Software

Ask something
Discussion Locked

Server 2003+SP1+Firewall1=No Workie!!

0 helpful
1 reply

by jguasch 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Here is an interesting pproblem we had. A Firewall1 server was installed in between out Lans and all my remote DC/GC Server 2003 with Sp1 started to fail when replicating, Wins Quiry, Browsing and Exchange servers started to fail on the remote sites.

Exchange server were having a metabase error and the system attendant wont start. Then the DC wont run and GC got corrupted.

The solution was to impliment the Firewall1 rule below and restarted all DC/GC and exchange servers everywhere. Local and remote.

Here is the Firewall 1 fix.

1 reply

by jguasch

Product:
Version: NG
Last Modified: 04-May-2005
Status: Approved

Symptoms

Active Directory Replication fails through the Security Gateway after installing Windows 2003 Service Pack 1.
SmartView tracker displays connection drops on rules 995 and 997.
Environment Changes Service Pack 1 was installed on the Windows 2003 Server Security Gateway.
Cause A new DCE-RPC bind packet type is introduced in Windows 2003 SP1.
Solution Modify "$FWDIR/lib/dcerpc.def" file to accomodate multiple DCRPC Alter Context messages in Windows 2003 SP1. Change parameter DCERPCt_NUM_CNTX_ITEMS = 1 to DCERPCt_NUM_CNTX_ITEMS > 3 found under #define CNTX_NUM_ENFORCEMENT

Procedure:
1) Type "cpstop" at SmartCenter Server prompt to stop firewall services.
2) Back up "$FWDIR/lib/dcerpc.def" file.
3) Edit "dcerpc.def" file.

CAUTION:
Windows GUI editors (Notepad or Wordpad) add carriage return / line feeds at the end of text. When editing "dcerpc.def" on Windows machines, use "edit.com" from a DOS command prompt.

Original

DCERPCt_NUM_CNTX_ITEMS = 1 or (LOG(long, LOG_ALERT, 995), reject)

Modified

DCERPCt_NUM_CNTX_ITEMS > 3 or (LOG(long, LOG_ALERT, 995), reject)

4) Save change and close "dcerpc.def" file.
5) Type "cpstart" to start firewall services.
6) Log in to SmartDashboard and install policy.

Note:
Changes to .def files are relevant for a specific version/release and not supported with other releases unless specifically noted. Changes to .def files are overwritten when upgrading to a new feature pack, service pack, or new version.

This discussion is closed to new replies.