Network routing behaviour

Question

The below image represents the high level configuration of a Windows 2019 Server that was recently built with 2 network adaptors. The 192.168.1.0/24 network circle shown below was not working. The network adaptors on the server were live and showed as connected within windows with a static IPs assigned. A config issue within VMware resulted in the network connection shown bellow as crossed out not working. The windows server shown was the only device connected to both of the respective networks. That however is not the issue I am asking about. Due to the config issue on that network causing that issue we noticed interesting behaviour of the Windows box with how it routed traffic.

If we initiated a ping to 192.168.1.1 from the server we indeed received a reply, although that IP resides on the same subnet as the network adaptor connected to the dead network. A tracert showed that the ping was sent via the other network adaptor using its default gateway. If we forced the ping out the 192.168.1.10 adaptor with the -S parameter the ping would fail.

Although the network object we were trying to reach existed on the same subnet as a network adaptor, which as far as Windows was concerned was in a connected state, it sent out the ping via the other network adaptor using the default gateway. It's almost like it failed over, as Windows detected the network it was connected to had nothing in it.

Is this standard behaviour of Windows?

Answer 1

Hi @Limitless Technology and @Zac Avramides

bumping an old thread as I am researching this because I have seen some weird behaviour that didn't make sense to me. I wonder if you ever got to the bottom of this.

It looks to me as if you had inter VLAN or Inter network routing enabled on your firewall/router as I have and Windows is pinging the other network via the primary NIC and the router was then routing that to the correct network interface to get your ping back. That said it doesn't explain some of the crazy logic that seems to be going on.

Like you Zac, I set the second NIC without a default gateway. I did set a persistent static route via CLI and bound it to the second NIC though. I initially didn't bother with the metric and left that at default i.e. automatic.

I found Windows was randomly using the Primary NIC for traffic that should have gone through the secondary NIC even though it was for a different IP range like yours is.

I turned off Automatic Metric on the second NIC and manually increased the metric to make it higher than the default NIC and that sorted it out for traffic but weirdly some programs previously installed and operating on the Primary NIC decided to bind to the second NIC and will not let go. There seems to be no logic to this.

The way I see it if you set a different network range on the Second NIC and target the persistent route to the correct subnet and gateway and bind it to the correct Interface ID via route -p -add <network and mask> if <IF ID Number> then the metric should be irrelevant. Any traffic not for that subnet should go by default to the Primary NIC and any traffic for the subnet on the secondary NIC should stay off the primary NIC i.e. never route the Static Route bound to the secondary NIC through the Primary NIC. Clearly from your and my examples Default Gateway is a failover regardless of the Static Routes shown in route print in the CLI and the lowest metric NIC can be used even if it is not on and adaptor with a default gateway.

Why Window randomly treats the Secondary NIC as if it was primary and binds preinstalled software to the new NIC and routes traffic it should not send over it I do not know but that is exactly what I have seen.

Any thoughts anyone?

Answer 2

Hello there,

Yes, the behavior you described is consistent with how Windows handles network connectivity and routing in certain scenarios. Windows operating systems use a feature called "Automatic Metric" to determine the best network interface to use for routing traffic. When multiple network interfaces are active, Windows assigns a metric value to each interface. The interface with the lowest metric becomes the default route for outbound traffic.

In the situation you described, where there are two network adapters (interfaces) present on the same subnet, Windows might assign a lower metric to one of them based on various factors such as link speed, connection quality, or manual configuration. The adapter with the lower metric would be preferred for routing traffic to devices on the same subnet.

Hope this resolves your Query !!

--If the reply is helpful, please Upvote and Accept it as an answer--