Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

External Access to Share point, what's secure?

Posted on 2010-09-23
4
Medium Priority
?
822 Views
Last Modified: 2016-10-25
Hi Guys,

We have ASA 5540, ISA, WISP, SQL, Netscaler and sharepoint, what's the best secure way to architect this with one AD and single sign on?

ASA has outside, inside "LAN", and DMZ .

AD, WISP, ISA, SQL and Sharepoint are on the LAN side.

Netscaler has one leg on the DMZ and one on LAN

Your help is greatly appreciated!
0
Comment
Question by:smartnet
  • 2
4 Comments
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 2000 total points
ID: 33752967
Quite straightforward as Sharepoint and SQL are inside as opposed to in the DMZ. You have not mentioned whether ISA is actually installed as the intetrnal firewall or just as a proxy server but I will assume ISA is joined to the internal domain in either case.

This link provides the TechNet article regarding publishing the majority of common applications - including Sharepoint-  securely through ISA 2006.
http://technet.microsoft.com/en-gb/library/bb794854.aspx

In summary though, using the ISA server publishing wizard is the normal, recognised approach using https bridging and certificates.

Keith
0
 

Author Comment

by:smartnet
ID: 33755541
I think ISA is working as a proxy server rather than a firewall, do you recommend putting it in the DMZ, if so what about authentication??
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 33756400
The recommendation is always to use ISA or FTMG as a firewall/proxy rather than just a proxy and to have ISA or FTMG as a member of the domain.

if ISA/FTMG only has one nic then it can ONLY be a proxy server.

You can use the LDAP connection options though in the general confiuration if you decide to install ISA solely as a proxy server in the DMZ.
0
 
LVL 10

Expert Comment

by:simonlimon
ID: 33761396
It is much better for isa to be a member of the domain, if not you can't really have true sso as kerberos delegation is not possible... That would be the optimal way to publish a web page.
0
Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

The recent Microsoft changes on update philosophy for Windows pre-10 and their impact on existing WSUS implementations.
In case you ever have to remove a faulty web part from a page , add the following to the end of the page url ?contents=1
This tutorial will walk an individual through locating and launching the BEUtility application and how to execute it on the appropriate database. Log onto the server running the Backup Exec database. In a larger environment, this would generally be …
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question