https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713007#M977206 <HTML><HEAD></HEAD><BODY><P>I don't have a pointer to the MS KB article, but it's also possible to configure the servers to use a restricted port range for RPC (say, 5000 - 6000), and only open that range.</P></BODY></HTML> Tue, 03 Jul 2007 12:23:27 GMT lowen 2007-07-03T12:23:27Z https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713004#M977203 <P>Hi,</P><P></P><P>I have 2 active directory forests that reside on either side of my PIX. </P><P></P><P>Forest A is on Inside interface</P><P>Forest B is on a DMZ interface security level 50</P><P></P><P>The Microsoft guys would like to setup a trust between the 2 forests.</P><P></P><P>In order to do this, RPC traffic, both port 135 and RPC dynamic ports (1024-65535) need to be allowed, I don't however want to open those high ports unless I have to.</P><P></P><P>My Microsoft guy said that the firewall should be able to inspect RPC traffic in order to dynamically open higher ports when required by the application.</P><P></P><P>I don't see a fixup for RPC on the Pix however.</P><P></P><P>Couldn't anyone shed some light on how I can make the Pix aware of the RPC traffic between the 2 AD forests.</P><P></P><P>Thanks</P><P></P><P>Lee</P> Mon, 11 Mar 2019 10:38:17 GMT https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713004#M977203 lee.messenger 2019-03-11T10:38:17Z https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713005#M977204 <HTML><HEAD></HEAD><BODY><P>have your MS admins configure either a PPTP or IPSEC tunnel between the servers in one forest with the servers in the other forest. This will minimize the number of ports you need to allow.</P><P>Have them search the MS KB for instructions on this - they're out there.</P></BODY></HTML> Mon, 02 Jul 2007 17:37:59 GMT https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713005#M977204 srue 2007-07-02T17:37:59Z https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713006#M977205 <HTML><HEAD></HEAD><BODY><P>Hi Lee </P><P></P><P>Steven's solution is the best way to secure this traffic if you have to do this. </P><P></P><P>The pix does have a fixup for RPC but it is for Sun RPC (ie Sun Microsystems who make a version of Unix called Solaris) and so this would not help you for AD anyway.</P><P></P><P>Jon</P></BODY></HTML> Mon, 02 Jul 2007 17:51:27 GMT https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713006#M977205 Jon Marshall 2007-07-02T17:51:27Z https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713007#M977206 <HTML><HEAD></HEAD><BODY><P>I don't have a pointer to the MS KB article, but it's also possible to configure the servers to use a restricted port range for RPC (say, 5000 - 6000), and only open that range.</P></BODY></HTML> Tue, 03 Jul 2007 12:23:27 GMT https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713007#M977206 lowen 2007-07-03T12:23:27Z https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713008#M977207 <HTML><HEAD></HEAD><BODY><P><A class="jive-link-custom" href="http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx" target="_blank">http://www.microsoft.com/technet/prodtechnol/windows2000serv/technologies/activedirectory/deploy/confeat/adrepfir.mspx</A></P><P></P><P><A class="jive-link-custom" href="http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-9767-a9166368434e&amp;displaylang=en" target="_blank">http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-9767-a9166368434e&amp;displaylang=en</A></P></BODY></HTML> Tue, 03 Jul 2007 13:28:24 GMT https://community.cisco.com/t5/network-security/active-directory-thru-pix/m-p/713008#M977207 srue 2007-07-03T13:28:24Z