topic Re: AD through Cisco Pix in Network Security

AD through Cisco Pix

valsidalv — Mon, 11 Mar 2019 15:05:58 GMT

Hi,

I have Cisco Pix 515E,7.2(1) with two networks - inside and dmz. Communication between these network is NATed. In inside is Windows domain called GRP. In dmz I have some workstations which need to be domain member of GRP.

Is it any possibility to do it? Because I read, that kerberos has problem with NAT.

Many thanks,

Vladislav

Re: AD through Cisco Pix

veljko.tasic — Tue, 17 Mar 2009 18:56:56 GMT

Hi,

Yes it is possible.

DMZ interface is usually with lower security level then inside interface. Because of that you should define access-list that allows hosts from dmz to access your domain controllers and internal dns servers.

More on how communication between dmz and inside works:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00807fc191.shtml

Re: AD through Cisco Pix

valsidalv — Wed, 18 Mar 2009 05:47:01 GMT

Thanks.

I have no problem to define ACL. The main question was about windows domain. I don't know if active directory requires anything special to allow on pix.

Or it is enough to allow standard windows ports - 138, 139, 445?

Vladislav

Re: AD through Cisco Pix

sdoremus33 — Wed, 18 Mar 2009 05:56:15 GMT

This document might help out with your configuration task.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806de37e.shtml#diag

Re: AD through Cisco Pix

valsidalv — Wed, 18 Mar 2009 06:01:24 GMT

Thanks.

I know this document, but it is about accessing VPN users. There is nothing about my question.

Vladislav

Re: AD through Cisco Pix

veljko.tasic — Wed, 18 Mar 2009 07:36:22 GMT

If you are concerned about domain controllers then you should look at microsoft site.

If you have member server in dmz and dc in inside network then you have to enable traffic for following ports:

â€¢ Kerberos ports (88/tcp, 88/udp) used to perform mutual authentication between the member server and the domain controller. Kerberos traffic needs to be allowed in addition to the possible application specific traffic.

â€¢ DNS ports (53/tcp, 53/udp) used for name lookups.

â€¢ LDAP ports (389/udp, 389/tcp or 636/tcp for SSL) used for locator pings.

â€¢ Microsoft-DS traffic (445/tcp, 445/udp).

All neccessery data can be found here:

Active Directory in Networks Segmented by Firewalls

http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-9767-a9166368434e&displaylang=en

I hope that you can solve problem now. 🙂

Re: AD through Cisco Pix

valsidalv — Fri, 20 Mar 2009 09:54:49 GMT

Thanks, very helpful document. There is one very important information for me:

Note

Active Directory functionality is not supported over a router that has Network Address Translation (NAT) enabled. The configuration recommendations in this paper apply only to non-NAT environments.

So in my scenario I have to disable NAT between DMZ and INSIDE.

Vladislav

Re: AD through Cisco Pix

veljko.tasic — Fri, 20 Mar 2009 10:15:38 GMT

You can set NAT like this.

hostname(config)#static (inside,dmz) 10.1.1.2 10.1.1.2 netmask 255.255.255.0

This way you will NAT complete inside network to dmz but with same address range. I have seen scenarios that work this way.