[x]
Posted via EE Mobile

Search, ask, and monitor your questions on the go with EE Mobile. Visit Experts Exchange from your mobile device and never be out of touch again.

Question
[x]
Attachment Details
[x]
The Solution Rating System

With so many solutions, how can you tell which solutions are most likely to help you and which ones are not? To provide you with a tool to use, we rate our solutions based on various elements that most accurately determine if a solution is a quality solution. To explain what factors affect the solution rating, here are the elements we take into consideration when formulating our solution rating.

  • The Grade of the Solution
  • The Zone Rank of the Expert Providing the Solution
  • The Number of Author and Expert Comments
  • The Number of Experts Contributing
  • The Feedback of the Community

Your Input Matters
Because of the way the system is set up, the most important variable in this equation is you. As a member of Experts Exchange, you are able to cast your vote on the quality of the solutions in regard to how complete, accurate, helpful and easy to understand each solution is. When you provide your feedback, each rating is adjusted accordingly. So, if you see a solution that has a poor rating that you think is a good solution, let us know by rating it. As you do, the rating will be adjusted and will become more accurate for other members of our site.

If you have any suggestions that you would like to make for our rating system, please ask a question in the Suggestions Zone of Community Support.

Thank you!

9.0

Should I and how do I, run Active Directory into my DMZ?

Asked by Mr-Madcowz in Active Directory

Tags: active directory, dmz, ports, firewall

Hi,

My level of knowledge on Firewalls and Active Directory is pretty basic and I would appreciate some expert advice please.

I am trying to allow my windows 2003 & 2000 servers in my DMZ to connect to the 2003 Domain Controller in the LAN but I am getting errors with regards to the secure connection failing and there being no logon servers available:

Event ID: 5719
This computer was not able to set up a secure session with a domain controller in domain <DOMAIN> due to the following:
There are currently no logon servers available to service the logon request.  

Event ID: 1053
Windows cannot determine the user or computer name. (The specified domain either does not exist or could not be contacted. ). Group Policy processing aborted.

Firstly, is it good practice to allow Active Directory through into the DMZ?

I have opened up the following ports on the Firewall (Fortigate 60) as per KB 179442 (http://support.microsoft.com/kb/179442)

Client Port(s)      Server Port      Service
137/UDP      137/UDP      NetBIOS Name
138/UDP      138/UDP      NetBIOS Netlogon and Browsing
1024-65535/TCP      139/TCP      NetBIOS Session
1024-65535/TCP      42/TCP      WINS Replication

Client Port(s)      Server Port      Service
1024-65535/TCP      135/TCP      RPC
1024-65535/TCP      1024-65535/TCP      LSA RPC Services (*)
1024-65535/TCP/UDP      389/TCP/UDP      LDAP
1024-65535/TCP      636/TCP      LDAP SSL
1024-65535/TCP      3268/TCP      LDAP GC
1024-65535/TCP      3269/TCP      LDAP GC SSL
53,1024-65535/TCP/UDP      53/TCP/UDP      DNS
1024-65535/TCP/UDP      88/TCP/UDP      Kerberos
1024-65535/TCP      445/TCP      SMB


As a test I set my Firewall to allow all through from the DMZ to the LAN and then ran a

dia sni pa dmz host 192.168.4.100' (the dmz servers IP address)

while performing an nltest /sc_reset:<DOMAIN NAME> and it passes with a success

All of the ports listed in the sniff were covered in my ports I have opened on the Firewall and I have attached this image to this question. So far so good.

Going back to the Firewall and switching off the allow all and re-running the nltest /sc_reset fails with:

1311 0x51f ERROR_NO_LOGIN_SERVERS

and this is where I am stumped, as far as I can see I have the correct ports listed.

any advice appreciated,


thanks.
Attachments:
 
Image showing results of port sniff while performing an nltest /sc_reset
Image showing results of port sniff while performing an nltest /sc_reset
 
 
Related Solutions
Keywords: Should I and how do I, run Active Dire…
 
Loading Advertisement...
 
[+][-]07/01/09 03:51 AM, ID: 24753010Accepted Solution

View this solution now by starting your 30-day free trial. Setting up your free trial is quick, easy, and secure. We will return you to this solution, unlocked, when you're done.

About this solution

Zone: Active Directory
Tags: active directory, dmz, ports, firewall
Sign Up Now!
Solution Provided By: Kieran_Burns
Participating Experts: 2
Solution Grade: A
 
[+][-]07/01/09 04:11 AM, ID: 24753086Author Comment

Often, when Experts are collaborating with members who have asked questions, they will request additional information about the problem. Askers respond with an author comment like this one.

Start your 30-day free trial to view this Author Comment or ask the Experts your question.

 
[+][-]07/01/09 04:18 AM, ID: 24753123Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
[+][-]07/01/09 05:39 AM, ID: 24753647Expert Comment

At Experts Exchange, members can ask their questions to thousands of technology professionals, also known as Experts. Experts compete and collaborate to answer those questions by leaving comments like this one.

Start your 30-day free trial to view this Expert Comment or ask the Experts your question.

 
 
Loading Advertisement...
20091111-EE-VQP-92 - Hierarchy / EE_QW_3_20080625