Routing between networks on same lan

[BHX90]

Hi,

After the purchase of company B I need to relocate their network to our premises and provide access to both networks to the users.

I can't change the IP address on either network due to legacy system issues.

Do I simply use Windows 2003 as a router to connect the networks and then create a trust between the domains? Do I need to do anything with DNS?

Company A: NT4 Domain IP:192.168.0.x, 255.255.255.0
Company B: Windows 2003 Domain IP 10.10.10.x, 255.255.255.0

Any advice and pointers to whitepapers etc would be most welcome.

Thanks

 

[itsp1965]

For the interim, you can setup a multihomed Windows 2003 server with one interface pointing to each of the networks and setup RRAS to perform routing,
As for the trust relationship, you can setup the Windows 2003 server to trust the NT server, but this would have to be purely a NetBIOS based trust so DNS changes on the NT side won't work for you.
Does Windows 2003 environment already have active directory in place? and how big is the environment? You may want to consider merging into a new AD forest and start clean (just a thought)

 

[kmcferrin]

Honestly, I'd probably just put in a firewall between their network and your network, and then restrict what traffic you allow to go between them until you are ready to migrate. When you do migrate, migrate them from their network to your network, and then phase their network out. You don't want to just give them a wide-open connection to you, because if you do then their security problems will become your security problems.

 

[BHX90]

Thanks,

itsp1965

AD has about 100 users so very small and not all users will remain with the company. I will probably start AD from scratch.

kmcferrin

Would using a firewall allow access to systems on the "other" network?

Cheers

 

[kmcferrin]

It totally depends on how you set it up, and what traffic you allow through. My suggestion would be to put your company's network on the internal/trusted interface, and then put the new company's network on the external/untrusted interface. Since most firewalls by default allow all outbound traffic, you should then have access to their network from yours, but not the other way around. If you need to allow certain types of traffic through (like say you want the new company to be able to access your intranet site) then you would just put in rules to allow that inbound traffic only to the specific server in question (in the intranet example, you would allow port 80 inbound only to the intranet server, and only from the new company's subnets).