Saturday, April 12, 2008

Active Directory: how to understand IP Site Links?

A site link is a logical path. A site link don't correspond to the actual path taken by network packets on the physical network.


What does it mean? The diagram shows that Site A, B, C, and D are physically connected through T1 or other leased line. It is a full mesh topology. How many site links do you create? Only the DEFAULTIPSITELINK is enough. Each site can communicate directly with other site at a uniform cost, which is defined on the DEFAULTIPSITELINK object.

The physical connection might be as shown below. Because connections among routers have the same bandwidth and speed, and each router can directly reach another one, all four sites can bind to the one site link: DEFAULTIPSITELINK. Communication among sites shares the uniform cost and same schedule.The cost should reflect the physical network connection. For example, 100 for 10Mbps network and 10 for the 100Mbps network.

Because there are too many routes for the KCC to consider, you need to disable Bridge all site links and manually create site link bridges.


In the HUB-SPOKE network, you should create 3 site links: ADLink, DBLink, and DCLink.




What does the fully-routed network mean for a hub-spoke topology?

The following network is a fully-routed network as well as a hub-spoke topology. A fully-routed network is that every host can reach another host in the network . From this diagram, I have better understanding of the site. A site relates to a physical network but only for Active Directory. A site defines a set of well-connected domain controllers.

Site Link Bridge

In a fully-routed network, IP site links are transitive. After the three IP site links:ADLink, DBLink, and DCLink are created, a link with cost of ADLink plus DBLink and a link with cost of DClink and DBLink are automatically created.




In the above modified diagram, SITE B, C, and D can bind to one IP Site Link.


Not fully-routed network or disjointed network--that is, not connected to each other through any other router.

The 11.100.0.0 network and 11.200.0.0 network are not connected through a router. They are the disjointed network.

Netcard1: IP Address: 11.100.1.1 Mask: 255.255.0.0 Default Gateway: 11.100.0.1 Netcard2: IP Address: 11.200.1.1 Mask: 255.255.0.0 Default Gateway: 11.200.0.1

To reach the 130.20.0.0 network from 11.100.0.0 site, you could add a static route in the multihomed computer:
route add 130.20.0.0 MASK 255.255.0.0 11.200.0.1

The 11.200.0.1 is the interface IP address of the right router.
If your IP network is not fully routed, you must disable Bridge all site links for the IP transport and configure site link bridge objects.