Solved

Authenticating on internal domain from DMZ

Posted on 2004-09-02
3
232 Views
Last Modified: 2013-12-04
Hey folks,

I need to authenticate users connecting through VPN to our DMZ on our internal AD-Domains. Would it be enough to allow authentication with 1 DC in the top domain?

Shouldnt the TopDomain be able top authenticate for the sub-domains or atleast request and pass on authentication?

Please let me know if anyone of you know :)

/Rene
0
Comment
Question by:LamerSmurf
  • 2
3 Comments
 
LVL 16

Accepted Solution

by:
JamesDS earned 250 total points
ID: 11963385
LamerSmurf
If you allow access from the DMZ to only a domain controller in the root domain, then users will not be able to logon fully - without using cached credentials. The reason for this is that things like domain local group memberships are not replicated to all Global Catalogs and therefore are unavailable to Domain Controllers ouside of the users home domain. Without this information the user cannot be logged on, unless cached credentials are available.

The likely message a user will receive is "The user cannot log in because the domain DOMAIN is not available."

you need to allow the DMZ access to at least one domain controller in each domain.

Cheers

JamesDS
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11968976
Well actually Active Directory domains are two-way transitive trusts. So the whole forest trusts itself. The handshake can take longer without additional short-cut trusts created but it will work.
0
 
LVL 3

Expert Comment

by:Gargantubrain
ID: 11969012
Now that I think about it, the client on the outside of the VPN may not be able to make all of the kerberos handshakes if it can't contact each domain. I was initially speaking from the standpoint of a client that is in the network.
0

Featured Post

Networking for the Cloud Era

Join Microsoft and Riverbed for a discussion and demonstration of enhancements to SteelConnect:
-One-click orchestration and cloud connectivity in Azure environments
-Tight integration of SD-WAN and WAN optimization capabilities
-Scalability and resiliency equal to a data center

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
How to organize and manage AD group? 10 67
Is this error real? 2 54
Monitoring software... 2 66
How to centrally test thousands of laptops USB is blocked 5 34
Recently, a new law in my state forced us to get a top-to-bottom analysis of all of our contract client's networks. While we have documentation, it was spotty at best for some - and in any event it needed to be checked against reality. That was m…
Security measures require Windows be logged in using Standard User login (not Administrator).  Yet, sometimes an application has to be run “As Administrator” from a Standard User login.  This paper describes how to create a shortcut icon to launch a…
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
A short tutorial showing how to set up an email signature in Outlook on the Web (previously known as OWA). For free email signatures designs, visit https://www.mail-signatures.com/articles/signature-templates/?sts=6651 If you want to manage em…

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question