vanblah

I have a DHCP server (Windows Server 2003 Ent) that I want to set up a superscope on. I bind 10.10.2.20 and 10.30.10.2 to the NIC and set up the scopes. That's not the problem.

I have two VLANs 10.10.x.x and 10.30.x.x. Routing and forwarding seem to be working except in the following case.

I have one computer (10.30.10.14) in the 10.30.x.x VLAN and many computers in the 10.10.x.x VLAN.

From the 10.30.10.14 machine I can ping any device in the 10.10.x.x VLAN EXCEPT 10.10.2.20 (request timed out)...

From 10.10.2.20 (DHCP server) I can ping anywhere in the 10.10.x.x VLAN and I can ping 10.30.10.1 (gateway and address of VLAN 10.30.x.x) but not 10.30.10.14 (again, request timed out).

From any other machine in the 10.10.x.x VLAN I can ping 10.10.x.x (including 10.10.2.20) and I can also ping 10.30.x.x.

What am I missing?

bendsley

I'm assuming your subnets and routes are completely set correctly? As well as gateways?

Also, are you using IAS under Win2k3?

Might also look here.

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

vanblah

Yes. Actually I have edited the initial post to read:

From 10.10.2.20 (DHCP server) I can ping anywhere in the 10.10.x.x VLAN and I can ping 10.30.10.1 (gateway and address of VLAN 10.30.x.x) but not 10.30.10.14 (again, request timed out).

It's strange because I can ping EVERYTHING from anywhere EXCEPT between those two machines.

bendsley

If you have two subnets bound to the same NIC (10.10.2.20) and (10.30.10.2), why would you want to ping the second IP on the NIC (10.10) if they're both bound to the same NIC? If you are able to ping from 10.3.10.14 to any IP on the 10.10 VLAN, at least you know your routes are ok.

This might be easier by instant messenger instead of posting in the forums. Send me a private message through the forums and I will give you my IM names (aim, yahoo, msn).

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

vanblah

Bendsley - I have PM'd you my info.

I'm running ISA (not IAS) on the 10.30.10.14 server. Although right now I have shut down all of the ISA services to troubleshoot this weird problem. We may set up RADIUS at a later time on this server. We do use RADIUS on a W2K box; but the two machines aren't aware of each other.

To clarify: I can ping any IP on the 10.10 VLAN from 10.30.10.14 but NOT 10.10.2.20 ... very strange. I have even tried removing the 10.30.10.2 address from the NIC on 10.10.2.20 ... no luck.

gcbrowni

Check your subnet masks. What are your actual VLAN numbers? Ae you using the default VLAN?

__________________
From the day of his birth Gilgamesh was called by name.

vanblah

masks are all correct (we are using 16-bit masks).

Yes we are using the default VLAN defined as 10.10.80.1/16. The other VLAN is 10.30.10.1/16.

There is another VLAN that works just fine.

vanblah

UPDATE:

During lunch I rebooted the DHCP server (it's also a domain controller so I wanted to wait for lunch) 10.10.2.20 ...

I can now ping 10.10.2.20 from 10.30.10.14 ...

I still can't ping 10.30.10.14 from 10.10.2.20.

This may be a firewall issue (10.30.10.14 is running ISA 2004). I can't find any explicit rules that prevent pings from 10.10.x.x network though.

bendsley

When I setup and ISA 2004 server, I wasn't able to do a whole lot with it without highly configuring it. Then I realized how much Windows sucks and went with IPTables on a Debian machine.

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."

vanblah

Yes ... IPTABLES is a much better way to setup a firewall.

I don't have that luxury ... we want to use Active Directory for authentication. I don't even want to get into M$ version of LDAP ...

bendsley

LDAP really isn't that difficult at all and Linux can authenticate through LDAP very easily.

__________________
"You hear the one about the fella who died, went to the pearly gates? St. Peter let him in. Sees a guy in a suit making a closing argument. Says, "Who's that?" St. Peter says, "Oh, that's God. Thinks he's Denny Crane."