Recommended Posts

I am the System's Administrator of an EMS organization and we employ approximately 50-60 members. Some quick overviews on the existing network..

 

  1. The router is a Linksys E900 SOHO Router that has been working out surprisingly well for the last year or two.
  2. The router then feeds to a unmanaged 3Com SuperStack Switch (sorry for the typo)
  3. The Wireless Access Point is a Linksys WAP4400N Level 2 AP
  4. The Windows 2008 R2 Server runs: Active Directory, DNS, DHCP, File Services, Print Services, and Network Services (VPN-PPTP)
  5. The client workstations (4) are all running Windows 7 Pro with a fairly restrictive GPO
  6. At any given time I may have up to 15 wireless devices connected (primarily: iPhones/iPads, android devices, and laptops Mac/Windows)

I just purchased a Dell PowerEdge 6850 with 24GB of RAM and 4x3.0GHZ Dual Core Processors as an upgrade from our old PowerEdge SC440 with 4GB RAM and 1x2.8GHZ Core2Duo Processor. I plan on using the old server as an Untangle Web Filter (which I have running on a MUCH older machine and isn't worth mentioning). The new server I am looking to run as many items in a VM as possible without degrading the network. I want my VM's to backup weekly so we have a minimal chance of a data loss and guaranteed "restore points" that I can rely on should something need migrated or catastrophically fail. 

 

I guess what I'm asking is realistically, how would you deploy this network, I would like to almost totally "redo" it, the only thing I am limited by is where the computers physically are. The reason is some of the computers are logging on VERY slow (5-10 minute) times, while other's are zipping right into the AD. So between that and the new hardware coming it will give me some time to re-do some things.

 

Any insight/pro-tips would be incredibly helpful. Thanks!

 

Edit: Point of interest, I am debating "UniFi" as the wireless management solutions, but I would like to use my existing access points? I'm not sure if that is even a possibility? I haven't done as much research as should have since I have had limited time lately

Link to comment
https://www.neowin.net/forum/topic/1195363-input-reqredesigning-my-network/
Share on other sites

"The reason is some of the computers are logging on VERY slow (5-10 minute) times"

What are you clients dns - you have something WRONG if it takes more than a few seconds to login.

No you can not use Unifi with other AP.

Managed switch doing what? Do you have actual vlans, is your wireless isolated from your wired for example?

  On 05/01/2014 at 19:42, BudMan said:

"The reason is some of the computers are logging on VERY slow (5-10 minute) times"

What are you clients dns - you have something WRONG if it takes more than a few seconds to login.

No you can not use Unifi with other AP.

Managed switch doing what? Do you have actual vlans, is your wireless isolated from your wired for example?

 

  1. No the DNS settings are all the same on each machine
  2. I guess that rules out UniFi for now
  3. No I do not have actual Vlans (that was a typo, and I will fix that, it is UNmanaged)
  4. The Wireless is on the same 192.168.1.x network - no separation. 

Some recommendations

Get rid of the unmanaged junk if you can replace it with some real cisco gear which can be found cheaply online.

Get 2 or 3 .Net cards from smartcard focus and implement smart card login its very simple.

Switch to SSTP for the VPN (TMG can do this)

Two servers + Starwind ISCSI = cheap failover clustering

As for wireless if you can get some cisco gear go for WPA 2 enterprise PEAP with optional smart card login (instead of mschap 2)

If you do plan on using vlans don't get it confused with trunking just use static vlans ie switchport access vlan x

Great project for learning.

"No the DNS settings are all the same on each machine"

Which is what? Members of AD should ONLY - and I mean ONLY being pointing at your AD dns.. If they point to your router for example then its the reason for your issue with slow login.

If your looking to updated your network then yeah I would go with a managed switch and a min isolate your wired from your wireless network.

  On 05/01/2014 at 20:12, BudMan said:

"No the DNS settings are all the same on each machine"

Which is what? Members of AD should ONLY - and I mean ONLY being pointing at your AD dns.. If they point to your router for example then its the reason for your issue with slow login.

If your looking to updated your network then yeah I would go with a managed switch and a min isolate your wired from your wireless network.

 

 

The workstation computers are pointing to the AD server (192.168.1.2) as their only DNS server. nslookup resolves forward and reverse lookups appropriately.

  Quote
Then it makes no sense that it should take 5 to 10 minutes to log in, you need to run dcdiag and find out what is taking so long - clearly something is wrong. 

 

I know toss all about networks, but I had this at work when someone's profile was pulling down each time with all his files.

 

Like I said, I know toss about it, and not my dept.

......................... THOR failed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\THOR

Skipping all tests, because server THOR is not responding to directory

service requests.

That's a bad thing, Not diagnostics. I suspect you disabled a critical service on the dc when doing your hardening by linking the gpo to the domain not an ou.

If this is the case make some OU's like

CORPNET.LOCAL

---DOMAIN CONTROLLERS

---CORPNET COMPUTERS*

--------CLIENTS*

--------SERVERS*

---CORPNET USERS*

--------DOMAIN ADMINISTRATORS*

--------SERVICE ACCOUNTS*

--------LOCAL ADMINISTRATORS*

And link the gpos where marked instead of the entire domain

  On 06/01/2014 at 17:10, TPreston said:

......................... THOR failed test Connectivity

Doing primary tests

Testing server: Default-First-Site-Name\THOR

Skipping all tests, because server THOR is not responding to directory

service requests.

That's a bad thing, Not diagnostics. I suspect you disabled a critical service on the dc when doing your hardening by linking the gpo to the domain not an ou.

If this is the case make some OU's like

CORPNET.LOCAL

---DOMAIN CONTROLLERS

---CORPNET COMPUTERS*

--------CLIENTS*

--------SERVERS*

---CORPNET USERS*

--------DOMAIN ADMINISTRATORS*

--------SERVICE ACCOUNTS*

--------LOCAL ADMINISTRATORS*

And link the gpos where marked instead of the entire domain

 

I will absolutely look into that, most of the restrictions, however, are basic ones such as "no run box," "no task manager," nothing really involving services or anything but I will look into it. I've also been researching the *._msdcs.eatvac.org could not be resolved to an IP address error" and seeing that a lot of other users have had a similar problem. Thank you for the prompt reply!

 

Edit: I've also attached my GPO

East_Allen_EMS_GPO.zipFetching info...

yeah clearly

"Skipping all tests, because server THOR is not responding to directory"

Is not a good sign ;)

Also your AD domain resolves on the public net, not a FAN of doing this at all.. Can cause all kinds of grief.. Would normally suggest use of AD domain that is not a global TLD, something like .lan or .local .adnet - something that is not active tld on the public net.

;; QUESTION SECTION:

;eatvac.org. IN A

;; ANSWER SECTION:

eatvac.org. 86400 IN A 74.208.159.244

What does your DC point to for dns?? Should be pointing to itself or another AD dns server in your network. Should not be pointing to isp or public or router, etc.

It has been setup with a botched tld for awhile now... at the time I wasn't aware that use eatvac.local would be a best practice, I got a good head smack for that one. The DC (thor) is pointing to 192.168.1.2 (proper IP) forward and reverse. Attached both logs from DNS. Then to circumvent the issue we were having with www.eatvac.org not being accessible internally I just added a www host to point to our webserver IP.

Forward_Lookup_DNS.txtFetching info...

Reverse_Lookup_DNS.txtFetching info...

what is this?

(same as parent folder) Host (A) 74.208.159.244 static

You have eatvac.org pointing to that public IP?

You need to address this

"Skipping all tests, because server THOR is not responding to directory"

That clearly is not good ;)

The same as parent folder I replaced that with 192.168.1.2 - that should not have been, only "supply, support, test, internal, and www" should have pointed to our webhost IP. Same as parent folder is now 192.168.1.2 (HUGE OVERSIGHT, thanks for catching that, because I wouldn't have noticed it :() - now I released and renewed DHCP on my workstations, and for DNS I did a flush and register, and now logons seem to be improved tremendously. HOWEVER, this still does not resolve the "Skipping all tests.. error" - which you would think would be causing more problems?

 

Edit: I believe I resolved it by making some slight changes here and there and now I pass. I am getting TONS of errors now though about a printer (that is currently offline, so maybe that's why?)

DCDIAG_01-06-14_RESOLVED.txtFetching info...

I wouldn't be so worried about printer stuff, but this points to something out of whack.

An Warning Event occurred. EventID: 0x00001695

Time Generated: 01/06/2014 13:40:52

Event String:

Dynamic registration or deletion of one or more DNS records associated with DNS domain 'eatvac.org.' failed. These records are used by other computers to locate this server as a domain controller (if the specified domain is an Active Directory domain) or as an LDAP server (if the specified domain is an application partition).

No errors left :) everything seems to be good now. MUCH QUICKER (even than before) log ons! BudMan, +2 to you! I guess now I just have to review some of the proposed network solutions for redesign. Unfortunately we can't do much with CISCO since our budget does not allow for such equipment.

Well there are plenty of budget managed/smart switches on the market that would allow for vlans. How many ports do you need? You could always go with a smaller ported managed/smart switch as your core and then just use dumb switches in the closets or to add port count.

You could go with something something like a router distro, pfsense, m0n0wall, smoothwall, ipcop on some old pc hardware to give you a decent firewall/router at your edge vs some soho wireless thing. A e900 is something you would run in your house if you ask me, not a place of business.

You would be amazed at what you can accomplish on a shoestring budget ;) A cheap PC hardware with bit of ram and you could run content filtering with squid, ntop for reporting, snort for IDS, etc. Could run a captive portal for your guest wireless, using WPA enterprise for your normal wireless, etc. etc.

  • Like 1

The E900 was a serious quick fix when our original router took a dive. I'm looking at a NetGear FVS338 or FVS538 VPN/Firewall combo to allow for IPsec VPN as opposed to PPTP via Server 2008 which we have right now. When the new server arrives it will be a virtual Server 2008 installation and the old server will be an Untagle server more than likely running web filtering, and reporting. I love that it integrates with AD but I would like a free alternative so I can have users authenticate via their AD credentials and have their activity logged. I also would like to segment our Wifi and have a guest network so when we have "company" they don't have access to internal resources etc... Basically popping up our internet terms of service upon connection. I will definitely look into some of the router distros you mentioned as I have never heard of some of those and I'm sure you wouldn't mention them if they weren't looking into ;)

 

Edit: It looks like m0n0wall will be the winner for router distro :D

pfsense is a fork of m0n0wall - m0n0wall rocks it for router/firewall. Pfsense adds some bells and whistles is all.

It would be a fine choice to be sure.

If you ask me ipsec is dying as a road warrior solution to vpn access - I would look more to openvpn to be honest. It can run over 1 port (443 SSL for example) which is pretty much ALWAYS open no matter your location. Can even work over a proxy, for example to get ipsec vpn to work at a hotel quite often you have to request that type of connection.

Openvpn has released clients for both android and ios devices that works great. My ipad for example - click, click and vpn'd into my home network from anywhere there is wifi connectivity since when do they block 443.. While ipsec vpns use ESP protocol 50 and 51 AH and ISAKMP.. Its a fairly complicated solution that is not always available. There are better solutions to be sure.

My only concern with OpenVPN is it can not run as a server on Windows (so it seems), but I do agree with the logic... lots to think about there.

 

Edit: I'm dumb... http://forums.openvpn.net/topic7806.html

 

Smh... I'm going insane with all of this ;)

Who told you that?

https://community.openvpn.net/openvpn/wiki/Easy_Windows_Guide

But I would not suggest running it on a "server" inside your network be it linux, bsd or windows or OS X. The VPN endpoint belongs on the edge of the network - not some box "inside" the network.

No what I am saying it run it on the edge ;) With pfsense for example its click, click and up and running - one of those bells and whistles I was saying that m0n0wall does not have ;)

post-14624-0-83922700-1389047748.png

Whatever you pick for your router distro - it supporting the vpn server would be a nice bell or whistle ;)

You can run into problems with a vpn endpoint inside a NAT as an endpoint. For starters that server inside your network is NOT the gateway of your other devices on your network. So you might need to NAT your vpn clients into your lan network. Or create other routes, be it on your other edge router or the other hosts in your network. Or use tap vs tun interface where you bridge the remote clients into your network.. Now your sending broadcast traffic over a wan connection, etc. etc.

Its nothing that can not be worked out - but it is much simpler if the vpn endpoint is at your networks edge/gateway anyway.

Ah, I see! Hmm, I was really liking m0n0wall, which would be an IPsec VPN on the edge, but pfsense does look like it will integrate the VPN much easier. My users are absolutely TERRIFIED of technology so OpenVPN would make their connecting in a bit easier. I hope you are getting paid for schooling me in Windows networking... if not, I'll send cookies or something. I learned more today than I have in classes.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Vivetool also has a GUI. Literally took me three clicks to enable this from there.
    • Microsoft Weekly: OneDrive horror stories, ramblings about Start menu, and more by Taras Buria This week's news recap is here, delivering you a roundup of the most important Microsoft stories, including a bunch of odd stuff and bugs in Windows, OneDrive horror stories, ramblings about the Start menu, a couple of new Windows 11 preview builds, important news from AMD, and a lot more. Quick links: Windows 10 and 11 Windows Insider Program Updates are available Reviews are in Gaming news Windows 11 and Windows 10 Here, we talk about everything happening around Microsoft's latest operating system in the Stable channel and preview builds: new features, removed features, controversies, bugs, interesting findings, and more. And, of course, you may find a word or two about older versions. Microsoft released a new out-of-band update to fix boot issues on certain Surface devices. The company announced certain Windows 365 updates, such as VBS and HVCI support (by default) and app provisioning in Windows 365 instead of entire cloud PCs. Microsoft is also removing legacy drivers from Windows Update in a new "strategic move." This is the default Windows 365 wallpaper On the negative side, we have the latest Patch Tuesday updates breaking the DHCP Server in all Windows Server editions. Also, there is some bad news for PC users with Windows Hello cameras: after the April 2025 Patch Tuesday updates, Windows Hello does not work in the dark. The change was quietly introduced to address security issues. Windows Goodbye That is not all, though. As it turned out, solid-state drives from WD could still block your computer from installing Windows 11 version 24H2, which was released in October 2024. Also, Microsoft's Family Safety feature is now blocking Chrome, for some reason. Here is an editorial from Usama Jawad (welcome back) about how, four years after the initial release, Windows 11 still does not offer strong enough reasons to upgrade from the outgoing Windows 10. Also, Usama shared his thoughts about the Start menu and why he had stopped caring about its changes altogether. Speaking of the Start menu, check out our overview of what users wanted from Microsoft and what the company delivered in the redesigned Start menu, which was recently announced. Windows Insider Program Here is what Microsoft released for Windows Insiders this week: Builds Canary Channel Build 27881 This week's Canary build introduced context menu improvements, new accessibility features, Settings app tweaks, and more. Dev Channel Nothing in the Dev Channel this week Beta Channel Nothing in the Beta Channel this week Release Preview Channel Build 26100.4482 (KB5060829) This build improves File Explorer and search performance, adds some changes to default browser settings, and fixes multiple bugs. Some hidden stuff in the recent Windows 11 preview builds includes a new adaptive battery saver. This feature dynamically adapts battery saver mode according to your workflow, but in its current form, it is not fully operational. Even though Microsoft acknowledged its existence, the adaptive part still needs improvements. Another useful change in the recent builds is the return of a clock in the notification center. This time, however, Microsoft makes it more customizable, and you can toggle it on or off. Also, the company is moving more Control Panel bits to the Settings app and adding a rather unexpected customization feature that will let you select where system indicators (flyouts and sliders) appear on the screen. Microsoft started rolling out a new update for the Snipping Tool app. The latest release lets you save screen recordings as GIFs. Shortly after that, we posted a guide with a bit more detail about the feature. Updates are available This section covers software, firmware, and other notable updates (released and coming soon) from Microsoft and third parties, delivering new features, security fixes, improvements, patches, and more. Microsoft is working on a Dashboard redesign for PowerToys. Developers published an early look at what is coming to the app in future updates, revealing a better-organized page with quick links, a shortcut overview, and a list of available modules. This week's Office updates are rather mixed. OneDrive, for one, is having problems finding files. Microsoft acknowledged the issue, which affects users on Windows, iOS, Android, and the web. Unfortunately, that is not the only negative story about OneDrive. A new report from a frustrated user revealed a scary tale of Microsoft locking them out of an account full of invaluable content. Outlook also has some issues, this time, with opening emails, and Microsoft 365 will soon disable outdated protocols for file access. Finally, Copilot in Excel received a major update for context awareness, which made the assistant more useful when answering questions about data. This week's browser updates include several releases. Firefox announced a new method for pinning and unpinning tabs. It is now available for testing in the Nightly channel. Microsoft Edge was updated with fixes for two security vulnerabilities (high severity) originating from Chromium. Finally, here is this week's Microsoft 365 Roadmap with an overview of all the new stuff that Microsoft added to the website. Here are other updates and releases you may find interesting: Microsoft 365 security in the spotlight after Washington Post hack. Microsoft expands European sovereign cloud offerings with new data and key controls. Microsoft Defender XDR received TITAN-powered Security Copilot recommendations. Microsoft reportedly plans more layoffs. Watchdog found Microsoft guilty of confusing advertising when it comes to Copilot. Here are the latest drivers and firmware updates released this week: AMD released a new chipset driver for Ryzen processors under version 7.06.02.123, which followed a security update for TPM-Pluton. Nvidia 576.80 WHQL with fixes for the RTX 5090 FE, new game support, and a long list of fixes. You can get some extra performance on certain AMD Ryzen chips with a simple system tweak. Surface Pro 11 and Surface Laptop 7 received big firmware updates with multiple fixes and improvements. Reviews are in Here is the hardware and software we reviewed this week This week, Steven Parker reviewed the TerraMaster D4 SSD, a palm-sized DAS with up to 32TB of storage that you can connect over USB4. This thing is rather impressive, and for a modest price tag, it delivers a tiny footprint, great looks, full RAID support in TOS 6, quick connection, and more. On the gaming side Learn about upcoming game releases, Xbox rumors, new hardware, software updates, freebies, deals, discounts, and more. AMD and Microsoft announced some big news this week. The two companies revealed a new multi-year partnership, which secures AMD as the future maker of chips for Xbox consoles and other hardware. Sarah Bond announced the partnership in a new video on the official Xbox media channels. Turn 10 Studios announced a new Forza Motorsport update. Update 21 brings IndyCar content, Career mode expansion, Featured Tours, new reward cars, and more. It is now available on Xbox and PC via the Microsoft Store and Steam. Minecraft is another Microsoft-owned game that received a big update this week. The long-anticipated graphics overhaul is finally here with directional lighting, volumetric fog, improved shadows, reflections, godrays, and a lot more. In addition, Mojang released Chase the Skies, the latest content drop, which adds happy ghasts, new music disks, a locator bar for players, environmental fog in the overworld, new background music, and all sorts of small gameplay changes. Microsoft announced new games for Game Pass. The latest additions include FBC: Firebreak, Crash Bandicoot 4: It's About Time, Start Trucker, Wildfrost, Rematch, Call of Duty: WWII, Rise of the Tomb Raider, and more. As usual, some games are leaving the subscription. Valve released a big update for the Steam overlay. The latest version introduced major upgrades to CPU and VRAM usage, temperatures, and other important metrics that you might want to track when playing games on your gaming rig. Deals and freebies Also, be sure to check out this week's Weekend PC Game Deals article, which features rhythm bundles, fishing festivals, DRM-free summer sales, and more. Other gaming news includes the following: Take-Two confirmed Borderlands 4 will not cost $80 for the base game. The Coalition expanded the Gears of War: Reloaded beta after its rocky start. Ara: History Untold 1.4 update delivered overhauls to AI, map generation, combat, and more. Star Citizen Alpha 4.2 update lands with radiation hazards, dynamic rain, and more. This link will take you to other issues of the Microsoft Weekly series. You can also support Neowin by registering a free member account or subscribing for extra member benefits, along with an ad-free tier option. Microsoft Weekly image background by steve_a_johnson on Pixabay
    • I'm afraid not, Microsoft does release updated installation images for Windows through MVS every month, but they do not include any update to Defender's components or signatures. That's what the package talked about in the article is for, it includes a PowerShell script for the update.
  • Recent Achievements

    • First Post
      Johnny Mrkvička earned a badge
      First Post
    • Week One Done
      viraltui earned a badge
      Week One Done
    • One Month Later
      serfegyed earned a badge
      One Month Later
    • Dedicated
      firey earned a badge
      Dedicated
    • Dedicated
      fettermanj earned a badge
      Dedicated
  • Popular Contributors

    1. 1
      +primortal
      635
    2. 2
      ATLien_0
      230
    3. 3
      Michael Scrip
      218
    4. 4
      Xenon
      149
    5. 5
      Steven P.
      140
  • Tell a friend

    Love Neowin? Tell a friend!