Gpupdate fail through AppGate Proxy VPN

Chau Le 96

Hello

We have a VPN called AppGate ... Clients using this VPN when trying to run gpupdate does not work...nothing happens no error message. On regular Cisco Anyconnect VPn GPUpdate works just fine. Found out from the network team that this AppGate is like a proxy ...so it does not hand out new IP's to the client...it proxy the client request ...so the DC would not see the client IP it see's the AppGate IP...

I believe this is why GPUpdate is not working. DC needs to know the client IP for kerberos to work and would assume same requirements here. Can someone please confirm or negate my suspicions. ?

Thanks
C

2 answers

Thameur-BOURBITA 33,976 Reputation points

2022-03-28T07:59:46.227+00:00

Hi,

** DC needs to know the client IP for kerberos to work and would assume same requirements here. Can someone please confirm or negate my suspicions. ?**

I confirm that the DC needs to know the client IP to identify its subnet and the closest domain controller for authentication and GPO.
The network flow should be opened between the client and domain controller to apply GPOs.

Please don't forget to mark helpful reply as answer
Please sign in to rate this answer.
Chau Le 96 Reputation points

2022-03-28T14:33:10.283+00:00

HI Thameur! Thanks for the response... do you have an documentation on this? I have some hard headed peers that don't believe.

I can give documentation on how Kerberos works, I know for sure DC need to know client IP and DNS for kerberos to properly work. But how about for GPUpdate.

Is there some sort of flow diagram on GPupdate process? Like

Client -> request GP update to DC...
DC -> check for clients IP or network
DC -> response with GP ...

something like that detail? (thats just an example_)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Thameur-BOURBITA 33,976 Reputation points

2022-03-28T15:07:42.803+00:00

Hi,
You can refer to the following link to understand the DClocator process used by client machine to identify the closest domain controller:
How-domain-controllers-are-located-in-windows.aspx

Please don't forget to mark helpful reply as answer
Please sign in to rate this answer.
Chau Le 96 Reputation points

2022-03-28T15:17:40.09+00:00

THanks for that documentation..

But how does the DC locator process impact GPUpdate via VPN?

If you're on the network and the network is not defined, the client just finds some other DC not in its own site...but everything still works...

How does this apply to gpupdate ?

Thameur-BOURBITA 33,976 Reputation points

2022-03-28T16:05:31.407+00:00

If you're on the network and the network is not defined, the client just finds some other DC not in its own site...but everything still works..

In this case ,you should check if required port are opened between client from VPN via Proxy and all others domain controllers
You can use PortQryUI tools to check network flow between client and domain controllers.

config-firewall-for-ad-domains-and-trusts
PortQryUI - User Interface for the PortQry Command Line Port Scanner

Please don't forget to mark helpful reply as answer

Chau Le 96 Reputation points

2022-03-28T19:00:16.58+00:00

YEs I know portquery I use it alot..but that only check communication from client to server right? It doesn't check from server to client?

Thameur-BOURBITA 33,976 Reputation points

2022-03-28T21:50:24.45+00:00

Hi

Yes… you have to launch it from server to client ..

Please don’t forget to mark helpful reply as answer

Chau Le 96 Reputation points

2022-03-28T23:40:37.23+00:00

But in this case the client is behind the proxy server ...the only IP the DC knows is the Proxy Server IP

Thameur-BOURBITA 33,976 Reputation points

2022-03-29T08:01:32.95+00:00

But in this case the client is behind the proxy server ...the only IP the DC knows is the Proxy Server IP
Check if you are able to access to sysvol folder from Client through VPN proxy. To apply GPO client needs to access to sysvol folder : \domainname.lan\sysvol

Please don't forget to mark helpful reply as answer
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Gpupdate fail through AppGate Proxy VPN

2 answers

Your answer