RE: [ActiveDir] Site link costs

[Rick Kingslan]

Title: Site link costs

Cathy – Sadly, I don’t think that it would surprise you how many companies simply ‘slap AD in’ with little or no planning because there is some high-level mandate that ‘we have to have it’.  Obviously, you’ve realized that the lack of planning time is impacting some areas / customers, while others are not AS impacted.  You prioritized some of the key things (like site and site link configs), even though others did their best to unknowingly scuttle your efforts.  ;o) The upgrade to the full mesh may or may not help – I can’t know because the number of variables are too great and site replication is a reasonably complex animal.  Big changes in network can have a positive effect, or a negative one.  It all depends on the state of the current topology, and how radical the changes will be.   One thing is for sure – someone (or a small, communicating, knowledgeable group) needs to be in control of the site topology – this includes all areas, groups, subsidiaries.  And, in my opinion – someone who ‘gets it’ needs to get management out of the technical decision making. Let them run the business – not the technology.   I can think of few other things that can turn AD into a troublesome pile of woe quicker than bad replication.   Let us know if there are other questions / concerns.   Rick   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of O'Brien, Cathy Sent: Thursday, July 21, 2005 1:59 PM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Site link costs   Thanks, Rick.   Re: the subsidiary that left their objects in the Default-First-Site-Name site, that's been a whole other argument. They have several locations around the US and Canada and they're not currently that well connected. They claim as long as they have at least 64K they'll be okay. I think their tolerance for slow connections must be much better than ours... when we were first testing and had just a single default site for locations spread out globally (Corporate mandate at that point), we and another subsidiary quickly decided that it was worth a fight to get sites defined, even if it was just for our own locations.   Now the argument has moved on because our subsidiary went in and defined site links (and costs) connecting all our sites, and our replication performance hasn't given us any problems. A second subsidiary did define their sites/subnets but did not create site links, and they're seeing replication traffic being routed through a slow VPN link when there's a faster route available. They'd like to go back and create site links now but they no longer have rights to do so (we were quick and did it while we had rights for our PDC upgrade), so they're trying to justify the change at this point. Corporate claims it's unnecessary.   Within the next several months our network will be upgraded to full mesh, at least within the US (we don't have all the details yet). So perhaps some of this will be moot at that point, but things tend to happen slowly here so we'd like to have a good design for our current network situation.   It's undoubtedly apparent that there's some of the tail wagging the dog here... management needed to be able to say we were using active directory, so the initial upgrades were done before we had a complete design. Now we're going back to finish up designing and cleaning up after the fact. We're also having to rework all our processes to support a global IT environment. Up until now we had 6 separate IT groups that operated more or less autonomously except that Corporate controlled the WAN infrastructure. It's a slow painful process :-).   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Rick Kingslan Sent: Thursday, July 21, 2005 11:27 AM To: ActiveDir@mail.activedir.org Subject: RE: [ActiveDir] Site link costs Cathy, My approach to sites, site link objects, and topology overall has been to look at the physical/logical layout of the network as it pertains to the Layer 2/Layer 3 communication. Remember what we’re telling AD with Sites, Subnet objects, site links, etc – This is what the network looks like, or how I want you to THINK the network looks like. So, when you crate a site (a site is a collection of subnet objects that are ‘local’ to each other) you are telling AD that this site and another site will communicate Inter-Site.  While the subnets inside the site will be deemed ‘Intra-site’. To that, I would question the subsidiary that left their objects in the Default-First-Site-Name site.  Are they all local to all other objects in that site?  Does it make sense from a local vs. remote perspective? I managed the AD of a company that used ATM practically to all of our ~50 remote sites.  (Telecomm heavy company – we had lots of carrier agreements with b-width to spare…)  I STILL treated remote sites not in the campus with the Data Center as a remote site.  They might have appeared as well connected, but that could have changed at any time. As to costing for site links – you can do that, but if there is only on site link from A to B, the cost isn’t going to have much impact.  There still is only one way to get there.  Now, if you want redundancy for site links, you CAN add links from C to B, and cost that one higher than A to B.  You will also want to take into account site link bridging and determine if you want that on or off. (Site link bridging transitively connects one site through another site with a virtual link – the site link bridge.)  Typically, I have turned off site link bridging to accomplish what I need to have done – not leaving those decisions up to the mechanisms that might not have a clear idea of what my topology was really like. The key here is much more in the realm of Network considerations than OS.  The KCC is still going to connect things – but not optimally until you set up a site topology that emulates efficiencies that you can only hope are in your network design. Rick   From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of O'Brien, Cathy Sent: Thursday, July 21, 2005 1:06 PM To: ActiveDir@mail.activedir.org Subject: [ActiveDir] Site link costs   Sorry for the basic question... Our company just upgraded our NT4 domains in-place as child W2K3 domains under an empty W2K3 forest root domain. 22 sites and their associated subnets were established, with one subsidiary leaving all their objects in the default first site because they feel their bandwidth will support it. However, we're currently having heated discussions regarding AD and site topology. Some IT members are saying that there is no need to manually create site links or assign properties such as cost and replication interval. They say that if we don't do this, then AD does it automatically and it will do a better job than we would anyway. I  thought that the KCC needed the site topology info to be provided (whether manually or programmatically) so that it could automatically create the connection objects (provided you're not manually creating them). So who is confused here, me or them? This should be basic stuff, and I want to understand it correctly :-). TIA, Cathy