Cannot Access Windows 2008 R2 Member Servers From The DMZ Zone to the Internal Network Domain Controller

active-directory

I have 2 Sharepoint Servers and 1 Fast Server(All Windows 2008 R2) moved From Internal Network To The DMZ layer. Now these 3 servers cannot communicate with the DC & DNS(Windows 2000). All the related ports have been open from the Firewall WatchGuard both ways.
But i can ping the DC & DNS. I can access the shared folder on both the DC & DNS.

Login is too slow,
When i try to add a domain user to local administrators group, the following error occurs:

Error: RPC Server is Unavailable.
Event Log Error: **The processing of Group Policy failed. Windows could not resolve the user name. This could be caused by one of more of the following:
a) Name Resolution failure on the current domain controller.
b) Active Directory Replication Latency (an account created on another domain controller has not replicated to the current domain controller).

Best Answer

  1. Use Network Monitor to watch for packet retransmits from a server on DMZ when you try to do something that fails, like add a local admin.
  2. You have increased complexity because your DMZ servers are >= 2008 and your old internal AD boxes are not. 2008 changed RPC port ranges. I see you've listed some in comments, but make sure all ports on both 2003 & 2008 are open both ways.
  3. You should route, not NAT, your DMZ to internal network. NAT will make things harder, if not impossible to get working. Microsoft does have some suggestions on this.
  4. Make this all easier by using IPSec tunneling, but I don't believe it can use NAT either.
Related Topic