0

I’ve recently come to manage the IT at a small organisation and am in the process of figuring out their setup (they previously outsourced IT work). They have a main server (running Windows Server 2008 Standard) at one office and a second server (running the same Windows version) at second office in another geographical location. All files are stored on the main server and, from what I can tell, the second one synchronises with it via a mapped network drive. Active Directory is also handled on the main server.

We’re looking to switch ISP at the main office which will mean a change of external static IP address. Can anyone give me some advice about what would need to be done in order to maintain the current connection between the second server and the main one?

Lex1con
  • 11

1 Answers1

4

You're going to need access to both firewalls likely, in order to change the IP configuration, which will invariably change if you're moving to a different ISP, as each maintain their own netblocks of IPs, which they allocate to their customers either statically or dynamically. Presumably you have the former, but your current ISP will be able to tell you that and/or you can tell by looking at the WAN port configuration on the firewall.

Secondly, I would need to understand how the two servers are connected.

Presumably there's a site-to-site IPSec (VPN) tunnel between both offices, which would be configured on both location's firewalls, providing connectivity between locations, but they could have a LAN extension (MPLS/VPLS) or some other kind of private network that the ISP created and manages between both endpoints (each office).

My guess is that if they're rockin' 2008 Servers, the IT budget would make a LAN extension/MPLS connection between locations cost-prohibitive, but this obviously needs to be vetted and pricing varies wildly depending on where you are. This is something that the current ISP's invoices would have itemized and a call with them would be prudent.

So assuming these are just regular independent Internet connections, and if you can get into the firewalls without having to factory reset them, you can dig around and find the VPN/IPSec/Site-to-Site/LAN-to-LAN whatever (posting the make/model would be helpful).

A simple test is to ping the IP address that's assigned to the interface on Server B, from the command prompt of Server A.

You can run net use from the command prompt of the server with the mapped drive to find out the IP of server B. It may be mapped via DNS too (\\serverb.company.local\some\shared\folder)

I'd thenping -t 192.168.2.2 (or serverb.company.local) which will give you a continuous ping so you can also do things like check the latency while you're at it.

If you get a response from Server B, then you know that there is Layer 3 connectivity between locations and likely an IPSec tunnel. If you can preserve that Layer 3 connectivity, then synchronization should continue to work, in other words, if that mapped drive can stay up, you should be ok.

Having said that, I would first want to ensure that there is synchronization in place and that it does indeed work over mapped drive (which in and of itself does not do any kind of replication/synchronization, it meerly creates a user-friendly mapping for accessing files), because I know I probably would've setup Distributed File System Replication (DFS-R) back in the day if bandwidth was limited, but it comes with it's own headaches (locks, backup can be weird, etc.).

Are you sure that the mapped drive is not just for accessing the data on-demand?

When we setup branch offices nowadays, even with cable modem connections (150/20 Mbps) and IPSec tunnels, we're usually just mapping drives on individual machines at the branch office.

Does each location see the same drives/UNC paths? i.e. Location A accesses shares on \\server-a\some\shares and Location B access shares on \\server-b\some\shares and both those shares have identical files? Can you do a test and create a dummy.txt file and wait an hour and have it show it on the other side? I would really want to know what's actually going on before changing anything.

As to changing ISPs, if there is a LAN extension (MPLS/VPLS) and you plan on getting the equivalent, then you're going to need to coordinate a maintenance window (downtime) and configure the routers at either end; these could be layer 3 switches and they could be routing between themselves, bypassing the firewall entirely; all kinds of topologies you can get into with that.

If my hunch is correct and these are just regular independent Internet connections, then you'll need to reconfigure the site-to-site VPN at each location's firewall, which essentially boils down to:

  1. Remote and Peer IP addresses for identity (office A and office B IP addresses assigned to the firewall, or the first one of the usable range in the subnet provided by the ISP)

  2. Policy agreement on cryptography, encapsulating, and timing (phase 1 and phase 2, IKE version, crypto algorithm, etc.): basically make sure both sides have the same settings. :)

If the tunnel is already there, you just need to change each side's respective remote gateway and peer/local IP address in the configuration, assuming they used IPs as the identifiers, but rarely have I seen it done otherwise: basically look for old IP, replace with equivalent new IP; rinse and repeat.

There are lots of tutorials on how to do this, but they all should use the same IPSec framework to do so.

gravyface
  • 13,957
  • 19
  • 68
  • 100
  • Thank you for your superbly detailed response. Bear with me... `net use` on server A showed the details of the mapped drive, but not server B. `ping -t ` gave a continuous response. DFS-R isn't installed on the File Services role, so... not in use? I created a file at `\\server-a\share` on server A which, after an hour, did appear on server B. I found a VPN connection of type PPTP on the router at office A. This shows: My WAN IP, Remote Gateway IP, _etc._ Haven't been able to access the router at office B yet. Hopefully this clarifies things a bit? – Lex1con Jan 15 '19 at 15:22
  • I've never heard of PPTP being used for site-to-site VPNs; I don't know if that's even supported. However, My WAN IP, Remote Gateway IP seems more reminiscent of a site-to-site VPN (IPSec) tunnel. Maybe the web interface is a bit confusing. What's the make/model of the firewall? Waiting an hour for replication seems like it could be a 3rd-party app via a scheduled task; I'd check the Task Scheduler on both servers. – gravyface Jan 15 '19 at 20:59
  • Not sure what you mean by the make/model of the firewall. The router at site A is a DrayTek Vigor 2860n. I've also managed to access the router at site B, which is a DrayTek Vigor 2760n. Checked Task Scheduler on both servers, but didn't see anything that seemed relevant. – Lex1con Jan 18 '19 at 09:54