09-23-2008 07:53 AM - edited 03-11-2019 06:48 AM
I currently have servers in DMZ3 that allow SSL VPN connection to them. The SSL authenication is to the DMZ only.
I want to allow AD authenication from DMZ3 to AD directory domain that is located in the inside network.
What ports need to be open to allow this to happen? I have read that this type of authenication is a security nightmare because of the number of ports that must be open for this to work correctly. There is no domain controller on DMZ3 so the AD authenication traffic must pass to the inside network.
Another complication is that there are over 100 domain controllers that could answer the authenication request located on several different networks.
Any ideas?
Thanks
09-24-2008 02:54 AM
if it is comlex like this
allow the communication from the dmz servers to the AD subnet in the inside
09-24-2008 06:04 AM
"allow the communication from the dmz servers to the AD subnet in the inside"
That is really POOR advice. If servers in the
DMZ are compromised, then hackers will be able
to access everything on the AD subnet in the
inside network.
The objective is to get this thing working
while minimizing the security risks. This
can be done by limiting the dynamic DCOM
ports that AD uses. It will involve modifying
windows registries. If you're familiar
with Passive FTP, you get the idea.
That way you will minimize the security risks
to your Corporate network if DMZ Servers are
somehow compromised, your "inside" network
is still protected.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide