Connect to domain from another site

[mikkydoos]

Hi all,

 

Can anyone point me in the right direction to solve a problem....

 

Scenario:

 

Active directory domains...

Two separate schools, two separate Windows domains, two separate subnets.

The two sites are joined with an IPsec VPN connection between firewalls (Smoothwall).

DNS conditional forwarding is set up on both sites DC's pointing at each DC in the other domain.

 

Site A and site B are able to resolve hostnames, browse files and ping by IP and by hostname from client machines.

 

Problem:

Users travel from one site to the other with their respective domain joined laptops and are unable to connect/login to the remote domain.

DHCP addresses at the remote site are a different subnet to the domain they are trying to connect to.

 

 

Any pointers on how to set this up so users can login at each remote site?

 

Is this DNS or am I missing something in the firewall setup?

 

I also assume its a configuration that needs setting up in AD domains and trusts

 

 

 

 

 

Cheers in advance

Edited July 3, 2024 by mikkydoos

[Davit2005]

Trust between the 2 domains? You got the conditional forwarders which is also needed.

 

I know I did this when I wanted to rename a domain so I could have devices on either during migration.

 

If you have FW in between you may also need the AD directory applications or the roughly 21 tcp/udp ports allowed.

Edited July 3, 2024 by Davit2005

[3s-gtech]

https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts

 

We have two remote sites linked, but it's by leased line inside the PSBN so no need for a VPN. Your VPN will need to support all of these, or use AOVPN on the clients which can do it through 80 and 443.

[Michael]

You'll need to create a DNS Stub zone on each domain.

[mikkydoos]

All sorted with a Trust configured.

 

Works like a charm.

 

Thanks guys

[TwistedHelixis]

Can i jump in, now you have sorted it?

@Davit2005

I know I did this when I wanted to rename a domain so I could have devices on either during migration.

 

I need to rename a domain soon and this sounds like a smooth way of getting there. Would you mind letting me know what you did?

[jmak]

Can i jump in, now you have sorted it?

@Davit2005

 

 

I need to rename a domain soon and this sounds like a smooth way of getting there. Would you mind letting me know what you did?

This became something I need to do as of yesterday - I'd be interested too

[mikkydoos]

This became something I need to do as of yesterday - I'd be interested too

 

Actually me too... we have a stupid NT suffix name for our domain.