Windows 2008 + AD + PF + bridge = problems?

[mojo fms]

On Mon, Aug 3, 2009 at 5:15 PM, Mel Flynn <
mel.flynn+fbsd.questions at mailing.thruhere.net<mel.flynn%2Bfbsd.questions at mailing.thruhere.net>
> wrote:

> On Friday 31 July 2009 10:15:56 markham roan wrote:
>
> > A packet capture revealed a number of anomalies.  Once the server starts
> > trying to join the domain, we get all sorts of TCP transmission errors,
> > retries, duplicate ACKs etc.  In some cases, the public side of the
> > firewall will send an ICMP host-unreachable message for a host which is
> > clearly being BINAT.
> >
> > I've tinkered with net.inet.ip.intr_queue_maxlen, but it doesn't seem to
> > help.  net.inet.ip.intr_queue_drops isn't increasing at a noticeable
> rate,
> > anyway.
> >
> > Does anyone have any thoughts and/or advice on where I can go from here?
>
> No experience with the case at hand, but I do see that Vista started to use
> IGMP protocol even when there's no obvious need to do so. Given that "allow
> all" does in fact only allow a handful of IP protocols, excluding IGMP, you
> may want to investigate if you're not silently blocking (or not
> translating)
> one of the more obscure IP protocols.
> --
> Mel
>  _______________________________________________
> freebsd-questions at freebsd.org mailing list
> http://lists.freebsd.org/mailman/listinfo/freebsd-questions
> To unsubscribe, send any mail to "
> freebsd-questions-unsubscribe at freebsd.org"
>



This might be way off base but I had a server that had issues like that and
it ended up being the network cable going bad.  It would send an ack but if
you captured the ack and other packets at the destination server it would be
missing bits.  I have personally not had an issue with a pf firewall and
server 2008 joining a 2003 domain but network card or cable could cause an
issue like that.

What does tcpdump tell you on the firewall when monitoring PF while it
joins, what rule(s) is it using when it joins?

-- 
Who knew