I have been trying to solve this problem for a few days and am getting
desperate. Here is the set-up:
. two VLANs with a router between them, no filtering, no ACLs
. one domain with two clustered PDCs (Win2003), running WINS
. VLAN A contains servers, VLAN B a couple of test workstations

What works:
. I can see all the registrations on the WINS servers, all servers and
workstations which have WINS IP addresses defined are there
. from workstations in VLAN B I can map drives on the servers in VLAN A

What does not work:
. from the workstation on VLAN B I cannot run 'browstat gm' (getting "Unable
to get Master: access denied", and "Master name cannot be determined from
GetAdapterStatus") and browstat sts ("Unable to query browser statistics:
2184")
. from any of the servers in VLAN A I cannot see the workstations in VLAN B.

I am testing an application which requires the workstations to show up in the
windows browser in order to deploy clients. I would really appreciate tips on
how to further troubleshoot this issue. Thanks.

Regards
Marcin

marcin <u52472@uwe> wrote:
Show quoteHide quoteYou have a WINS server in each location, yes? Is the WINS partnership
working?

Thank you very much for your reply. I have two WINS servers on VLAN A. That
partnership is working. I have no WINS server on VLAN B. According to MS WINS
Best Practises, one WINS server is sufficient for a small routed network...
The reason I introduced WINS was that we don't have DCs on all VLANs and I
have to make browsing work between VLANs.

Lanwench [MVP - Exchange] wrote:
Show quoteHide quote

marcin <u52472@uwe> wrote:
It's been a while since I had to to anything like this, but I think you do
want a WINS server on VLAN_B. Could be I'm wrong. What traffic is permitted
between VLAN segments?

Show quoteHide quote

"Lanwench [MVP - Exchange]"
<lanwe***@heybuddy.donotsendme.unsolicitedmailatyahoo.com> wrote in message
He can actually do it either way, but if only using one, and all machines on
both sides of the fence are using the one WINS box, the fence will
experience extra weight with the resolutions requests.

But of course, all traffic (no barb wires) needs to allowed across the
fence.

Show quoteHide quote

Are all machines in both VLANs using this WINS server in their IP
properties?

Are there any firewall rules blocking NetBIOS or any other type of traffic
in the VLAN config?

Show quote Hide quote    Ace put his finger on the essential bit. It is not how many WINS servers
you have, but how everything is set up. What really matters is that you have
a WINS database which contains all the possible master browsers.

   In a small network one WINS server is sufficient, but all machines must
register with this WINS server. If you have a multiple WINS servers, they
must all replicate to give you a database containing all the possible browse
masters.

    The master browsers use WINS to get the IP addresses of other master
browsers so that they can communicate directly with them. Once you segment
your network you can't rely on broadcasts any more for communication between
master browsers.

    You don't need a DC in each segment/VLAN. You don't even need a server.
A workstation can act as a segment master browser. You do need at least one
DC in the network. Only a DC can merge the lists from the segment master
browsers into a network-wide browse list.

There are no ACLs on the router. In our test environment we have two DCs and
WINS are installed on both of them, all that on VLAN A. The number of users
is small, so one server can certainly handle the traffic. Are there any
specific packets I should be looking for in network traffic captures on both
VLANs in order to determine what is failing? Thank you very much for your
help.

Bill Grant wrote:
Show quoteHide quote

news:9764a44de8ebc@uwe...
WINS uses port TCP 42. Is that being blocked?

Ace

The workstations I want to see in the browser on VLAN A all have both WINS
servers entered in the Advanced configuration. There is no filtering on the
router, which connects the two VLANs.

Ace Fekay [Microsoft Certified Trainer] wrote:

news:9764c0427d93a@uwe...
Sometimes certain ports are blocked by default in some routers.

Ace

Hey Folks,..

If it were me, I would just use a single WINS and forget it.  Yes, the
queries would go over the router but I doubt those really amount to much
load.  But then,...I am me,...and I and using two,..hmm,...I'll have to
think about that one for a while.

Two WINS are fine but it is not always so great either. Putting both in a
Clients TCP/IP Settings doesn't always mean the client will actually use
both,...the "failover" to the second WINS is probably no more consistant or
reliable than it is with having two DNS entries.  Then with two WINS you
would probably want a Push/Pull Partnership setup with them and I have seen
that not always work so smoothly either.  Then you don't really need the
redundancy with WINS like you do DNS because it just isn't that critical,...
nor does it even really provided redundancy quite like DNS with AD
replication does anyway,..I've probably seen as much inconsistancy and
conflicts between two WINS databases as I have agreement.   And lastly a
single WINS will easly and fairly quickly rebuild it self if lost,....I have
deleted corrupt databases and they rebuilt themselves quite quickly.


Show quoteHide quote

Show quote Hide quote All your points sound good to me.

I'm just wondering with the poster's VLAN routing between switch ports if
there is anything being blocked.

Ace

Could be.  A lot of messes are created with ACLs in the name of "security".
I suppose the router would log that if it was.

Good point, depending on the switch vendor the VLANs are created on if
syslogging is available or enabled on it. Let's hope to hear back from the
poster to see how far he has taken it on his end to troubleshoot it.

Ace

We use Cisco switches and routers around here. I checked the config on the
router connecting VLANs A and B, and there are no ACLs between them. Any
pointers as far as what kind of packets I should be looking for in network
packet captures? I am going to collect traffic on both VLANs to see if that
will help me getting to the bottom of this problem.

Regards
Marcin

Ace Fekay [Microsoft Certified Trainer] wrote:

news:9773fd06212c3@uwe...
Nothing from me.  I can't remember the last time I ever opened a "packet
sniffer".  I can almost always solve problems without ever staring myself
blind at packet captures.  It's probably been 3 or 4 years since I ever used
a "packet sniffer" for any "real" reason.  There is just too many other
"higher level"  ways of solving problems to mess with that as far as I am
concerned.

news:9773fd06212c3@uwe...
WINS uses port 42 traffic. NetBIOS uses 139. NetBIOS broadcasts are stopped
on a router by default, which is fine, but when one machine queries WINS, it
uses TCP 42.

Ace

Show quote Hide quote    And the best way to debug browser problems is still the NT utility
browstat.

I agree. Great tool.

Ace

I use browstat for troubleshooting. I posted the error messages from that
tool in my original message. Hopefully, I will have some packet captures to
look at later today.

Ace Fekay [Microsoft Certified Trainer] wrote:
Show quoteHide quote

news:977d081d6521b@uwe...
Sorry about that. Re-reading the original post, I see you are getting an
access denial message from VlanB to VlanA trying to find the master browser.
The master browser is normally the PDC Emulator in the domain. I assume that
DC with that role is on VlanA.

You're router is allowing all traffic. Good.
The domain master browser, as I mentioned, is the PDC Emulator. HOwever if
the infrastructure is segmented, each segment will elect a master browser.
The winner is determined by the operating system type and version. Obviously
a 2003 server will win over a 2000 server, and a 2003 DC will win over a
2003 member server.

The domain master will collect info from each master browser from each
subnet to assemble a browse list that any machine requesting it, will show
you a compiled list in Network Neighborhood. If the machines in VlanB are
workstations, and are constantly restarted or not on, they will be
constantly vying for browse master of the segment, and will give you
unexpected results. I had a customer awhile back with a similar issue with a
segmented LAN with 100 workstations, no servers. They were shutdown each
night, sometimes restarted during the day, etc, so it was constantly
changing the network neighborhood list of machines. I suggested to throw any
old server over there to see what happens, not even a WINS server, just any,
and it worked for them. Workstations are not the best for a segment's master
browser.

Going through the original post, you didn't mention if a DC or some other
type of server is on the other VLAN. Is there one, or are they all
workstations?
I assume NetBIOS is not disabled on any machine?
Have any lmhosts files been changed with any additions on any machine?
And I assume there are not firewall running on the workstations on VlanB if
there are no servers?

I hope that helps to get a better handle of what's going on or what may be
contributing to what's going on.

Looking forward to what you find in the captures.

Ace

Server 2505 error
Multiple NICs in same segment server 2008
Taking ownership of files on remote computer
Group Policy logon script not applied if connected by WiFi
Multi-WAN loadbalancing & RRAS.
Routing and Remote Access NAT - I need to modify TTL
Remote AD offline and lack of access to local file server
VPN/RRAS, Workgroup mode
Reseting LAN interface count Windows 2000 server
shared drive problem