Domain connectivity issue

[damarious25]

Just took over the network so still learning how everything is setup.

Domain uses a Windows DC with AD, DNS, and DHCP. There is a second server for AD, DNS, and Exchange.

Users are having issues where connections remain active on local PCs, and external e-mail is sent and received, but browsing the web fails. Users loose internet connectivity for a few minutes. It happens for different users at different times so it's not domain wide when it happens.

It has me stumped. I changed the APs with brand new ones thinking it was a wifi issue. The IP pool is a mess and fills to 100% so I had to increase that and reserve some IPs for devices. I've added conditional forwarders to the DNS servers (there were none before). I tried using netstat on local machines experiencing the issue but it doesn't work when the connection is fine, but there's no internet connectivity. I looked through event viewer but there are no serious or critical errors. I scavenged resource records.

I assume it's a DNS issue but as far as I can tell DNS is configured, up, and working. Plus the connectivity loss is always just temporary. Sometimes a minute, sometimes 5, but if a user always hits refresh web connectivity returns. Could there be an issue with forward and reverse lookup zones? Why is internet connectivity lost on local machines and always just temporarily. The servers never loose connectivity, and some users who all go through the same infrastructure never seem to have the issue. Like I bought a few new laptops for users, and on these same new computers, over the same network, half of those users have the issue and the others not nearly as often.

I'm not sure how to resolve this and really need some help.

 

[gimp]

can you ping an external IP address when the issue is occurring?
if you try to ping an external domain name when the issue is occurring, does it resolve to an IP address?

 

[MrGuvernment]

There is a second server for AD, DNS, and Exchange.

Get that fixed as well, AD + Exchange = waiting for problems to happen.

have you monitored the link to the ISP, maybe it is dropping out..

What device for firewall access on the perimeter?

How do all the AP's link back?

Can you create separate SSID's to test with to try to narrow the issue down to a single AP / switch / router ?

 

[damarious25]

What device for firewall access on the perimeter?

Nailed it.

An old Cisco device with a 50 user licence. Old as in way past EOL, so no unlimited user licence can be added. Plus, I read somewhere that internet browsing/connectivity will drop when a Cisco device maxes its' user licence.

I "think/hope" this is the cause. Now I need a way to troubleshoot it to determine if we're hovering around the max 50 user. Some users don't experience any drops so I wonder if they're heavy users or have their IP's set in the Cisco device? I know our DHCP IP pool was maxing out at over 50 users until I added more to the scope.

 

[MrGuvernment]

time to start counting! can you watch logs to check how many LAN ip's are hitting the device at one time when it drops..