Update 2011-07-16
We filed a request to have the 2008 R2 solution listed below backported to Windows 2008 SP2, but the request came back denied yesterday. The escalation engineer’s comment: “Considering that Windows Vista and 2008 SP1 hit End of Life this month, the resources were not available for a fix.” That will close the book on this issue – if you need the SkipAsSource functionality in Windows 2008, you have to use 2008 R2.
Update 2011-04-15
Microsoft support advises that there are no plans to bring the ‘netsh int ipv4 show ipaddresses level=verbose’ command to Windows 2008. It will only be available for 2008 R2.
Update 2011-04-10
I can confirm that KB2386184 does work on Windows 2008 R2, the netsh int ip command with the SkipAsSource flag works, and ‘netsh int ipv4 show ipaddresses level=verbose’ does display the flags on all IPs on the box. The issue I ran into was because of how the Hotfix downloader works. We don’t download patches directly from servers, so I was downloading from my workstation which is Windows 7 32-bit. I didn’t notice at the time, but it pushed a 32-bit version of the hotfix down because that’s what it detected on my workstation. When I tried installing the 64-bit version, it (not suprprisingly) worked.
I have our MS rep looking into why the same show ipaddress command doesn’t exist for 2008 SP2, KB975808.
Update 2011-04-06
My change request was closed. MS says they addressed the 2 biggest concerns – setting the SkipAsSource flag and being able to view the flag in the hotfix available at KB2386184. They opened a new ticket to address why I am unable to successfully install the hotfix – when I attempt the installation on 2008 R2, I get an error saying that the hotfix doesn’t apply to my system.
Update 2011-04-02
KB2386184 references a way to at least dump the existing SkipAsSource flag on Windows 7 and Windows 2008 R2, but I was unable to install the hotfix, it said the hotfix didnt apply to my 2008 R2 server. I have a meeting next week with a product manager, hopefully we can come to some resolution.
Update 2010-02-08
Heard back from Microsoft and option “a” below is being considered for backporting into Windows 2008. All of the features listed below are part of Windows 8.
Update 2009-12-17
We have filled out a design change request for Microsoft – we’re not holding our breath on implementation though.
a) There doesn’t appear to be a command to list out the IPs on the box and determine which ones are flagged SkipAsSource. When we have a server that’s reporting intermittent failures to connect to an SMTP server, it is not possible to figure out which IP is the offending IP.
b) The SkipAsSource flag should be in the GUI instead of a command line netsh.
c) You can only set the flag on an IP add, not on an existing IP.
d) We should be able to set the default behavior so new IPs that are added are automatically flagged SkipAsSource.
Update 2009-11-16
Microsoft advised the instructions in their hotfix were not 100% accurate, the syntax of the netsh command was incorrect. It has since been updated. I did get the hotfix to work with one caveat: the name of the interface can not start with a digit – the command fails unless the interface name starts with a letter i.e. interface 10.0.0.x won’t work, but if you name it i10.0.0.x it will work.
It’s not a great solution because 1) You can only use the netsh command to add an IP with the SkipAsSource flag, there’s no way to set it after it’s on the box, you have to delete and add it again 2) You have no command to display which IPs have the SkipAsSourceFlag set, 3) There’s no GUI option, 4) There’s no option for SkipAsSource to be the default setting for all IPs added to the box. But it’s the best we have for now.
2009-11-02
We’ve run into issues with Windows 2008. The first is that every IP on the box gets auto-registered in DNS. This causes issues with some of our monitoring software being unable to handle multiple IPs returned in the DNS query. The second is that there is no concept of “primary” IP on the box anymore. In Windows 2003, the first IP on the box is the primary IP and it’s the default IP for all outbound communication. In what appears to be a random fashion, 2008 picks different IPs for outbound traffic. This is causing problems as we’re having to add firewall rules for every new IP that we add to a box – we never know which IP is going to be used to hit a SQL box or SMTP server.
I found this MS article that explains how an IP is selected. This does seem to explain the behavior; however, it isn’t consistent. I also found a hotfix KB975808 that claims to fix the DNS registration and primary IP issue, but was unable to get it to work. The fix is a “SkipAsSource” flag addition to the netsh command, adding an IP with the flag enabled will force windows to skip the IP for DNS registration and outbound IP selection.
I opened a ticket with Microsoft and we’ll see what happens.