eean Posted October 10, 2008 Posted October 10, 2008 Hi, We are a split site school (primary school and secondary school - 10k distance). There is a VPN link (leased line) connection between the two for SIMS and the connection to the internet at the secondary site. The link is not fantastically fast or reliable (we're overseas). Currently, there are a number of domains on each site. This causes problems with duplicating work, and some (admin, mainly) staff work on both sites. So it would be better to have one domain. I understand that this is possible with active directory sites. Do we just have a subnet for each site then use that? Replication - is it bandwidth hungry? What happens when the link is down? Can we make it so that most services are replicated across each site? What happens when the link returns? Will windows figure everything out? (How clever is it? Hypothetically: if a user has changed their password at each site while the link is down, how does it know which to use?) Does it actually work?! Any help will be appreciated. I need to convince the new network manager that this is better than having all domain controllers at secondary, then a separate subdomain at primary which users can select if the link goes down Thanks,
eean Posted October 10, 2008 Author Posted October 10, 2008 Also, NM wants to put a firewall between the sites? I'm not entirely sure why... I think it might be to stop viruses spreading between the sites or something. Is there logic in this? Or will we have to open up so many ports for the replication that it's not worth doing.
mattx Posted October 10, 2008 Posted October 10, 2008 You can change settings in AD for replication over slow links etc. Checkout: How to optimize Active Directory replication in a large network For some more info on it.
mattx Posted October 10, 2008 Posted October 10, 2008 You have opened a whole new kettle of fish in regards to AD replicating between firewalls - happy reading !! Active Directory Replication over Firewalls 1
SYNACK Posted October 10, 2008 Posted October 10, 2008 I would think that you would want a server at each end so that all of the authentication is local to the site. AD sites and services can be used to setup multiple sites and sort out replication. Replication can be quite bandwidth heavy if there are lots of changes and initially. The clients will request and respond to the closest controller which could be specified in ad. Dividing up the subnets properly and firewalling will stop any authentication and unnecessary traffic from flowing over the slow link. AD is pretty reasonable when it comes to replication and working things out, it will attempt on to converge the data fully at each replication interval which I think is around 120 minutes. AD will start to complain if it cannot replicate for two to three days depending on configuration which starts to cause issues. If the user changes a password while the link is down at the remote site the local AD server will keep this change in its AD database and replicate it when it next can. If the user attempts to logon at the remote site they will have the new password but if the drive to the old site before the change has replicated it will be the old one. In general it will take 5 - 10 minutes to replicate it if the link is up but if you are dealing with file shares and stuff this interval will not matter as the authentication and kerberos ticket are picked up from the local server and then used on the main network. 1
powdarrmonkey Posted October 10, 2008 Posted October 10, 2008 To answer your broad questions: yes, it works, and it works well, and it sorts everything out. But it is no simple thing to set up, be prepared to spend probably a year on the transition. It's a very time-consuming process. Introducing a firewall is a whole other kettle of fish though.
eean Posted October 10, 2008 Author Posted October 10, 2008 To answer your broad questions: yes, it works, and it works well, and it sorts everything out. But it is no simple thing to set up, be prepared to spend probably a year on the transition. It's a very time-consuming process. Introducing a firewall is a whole other kettle of fish though. Why is it so complicated? The Microsoft article seems to make it sound fairly simple! What sorts of problems occurred? Thanks.
FN-GM Posted October 10, 2008 Posted October 10, 2008 Personally i would go on one domain. How much money (if any) would you have to spend for the connection between the schools. You could have a fibre connection between the school and use the internet connection just at one school. All internet traffic will go down the fibre connection. Fibre is expensive but is faster and more reliable.
Mcshammer_dj Posted October 10, 2008 Posted October 10, 2008 I would consider terminal services with the fibre option
eean Posted October 10, 2008 Author Posted October 10, 2008 Fibre is expensive but is faster and more reliable. I think we've got fastest option we can get/afford... I'm in Malaysia, you kinda have to take what you can get!
powdarrmonkey Posted October 10, 2008 Posted October 10, 2008 Why is it so complicated? The Microsoft article seems to make it sound fairly simple! What sorts of problems occurred? It's not so much complicated as time-consuming, particularly if it doesn't work quite how you expected. All I'm saying is don't rush into it.
eean Posted October 12, 2008 Author Posted October 12, 2008 What roles (e.g. Operations master etc...) need to be replicated on each site to ensure that if the link goes down both sites remain functional? Or does the Sites setting itself sort this out? What about DNS? Obviously needed on each site, but how do you set them up? Is one a backup to the main?
FN-GM Posted October 13, 2008 Posted October 13, 2008 What roles (e.g. Operations master etc...) need to be replicated on each site to ensure that if the link goes down both sites remain functional? Or does the Sites setting itself sort this out? What about DNS? Obviously needed on each site, but how do you set them up? Is one a backup to the main? If you make both DC’s a global catalogue if one DC goes down the network should run. As for DNS, have a DHCP server on each site and configure the DHCP so it points to your DNS that is on site as primary. If you only have one DNS server on each site make the secondary the one on the other site. Do the ordering the opposite way round on the other site 1
eean Posted October 13, 2008 Author Posted October 13, 2008 Yikes! I've just discovered that our WAN link is a 1MB PTP VPN. Our new NM wanted to have all the domain controllers at the secondary site and for primary to authenticate over that!
eean Posted October 13, 2008 Author Posted October 13, 2008 As for DNS, have a DHCP server on each site and configure the DHCP so it points to your DNS that is on site as primary. If you only have one DNS server on each site make the secondary the one on the other site. Do the ordering the opposite way round on the other site Will the changes replicate to each other?
FN-GM Posted October 13, 2008 Posted October 13, 2008 Will the changes replicate to each other? No you do it once on each site Zak
SYNACK Posted October 13, 2008 Posted October 13, 2008 Will the changes replicate to each other? If you use AD integrated DNS this will replicate across the sites aswell along with the other AD data. 1
somabc Posted October 13, 2008 Posted October 13, 2008 You have a school with sites in Essex & Malaysia?
eean Posted October 14, 2008 Author Posted October 14, 2008 You have a school with sites in Essex & Malaysia? Now now, no one likes a smartarse. Location duly updated, with flags.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now