DCs and Network Address Translation

re: DCs and Network Address Translation

Herbert Mauerer [MSFT] — Wed, 09 Jan 2013 12:29:13 GMT

this blog does not warn sufficiently about DCs and NAT. The MS support statement is:

978772 Description of support boundaries for Active Directory over NAT

support.microsoft.com/.../EN-US

Cheers

Herbert Mauerer

re: DCs and Network Address Translation

dsammich — Mon, 19 Apr 2010 14:16:03 GMT

Tim,

I have been working with this for a couple of days. I have site-to-site IPSEC tunnel built and can ping everything with no issues. The DNS piece you menioned with reg hack doesn't seem to be working and would like more information on the key and how DNS publishes.

I am in a hosted environment and have to hide networks all of the time to prevent subnet overlapping. I am able to translate the addresses properly to the outside, essentially masking the "real" ip of the domain controllers.

When I attempt to connect to a DC from a box that I am trying to run DCPROMO on, the existing DC (that has your reg hack), is returning the "real" IP, not the NAT'd IP?

Thoughts?

re: DCs and Network Address Translation

Tim Springston [MS] — Fri, 11 Sep 2009 18:52:15 GMT

Kerberos should not have problems with the NATted solution as long as the appropriate ports (UDP and TCP 88) are open.

re: DCs and Network Address Translation

msbrianp — Wed, 29 Jul 2009 16:09:40 GMT

Does this potentially pose problems with Kerberos authentication through the NAT device to the DC in the NATed segment? Good artical- thanks.

re: DCs and Network Address Translation

jansenet — Wed, 29 Apr 2009 07:31:16 GMT

I had a client with that same issue about 3 years ago. They ended up re-arranging the network and did an IP cutover, going away from using NAT'ing to fix the issues. I have to say that this is the best breakdown of this specific issue that I have seen to date. Keep up the good articles!

Eric Jansen

re: DCs and Network Address Translation

wilfman — Wed, 22 Apr 2009 17:11:33 GMT

Tim.

Great article. Will remember this for next time we come across this issue.