Solved

Adding DMZ Servers to internal domain

Posted on 2011-02-17
5
378 Views
Last Modified: 2013-12-23
Howdy,

Quirky question - currently we have our internal domain, a DMZ in its own workgroup, and a
router/firewall connecting the two.  We have ACLs limiting the connectivity between the two,
and I was wondering if that because of those ACLs, if I'd be OK to add our servers in our DMZ
to our internal domain.  I.E., we'd open up traffic on port 389 (LDAP) and port 53 (DNS) and leave
the rest blocked.  Would that cause an absurd lack of security?

Thanks!
Matt
0
Comment
Question by:mhentrich
  • 3
  • 2
5 Comments
 
LVL 4

Accepted Solution

by:
mansmanf earned 125 total points
ID: 34920475
No, to get it work properly you need some more:
See here:
http://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx

Check the tables and decide what services / ports you need.
Then define these on the firewall with the correct source and target IPs
e.g. port 88, 636,3268,3269 (for replication)


http://technet.microsoft.com/en-us/library/bb727063.aspx

My experience is that also port 135, 137,138,139 are necessary because clients try to open authentication sessions etc. via NetBIOS also (first)
Be sure that also DNS (port 53) is working!
0
 
LVL 4

Expert Comment

by:mansmanf
ID: 34920546
It is not a security hole from my perspective if you have clear rules (source-IP, port  => target IP,port)
I would propose to do some monitoring and also spot check on eventlogs, auditing logs....
If this is a *managed* environment, why not.
I assume in this case that the servers in the DMZ (that are accessable from the Internet) are hardened and also monitored?

0
 

Author Comment

by:mhentrich
ID: 34923732
Thanks mansmanf, spot on...help me figure out what you mean by hardened and monitored, though.  We have a monitoring program in place that keeps tabs on disk space, RAM usage, etc. and lets us know if a server goes down.  We also have an IPS on the aforementioned firewall.  What else would you consider neccessary?

Thanks,
Matt
0
 

Author Closing Comment

by:mhentrich
ID: 34923737
Thanks!
0
 
LVL 4

Expert Comment

by:mansmanf
ID: 34923835
A good point to start is Technet, e.g.
http://technet.microsoft.com/en-us/library/cc264463.aspx
Be sure to document what you are doing, then you will be able to revert steps if something is not working any more
0

Featured Post

Top 6 Sources for Identifying Threat Actor TTPs

Understanding your enemy is essential. These six sources will help you identify the most popular threat actor tactics, techniques, and procedures (TTPs).

Join & Write a Comment

Enterprise networks where VoIP phones have been deployed frequently use port configurations that allow both a computer and an IP phone to be plugged into the same switch port but use different VLANs. On Cisco equipment I'm referring to the "native V…
Are you one of those front-line IT Service Desk staff fielding calls, replying to emails, all-the-while working to resolve end-user technological nightmares? I am! That's why I have put together this brief overview of tools and techniques I use in o…
Illustrator's Shape Builder tool will let you combine shapes visually and interactively. This video shows the Mac version, but the tool works the same way in Windows. To follow along with this video, you can draw your own shapes or download the file…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

757 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

22 Experts available now in Live!

Get 1:1 Help Now