RE: [ActiveDir] Disable site link bridging and DFS site costing

Fri, 07 Apr 2006 01:34:20 -0700

Title: Disable site link bridging and DFS site costing

Thanks Dean.
Comments inline.
 
 ... sorry, got carried away and forgot to address your more direct questions -
[Neil Ruston] LOL. 
 
>> Is this a forest wide or site wide change?
I believe it prevents the affected ISTG from creating connection objects on its bridgeheads sourced from DCs in non-transitive sites, i.e. it's mostly a site-wide change (to be clear though, I'm inferring this definition since I don't have any other docs. that neatly package a full feature description)
[Neil Ruston] I guessed as much and this is a shame. I now need to ensure somehow that admins change each site as they come online :( 

>> What attribute is changed in AD as a result of the above repadmin command?
NTDS Site Settings --> Options : bit 12 I believe (4096)
[Neil Ruston] OK - that's nice and intuitive :) and this is documented where... ? 

>> Is the change effective immediately or after a reboot?
To the ISTG, it's immediate.  DFS requires a bounce.
[Neil Ruston] Meaning all DFS servers in the hierarchy need a bounce or just... ? 
 
>> Does this actually disable site link bridging as per my requirement?
I haven't had reason to try it myself as yet ... that said, theory would indicate that it does so but only for the site in question and only from an inbound perspective.  I'd have to try it out myself to be sure though (let me know your findings ;o)
[Neil Ruston] Understood altho tough to test in a lab :) 
 
>> Is my requirement not met at all? [or is it partially met? :) ]
Since you haven't defined your requirement, I don't know :o)
[Neil Ruston] My (hidden) requirement was to disable link transitive bridging whilst not breaking DFS :) 

>> Is there further info which describes how this functions 'under the covers'?
Public?  No, not that I know of.
[Neil Ruston] OK, time to pester my MS rep... 
 
>> i.e. what is happening behind the scenes such that bridging is disabled but DFS costing is not affected?
Unlike AD (necessary func. levels assumed), DFS costing does not use the ISTG's newer algorithms employed on 2K3 DCs (the Dykstra and Kruskal combo.), it continues to use the legacy ISM.  The legacy ISM remains active even on 2K3 DCs regardless of forest functional level for precisely this purpose.  In line with legacy behaviors, "Bridge all site links" disables the ISM subsequently and effectively disabling the newer DFS site-costing mechanisms.
[Neil Ruston] I didn't realise the legacy ISM still remained and that DFS costing used that. So the repadmin command affects the newer algo but leaves the older algo (and DFS) unchanged. Whereas the 'disable site link bridging' setting affects both ISM algos. Makes sense.   
 
--
Dean Wells
MSEtechnology
* Email: dwells@msetechnology.com
http://msetechnology.com
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dean Wells
Sent: Thursday, April 06, 2006 1:32 PM
To: Send - AD mailing list
Subject: RE: [ActiveDir] Disable site link bridging and DFS site costing

This switch is used to permit automatic site link bridging to be disabled without affecting DFS's ability to use the legacy ISM to calculate the cost matrix.  The change is maintained on the NTDS Site Settings object and is effective only against 2K3 SP1 ISTGs (you can originate the change anywhere you like but it won't become effective until it replicates to the active ISTG within the site whose NTDS Site Settings object you just altered).  When used to disable automagic site link bridging (as opposed to disabling it for the entire repl. transport), the site-costing calculation continues to occur and can subsequently be used by DFS.  Note that this ISTG behavior requires a minimum of forest func. level 1 and (again) a 2K3 SP1 DC.
 
Hope that helps.

--
Dean Wells
MSEtechnology
* Email: dwells@msetechnology.com
http://msetechnology.com
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED]
Sent: Thursday, April 06, 2006 12:15 PM
To: [email protected]
Subject: [ActiveDir] Disable site link bridging and DFS site costing

Background:

  • Designing a new global AD
  • Designing a new global DFS hierarchy
  • Org is very federated with firewalls etc etc
  • For various reasons, I suspect we may need to disable transitive bridging of site links (due to firewall rules)

According to this article: http://technet2.microsoft.com/WindowsServer/en/Library/c238f32b-4400-4a0c-b4fb-7b0febecfc731033.mspx disabling site link bridging can have a detrimental effect upon DFS.

As a result, the article explains how repadmin may be used to disable bridging without affecting DFS, using "repadmin /siteoptions w2k3_bridges_required" [supported by w2k3 sp1 ISTG DCs only]

This looks like a good fit for our requirements but I need a little more info on this new feature:

  • Is this a forest wide or site wide change?
  • What attribute is changed in AD as a result of the above repadmin command?
  • Is the change effective immediately or after a reboot?
  • Does this actually disable site link bridging as per my requirement? Is my requirement not met at all? [or is it partially met? :) ]
  • Is there further info which describes how this functions 'under the covers'? i.e. what is happening behind the scenes such that bridging is disabled but DFS costing is not affected?

Hopefully I understood the article correctly and haven't asked redundant questions :)

Thanks in advance,
neil



___________________________
Neil Ruston
Global Technology Infrastructure
Nomura International plc
Telephone: ჸ (0) 20 7521 3481

 
PLEASE READ: The information contained in this email is confidential and
intended for the named recipient(s) only. If you are not an intended
recipient of this email please notify the sender immediately and delete your
copy from your system. You must not copy, distribute or take any further
action in reliance on it. Email is not a secure method of communication and
Nomura International plc ('NIplc') will not, to the extent permitted by law,
accept responsibility or liability for (a) the accuracy or completeness of,
or (b) the presence of any virus, worm or similar malicious or disabling
code in, this message or any attachment(s) to it. If verification of this
email is sought then please request a hard copy. Unless otherwise stated
this email: (1) is not, and should not be treated or relied upon as,
investment research; (2) contains views or opinions that are solely those of
the author and do not necessarily represent those of NIplc; (3) is intended
for informational purposes only and is not a recommendation, solicitation or
offer to buy or sell securities or related financial instruments. NIplc
does not provide investment services to private customers. Authorised and
regulated by the Financial Services Authority. Registered in England
no. 1550505 VAT No. 447 2492 35. Registered Office: 1 St Martin's-le-Grand,
London, EC1A 4NP. A member of the Nomura group of companies.

Reply via email to