MarcAlle

To followup on both. Client/Server time workstation is fine. To be clear, this is EVERY client in the domain cant map drives, only logging in locally, etc. Password has no expiration on it, can't reset it either because the domain controller cant see itself somehow. Cant open group policy either. It gets stuck at Applying Windows Settings - Safe mode just reboots the machine.

I'm getting an error and I have no idea why. It came up once before, then went away on its own. Symptoms: No network drives are mapping, can't see any shares, etc. DNS is working DHCP is working NPS is working RDP isn't working to the server (AD PDC), "Because of an error in data encryption, this session will end. Please try connecting again." I don't even know where to start. Nothing has been touched on this machine for a while! We installed Avast Business on this server several months ago, but it worked after that up to about 5 weeks ago, then it had this same issue. That issue went away, but now is back 5 weeks later. I've done 5 reboots to no avail. Thanks!

Oh...wait a moment. I forgot to put the default gateway into the machines on the VLAN network! Everything is working properly now. Now I just have to figure out HP's ACL's and I'll be all set haha!

Sorry to get you too excited haha! That is correct, I'm not able to.

Sorry...1 more question. Vlan100 isnt working for some reason. I had mentioned before about I want it (192.168.100.0/24) to be able to see the 172.16.0.0/16 network, but only select ports see the Vlan 100 network. Any ideas there. I've done this before, its just been a few years since and it was on older 3com equipment. Still a small learning curve here with the HP stuff and I'm very tired from working all weekend ha!

Yes its the "live" network...kinda. Its not going to be user-affecting at all at this point. My firewall is connected "directly" through an inline web filter. It goes Port41 on Switch -> Barracuda Filter -> LAN Side of Firewall. I ended up doing this: Secondary IP on VLAN1 of 172.1.1.2 Secondary IP on Firewall of 172.1.1.1 ip route 0.0.0.0/0 172.1.1.1 It looks like I'm able to get to the .18 range now and everything works as intended. Thanks for your help.

So, I'm a bit confused when you say add the IP to the switch? Whats the best way to approach this? Pardon my ignorance, I may just be not thinking properly.

So, if I understand properly. 1) Firewall is set to 172.1.1.1/30 2) Core's default ip route for 0.0.0.0 0.0.0.0 is now 172.1.1.1

Exactly. They all have the default gateway of the core router (18.10.1)

Destination Gateway VLAN Type Sub-Type Metric Dist. ------------------ --------------- ---- --------- ---------- ---------- ----- 0.0.0.0/0 172.16.0.1 1 static 1 1 127.0.0.0/8 reject static 0 0 127.0.0.1/32 lo0 connected 1 0 172.16.0.0/16 DEFAULT_VLAN 1 connected 1 0 172.18.0.0/16 DevNetwork 18 connected 1 0 192.168.100.0/24 Universal 100 connected 1 0

172.18.0.1 is the virtual interface on the firewall (which is 172.16.0.1) I initially set it up that way so the firewall would see the IP addresses utilizing the internet. The default gateway should really be the 16.0.1 - not sure how I messed that up or how to fix it. I tried to change it, it says ip routing must be disabled.

I'm stumped on this and don't know what I'm doing wrong here! I just replaced the Cisco switches that were very old with brand new HP 2920s at work. Below is the config. What I'm trying to do is allow users to talk to the Dev network (vlan 18) from the default vlan (1) (all ports). I've been here a long time now, so maybe my brain is just fried. Also, I would like specific users (2 ports) to be on the default vlan, but be able to communicate with vlan 100. Still unable to do this as well. Any thoughts would be very helpful. Right now, everything I've tested has been from just the primary (core) switch, there are additional switches down the line, but I want to get the core going first obviously. The vlans work for the machines in them. config.txt

Thanks for that, however that is already what is setup. On my windows clients, I get these 2 pages. I've double and triple checked to ensure that is the only GPO that has Windows Updates.

So, I have windows updates configured and I'm wondering if it is possible to change it to function like this: Desired Setup: Updates from Intranet Location, once updates are approved they auto install at NOON each day. HOWEVER, if a user would like to install updates earlier, they may do so by clicking the install button early. Is this possible to do?

Firmware is the latest. Just flashed again to check. Tried another 5500-EI, same issue. There has GOT to be a setting in this thing that I'm missing.