asked on

Adding DMZ Servers to internal domain

Howdy,

Quirky question - currently we have our internal domain, a DMZ in its own workgroup, and a
router/firewall connecting the two. We have ACLs limiting the connectivity between the two,
and I was wondering if that because of those ACLs, if I'd be OK to add our servers in our DMZ
to our internal domain. I.E., we'd open up traffic on port 389 (LDAP) and port 53 (DNS) and leave
the rest blocked. Would that cause an absurd lack of security?

Thanks!
Matt

ASKER CERTIFIED SOLUTION

Fridolin Mansmann

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Fridolin Mansmann

It is not a security hole from my perspective if you have clear rules (source-IP, port => target IP,port)
I would propose to do some monitoring and also spot check on eventlogs, auditing logs....
If this is a *managed* environment, why not.
I assume in this case that the servers in the DMZ (that are accessable from the Internet) are hardened and also monitored?

mhentrich

ASKER

Thanks mansmanf, spot on...help me figure out what you mean by hardened and monitored, though. We have a monitoring program in place that keeps tabs on disk space, RAM usage, etc. and lets us know if a server goes down. We also have an IPS on the aforementioned firewall. What else would you consider neccessary?

Thanks,
Matt

mhentrich

ASKER

Thanks!

Fridolin Mansmann

A good point to start is Technet, e.g.
http://technet.microsoft.com/en-us/library/cc264463.aspx
Be sure to document what you are doing, then you will be able to revert steps if something is not working any more