ZeroTier Question

JaredBusch

in the beginning I asked if I need to put the ZeroTier IP address into the server options of DHCP. I don't remember and can't find if anyone answered that.

This depends on how full mesh you want everything.

If you are going 100% full mesh, then yes.

You want your internal DNS server to be the thing handing out all DNS over ZT.

But this also means that your internal DNS server needs to KNOW all the ZT addresses for every device. This is not something that may always jsut magically register in DNS because the addresses are not being assigned out by the Windows DHCP server that normally can auto update the DNS records.

dafyre

This will also mean that you need to put the ZT IP address of your DNS server on the ZT NICs on Laptops that leave the physical network.

Edit: The caveat here will be if your DNS server responds with a LAN IP address instead of a ZT IP address for a device that is not located on physical LAN.

WLS-ITGuy

So the plain answer is no then

I received feedback overnight that there are two machines for sure that cannot access mapped drives or files from the DC/File Server.

I couldn't ping from my mac but could access files with no issues.

scottalanmiller

So the drives are getting mapped, or are not?

WLS-ITGuy

@scottalanmiller The drives are mapped via logon script but have a red x when off campus. When you click on them it says it could not reconnect.

scottalanmiller

@WLS-ITGuy said in ZeroTier Question:

@scottalanmiller The drives are mapped via logon script but have a red x when off campus. When you click on them it says it could not reconnect.

And if you ping the name used for the mapping, it does not respond? Does it respond on the machines that work?

JaredBusch

@WLS-ITGuy said in ZeroTier Question:

@scottalanmiller The drives are mapped via logon script but have a red x when off campus. When you click on them it says it could not reconnect.

Then you have DNS resolution issues, a routing issue, or a firewall issue.

Most likely it is DNS.

JaredBusch

My machines off the network can still ping the server by netbios name. It comes up with the ZT address.

So the shared drive (mapped by GPO) still works.

I have changed no DNS settings or anything at all.

WLS-ITGuy

@scottalanmiller If I ping the server name, whether it is FQDN or just the name, it shows the 198.105.254.130 address from a WIndows 10 laptop.

I am on campus now so I cannot test on my laptop. However, when I did test last night, I got a similar address like the one above. But I could see the Server name in my Finder on my mac.

WLS-ITGuy

Just to add some info I can ping the ZT NIC IP of the DC on the remote machine. I can also connect to mapped drives using \SERVER-IP\SHARE

scottalanmiller

@WLS-ITGuy said in ZeroTier Question:

@scottalanmiller If I ping the server name, whether it is FQDN or just the name, it shows the 198.105.254.130 address from a WIndows 10 laptop.

I am on campus now so I cannot test on my laptop. However, when I did test last night, I got a similar address like the one above. But I could see the Server name in my Finder on my mac.

Is that your ZT range?

Do an nslookup to see where it gets its address from.

scottalanmiller

@WLS-ITGuy said in ZeroTier Question:

Just to add some info I can ping the ZT NIC IP of the DC on the remote machine. I can also connect to mapped drives using \SERVER-IP\SHARE

Oh, you are using the ZT IP directly in the mapped drive settings?

WLS-ITGuy

@scottalanmiller I just did as a test to see if it would resolve via IP and it does.

WLS-ITGuy

@scottalanmiller ZT Range is 192.168.191.x/24

scottalanmiller

@WLS-ITGuy said in ZeroTier Question:

@scottalanmiller ZT Range is 192.168.191.x/24

So you have a mismatch. What you showed above is not in this range.

WLS-ITGuy

@scottalanmiller I don't see where though...Or how for that matter.

Dashrender

@dafyre said in ZeroTier Question:

This will also mean that you need to put the ZT IP address of your DNS server on the ZT NICs on Laptops that leave the physical network.

Edit: The caveat here will be if your DNS server responds with a LAN IP address instead of a ZT IP address for a device that is not located on physical LAN.

This is the continuing problem. your office DNS will have two or more IP's for laptops that live in the office at least part time. for example - if your laptop is at the office, and using DHCP from Windows, with DNS auto register enabled, all laptops will have two IPs in DNS. That LAN IP will not be automatically removed just because you go to StarBucks. So now, when the server goes looking for your laptop, it will find two IPs.. one of which will not work because it's not on the local network at the moment.

The same goes for Servers in a situation where you have a non ZT device on the local network. Local devices that don't have ZT installed are known to get a DNS response for a ZT IP address, and this of course causes problems.

WLS-ITGuy

@Dashrender All devices on LAN or off LAN have ZT installed.

scottalanmiller

@WLS-ITGuy said in ZeroTier Question:

@scottalanmiller I don't see where though...Or how for that matter.

That's where I am confused. Can you post the results from an nslookup of the server name from the machines that do not work?

WLS-ITGuy

Sure - any specific commands?

If not, I get:

Default Server: Unkown
Address: 2602:306:8b7e:f60::1