Re: R2 in-place upgrade bug ? ..HELP

UPDATE* -- i've enabled to the windows firewall just to see what can be done
with regard to icmp.

i've used the netsh command to add a custom port that DAMEWARE remote uses.

netsh firewall add portopening TCP 6129 dameware.

once i added that, i was able to dameware into the box ( which i wasn't able
to do previously)

i then adjust the ICMP setting to allow ALL icmp.

netsh firewall set icmpsetting ALL enable

and allowed incoming

netsh firewall set icmpsetting 8 enable

C:\>netsh firewall show icmpsetting

ICMP configuration for Standard profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Enable 3 Allow outbound destination unreachable
Enable 4 Allow outbound source quench
Enable 5 Allow redirect
Enable 8 Allow inbound echo request
Enable 9 Allow inbound router request
Enable 11 Allow outbound time exceeded
Enable 12 Allow outbound parameter problem
Enable 13 Allow inbound timestamp request
Enable 17 Allow inbound mask request

ICMP configuration for Local Area Connection 7:
Mode Type Description
-------------------------------------------------------------------
Enable 3 Allow outbound destination unreachable
Enable 4 Allow outbound source quench
Enable 5 Allow redirect
Enable 8 Allow inbound echo request
Enable 9 Allow inbound router request
Enable 11 Allow outbound time exceeded
Enable 12 Allow outbound parameter problem
Enable 13 Allow inbound timestamp request
Enable 17 Allow inbound mask request

then - i disabled netsh opmode and enable's the exceptions on all the
interfaces. I disabled the ICF service in the services console and restarted
the machine. this is the output of the opmode syntax.

C:\>netsh firewall show opmode

Domain profile configuration:
-------------------------------------------------------------------
Operational mode = Disable
Exception mode = Enable

Standard profile configuration:
-------------------------------------------------------------------
Operational mode = Disable
Exception mode = Enable

Local Area Connection 7 firewall configuration:
-------------------------------------------------------------------
Operational mode = Disable

Local Area Connection 8 firewall configuration:
-------------------------------------------------------------------
Operational mode = Disable

This is my config: Looks like i might want to disable the ICF using the
domain profile in gpo, since it looks enabled ?

C:\>netsh firewall show config

Domain profile configuration:
-------------------------------------------------------------------
Operational mode = Disable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable

Service configuration for Domain profile:
Mode Customized Name
-------------------------------------------------------------------
Enable No File and Printer Sharing

Port configuration for Domain profile:
Port Protocol Mode Name
-------------------------------------------------------------------
139 TCP Enable NetBIOS Session Service
445 TCP Enable SMB over TCP
137 UDP Enable NetBIOS Name Service
138 UDP Enable NetBIOS Datagram Service

Standard profile configuration:
-------------------------------------------------------------------
Operational mode = Disable
Exception mode = Enable
Multicast/broadcast response mode = Enable
Notification mode = Enable

Service configuration for Standard profile:
Mode Customized Name
-------------------------------------------------------------------
Enable No File and Printer Sharing

Port configuration for Standard profile:
Port Protocol Mode Name
-------------------------------------------------------------------
6129 TCP Enable dameware
139 TCP Enable NetBIOS Session Service
445 TCP Enable SMB over TCP
137 UDP Enable NetBIOS Name Service
138 UDP Enable NetBIOS Datagram Service

ICMP configuration for Standard profile:
Mode Type Description
-------------------------------------------------------------------
Enable 2 Allow outbound packet too big
Enable 3 Allow outbound destination unreachable
Enable 4 Allow outbound source quench
Enable 5 Allow redirect
Enable 8 Allow inbound echo request
Enable 9 Allow inbound router request
Enable 11 Allow outbound time exceeded
Enable 12 Allow outbound parameter problem
Enable 13 Allow inbound timestamp request
Enable 17 Allow inbound mask request

Log configuration:
-------------------------------------------------------------------
File location = C:\WINNT\pfirewall.log
Max file size = 4096 KB
Dropped packets = Enable
Connections = Disable

Local Area Connection 7 firewall configuration:
-------------------------------------------------------------------
Operational mode = Disable

Port configuration for Local Area Connection 7:
Port Protocol Mode Name
-------------------------------------------------------------------
3389 TCP Enable Remote Desktop

ICMP configuration for Local Area Connection 7:
Mode Type Description
-------------------------------------------------------------------
Enable 3 Allow outbound destination unreachable
Enable 4 Allow outbound source quench
Enable 5 Allow redirect
Enable 8 Allow inbound echo request
Enable 9 Allow inbound router request
Enable 11 Allow outbound time exceeded
Enable 12 Allow outbound parameter problem
Enable 13 Allow inbound timestamp request
Enable 17 Allow inbound mask request

Local Area Connection 8 firewall configuration:
-------------------------------------------------------------------
Operational mode = Disable


This is increasingly looking like a bug in the tcpip stack --

hboogz wrote:
Morning to all -

I just spent the last 6 hours with dell gold software support team trying to
figure out the following occurrence:

The upgraded R2 DC does not accept incoming connections, but it appears it
accepts certain connections. Particularly those related to directory services.
e.g. telnet server ip 389 from the mail server works. \\serverip or
servername brings up the shared printers and folders perfectly.

outbound traffic and icmp works fine, inbound icmp returns a time out.

scenario:

Windows 2000 SP4 DC in-place upgrade to windows 2003 SP1 then upgrade to R2.
connections to and from box were fine on 2003 sp1.
downgraded NIC drivers to match other r2 DC on identical server
hardware/model
installed new nic drivers and proset
upgraded to R2.
rebooted and noticed a ton of errors with services hanging upon boot.
checked connection to the box from workstations and servers, but all requests
timed out.
i made sure ICF was disabled.
i disabled IPSEC and entered dword value for ProhibitIpSec - nothing
i then enabled ICF configured exceptions - explicitly allowing ICMP, and
still nothing.
reset the TCP/ip stack and winsock using netsh, nothing
servers has two nics, one of which is disabled. changed binding order so
active is on top -- nothing
reinstalled the binaries of windows 2003 sp1 and upgraded to r2 again --
nothing.

i'm at a lost of ideas and sure could use the vast resources the contributors
of this group may have or know of.

**To make matters even more confusing, workstations located outside of this
main office site that are connected via ipsec vpn can ping this server!!!

HELP

Thanks,


--
---
I do what i got to do in order to do what i want to do...

Message posted via http://www.winserverkb.com

.

Relevant Pages

  • Re: Cant Ping Windows 2003 server after R2 Upgrade..HELP!
    ... UPDATE* -- i've enabled to the windows firewall just to see what can be ... i then adjust the ICMP setting to allow ALL icmp. ... Enable 3 Allow outbound destination unreachable ... ICMP configuration for Local Area Connection 7: ...
    (microsoft.public.win2000.active_directory)
  • Re: R2 in-place upgrade bug ? ..HELP
    ... Enable 3 Allow outbound destination unreachable ... Enable 9 Allow inbound router request ... ICMP configuration for Local Area Connection 7: ...
    (microsoft.public.windows.server.active_directory)
  • Re: R2 in-place upgrade bug ? ..HELP
    ... Enable 3 Allow outbound destination unreachable ... Enable 9 Allow inbound router request ... ICMP configuration for Local Area Connection 7: ...
    (microsoft.public.windows.server.active_directory)
  • Re: Cant Ping R2 server in same subnet, but can ping outside subnet.!!
    ... Enable 3 Allow outbound destination unreachable ... Enable 9 Allow inbound router request ... ICMP configuration for Local Area Connection 7: ...
    (microsoft.public.security)
  • Re: Completely replace software firewall with hardware firewall?
    ... > becoming an enthusiast or even expert in firewall configuration. ... NAT router is a plug it up and go device with little configuration on ... viewer so you can watch inbound and outbound traffic to/from the network. ...
    (comp.security.firewalls)