Thursday, October 9, 2014

Source IP Address Preference with Multiple IPs on a NIC

Deploying SCOM agents on servers in the DMZ isn't that difficult, what is so difficult about this?
All that is needed is to raise a Change Request for the Firewall Team to open up TCP 5723 between the SCOM Management Server and the server to be monitored. Well, you are right.
What about if the server is having a single NIC that is assigned several IP addresses?
That's where the challenge will come.

A behavior that changed with the introduction of Server 2008 is that the source IP address on a NIC will always be the lowest numerical IP. So that whole idea of your primary IP being the first one you put on the NIC will be used by the server to communicate is no longer valid.

For example, let’s say we build a new web server and configure the NIC with IP This IP is registered in DNS and the server uses this IP as the source when communicating with other servers. Our fantastic network administrator has also created a NAT rule on the firewall to map this IP to a particular public IP for outbound SMTP so that our PTR lookups match up.

But now we want to add another IP for a new website and the network admin hands you a free IP which happens to be You add this as an additional IP on the NIC and voila – you have a couple issues:

1) You just registered two names for the same server in DNS if dynamic registration is enabled.
2) Your server is now sending all outbound traffic from! (because 50 is lower than 100)

One of these is easily solved – just turn off dynamic registration and manually create the DNS records for the server. The other one is a little trickier because Server 2008 and 2008 R2 will still be sending traffic as the IP.

Fortunately, there is a way to tell Windows not to use the lower numbered IP as a source address by adding the IP via the netsh.exe command. For Server 2008 SP2 and 2008 R2 RTM we need to apply a hotfix first. 2008 R2 SP1 included this fix by default so it is no longer required. Without the hotfix or SP1 you’ll find netsh.exe does not display or recognize the special flag.

Hotfix Downloads:
2008 SP2:
2008 R2 RTM:

The key to this is the IP address must be added via netsh.exe with a particular flag. So if you’ve already added the IP address via the GUI you’ll need to remove it first. After that, use this command to add the secondary IP:

netsh int ipv4 add address "Local Area Connection" SkipAsSource=true

The SkipAsSource flag does two things – first, it instructs Windows not to use this IP as a source IP for outgoing traffic. And secondly, it prevents the registration of this IP in DNS if dynamic registration is enabled. Two birds with one stone!

You can always view the status of the IPs and their SkipAsSource status with the following command:

netsh int ipv4 show ipaddresses level=verbose

Once you have done the above, you can now put in the correct IP address to be allowed for communications through the firewall in your change request.

No comments:

Post a Comment