IPS error initiated by Fortigate firewall

In this case, we had a user who had no internet access and got this screen when web browsing.

We found that the Fortigate 60D we had was causing this.  The cause seems to have been multiple invalid DNS lookups.  We didn't find any error logs that suggested that problem, but this is what this IPS block is typically caused by.  In the end, we fixed this by changing the user's LAN IP address, but we also could have seen the blocked IP addresses via these commands from the CLI:

OS 5.0:
get user ban list

OS 5.2
diagnose firewall ip_host list

To delete an entry, you'd enter this command:
diagnose firewall ip_host delete src4/src6

Exmaple:
diagnose firewall ip_host delete src4 10.10.10.21

The information from this page came from here:
http://kb.fortinet.com/kb/documentLink.do?externalID=FD36211

putting DNS in place at godaddy in advance of migrating registrar

I was moving a domain from Network Solutions to Godaddy, and I had DNS managed at NetSol and intended for DNS to be managed at Godaddy.  With this setup, there would have been DNS downtime during the transfer when the trasnfer actually happened and DNS wasn't in place at Godaddy before I put it in place.  This is because Godaddy won't let you manage DNS until the domain is actually transferred.

This article describes the process for setting up Godaddy calls off-site DNS, where its DNS servers can provie DNS for a domain it doesn't hold.  This off-site DNS can then be applied to the domain when you transfer.

This article is here:
http://support.godaddy.com/help/article/4041/managing-domain-names-with-offsite-dns?pc_split_value=1

And recreated here (in case that page is ever moved):

To manage the DNS for an off-site domain name, you must add it to the DNS Dashboard, and then change your nameservers at your current registrar.

1. To Add Off-site DNS for a Domain Name
2. Log in to your Account Manager.
3. Next to Domains, click Launch.
4. From the DNS menu, select DNS Manager.
5. From the Off-site menu, select Add Off-site. The Add Off-site DNS window displays.
6. In the Domain name field, enter the domain name you want to manage with Off-site DNS.
7. (Optional) If you plan to transfer the domain name's registration to us and you want to transfer its existing DNS records as well, select The domain will be transferred ... . We apply the zone file to the domain name upon transfer. Otherwise, de-select this option.
8. Click OK. The domain name displays in your Domain list with (Off-site) next to it.

NOTE: If your domain name does not display, click  to refresh the list.

Contact your current registrar to update your nameservers to the following:
Standard DNS
mns01.domaincontrol.com
mns02.domaincontrol.com

Windows could not start the DNS server service on the local computer. Error 1717: The interface is unknown.

I ran into an issue the other week where my SBS 2008 box lost power.  There's a bunch of irrelevant backstory that I won't go into.  But the next day, more than a dozen services were not started - including all the Exchange services.  In the end, I tracked it down to the DNS Server service not being started.  When I attempted to start it manually, I got "Windows could not start the DNS server service on the local computer. Error 1717: The interface is unknown."

I found two solutions.  I applied them both simultaneously, so I don't know which one worked, but I'm documenting them here:

Solution 1:

I set my group policy back to defaults as per this page:
http://forums.whirlpool.net.au/archive/1533833
I did this (copying the solution in case that page ever goes away):

• dcgpofix /ignoreschema
• Press OK twice and run gpupdate /force
• Reboot

Interestingly, my drive mappings group policy stayed in effect.  However, my password policy group policy settings were removed.

Solution 2:

I removed all of my event logs as per this page:

http://vittoriop77.blogspot.com/2007/10/error-1717-interface-is-unknown.html#.UDmCEsFlTB-

I'm writing this a couple weeks after the incident.  I don't remember not being able to open the event log, but I was in a panic as the issue was occurring during work hours, so I was throwing the kitchen sink at the problem.  To accomplish this task (copying the solution in case that page ever goes away), I did this:

• Stopped the event log service
• moved all files from %systemroot%\system32\winevt\logs to another location
• Started the event log service

checking autodiscover SRV records using nslookup

There are a couple ways to add autodiscover - which is required by Exchange 2007 (and presumably Exchange 2010) for full functionality (more coming on this concept).

One method is to add an SRV record. Because nothing is easy, not all DNS editors allow you to create SRV records. Sometimes, you can add them yourself. Sometimes, you have to write to support. Sometimes, it can't be done. But when it is done, here is how to check on it:

In a DOS prompt, type "nslookup"
Then "set type=srv"
Then the record you want - such as "_autodiscover._tcp.exampledomain.com"

Here's what a properly configured autodiscover looks like:

Blackberry Controller Service stops with error error 5003 (0x138B)

On one of my SBS 2003 servers, I run Blackberry Professional Server Express. All of a sudden, last night at about 7 pm, I got this in my application event log:

EVENT ID 20000
COMPUTERNAME SERVER1
DATE / TIME 2/25/2010 7:05:00 PM
MESSAGE Could not connect to Service Control Manager at \\127.0.0.1: 1722

and then I got this error when trying to start the Blackberry Controller Service - which was stopped:
The BlackBerry Controller service terminated with service-specific error 5003 (0x138B).

Long story short . . .

For some reason, the DNS Server service causes some problem with the Blackberry Controller service. It's easily fixed by stopping the DNS Server service and then starting the Blackberry Controller service. And then you can restart the DNS Server service. It's not a big deal - but it looks like I'm going to have to go through this stupid rigmarole each time I reboot the server from this point forward.

tool for checking email and DNS issues

I use lots of different tools for checking DNS and email issues. My favorite is www.dnswatch.info

But I came across a new one today which looks very helpful:

http://www.hq42.net/net_tools/index.php

There are tons of tools there - but a great one is test an email address - which even shows you a the transcript of the conversation with the remote mail server.

Fixing the DNS poisoning patch (MS08-037) on SBS 2003

I found a server that had no ability to interact on the network after a reboot. The IPSec service was stopped and would not start (error 10048). After troublehsooting, I found this - which someone else referred to as the DNS poisoning patch. Making the registry changes solved the issue:

http://blogs.technet.com/sbs/archive/2008/07/17/some-services-may-fail-to-start-or-may-not-work-properly-after-installing-ms08-037-951746-and-951748.aspx

Add these items to:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ReservedPorts

1433-1434
1745-1745
1080-1080
1720-1720
3343-3343
1645-1646
1701-1701
1812-1813
2883-2883
4500-4500

Of note, on another server, without making any changes, I saw this superset list of ports in that registry key:
1433-1434
1801-1801
1745-1745
1080-1080
1720-1720
3343-3343
1434-1434
1645-1646
1701-1701
1755-1755
1812-1813
1900-1900
2460-2460
2535-2535
2701-2704
2883-2883
3527-3527
4011-4011
4500-4500
5004-5005

SBS 2008 - not resolving some external DNS

Today, I found an SBS 2008 box that was not resolving a certain web site. The client had gone to that site before, but today they could not. The client was on-site with the server and set only with the SBS box as the DNS server. I couldn't run a tracert to the site (from a DOS prompt on the server) - it said unable to resolve target (I believe). After troubleshooting, all I did was stop and restart the DNS Server service. Very dumb.

Perhaps this article might have helped, I don't know.

http://support.microsoft.com/kb/968372

But it was next on my list of things to try.