Server in DMZ joing to Domain

[fzx5v0]

Hi
I have a server in the DMZ and i have these firewall ports to open to join it to the domain. Can you advise if the traffic has to go in both directions so do open the port server to ad controller and ad controller to server

thanks


DNS (53/tcp and 53/udp)
Kerberos-Adm (UDP) (749/udp)
Kerberos-Sec (TCP) (88/tcp)
Kerberos-Sec (UDP) (88/udp)
LDAP (389/tcp)
LDAP UDP (389/udp)
LDAP GC (Global Catalog) (3268/tcp)
Microsoft CIFS (TCP) (445/tcp)
Microsoft CIFS (UDP) (445/udp)
NTP (UDP) (123/udp)
PING (ICMP Type 8)
RPC Endpoint Mapper (135/tcp)
RPC Dynamic Ports (5000-5100/tcp)




Easyinkz Printer cartridges

http://www.easyinkz.co.uk

 

[cajuntank]

There are so many ports that have to be opened for Kerberos and authentication, having the server on the DMZ is worthless.

The whole point of the DMZ is having those public facing services you need your Internet users to access available, but protect your private LAN from access or attack should their be a breach on that DMZ'd machine.

With your scenario, should they gain access to your server in the DMZ, they now have access to your private LAN anyway, so just put your server on your private LAN and make it easy on yourself (not really recommending this, just stressing a point).

What application or scenario are you running into that dictates having this server joined to your domain?

 

[NortonES2]

If the ports are opened correctly and in the right direction only then they won't have access to your LAN. Though I wouldn't put a DC in the same DMZ as a web or ftp server also ensure that AV software is up to date and install an IPS system as well.

-------------------------------

If it doesn't leak oil it must be empty!!

 

[58sniper]

What's the purpose of putting a domain joined maching in the DMZ? If it's for some web application, your approach should be to put the app server in your production network and publish it through something like TMG or ISA.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[fzx5v0]

Hi
The server is for ISA and to use the advance fetures like certificate base authentication it has to be a domain member

thanks

Easyinkz Printer cartridges

http://www.easyinkz.co.uk

 

[theravager]

The isa box should have 2 nic's one in the dmz and one in internal.

The external nic only has listeners on it for http/s traffic so the rules are pretty straight forward.