[EMAIL PROTECTED] wrote:
Within a domain, when a user’s credentials are presented to a member
server, that member server communicates with the domain controller to
validate the creds.
We have a cross-forest (cross–company; a divestiture) trust set up that
we are testing. A member server in the other forest/domain and across
the firewall is having trouble authenticating credentials from our
domain. Their DC works fine. Ports on the firewall are only opened for
the two domain controllers (one on each side).
Here’s the question: in order to validate the “foreign” credentials,
should the member server be looking first to its own DC, or is it trying
to cross the firewall to find our DC? Based in the preliminary traffic
sampling so far, I think that’s what is happening. Is that
normal/expected behavior?
I've encountered similar problem with someone who requested my help, his
company was providing help desk services for company in the states, they
have similar configuration, also only one DC from each side was able to
communicate across the firewall- most probably because is that You have
opened ports to only one DC at opposite side, but in DNS You have more
then these two DCs registered - client is picking up DC (but not these
for which You have ports opened) and tries to contact this DC.
Check if such situation is not the case in Your network.
--
Tomasz Onyszko
http://www.w2k.pl/blog/ - (PL)
http://blogs.dirteam.com/blogs/tomek/ - (EN)
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
