AWS AD Connector - Testing TCP Ports Failed - UDP Ports Passed

Question

Hi

I'm currently using a local Hyper-V hosted Domain Controller on my laptop to act as an on-prem Active Directory DC, currently with no firewall running on the DC VM currently and all pre-req ports opened for AD connector on local laptop firewall hosting Hyper-V.

I have a site to site VPN connected to a VPC in AWS via a Meraki Z1 teleworker gateway and I'm trying to setup the AWS AD connector which keeps failing to create.  
Followed steps to use the DirectoryServicePortTest tool on an EC2 instance from AWS and when running the tests it fails on all TCP ports but passes on all UDP ports, also cannot get a forest functional level, see below (domain and IP address removed from output):

Testing forest functional level.
The domain  could not be found.

Testing TCP ports to :
Checking TCP port 53: FAILED
Checking TCP port 88: FAILED
Checking TCP port 135: FAILED
Checking TCP port 139: FAILED
Checking TCP port 389: FAILED
Checking TCP port 445: FAILED
Checking TCP port 464: FAILED
Checking TCP port 636: FAILED
Checking TCP port 49152: FAILED

Testing UDP ports to :
Checking UDP port 53: PASSED
Checking UDP port 88: PASSED
Checking UDP port 123: PASSED
Checking UDP port 137: PASSED
Checking UDP port 138: PASSED
Checking UDP port 389: PASSED
Checking UDP port 445: PASSED
Checking UDP port 464: PASSED

I'm puzzled at the moment  as why it keeps failing and cannot see where the problem lies, could be with the Meraki firewall but I have added port forwarding rules to the local Server IP but still not working for TCP but UDP passes fine.

Can anybody please give me some ideas what could be going wrong or if anyone has encountered a similar problem before?

Any advise is appreciated and thank you in advance

Mark

Answer

Hi Mark,

In order to narrow down the issue on why connection to TCP ports are failing, please enable VPC flow logs [1] on the AWS EC2 instance from which you are testing the connectivity and check for two-way TCP traffic or for any rejects.

Since you are connecting to on-prem over site-to-site VPN connection which is terminating on Cisco meraki device at on-prem, please enable logging/filtering on it just to see if the TCP traffic is received from AWS side and responded back.

Also, please make sure SG's and NACL's for the instance are allow-listed for destined TCP ports and IP's.

Try launching a test VM in the same subnet as AD connector at on-prem and test for TCP connectivity.

The above steps would help in identifying where TCP traffic is getting dropped.

References:
[1] https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-cwl.html

AWS AD Connector - Testing TCP Ports Failed - UDP Ports Passed

Relevant content