Source IP Address Preference with Multiple IPs on a NIC

Deploying SCOM agents on servers in the DMZ isn't that difficult, what is so difficult about this?

All that is needed is to raise a Change Request for the Firewall Team to open up TCP 5723 between the SCOM Management Server and the server to be monitored. Well, you are right.

What about if the server is having a single NIC that is assigned several IP addresses?

That's where the challenge will come.

A behavior that changed with the introduction of Server 2008 is that the source IP address on a NIC will always be the lowest numerical IP. So that whole idea of your primary IP being the first one you put on the NIC will be used by the server to communicate is no longer valid.

For example, let’s say we build a new web server and configure the NIC with IP 10.0.0.10. This IP is registered in DNS and the server uses this IP as the source when communicating with other servers. Our fantastic network administrator has also created a NAT rule on the firewall to map this IP to a particular public IP for outbound SMTP so that our PTR lookups match up.

But now we want to add another IP for a new website and the network team hands you a free IP which happens to be 10.0.0.5. You add this as an additional IP on the NIC and voila – you have a couple issues:

1. You just registered two names for the same server in DNS if dynamic registration is enabled.
   2) Your server is now sending all outbound traffic from 10.0.0.5! (because 5 is lower than 10)

One of these is easily solved – just turn off dynamic registration and manually create the DNS records for the server. The other one is a little trickier because Server 2008 and 2008 R2 will still be sending traffic as the 10.0.0.5 IP.

Fortunately, there is a way to tell Windows not to use the lower numbered IP as a source address by adding the IP via the netsh.exe command. For Server 2008 SP2 and 2008 R2 RTM we need to apply a hotfix first. 2008 R2 SP1 included this fix by default so it is no longer required. Without the hotfix or SP1 you’ll find netsh.exe does not display or recognize the special flag.

Hotfix Downloads:
2008 SP2: http://support.microsoft.com/kb/975808
2008 R2 RTM: http://support.microsoft.com/kb/2386184/

The key to this is the IP address must be added via netsh.exe with a particular flag. So if you’ve already added the IP address via the GUI you’ll need to remove it first. After that, use this command to add the secondary IP:

netsh int ipv4 add address "Local Area Connection" 1.2.3.4/24 SkipAsSource=true

The SkipAsSource flag does two things – first, it instructs Windows not to use this IP as a source IP for outgoing traffic. And secondly, it prevents the registration of this IP in DNS if dynamic registration is enabled. Two birds with one stone!

You can always view the status of the IPs and their SkipAsSource status with the following command:

netsh int ipv4 show ipaddresses level=verbose

*
*

Once you have done the above, you can now put in the correct IP address to be allowed for communications through the firewall in your change request.