I have a Cisco C9300-24P layer 2 switch with a dozen computers and 2 servers on the same VLAN, all statically set with no default gateway as there is no router and all offline from the internet. The servers are DCs and see the domain as DOMAIN.NET. These are all fresh installs of windows. The computers see the network as "unidentified network". I have this same setup on an HP switch and those machines see the domain as DOMAIN.NET. So my question is can a Cisco switch config prevent the clients from seeing the domain connection as a domain connection on Windows 10?

  • 1
    We would need to see the switch configuration to see if it has been configured in any way that would prevent that, but normally, no, a switch has nothing to do with that. – Ron Maupin Jun 10 at 19:05
  • 1
    For a domain, NLA simply detects that a domain controller is reachable. The client needs the network connectivity and the ability to find and resolve the required DNS records. Most often, the DNS setup is the problem - using Windows DNS is the easiest solution by far. However, all that is off topic here. Unless the switch is using ACLs to control L2 traffic it's not the problem. – Zac67 Jun 10 at 19:18
  • @Zac67 I am using Windows DNS. NLA is running but still showing Unidentified Network. BUT nslookup finds the DC. All my computers are doing that. And the system setup the DNS during creation of the domain. Not sure where to look in DNS. – JukEboX Jun 10 at 20:05
  • 1
    You could try on Server Fault to get help for verifying DC DNS. – Zac67 Jun 10 at 20:15

can a Cisco switch config prevent the clients from seeing the domain connection as a domain connection on Windows 10?

No, not normally. Windows NLA works by trying to establish certain connections with a domain controller. So, unless a switch actually filters those connections by ACLs, it doesn't interfere with NLA at all.

If the connections cannot be established, the usual causes are (mostly off-topic here) DNS problems (e.g. non-MS DNS) or firewall settings. Make sure the DCs allow all relevant protocols regardless of the apparent location/profile (in case you need to boot all of them at the same time) - and of course, never connect them to anything but the company LAN, and do not port-forward anything from the Internet.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.