0

I’m in desperate need of help. I have a bizarre problem that I’ve had no success in solving. See below the pertinent backstory and details.

BACKGROUND
This all began about two months ago. Two months ago the network consisted of two computers used 8 hours/day, and three more used much more seldom on a 12Mbps internet connection that splits the connection equally among clients. Basical mail/web browsing. No video streaming to speak of. We do have 5 Cisco VOIP phones, but they're used somewhat infrequently.

Since then, we’ve added a server/domain controller, and three additional computers used 8 hours/day. The three new computers were purchased from Dell Business, and all are running Win 10 Pro. No networking hardware changes have been made (router/switch). The network was then switched over to a domain network, with all computers enrolled in the domain except two personal computers running Win 10 Home, which are no longer used as of now.

DISCOVERY OF ISSUE
We didn’t get all of the new Dell machines at once. First we just bought one. Within a week the user was reporting the inability to send/receive emails in Outlook on occasion. When I troubleshot the issue I noticed the computer couldn’t connect to the IMAP or SMTP server, or the webmail login, or the server’s IP address. Couldn’t connect in Outlook, couldn’t connect in-browser to the webmail login, couldn’t ping the server in CMD or powershell, nothing. But a reboot instantly solved the issue. I tried setting up a different IMAP account in Outlook, but the issue didn’t occur with that account (GSuite Business account).

I tried disabling the firewall, adding the IP to the whitelist. No joy. Finally, I reinstalled the network adapter driver – nothing. Then I setup the account in Windows Mail – though it happened less frequently, it still happened. A reboot instantly fixed it, but I couldn’t find the cause. I even called our mail provider, thinking perhaps the machine was being temporarily blocked, but they claimed that wasn’t possible. Nothing in Event Viewer pertaining to the issue either. Nearing the end of my rope with this issue, I opted to reinstall Windows before troubleshooting further. After a complete reinstall the issue returned. None of the other computers experience the issue – at that time.

PROBLEM CONTINUES
Shortly thereafter we purchased two more Dell PCs. Different models from the first and one-another. Both have the same issue, but the issue has also expanded. It’s not just the mail server that we can’t connect to after a time, it’s also websites like McMaster Carr, Yahoo Mail – etc. It almost seems as though it’s any site or server that’s frequently used/accessed on the machine in question. At first I thought it was an O/S issue, but we have another Win10 Pro machine on-site that doesn’t have this issue. We also have several Win10 Home machines (personal computers owned by employees) that don’t have this issue, plus two Win 7 Pro machines, also without this issue. It’s only on the new Dell PCs running Win 10 Pro.

TROUBLESHOOTING EFFORTS & RESULTS
I maintain this network remotely, so booting into Safe Mode with Networking to troubleshoot further isn’t possible, but it’s the next thing I’m going to try when I’m on-site later this week. The issue doesn’t seem to occur at set intervals. Sometimes things work great for hours and hours, then stop, other times 10 minutes after booting up the issue begins. I also want to wait for the issue to occur, then try to connect the computer to a completely different network. Haven’t been able to try this yet as only one of the machines has a wireless adapter, but when I’m on-site my goal is to wait for the issue to occur, the connect it to a WiFi hotspot on my phone and see if the issue persists.

NOTES
One other potentially important note – the internet at this business isn’t DSL or cable. Those services aren’t available at this location; despite the fact the business isn’t in a particularly remote area. The service we have is a fixed-wireless system provided by the City. It’s slow and buggy. For example, I’ve been trying to setup a new router for 4 weeks, but they’ve been unable to get the new router that we purchased to connect. I RMAed the first one, thinking it was a router issue. The new router can resolve hostnames to IPs, but can’t connect to the internet or ping IPs. Very weird. We’re using Cisco hardware right now, but I’m thinking about switching to Ubiquiti depending on how this shakes out. Just need to make sure Ubiquiti routers provide L2TP VPN.


List of what I’ve tried:

  • Disabling all Dell OEM Software

  • Disabling Firewall

  • Adding server IP & host names to allow list in Firewall

  • Add server IP & host names to whitelist

  • Reinstalling network adapter drivers

  • Reinstalling Windows (OEM edition – I don’t have another free license)

  • Setting up an IMAP Gmail account in Outlook and constantly hitting send/receive for 30 minutes

    List of what I plant to try when I'm next on-site this week

  • Safe mode with networking to see if issue presents in this diagnostic mode

  • Change networks without reboot during time the issue is occurring

  • Swap router & switch

EDIT: ADDITIONAL DETAILS PER COWN'S REQUEST:

When this problem occurs access is only disabled to the site's/servers in question. We do NOT lose internet access on the machines. I can ping the DC and the router, and other machines. Other websites/servers can still be accessed without issue.

The problem doesn't appear to be caused by software or drivers, are three affected computers are running completely different software. The only common threads are: Dell machines, Win 10 Pro.

We're using a Cisco C881 router and Cisco SG300-38P Switch. No other machines on the network apart from the new Dells have this issue.
DHCP is provided by our Windows A/D DC. DHCP is disabled on our router.

enter image description here

closed as too broad by user36472, Zac67, Ron Maupin Mar 18 at 13:30

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Hello and welcome to Network Engineering. I'm struggling to find any information, that we can use to help you troubleshoot your issues. All software, servers, host configurations, drivers etc. are off topic on our site. You should add a drawing of your network design and tells us what network devices you use on your network. Also, what is the configuration of your network devices? – user36472 Mar 18 at 7:15
  • Too broad? How is it too broad? I'm simply stated that I've rules out drivers, software, servers, etc. Those have been ruled out as NOT THE CAUSE. – B4THC4T Mar 18 at 13:39
  • You have not provided any information about your network design, network devices or configurations. If you need help troubleshooting your problem, this is what we need to help you. – user36472 Mar 18 at 13:43
  • 1
    If you're sure your basic setup is AOK (switches, DHCP, DNS) the most likely cause is the router - there's always a certain limit of NAT sessions a router model can manage and possibly you've exceeded that limit. – Zac67 Mar 18 at 14:00
  • You have not given us enough detail to do anything but guess or speculate, which is off-topic here. For example, what are the network device configurations? You can refer to the Network Engineering Question Checklist for guidance. – Ron Maupin Mar 18 at 14:03
1

(I’m not sure on your level of network knowledge so forgive me if I’m putting things too simply).

In my experience when there is an intermittent issue like this is can often be caused by IP conflicts (either because of static IP misconfiguration or a problem with DHCP). By that I mean that two or more computers are trying to use the same IP for their interface at the same time.

For example computer A is using an IP of 10.0.0.5 and a second computer B comes online and tries to use the same IP for some reason. When this happens the router starts sending the traffic that was going to computer A to computer B. Computer A keeps sending packets out to the router but the router will send the replies to computer B. Essentially computer A will never get reply packets and it will look to computer A that Internet connections are failing. Meanwhile computer B is accessing the Internet just fine and while it’s getting computer A’s return packet it will just ignore them. Eventually computer A will re-ARP for the duplicate IP and now A works and B will fail to make connections. This continues until one machine is rebooted, gets a new IP via DHCP, and kicks the can down the road until the next conflict.

I’d pose the theory that you previously had DHCP being handled by the router (although that’s an assumption) and once you setup the new domain controller (which I’m assuming is a Microsoft AD domain controller) that the domain controller is also running a DHCP server. If that’s true then when clients make DHCP requests they’ll get answers from both servers and whichever one it gets first it will use. Since the router DHCP and AD DHCP are not communicating with each other they are very likely offering clients the same IPs - thus causing the conflict. Again there are some assumptions I’m making here for this theory as it’s not clear from your post. If this is the case then the fix is easy: disable The DHCP server on the router and let AD handle DHCP (which it needs to for AD to work correctly). The AD server should be IPd statically with a default gateway set to the router’s IP.

There is more information needed to really troubleshoot problems like this. If the above isn’t your problem then I’d suggest gathering st least the following information:

What router/firewall are you using? What is it’s external/Internet facing IP, subnet/netmask, and default gateway? What is it’s internal IP and subnet?

When this problem happens does the victim machine lose ALL network access or just Internet access? When it happens can you ping the router’s internal IP? Can you ping another IP on the same network? How about an IP on the Internet such as 4.2.2.1? Can you resolve DNS entries like google.com?

Are IPs assigned statically or via DHCP? Check EVERY computer.

Are the machines plugged into a hub or switch? Are the managed or unmanaged? Layer 2 or layer 3 hub/switches? How many and how are they connected to each other?

Any other devices on the network like printers, smart devices, wireless APs?

On a personal note replacing devices, reinstalling OSes, and rebooting in general isn’t really troubleshooting and will generally just waste your time as the problem hasn’t been fixed and will most likely come back. I appreciate that you’re doing this remotely so it’s harder to troubleshoot but one good troubleshooting session will save you weeks of intermittent issues. Remote access to the router, especially CLI will serve you well. Wireshark is your friend here.

Not the answer you're looking for? Browse other questions tagged or ask your own question.