Cannot Communicate with Active Directory from a separate VLAN with Unifi Router

Networking & Firewalls
1

I recently swapped out an Untangle box for A UDM Pro Max. I opened up the firewall to allow traffic from another VLAN (106) to communicate with the network hosting the domain controller (103). DNS is working but only with domainname.local in nslookup. Normal domainname queries return a not found message.

I am also only able to access SMB shares on the 103 network by specifying the IP address. My domain controller is the only dns given out by the dhcp server on the 106 network.

I am not able to update group policy or add a new device to AD from the vlan network. On the same network everything works as expected. I am also able to access the web interfaces of devices on the 103 network from 106 so TCP and UDP traffic are being sent. Pings also work no problem.

Is there something I need to configure in Active Directory to let it know about the vlan or is there a setting on the router I need to configure besides opening up the firewall to allow active directory to work?

For some context, all I know about Active Directory was from skimming “Active directory for Dummies” about 4 years ago.

2

Did you add the subnet in Active Directory Sites & Services?

3

Is DHCP handled from a windows server or is it handled from the UDM pro? If it’s the UDM pro then you need to specify the DHCP options and set the domain name.

4

What dhcp options specifically? The UDM provides dhcp to both vlans. I have the dhcp for the 106 network only giving out the IP of the AD server. Do I set the domain name under the domain name option on the network settings screen? Do I want to specify that domain name on the 103 and the 106 networks? And finally, do I just add the domain suffix (.local) the full domain (companyname.local) or am I specifying the domain name for the default gateway for that VLAN (unifi.companyname.local)?

Sorry for all the questions. Thank you for replying

5

I added it there. And I added the lookup zone in the DNS as well.

6

don’t use .local (or anything xyz.local) for your AD domain because .local has special meaning - its meant to be used by mDNS only.

Anyway, the “domain name” option in the network settings is the value that computers should add at the end of their lookups to get a valid result for the local domain. In your example it would be companyname.local