Mail Server, Web Server, FTP Server (all on one box (PC). I was wondering how everyones experiences with DMZ and port forwarding have been with these protocols with Airport and supporting a group of this size? Do you forsee issues? Will the new Airport handle these requirements better?
    Thanks

    A record for mail.mydomain.com going for ip 199.99.99.999
    MX record for mail.mydomain.com with destionation as mail.mydomain.com
    That doesn't quite make sense. There must be an A record for "server.mydomain.com" or you wouldn't be able to reach it at all. You want the MX record to point to that.

  • Need help with ASA 5512 and SQL port between DMZ and inside

    Hello everyone,
    Inside is on gigabitEthernet0/1 ip 192.9.200.254
    I have a dmz on gigabitEthernet2 ip 192.168.100.254
    I need to pass port 443 from outside to dmz ip 192.168.100.80 and open port 1433 from 192.168.100.80 to the inside network. 
    I believe this will work for port 443:
    object network dmz
    subnet 192.168.100.0 255.255.255.0
    object network webserver
    host 192.168.100.80
    object network webserver
    nat (dmz,outside) static interface service tcp 443 443
    access-list Outside_access_in extended permit tcp any object webserver eq 443
    access-group Outside_access_in in interface Outside
    However...How would I open only port 1433 from dmz to inside?
    At the bottom of this message is my config if it helps.
    Thanks,
    John Clausen
    Config:
    : Saved
    ASA Version 9.1(2) 
    hostname ciscoasa-gcs
    domain-name router.local
    enable password f4yhsdf.4sadf977 encrypted
    passwd f4yhsdf.4sadf977 encrypted
    names
    ip local pool vpnpool 192.168.201.10-192.168.201.50
    interface GigabitEthernet0/0
     nameif outside
     security-level 0
     ip address 123.222.222.212 255.255.255.224 
    interface GigabitEthernet0/1
     nameif inside
     security-level 100
     ip address 192.9.200.254 255.255.255.0 
    interface GigabitEthernet0/2
     nameif dmz
     security-level 100
     ip address 192.168.100.254 255.255.255.0 
    interface GigabitEthernet0/3
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/4
     shutdown
     no nameif
     no security-level
     no ip address
    interface GigabitEthernet0/5
     shutdown
     no nameif
     no security-level
     no ip address
    interface Management0/0
     management-only
     nameif management
     security-level 100
     ip address 192.168.1.1 255.255.255.0 
    ftp mode passive
    dns server-group DefaultDNS
     domain-name router.local
    object network inside-subnet
     subnet 192.9.200.0 255.255.255.0
    object network netmotion
     host 192.9.200.6
    object network inside-network
     subnet 192.9.200.0 255.255.255.0
    object network vpnpool
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.168.201.0_26
     subnet 192.168.201.0 255.255.255.192
    object network NETWORK_OBJ_192.9.200.0_24
     subnet 192.9.200.0 255.255.255.0
    access-list outside_access_in extended permit icmp any4 any4 log disable 
    access-list Outside_access_in extended permit udp any object netmotion eq 5020 
    access-list split standard permit 192.9.200.0 255.255.255.0 
    access-list VPNT_splitTunnelAcl standard permit 192.9.200.0 255.255.255.0 
    pager lines 24
    logging asdm informational
    mtu outside 1500
    mtu inside 1500
    mtu management 1500
    mtu dmz 1500
    icmp unreachable rate-limit 1 burst-size 1
    no asdm history enable
    arp timeout 14400
    no arp permit-nonconnected
    nat (inside,outside) source static inside-network inside-network destination static vpnpool vpnpool
    nat (inside,outside) source static NETWORK_OBJ_192.9.200.0_24 NETWORK_OBJ_192.9.200.0_24 destination static NETWORK_OBJ_192.168.201.0_26 NETWORK_OBJ_192.168.201.0_26 no-proxy-arp route-lookup
    object network netmotion
     nat (inside,outside) static interface service udp 5020 5020 
    nat (inside,outside) after-auto source dynamic any interface
    access-group Outside_access_in in interface outside
    route outside 0.0.0.0 0.0.0.0 123.222.222.1 1
    timeout xlate 3:00:00
    timeout pat-xlate 0:00:30
    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
    timeout tcp-proxy-reassembly 0:01:00
    timeout floating-conn 0:00:00
    dynamic-access-policy-record DfltAccessPolicy
    user-identity default-domain LOCAL
    http server enable
    http 192.168.1.0 255.255.255.0 management
    http 192.9.200.0 255.255.255.0 inside
    no snmp-server location
    no snmp-server contact
    snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac 
    crypto ipsec security-association pmtu-aging infinite
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group5
    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
    crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
    crypto map outside_map interface outside
    crypto ca trustpool policy
    crypto ikev1 enable outside
    crypto ikev1 policy 10
     authentication crack
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 20
     authentication rsa-sig
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 30
     authentication pre-share
     encryption aes-256
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 40
     authentication crack
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 50
     authentication rsa-sig
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 60
     authentication pre-share
     encryption aes-192
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 70
     authentication crack
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 80
     authentication rsa-sig
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 90
     authentication pre-share
     encryption aes
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 100
     authentication crack
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 110
     authentication rsa-sig
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 120
     authentication pre-share
     encryption 3des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 130
     authentication crack
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 140
     authentication rsa-sig
     encryption des
     hash sha
     group 2
     lifetime 86400
    crypto ikev1 policy 150
     authentication pre-share
     encryption des
     hash sha
     group 2
     lifetime 86400
    telnet 192.9.200.0 255.255.255.0 inside
    telnet timeout 5
    ssh timeout 5
    ssh key-exchange group dh-group1-sha1
    console timeout 0
    dhcpd address 192.168.1.2-192.168.1.254 management
    dhcpd enable management
    threat-detection basic-threat
    threat-detection statistics access-list
    no threat-detection statistics tcp-intercept
    ssl encryption aes128-sha1 3des-sha1
    webvpn
     enable outside
     anyconnect image disk0:/anyconnect-win-2.5.2014-k9.pkg 2 regex "Windows NT"
     anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 3 regex "Intel Mac OS X"
     anyconnect enable
     tunnel-group-list enable
    group-policy SSLVPN internal
    group-policy SSLVPN attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ssl-client 
     split-tunnel-policy tunnelspecified
     split-tunnel-network-list value split
     default-domain value router.local
    group-policy VPNT internal
    group-policy VPNT attributes
     dns-server value 192.9.200.13
     vpn-tunnel-protocol ikev1 l2tp-ipsec 
     split-tunnel-policy tunnelspecified
    split-tunnel-network-list value VPNT_splitTunnelAcl
     default-domain value router.local
    username grimesvpn password 7.wersfhyt encrypted
    username grimesvpn attributes
     service-type remote-access
    tunnel-group SSLVPN type remote-access
    tunnel-group SSLVPN general-attributes
     address-pool vpnpool
     default-group-policy SSLVPN
    tunnel-group SSLVPN webvpn-attributes
     group-alias SSLVPN enable
    tunnel-group VPNT type remote-access
    tunnel-group VPNT general-attributes
     address-pool vpnpool
     default-group-policy VPNT
    tunnel-group VPNT ipsec-attributes
     ikev1 pre-shared-key *****
    class-map inspection_default
     match default-inspection-traffic
    policy-map type inspect dns preset_dns_map
     parameters
      message-length maximum client auto
      message-length maximum 512
    policy-map global_policy
     class inspection_default
      inspect dns preset_dns_map 
      inspect ftp 
      inspect h323 h225 
      inspect h323 ras 
      inspect rsh 
      inspect rtsp 
      inspect esmtp 
      inspect sqlnet 
      inspect skinny  
      inspect sunrpc 
      inspect xdmcp 
      inspect sip  
      inspect netbios 
      inspect tftp 
      inspect ip-options 
      inspect icmp 
    service-policy global_policy global
    prompt hostname context 
    no call-home reporting anonymous
    Cryptochecksum:36271b5a1b9382621e14c3aa635e2fbb
    : end

    Hi Vibor. Apologies if my comment was misunderstood.  What I meant to say was that the security level of the dmz interface should probably be less than 100. 
    And therefore traffic could be controlled between DMZ and inside networks. 
    As per thr security level on the DMZ interface. ....... that command is correct. :-)

  • Static translation from dmz to inside on Asa 8.6

    Recently upgraded to an Asa 5512x from a pix 515e. I have an Ipswitch secure MoveIT server on the dmz1 interface that needs to be accessed from both the inside and outside interfaces. I have setup a static nat from the outside to the dmz1 and it works, I can also connect from the inside interface. Now I need the MoveIT server to access the DNS server and email server on the inside interface so it can send notifications. On the pix I just created a static from the inside to the dmz1 using its own IP address - static (inside,dmz1) 192.168.1.7 192.168.1.7 net mask 255.255.255.255. I would then add the access-list to allow. How would I set this up with the Asa 8.6 commands?
    Sent from Cisco Technical Support iPad App

    Hi,
    The default operation of the new ASAs/Softwares is that you dont configure NAT if you dont need one.
    So if you for example have the following interfaces
    outside
    lan1
    lan2
    dmz
    If you want the lan1, lan2 and dmz to communicate between eachother with the actual IP addresses, you dont configure any type of NAT between them (even the ones that you used to do with the old software with the "static" commands)
    Only situations where I have configured Twice NAT is when I have configured a L2L VPN or there is migrated some old 8.2 or below software Policy NAT.
    So to my understanding you would probably have a new type of Static NAT for the dmz1 server towards outside
    object network DMZ-STATIC
    host 192.168.1.7
    nat (dmz1,outside) static x.x.x.x dns
    For the same server to communicate with other networks behind the firewall (LAN networks) you shouldnt really need any addiotional NAT configurations. Only have the access-rules permit the traffic if it already doesnt do so.
    You can always post some configurations if you want someone to take a look through them.
    - Jouni

  • How to config firewall if accessing from dmz to inside lan

    Hi everyone,
    Hope you can help on this.
    We have a ASA with IOS 8.44. We just configured a dmz zone. Now we try to access a share of a windows server in INSIDE interface from another windows server in dmz,  So on the server in DMZ, I will type \\INSIDE_Server\SharedName (or \\ip_of_inside server\SharedName) to access the share.
    On the firewall, I open tcp port 137, 138, 139, and 445 to allow from DMZ to access to Inside server. But I failed. So what do I need to configure so that I can complete my task?
    Also, we have some internal DNS in INSIDE interface. How do I make my DMZ server to use the inside DNS servers for dns resolution?
    Hope you can help. Thank you!
    Takami Chiro

    Hi Jcarvaja,
    Thank you very much. Finally I could run the command for the troubleshoot. And the following is the result:
    esult of the command: "packet-tracer input dmz2 udp 172.20.0.49 1025 10.10.0.9 53"
    Phase: 1
    Type: ACCESS-LIST
    Subtype:
    Result: ALLOW
    Config:
    Implicit Rule
    Additional Information:
    MAC Access list
    Phase: 2
    Type: ROUTE-LOOKUP
    Subtype: input
    Result: ALLOW
    Config:
    Additional Information:
    in   10.10.0.0       255.255.0.0     inside
    Phase: 3
    Type: ACCESS-LIST
    Subtype: log
    Result: DROP
    Config:
    access-group dmz2_acl in interface dmz2
    access-list dmz2_acl extended deny ip any 10.0.0.0 255.0.0.0
    Additional Information:
    Result:
    input-interface: dmz2
    input-status: up
    input-line-status: up
    output-interface: inside
    output-status: up
    output-line-status: up
    Action: drop
    Drop-reason: (acl-drop) Flow is denied by configured rule
    So to do so...does it mean I need to allow tcp  53 from dmz that server to inside the DNS server?
    Thank you very much again...

  • Internal DNS server and NAT routing issue.

    Hi -- I am not terribly experienced with DNS and I am running into an issue that I can't seem to resolve. My company.com DNS information is hosted by an outside ISP for email, web, etc... but I have configured an A record there to point to the public IP to my mac os x server (server.company.com).
    We have a cisco router configured with one to one NAT from the public IP to the internal IP for our server in a 192.168.15.x subnet. The same router is running DHCP and and NAT on that subnet under a different public IP provided by our ISP.
    Our server is running DNS with recursion and has a "company.private" zone set up for internal services and machine names. Thus, the server is accessible via "server.company.com" from the outside and "server.company.private" from the private LAN.
    The problem is that I would like to be able to access some services simply via "server.company.com" both inside and outside the private network. Now, accessing the "server.company.com" services from the private lan does not work because the name resolves to the external IP and the external IP cannot be used internally due to NAT.
    Is there a way to configure my internal DNS server to respond with the appropriate private address when receiving a query only to "server.company.com" and forward requests on for anything else on "company.com"?
    I know that I could manually duplicate all entries for our domain from my ISP and host the same entries for internal clients, but it would be much easier to only have our server handle requests for itself. The server is running OS X Server 10.4.11.
    Thanks

    Is there a way to configure my internal DNS server to respond with the appropriate private address when receiving a query only to "server.company.com" and forward requests on for anything else on "company.com"?
    Ordinarily, no. Once your server thinks it is responsible for a zone (e.g. company.com) then it will answer all queries for that domain and never pass them upstream. Therefore you'd have to replicate all the zone data, including all the public records, and maintain them both.
    The one possible exception to this (I haven't tried) is to create a zone for server.company.com that has your internal address. In theory (like I said, I haven't tried this), the server should respond to 'server.company.com' lookups with its own zone data and defer all other lookups (including other company.com names since they're not in a zone it controls). Might be worth trying.

  • Install SCCM client to server in DMZ: "MP does not exist"

    Hi,
    I’d need to put a management point/distribution point in a DMZ.
    Therefore I wanted to make sure this MP/DP works before I move it to this DMZ and I:
    *configured a Windows 2012 R2, (name: “DMZ01”) server with the prereqs*removed this server DMZ01 from the actual domain*added a DNS entry from DMZ to which I can connect successfully
    *added a network access account in order to push the sccm client
    *added correct boundary group
    Now when I try to deploy an SCCM client to it, I get a failure in the ccmsetup log saying MP does not exist:
    Failed to load mdmregistration.dll with error 0x8007007e          
    ccmsetup           
    27/04/2015 10:54:48       932 (0x03A4)
    Failed to load mdmregistration.dll. Continue deployment.        
    ccmsetup           
    27/04/2015 10:54:48       932 (0x03A4)
    An MP does not exist on this machine. ccmsetup           
    27/04/2015 10:54:48       932 (0x03A4)
    My questions:
    *should I use the management point affinity here to force finding the management point?
    *what about the domain certificate (that’s gone now since it isn’t domain joined anymore)? How to deal with this/revive this?
    Please advise.
    J.
    Jan Hoedt

    Ok, thanks.
    Note: there is no trust between the DMZ domain and the domain in which the "main" sccm server exists.
    What are the options there? F.e. could we use Mutual authentication just as with a Mac
    https://technet.microsoft.com/en-us/library/jj591553.aspx#BKMK_ManualCertifcateInstallation
    Jan Hoedt

  • Split-horizon DNS server

    Hi,
    is it possible to use novell-named on OES 2 Linux to create split-horizon DNS server? Something like this: Two-in-one DNS server with BIND9 | HowtoForge - Linux Howtos and Tutorials. What I want to achieve is "to resolve to internal IPs when you are inside and external IPs when you are outside".
    We have some services (web applications, Groupwise messenger etc.) which can be accessed from the LAN using private addresses and which are also visible from the public network (Internet).
    Currently we have Netware 6.5 with DNS Proxy binded to internal address and some hostnames bound to internal IP addresses inside hosts file (and therefore resolved by DNS Proxy with private addresses for LAN clients) and named bound to public IP and serving DNS requests from public network. But we'd like to migrate everything from Netware to OES 2 Linux.
    Any help is much appreciated!
    Bruno

    Originally Posted by joharmon
    Just found this:
    Is Views for DNS Supported or Possible on NetWare or OES?
    Bad news but thanks for your answer!
    Bruno

  • DNS Server Infrastructure Design

    Good day IT Folks,
    Currently I'm on the planning stage of designing DNS infrastructure of our company. I've read a lot of reading materials available online about DNS. According to what I've gathered, two (2) DNS server is the minimum and three (3) is the recommended for the
    usual set up of DNS. What I want to my DNS infrastructure is to have two (2) DNS servers for my LAN (internal network) and one (1) DNS for my LAN-to-Internet connection (external network).
    The two (2) DNS servers will resolve LAN request and will forward requests to the another one (1) DNS server if internet-related sites is requested. I would like to ask for your help to give me insights how am I going to do this, where to start and what
    are the things I should consider.
    Thanks.
    akosijesyang - the conqueror

    You could go with a secure design such as the following (click on it to open a larger image in a new page):
    See if the following threads help:
    Technet Thread: Problem with Windows 2008 R2 Dns Server getting SERVFAIL resolving one domain, 1/18/2012
    Includes a secure DNS forwarder in the DMZ image
    http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/b00fc041-ba44-45b6-a8a1-a00374a20edf
    Technet Thread: DNS Structure to rebuild efficiently - Question about the resolution process, 10/27/2011
    Includes a secure DNS forwarder in the DMZ image
    http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/3a5fb6ac-6ab7-45b1-abab-e0d928a7e06c
    Good discussion on DMZ secured resolver design, and the use of "Unbound DNS Resolver (http://unbound.net/) to use on your DMZ DNS server instead of Windows DNS. (Note: IMHO, for AD, I would rather use Windows DNS. - Ace)
    Technet Thread: W2003 DNS cache snooping vulnerability for PCI-DSS compliance, 10/10/2011
    http://social.technet.microsoft.com/Forums/en-US/winserverNIS/thread/67e9189b-606a-40d2-9944-8b4c7d084017/
    And dealing with internal and external names:
    Can't Access Website with Same Name (Split Zone or no Split Brain)
    Published by Ace Fekay, MCT, MVP DS on Sep 4, 2009 at 12:11 AM  1278  0
    Note - In an AD same name as the external name (split zone) scenario, if you don't want to use WWW in front of URL, such as to access it by
    http://domain.com, then scroll down to "So you don't want to use WWW in front of the domain name"
    http://msmvps.com/blogs/acefekay/archive/2009/09/04/split-zone-or-no-split-zone-can-t-access-internal-website-with-external-
    name.aspx
    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
    This post is provided AS-IS with no warranties or guarantees and confers no rights.

  • Remote DNS server across ASA

    Hi guys,
    i am hoping if anyone can reply to my query below.
    We have got a new batch of servers and they reside on a separate VLAN 192.168.45.x 255.255.255.0
    Those  servers are required to be registered on the DNS server located on  the remote site (SITE 2). Please refer to the attached diagaram. We  also have a DNS server in our LAN but these new servers will need  to be in the domain in SITE 2
    Can anyone advise if need anythin else other than the following ACLs in the ASA firewall
    Access-list inside extended permit udp 192.168.45.0 255.255.255.0 host 10.10.100.150 eq 53
    Access-list inside extended permit tcp 192.168.45.0 255.255.255.0 host 10.10.100.150 eq 53
    Thanks
    jay

    The ACL entries above will allow DNS queries across the provider link from your local site. We are assuming matching entries allow the communications on the remote and and that routing etc. is all in place.. 
    You asked however about needing to be "registered" on the DNS server and in the domain. Also your diagram mentions the server is a DHCP server and you show it configured with the helper-address in your local core switch. DHCP uses TCP ports 67 and 68. When you say domain if you are talking about a Windows domain that is another set of ports.

  • UC520 - DNS server error - Low memory

    Has anyone else hit this issue:
    006125: Nov  7 12:30:21.132 PST: %DNSSERVER-3-UDPDNSOVERLOAD: Low available memory: dropping <id# 37428> from <cli 192.168..x.x>.
    Using a UC520.
    Issue seen in following IOS:
    uc500-advipservicesk9-mz.151-4.M5
    uc500-advipservicesk9-mz.151-4.M4b
    No issue with:
    uc500-advipservicesk9-mz.151-2.T4
    Using the UC520 as a DNS server/forwarder for a small number of hosts < 10 to resolve inside IP's for internal applications.
    UC520 will eventually stop resolving DNS requests.
    Thanks.

    Hi Mike,
    What else are you running on the UC520?  VPN, Applications, SSL?  If possible could you post a sanitized version of your config as well?
    Thank you,
    Jason Nickle

  • Cisco 1821 as DNS server

    Hello I have a cisco 1821 router acting as remote access for vpnclients, LAN LAN VPN device and also
    LAN router. All in one.
    My LAN has a 192.168.23.0/24 addressing, and router has 2 IP Addresses, one on public IP on the public interface Fa0/1
    and 192.168.203.1 on the private interface Fa0/0
    I set up it as a name server for local LAN:
    ip dns server
    ip host pc10 192.168.203.10
    ip host pc83 192.168.203.83
    ip host c1821 192.168.203.1
    I did this so that local PC on my lan can have a resolution for local addresses since I do not have a DNS server inside my line
    and I do not have a Active Directory infrastructure.
    on the public IP interface my router can be queried for LOCAL IP  resolution for my lan 192.168.203.0/24, I Tryed from outside using dig command.
    I Wanted to prevent this. I cannot use an ACL because I would prevent DNS queries to work in general. trying to resolve
    an external IP Address from inside my lan, I just want the router to refuse DNS resolution for any query coming to external interface,
    while I Want to allow only queries coming form my local lan to internal interface.
    is this possible in some way ?
    thank you
    Riccardo

    You are asking your IOS device to act as a split-DNS server, providing RFC1918 addresses on internal interfaces, and global address (or no addresses) on the public inetrface.
    Look at the "ip dns view" command so you can present differnt DNS responses by interface.
    This article may help:
    http://www.nil.com/ipcorner/RouterDNS/

  • Moving from Exchange 2007 to 2013 (leaving the DNS Server for it's own dedicated server)

    Hello! I am quite new to Exchange and Server management in general. I will do my best to explain my situation.
    I am looking to move my Exchange server off of our DNS server. When we installed them on the same server, we did not have the funds to buy 2 separate servers. I am told that it is best to separate the two. I have followed the Microsoft instructions for installing
    the prerequisites for Exchange 2013 on a 2012 R2 server, and i am at the point where it wants me to configure AD LDS. As I have active directory running on the current server, I was a little hesitant to just install it without understanding what i am doing.
    After the AD LDS is configured, I believe i can move forward with installing Exchange 2013 (all 3 roles will be hosted on the new server), export the mailboxes from 2007 server and import them into the new Exchange 2013 server. After 2013 is up and stable,
    I plan on removing 2007 from the old server (DNS server).
    What are my next steps after importing the mailboxes? Am i missing important details that I need to change or migrate?
    My biggest fear is that nothing works after the installation and moving the mailboxes over. For that case, it makes sense to keep 2007 installed as a fallback for when my installation fails and all i have lost is just my time :)
    Current Server:
    Windows Server 2008 Standard (64 bit)
    1. Roles: Active Directory, DNS, IIS
    2. Software: Exchange 2007
    New Server:
    Windows 2012 R2 Server
    1. Roles: ???
    1. Software to install: Exchange 2013
    Thank you for any help you can provide!

    These are good resources, but i am still caught up with the active directory issue.  Am I able to keep the old Domain/DNS/Active directory on it's current server and move Exchange 2007 off onto a new server (with Exchange 2013)?
    In the first example, he is moving everything (domain controller, exchange, users, etc) onto a different server and decommissioning it.I've been told that it would be better practice to keep the domain and exchange on 2 different servers. Is this true?
    I go to run commands like:
    .\setup /PrepareAD /OrganizationName: orgname /IAcceptExchangeServerLicenseTerms
    on the new exchange server, as a prerequisite and it doesnt recognize the command - even after following the steps before. Is this because the new server is not a domain controller? does it have to be? What are the best practices for setting up a server(s)
    with exchange + domain controller?
    Thanks for responding.

  • Your computer appears to be correctly configured, but the device or resource (DNS server) is not responding [and I'm at my wit's end!]

    I originally posted this question to the community section and was advised to post it here.  Please bear with me as this will be a long post.  I'm including the scenarios involving this reoccurring issue, the trouble shooting steps I've already
    taken and the results of several diagnostic tools and logs.
    I have a Sony VAIOS VPCEBB33FM lap top since 2011.  I have had this issue on an off for a long time.  I'm at my wit's end.  Any new insights or suggestions would be greatly appreciated.
    Scenario Details
    1)  Some times it's on and off through out the day, sometimes it won't work all day, and once in a while it will work fine for the entire day.
    2)  I've had this issue across several wireless services, Clear Network accessed with WiMax, Library Wi-fi, Comcast cable internet using wireless router and Wi-fi, and Comcast Xfinity Wi-Fi, to name a few examples.
    3)  Other devices in the household or library will work with no problems such as my smart phone or my roommates' laptops or desktop computers.
    4) Once in a while,  the built-in wireless adapter is not found and I have to reinstall the driver.  Also the diagnostic tool has had to reset my adapter on an increasing basis.
    5)  I had my hard drive replaced in December 2014 and my system restored from the System Restore disks that came with it when I bought the laptop.  Even though I've been online on an infrequent basis it worked just fine for a while. Now that
    I've been online a bit more I'm having the same issues again.
    Below are my attempts at trouble shooting so far but I still have not been able to consistently resolve my DNS issues
     1) Restarting my adapter
     2) Turning off my laptop and removing the power supply for 5-10 minutes before turning it back on.
     3)  Using the IP Config in Command Prompt
         ipconfig /flushdns
         ipconfig /registerdns
         ipconfig /release
         ipconfig /renew
     4) Using the NetSh reset in Command Prompt and restarting my laptop
         netsh int ip reset c:\resetlog.txt
         netsh winsock reset
         ipconfig /flushdns
         [restart laptop]
     5)  Configuring the TCP/IP in several settings
        Select Internet Protocol Version 4 (TCP/IPv4), and then click Properties.
        I have used the following settings:
           a) Obtain an DNS server address automatically
           b) OpenDNS
               208 67 222 222
               208 67 220 220
           c) Google DNS
               8 8 8 8
               8 8 4 4
     6) Updating the driver for my Intel Centrino(R) Advanced-N 6250 AGN and Intel Centrino(R) WIMAX 6250 from the Intel website previous having my laptop wiped clean in 2014.  It still did not resolve the issue.  My laptop
    manufacturer as not come up with an driver update for my adapter since 2010.  I haven't tried to update the adapter driver from Intel's website since having my laptop repaired due to the fact that Intel strongly recommending using the manufacturer's updates
    instead and frankly it didn't make much of a difference when I did it the first time.
     7) The last one I've tried as of today is going into Services and changing the start up type to automatic for the following:
           Computer Browser [changed from manual to automatic]
           DHCP Client [already set to automatic]
           DNS Client [already set to automatic]
           Network Connections [already set to automatic]
           Network Location Awareness [changed from manual to automatic]
           Remote Procedure Call (RPC) [already set to automatic]
           Server [already set to automatic]
           TCP/IP Netbios helper [already set to automatic]
           Workstation [already set to automatic]
    ...and I'm still having DNS issues.
    My only guessing are that my laptop came with a lemon adapter that needs to be replaced, some advanced setting(s) that I'm not aware off, or my firewall/anti-virus is interfering. I've used Symmantic Anti-virus and Firewall in the past and currently
    Avast Anti-Virus with Microsoft Network Firewall.  I've had DNS issues with both anti-virus/firewall set ups.
    Below are the results from the diagnostics and tests that I've ran.
    Windows Network Diagnostics
    Your computer appears to be correctly configured, but the device or resource (DNS server) is not responding Detected Detected
    Contact your network administrator or Internet service provider (ISP) Completed
    Windows can't communicate with the device or resource (DNS server). The computer or service you are trying to reach might be...
    Details about network adapter diagnosis:
    Network adapter Wireless Network Connection driver information:
       Description . . . . . . . . . . : Intel(R) Centrino(R) Advanced-N 6250 AGN
       Manufacturer  . . . . . . . . . : Intel Corporation
       Provider  . . . . . . . . . . . : Intel
       Version   . . . . . . . . . . . : 13.2.1.5
       Inf File Name . . . . . . . . . : C:\Windows\INF\oem17.inf
       Inf File Date . . . . . . . . . : Monday, June 14, 2010  9:05:44 AM
       Section Name  . . . . . . . . . : Install_MPCIEX_GEN_6250_AGN_2x2_HMC_WIN7_64_MOW
       Hardware ID . . . . . . . . . . : pci\ven_8086&dev_0087&subsys_13018086
       Instance Status Flags . . . . . : 0x180200a
       Device Manager Status Code  . . : 0
       IfType  . . . . . . . . . . . . : 71
       Physical Media Type . . . . . . : 9
    Informational Diagnostics Information (Wireless Connectivity)
    Details about wireless connectivity diagnosis:
    Information for connection being diagnosed
     Interface GUID: 70a0781d-6329-45e4-8d7c-34aeca294c39
     Interface name: Intel(R) Centrino(R) Advanced-N 6250 AGN
     Interface type: Native WiFi
    Connection incident diagnosed
     Auto Configuration ID: 1
     Connection ID: 1
    Connection status summary
     Connection started at: 2015-03-07 19:57:14-186
     Profile match: Success
     Pre-Association: Success
     Association: Success
     Security and Authentication: Success
    List of visible access point(s): 22 item(s) total, 22 item(s) displayed
            BSSID        BSS Type PHY    Signal(dB)    Chnl/freq    SSID
    60-02-92-C6-D3-E8    Infra     <unknown>    -62        11     HOME-C7D4-2.4
    60-02-92-A1-75-E0    Infra     <unknown>    -58        6     HOME-B917-2.4
    00-1D-D5-D5-34-F0    Infra     <unknown>    -73        6     HOME-34F2
    60-02-92-A1-75-E1    Infra     <unknown>    -58        6     (Unnamed Network)
    06-1D-D5-D5-34-F0    Infra     <unknown>    -78        6     xfinitywifi
    C4-27-95-C9-C4-2D    Infra     <unknown>    -57        1     HOME-C42D
    02-1D-D5-D5-34-F0    Infra     <unknown>    -74        6     (Unnamed Network)
    00-0D-97-07-E0-79    Infra     g    -75        6     (Unnamed Network)
    00-1D-CF-2A-44-C0    Infra     <unknown>    -86        6     HOME-44C2
    02-1D-CF-2A-44-C0    Infra     <unknown>    -86        6     (Unnamed Network)
    F8-E4-FB-3C-87-A2    Infra     <unknown>    -89        6     YVNM7
    06-1D-CF-2A-44-C0    Infra     <unknown>    -87        6     xfinitywifi
    0C-F8-93-7A-13-50    Infra     b    -87        6     PKennedy
    06-F8-93-7A-13-50    Infra     b    -89        6     xfinitywifi
    02-F8-93-7A-13-50    Infra     b    -87        6     (Unnamed Network)
    E0-88-5D-C8-A9-DC    Infra     <unknown>    -80        1     HOME-A9DC
    E2-88-5D-C8-A9-DD    Infra     <unknown>    -79        1     (Unnamed Network)
    16-CF-E2-43-0B-30    Infra     <unknown>    -88        1     xfinitywifi
    60-02-92-F0-A8-C0    Infra     <unknown>    -90        11     HOME-96A6-2.4
    60-02-92-C6-D3-E9    Infra     <unknown>    -63        11     (Unnamed Network)
    02-1D-D4-EB-87-00    Infra     <unknown>    -88        11     (Unnamed Network)
    06-1D-D4-EB-87-00    Infra     <unknown>    -88        11     xfinitywifi
    Connection History
     Information for Auto Configuration ID 1
      List of visible networks: 13 item(s) total, 13 item(s) displayed
      BSS Type PHY    Security    Signal(RSSI)    Compatible    SSID
      Infra     <unknown>    Yes        63    Yes        HOME-C7D4-2.4
      Infra     <unknown>    Yes        70    Yes        HOME-B917-2.4
      Infra     <unknown>    Yes        43    Yes        HOME-34F2
      Infra     <unknown>    Yes        70    Yes        (Unnamed Network)
      Infra     <unknown>    No        40    Yes        xfinitywifi
      Infra     <unknown>    Yes        71    Yes        HOME-C42D
      Infra     g    No        43    Yes        (Unnamed Network)
      Infra     <unknown>    Yes        28    Yes        HOME-44C2
      Infra     <unknown>    Yes        20    Yes        YVNM7
      Infra     b    Yes        21    Yes        PKennedy
      Infra     <unknown>    Yes        33    Yes        HOME-A9DC
      Infra     <unknown>    Yes        35    Yes        (Unnamed Network)
      Infra     <unknown>    Yes        16    Yes        HOME-96A6-2.4
      List of preferred networks: 3 item(s)
       Profile: xfinitywifi
        SSID: xfinitywifi
        SSID length: 11
        Connection mode: Infra
        Security: No
        Set by group policy: No
        Connect even if network is not broadcasting: No
        Connectable: Yes
       Profile: HTC Portable Hotspot 9F50
        SSID: HTC Portable Hotspot 9F50
        SSID length: 25
        Connection mode: Infra
        Security: Yes
        Set by group policy: No
        Connect even if network is not broadcasting: No
        Connectable: No
         Reason: 0x00028002
       Profile: belkin.332
        SSID: belkin.332
        SSID length: 10
        Connection mode: Infra
        Security: Yes
        Set by group policy: No
        Connect even if network is not broadcasting: No
        Connectable: No
         Reason: 0x00028002
     Information for Connection ID 1
     Connection started at: 2015-03-07 19:57:14-186
      Auto Configuration ID: 1
      Profile: xfinitywifi
      SSID: xfinitywifi
      SSID length: 11
      Connection mode: Infra
      Security: No
      Pre-Association and Association
       Connectivity settings provided by hardware manufacturer (IHV): No
       Security settings provided by hardware manufacturer (IHV): No
       Profile matches network requirements: Success
       Pre-association status: Success
       Association status: Success
        Last AP:  06-1d-d5-d5-34-f0
      Security and Authentication
       Configured security type: Open
       Configured encryption type: None
       802.1X protocol: No
       Key exchange initiated: Yes
        Unicast key received: No
        Multicast key received: No
       Number of security packets received: 0
       Number of security packets sent: 0
       Security attempt status: Success
     Connectivity
       Packet statistics
        Ndis Rx: 2068
        Ndis Tx: 2543
        Unicast decrypt success: 0
        Multicast decrypt success: 0
        Unicast decrypt failure: 0
        Multicast decrypt failure: 0
        Rx success: 3954
        Rx failure: 0
        Tx success: 537
        Tx failure: 4
        Tx retry: 2
        Tx multiple retry: 2
        Tx max lifetime exceeded: 0
        Tx ACK failure: 18
       Roaming history: 0 item(s)
    InformationalDiagnostics Information (Wireless Connectivity)
    Details about wireless connectivity diagnosis:
    For complete information about this session see the wireless connectivity information event.
    Helper Class: Auto Configuration
     Initialize status: Success
    Information for connection being diagnosed
     Interface GUID: 70a0781d-6329-45e4-8d7c-34aeca294c39
     Interface name: Intel(R) Centrino(R) Advanced-N 6250 AGN
     Interface type: Native WiFi
    Result of diagnosis: There may be problem
     Network Connection details from Command Prompt  (some info hidden for security reasons)
    Connection-specific DNS Suffix:
    Description: Intel(R) Centrino(R) Advanced-N 6250 AGN
    Physical Address: ‎00-23-15-54-19-B8
    DHCP Enabled: Yes
    IPv4 Address: 192.168.X.XX
    IPv4 Subnet Mask: 255.255.XX.X
    Lease Obtained: Saturday, March 07, 2015 7:57:14 PM
    Lease Expires: Saturday, March 07, 2015 8:24:44 PM
    IPv4 Default Gateway: 192.168.X.X
    IPv4 DHCP Server: 192.168.X.X
    IPv4 DNS Servers: 75.75.75.75, 75.75.76.76
    IPv4 WINS Server:
    NetBIOS over Tcpip Enabled: Yes
    Link-local IPv6 Address: fe80::b8de:3ac9:e166:XXX%XX
    IPv6 Default Gateway:
    IPv6 DNS Server:
    Results of Ping and Trace Route in Command Prompt
    Microsoft Windows [Version 6.1.7601]
    Copyright (c) 2009 Microsoft Corporation.  All rights reserved.
    C:\Windows\system32>ping 127.0.0.1
    Pinging 127.0.0.1 with 32 bytes of data:
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Reply from 127.0.0.1: bytes=32 time<1ms TTL=128
    Ping statistics for 127.0.0.1:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 0ms, Maximum = 0ms, Average = 0ms
    C:\Windows\system32>ping www.youtube.com
    Pinging youtube-ui.l.google.com [173.194.121.6] with 32 bytes of data:
    Reply from 173.194.121.6: bytes=32 time=24ms TTL=55
    Reply from 173.194.121.6: bytes=32 time=19ms TTL=55
    Request timed out.
    Request timed out.
    Ping statistics for 173.194.121.6:
        Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 19ms, Maximum = 24ms, Average = 21ms
    C:\Windows\system32>ping 74.125.239.34
    Pinging 74.125.239.34 with 32 bytes of data:
    Request timed out.
    Request timed out.
    Reply from 74.125.239.34: bytes=32 time=3286ms TTL=50
    Request timed out.
    Ping statistics for 74.125.239.34:
        Packets: Sent = 4, Received = 1, Lost = 3 (75% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 3286ms, Maximum = 3286ms, Average = 3286ms
    C:\Windows\system32>ping www.hotmail.com
    Pinging dispatch.kahuna.glbdns2.microsoft.com [65.55.157.204] with 32 bytes of data:
    Reply from 65.55.157.204: bytes=32 time=111ms TTL=237
    Request timed out.
    Request timed out.
    Reply from 65.55.157.204: bytes=32 time=1537ms TTL=237
    Ping statistics for 65.55.157.204:
        Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 111ms, Maximum = 1537ms, Average = 824ms
    C:\Windows\system32>ping 207.46.11.236
    Pinging 207.46.11.236 with 32 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.
    Ping statistics for 207.46.11.236:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),
    C:\Windows\system32>tracert www.youtube.com
    Tracing route to youtube-ui.l.google.com [173.194.121.5]
    over a maximum of 30 hops:
      1    19 ms    13 ms    17 ms  xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
      2    13 ms    13 ms    27 ms  ae-14-32767-ar03.newcastle.de.panjde.comcast.net [68.85.192.205]
      3    20 ms    26 ms    21 ms  he-5-10-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.94.249]
      4    18 ms    34 ms    22 ms  he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
      5    19 ms    18 ms    18 ms  50-248-116-190-static.hfc.comcastbusiness.net [50.248.116.190]
      6    35 ms    18 ms    18 ms  209.85.249.217
      7    21 ms    19 ms    19 ms  72.14.233.93
      8     *        *        *     Request timed out.
      9     *     2509 ms   677 ms  iad23s25-in-f5.1e100.net [173.194.121.5]
    Trace complete.
    C:\Windows\system32>tracert 74.125.239.34
    Tracing route to nuq04s19-in-f2.1e100.net [74.125.239.34]
    over a maximum of 30 hops:
      1    54 ms    23 ms    12 ms  xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
      2    22 ms    19 ms    17 ms  ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
      3    19 ms    19 ms    18 ms  he-5-14-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.166.121]
      4    18 ms    18 ms    18 ms  he-0-15-0-0-cr01.350ecermak.il.ibone.comcast.net[68.86.85.74]
      5    19 ms    18 ms    22 ms  50-248-116-190-static.hfc.comcastbusiness.net [50.248.116.190]
      6    22 ms    36 ms    19 ms  209.85.249.217
      7    26 ms    23 ms    25 ms  209.85.143.112
      8     *        *        *     Request timed out.
      9     *        *        *     Request timed out.
     10   972 ms     *        *     216.239.51.97
     11   148 ms    97 ms    95 ms  216.239.46.241
     12   324 ms   130 ms   432 ms  209.85.246.252
     13     *        *        *     Request timed out.
     14  1403 ms   101 ms   126 ms  nuq04s19-in-f2.1e100.net [74.125.239.34]
    Trace complete.
    C:\Windows\system32>tracert www.hotmail.com
    Tracing route to dispatch.kahuna.glbdns2.microsoft.com [65.55.157.144]
    over a maximum of 30 hops:
      1    13 ms    13 ms    25 ms  xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
      2    13 ms    15 ms    13 ms  ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
      3    20 ms    19 ms    17 ms  he-5-13-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.95.145]
      4    17 ms    20 ms    20 ms  he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
      5    17 ms    18 ms    38 ms  as8075-2-c.ashburn.va.ibone.comcast.net [173.167.58.82]
      6    18 ms    18 ms    36 ms  ae4-0.ash-96cbe-1a.ntwk.msn.net [207.46.36.172]
      7     *        *        *     Request timed out.
      8     *     2191 ms    35 ms  ae0-0.atb-96cbe-1b.ntwk.msn.net [191.234.81.167]
      9     *        *        *     Request timed out.
     10     *        *        *     Request timed out.
     11    86 ms    84 ms    84 ms  ae4-0.lax-96cbe-1a.ntwk.msn.net [191.234.83.150]
     12    86 ms    86 ms    87 ms  ae9-0.by2-96c-1a.ntwk.msn.net [207.46.42.176]
     13     *        *        *     Request timed out.
     14     *        *        *     Request timed out.
     15     *        *        *     Request timed out.
     16     *        *        *     Request timed out.
     17    87 ms    84 ms    85 ms  origin.by173w.bay173.mail.live.com [65.55.157.144]
    Trace complete.
    C:\Users\C.Cunningham>tracert 207.46.11.236
    Tracing route to origin.by181w.bay181.mail.live.com [207.46.11.236]
    over a maximum of 30 hops:
      1    16 ms    16 ms    19 ms  xfwsr12-nwca-01.sys.comcast.net [68.85.15.244]
      2    18 ms    13 ms    13 ms  ae-14-32767-ar03.newcastle.de.panjde.comcast.net[68.85.192.205]
      3    21 ms    19 ms    21 ms  he-5-12-0-0-cr01.ashburn.va.ibone.comcast.net [68.86.95.141]
      4    18 ms    21 ms    18 ms  he-0-13-0-0-pe07.ashburn.va.ibone.comcast.net [68.86.86.50]
      5     *        *        *     Request timed out.
      6     *        *        *     Request timed out.
      7     *        *        *     Request timed out.
      8     *        *        *     Request timed out.
      9     *        *        *     Request timed out.
     10     *        *        *     Request timed out.
     11     *        *        *     Request timed out.
     12     *        *        *     Request timed out.
     13     *        *        *     Request timed out.
     14     *        *        *     Request timed out.
     15     *        *        *     Request timed out.
     16     *        *        *     Request timed out.
     17     *        *        *     Request timed out.
     18     *        *        *     Request timed out.
     19     *        *        *     Request timed out.
     20     *        *        *     Request timed out.
     21     *        *        *     Request timed out.
     22     *        *        *     Request timed out.
     23     *        *        *     Request timed out.
     24     *        *        *     Request timed out.
     25     *        *        *     Request timed out.
     26     *        *        *     Request timed out.
     27     *        *        *     Request timed out.
     28     *        *        *     Request timed out.
     29     *        *        *     Request timed out.
     30     *        *        *     Request timed out.
    Trace complete.
    Results of Intel WiFi Manual Diagnostics
    Test Name                 Test Result   Test Summary
    Hardware Test           Passed        Wireless Hardware is enabled
    Driver Test                 Passed        Diver is loaded. NETwNs64 Version 13.3.0.24
    Radio Test                  Passed       Radio is ON
    Scan Test                   Passed       There are 25 Networks available to connect
    Association Test        Passed       Associated
    Authentication Test   Passed       Authenticated
    Signal Test                Passed       Signal Quality: Poor
    Ping Test                  Failed          No Reponse: default gateway, DHCP server
    I hope this information is enough to get to the root of this problem once and for all.  Please let me know if you any other information such as event logs or statistics. 
    Thanks in advance.

    Results of Intel WiFi Event View Log (I deleted some lines since there were basically repeats of the same messages)
    #Event  Source  Time     
    Error Severity    Domain               
    User      Description
    45           EvtEngine           
    3/8/2015 20:40  Success               
    Connection         SYSTEM               
    iAMT - Failed to read Windows Events Log
    46           S24EvMon          
    3/8/2015 20:41  Information       
    AppDriver          
    SYSTEM               
    Getting List of adapters.
    47           S24EvMon          
    3/8/2015 20:41  Information       
    AppDriver          
    SYSTEM               
    Intel adapter(s) found.
    156         S24EvMon          
    3/8/2015 20:47  Information       
    Driver    SYSTEM               
    AddToExclude 06:1d:d5:d5:34:f0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_AUTH_FAILURE
    157         S24EvMon          
    3/8/2015 20:47  Information       
    Driver    SYSTEM               
    ATC 06:1d:cf:2a:44:c0 xfinitywifi 6 RSSI=-88
    158         S24EvMon          
    3/8/2015 20:47  Error     
    Driver    SYSTEM               
    AssociationFailure 06:1d:cf:2a:44:c0 xfinitywifi 6 CNCT_GENERAL_FAILURE
    159         S24EvMon          
    3/8/2015 20:47  Information       
    Driver    SYSTEM               
    AddToExclude 06:1d:cf:2a:44:c0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
    160         S24EvMon          
    3/8/2015 20:47  Information       
    Driver    SYSTEM               
    ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-79
    161         S24EvMon          
    3/8/2015 20:47  Success               
    Driver    SYSTEM               
    RxAuthSuccess 06:1d:d5:d5:34:f0 6
    162         S24EvMon          
    3/8/2015 20:47  Success               
    Driver    SYSTEM               
    RxAssocResp 06:1d:d5:d5:34:f0 6 -77
    163         S24EvMon          
    3/8/2015 20:49  Information       
    TCP/IP  SYSTEM               
    VoIP: Got link down - deleting flows .
    164         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-88
    165         S24EvMon          
    3/8/2015 20:49  Error     
    Driver    SYSTEM               
    AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
    166         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    AddToExclude 06:1d:d4:eb:87:00 xfinitywifi 11 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
    167         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-89
    168         S24EvMon          
    3/8/2015 20:49  Error     
    Driver    SYSTEM               
    AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
    169         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    AddToExclude 06:1d:d4:eb:87:00 xfinitywifi 11 WEV_EXCLUDE_LIST_REASON_802_11_ASSOC_FAILURE
    170         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    ATC 06:1d:d4:eb:87:00 xfinitywifi 11 RSSI=-90
    171         S24EvMon          
    3/8/2015 20:49  Error     
    Driver    SYSTEM               
    AssociationFailure 06:1d:d4:eb:87:00 xfinitywifi 11 CNCT_GENERAL_FAILURE
    172         S24EvMon          
    3/8/2015 20:49  Information       
    Driver    SYSTEM               
    ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-82
    173         S24EvMon          
    3/8/2015 20:49  Success               
    Driver    SYSTEM               
    RxAuthSuccess 06:1d:d5:d5:34:f0 6
    174         S24EvMon          
    3/8/2015 20:49  Success               
    Driver    SYSTEM               
    RxAssocResp 06:1d:d5:d5:34:f0 6 -81
    175         S24EvMon          
    3/8/2015 20:50  Information       
    Driver    SYSTEM               
    AddToExclude 06:1d:d5:d5:34:f0 xfinitywifi 6 WEV_EXCLUDE_LIST_REASON_802_11_AUTH_FAILURE
    176         S24EvMon          
    3/8/2015 20:50  Information       
    Driver    SYSTEM               
    ATC 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-79
    177         S24EvMon          
    3/8/2015 20:50  Success               
    Driver    SYSTEM               
    RxAuthSuccess 06:1d:d5:d5:34:f0 6
    178         S24EvMon          
    3/8/2015 20:50  Success               
    Driver    SYSTEM               
    RxAssocResp 06:1d:d5:d5:34:f0 6 -80
    179         S24EvMon          
    3/8/2015 21:03  Information       
    Driver    SYSTEM               
    RoamTrigger 06:1d:d5:d5:34:f0 xfinitywifi 6 RSSI=-81 MisBcn=8 RSSITh=-85 Roam Other Reason
    186         S24EvMon          
    3/8/2015 21:21  Information       
    General               
    SYSTEM               
    DeviceIoCtrlS24NDIS: (2) Failed to send OID 0xff100055 to driver. Error - 31
    187        
    S24EvMon          
    3/8/2015 21:21  Information       
    General               
    SYSTEM               
    DeviceIoCtrlS24NDIS - Dot11ExtNicSpecificExtension failed (31)

  • DNS Server problems with ASA 5505

    Hi guys,
    we setup a new ASA 5505 which is mainly used as our VPN gateway. The ASA is configured and controlled by our ISP (and this is where the problem starts )) and they somehow cannot manage to get the VPN settings really working.
    So, here is our problem.
    our machines(Windows 7) are configured to get the network settings through DHCP (Windows 2012 Server).
    Before I connect with AnyConnect to our VPN gateway, the DNS Server setting in the network settings for the adapters(IPv4) are set to 'dynamic'
    When I now connect, this setting is changes to a statc entry (which is our DNS server).
    When disconnecting, it is not reverted back, which means I have to do this always manually.
    What I do not understand is the fact, that the DNS server is set for all the adapters, shouldtn't it be only set to the anyconnect adapter?.
    The interesting thing is, that when I connect to a different ASA, this does not happen. The ISP is now saying, that the machines are configured exactly the same and that they cannot reproduce, but I can't believe this.
    This issue shows up at every machine which connects to our vpn, so it is not only a single machine which might be misconfigured.
    Do you have any idea what might cause this issue?
    btw, the second ASA (which works) is from our partner company, so we cannot simply copy the config
    THanks in advance
    Patrick

    Nice to see someone from BT has addressed your issue 
    I have this exact same problem, seems completely bizarre, I'm pretty sure I had the same problem with the original home hub (i have the latest one now). Can you confirm whether the problem does affect anyone with a bt home hub and not just the one that the dyndns is pointing at? I'll try and confirm by hitting your domain from my home connection.

Maybe you are looking for

  • IPad as remote for Apple TV First Gen

    After installing the "Remote" app on my iPad 2, the instructions then direct you to "turn on Home Sharing on your apple tv." There is no such option on my apple tv settings. Am I even able to control my old apple tv with an iPad? Please advise.

  • Deploying the par file

    Hello experts...       Can any body have the step by step process for how to deply the par files? please let me know if you have any weblogs? Thanks padma

  • Routine in InfoPackage for flatfile loading

    Hi Friends, Can you give be possiblesolution for my scenario. I am getting a flatfile from a Third Party source and I am loading the data into a Cube. Recently, we have identified that we are getting duplicate data in the file for the same week.And I

  • Class filter, in need of

    I'm looking for a class filter. Do you know of one? Do you have any pointers for designing one? I'm thinking it would work like this: You've got a big set of classes. These classes implement various interfaces- some implement one, some implement seve

  • Migration Assistant to an Intel Mac?

    Will it be possible to transfer things like current user settings from my current mac to a new intel mac? Anyone whose done this, please let me know.... Thanks, -David