Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

Why Server in DMZ can't join domain (DC in Internal) in 3-leg network?

Posted on 2008-09-29
5
Medium Priority
?
4,728 Views
Last Modified: 2013-12-24
View my attachment for more information about my network.

I have configured ISA Server 2006 as standalone server (not joined domain). To communicate between all network, I open LDAP ports (all about LDAP).
ISA Server has recognized LDAP users from DC. Here is all rules I have configured in ISA server:

[rule name] ; [Action] ; [Protocol] ; [From] ; [To] ; [Condition]
1. Allow Ping ; Allow ; PING ; Internal, Perimeter, VPN Clients; External, Localhost, Perimeter, Internal; All Users
2. Allow LDAP; Allow, LDAP, LDAP (UDP), LDAP GC, LDAPS, LDAPS GC; Internal, Perimeter, VPN Clients; Localhost; All users
3. Web Access Only; Allow; FTP, HTTP, HTTPS; Internal, VPN Clients; External, Perimeter; All users
4. VPN clients to Internal; Allow; All outbound; VPN Clients; Internal; All users
5. Allow DNS; Allow; DNS; Internal, VPN Clients; Perimeter, External; All users

I have configured one more rule to test like that:
6. test; Allow; All outbound; Perimeter; Internal, Localhost; All users

So my trouble is Server in DMZ can't join domain, can not ping to SV1 (DC)...
Because i want to create Mail Exchange 2007 Server in DMZ, and it must joined domain to continue install process.

I guess servers in DMZ can't recognize SV1 in Internal because they don't have DNS to know who is SV1, but why I can't ping to sv1? How can I configured to let servers in DMZ communicate with DC in Internal?

Please help me.
Topology-3.png
0
Comment
Question by:vietpa
  • 2
  • 2
5 Comments
 
LVL 8

Expert Comment

by:anil_u
ID: 22603592
The most likely reason why you cannot join the domain is NOT because of DNS but because FW1 cannot see SV1. This is a networking problem. Both FW1 and SV1 have a subnet of 255.255.255.0 and fw1 is on 192.168.3.0 and SV1 is on 192.168.2.0 i.e two different networks. Is the device between the two a router. Has this been configured to allow traffic between the two networks?
0
 
LVL 71

Expert Comment

by:Chris Dent
ID: 22604577

> Because i want to create Mail Exchange 2007 Server in DMZ, and it must joined domain
> to continue install process.

Hmm I recommend you do not do this. It doesn't give you any additional security while adding a great deal of complication.

The thing is, you need so much open for Exchange to talk to AD that isolating the Exchange Server in the DMZ doesn't really improve security. Bear in mind that we must include RPC as well as services like MAPI for clients.

You would be better using a Proxy Server (like ISA Server) to publish OWA and any other public services from the private network (in my opinion).

Chris
0
 
LVL 8

Expert Comment

by:anil_u
ID: 22604613
Please ignore my comment - just had a proper look at your diagram :)
0
 

Accepted Solution

by:
vietpa earned 0 total points
ID: 22605163
Hi Chris,

You say that I had better using Proxy Server (like ISA Server). In my topology, I'm using ISA Server 2006, and I'll publish Web Server & Mail Server in DMZ. I put these servers in DMZ because I want to secure them from both Internal Users and External Users. I think if it's put in Internal, i can't manage them from internal access.
In addition, I'll use GFI for ISA Server as Proxy Server in near future.

Return to my problem. Now I've solved it. Mail Server in DMZ can join domain to DC in Internal.
Here is my solution:
- Go to Configuration > Network
- Add new network rule to use NAT from Perimeter to Internal.
- Open some ports (RPC, Microsoft CIFS, Kerberos-Sec, LDAP)

Is it secure when I open NAT from Perimeter to Internal? Is it secure when Mail Server put in Perimeter or Internal, where is more secure? Would you let's me know clearly about this, Chris?
0
 
LVL 71

Assisted Solution

by:Chris Dent
Chris Dent earned 400 total points
ID: 22606058

> Is it secure when Mail Server put in Perimeter or Internal

It very much depends on your reason for putting it there.

DMZ implies an area of the network for direct public access. Given that your Exchange Server needs a high degree of access to the internal network this is not generally a secure approach as you have to make a large number of holes in the Firewall.

That means that if the DMZ is compromised then the hop to the internal domain is a short one.

In terms of providing (public) inbound access to OWA you would certainly be better proxying / publishing it through ISA if you haven't already.

For restricting internal user account, I guess it depends on what you think your internal users might attack?

Chris
0

Featured Post

Vote for the Most Valuable Expert

It’s time to recognize experts that go above and beyond with helpful solutions and engagement on site. Choose from the top experts in the Hall of Fame or on the right rail of your favorite topic page. Look for the blue “Nominate” button on their profile to vote.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Creating a Cordova application which allow user to save to/load from his Dropbox account the application database.
Creating a Cordova application which allow user to save to/load from his Dropbox account the application database.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …

963 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question