Solved

Adding DMZ Servers to internal domain

Posted on 2011-02-17
5
395 Views
Last Modified: 2013-12-23
Howdy,

Quirky question - currently we have our internal domain, a DMZ in its own workgroup, and a
router/firewall connecting the two.  We have ACLs limiting the connectivity between the two,
and I was wondering if that because of those ACLs, if I'd be OK to add our servers in our DMZ
to our internal domain.  I.E., we'd open up traffic on port 389 (LDAP) and port 53 (DNS) and leave
the rest blocked.  Would that cause an absurd lack of security?

Thanks!
Matt
0
Comment
Question by:mhentrich
  • 3
  • 2
5 Comments
 
LVL 4

Accepted Solution

by:
mansmanf earned 125 total points
ID: 34920475
No, to get it work properly you need some more:
See here:
http://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx

Check the tables and decide what services / ports you need.
Then define these on the firewall with the correct source and target IPs
e.g. port 88, 636,3268,3269 (for replication)


http://technet.microsoft.com/en-us/library/bb727063.aspx

My experience is that also port 135, 137,138,139 are necessary because clients try to open authentication sessions etc. via NetBIOS also (first)
Be sure that also DNS (port 53) is working!
0
 
LVL 4

Expert Comment

by:mansmanf
ID: 34920546
It is not a security hole from my perspective if you have clear rules (source-IP, port  => target IP,port)
I would propose to do some monitoring and also spot check on eventlogs, auditing logs....
If this is a *managed* environment, why not.
I assume in this case that the servers in the DMZ (that are accessable from the Internet) are hardened and also monitored?

0
 

Author Comment

by:mhentrich
ID: 34923732
Thanks mansmanf, spot on...help me figure out what you mean by hardened and monitored, though.  We have a monitoring program in place that keeps tabs on disk space, RAM usage, etc. and lets us know if a server goes down.  We also have an IPS on the aforementioned firewall.  What else would you consider neccessary?

Thanks,
Matt
0
 

Author Closing Comment

by:mhentrich
ID: 34923737
Thanks!
0
 
LVL 4

Expert Comment

by:mansmanf
ID: 34923835
A good point to start is Technet, e.g.
http://technet.microsoft.com/en-us/library/cc264463.aspx
Be sure to document what you are doing, then you will be able to revert steps if something is not working any more
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in response to a question (http://www.experts-exchange.com/Networking/Network_Management/Network_Analysis/Q_28230497.html) here at Experts Exchange. The Original Poster (OP) requires a utility that will accept a list of IP addresses …
Resolve DNS query failed errors for Exchange
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
Although Jacob Bernoulli (1654-1705) has been credited as the creator of "Binomial Distribution Table", Gottfried Leibniz (1646-1716) did his dissertation on the subject in 1666; Leibniz you may recall is the co-inventor of "Calculus" and beat Isaac…

770 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question