AD through Firewall - tough question

[Hondy]

Hi

I have AD running through a firewall for some logistical reasons.

My remote member server needs to attach to my local domain which is live. I have done this before on a dev domain with 10 servers, but I am in the situation where I need to do it on my live domain also. What I am referring to is making the RPC/FRS/NTDS ports static in the registry of the DC's because the endpoint mapper will otherwise use a dynamic range and thus be blocked by the firewall.

My question is this... why didn't Microsoft make these ports static in the first place? Is there some sort of limitation that means my domain will break due to the amount of requests on a single port instead of the nomal 1024-65535 dynamically assigned range?

I want to make these ports static, is there anyone who has done this on a domain of say 150 devices?

Thanks

 

[TheLad]

Check out the document below, also look into IPSEC which will eliminate the "swiss cheese" firewall

http://technet.microsoft.com/en-us/library/bb727063.aspx

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[Hondy]

useful article - although we never went for the swiss cheese RPC model which is the dynamic FRS/NTDS/RPC port model.

My question was really that is using a static port a wise idea in a large environment. Can the DC handle everything ok just using one port?

The firewall is for intra-subnet protection, not externally accessible ports.

Cheers

 

[TheLad]

I was always under the impression that one port was a bad idea as applications will be restricted to that single port rather than being allocated its own in the >1024 range.

IPSEC is a possible solution unless anyone can offer some different advice on how to handle RPC through a firewall? I know I would be very interested to hear it as well as I have a similar issue (albeit that we have temporarily allowed the "swiss cheese" until we find a solution)

--------------------------------------
"Insert funny comment in here!"
--------------------------------------

 

[Hondy]

well, don't get me wrong, I currently have an environment working under one port through a firewall- but whether it is smart idea to change my live environment I don't know.

The other environment works just fine, if you want to try it then do this, its straight forward enough - but I honestly dont know why its not static in the first place:

http://support.microsoft.com/kb/224196

http://support.microsoft.com/kb/319553

I know HOW to do it, I can post the required ports if you want when I get into work, but my question is SHOULD i do this on my live environment. Its either that or the swiss cheese effect