AD dynamic port range should allow in firewall

[MrBeginner]

Hi,

I would like to ask about to allow essential port on firewall to secure.

I saw essential port to open for active directory service as below .

RPC endpoint mapper: port 135 TCP
LDAP: port 389 TCP, UDP
LDAP over SSL: port 636 TCP
Global catalog LDAP: port 3268 TCP
Global catalog LDAP over SSL: port 3269 TCP
DNS: port 53 TCP, UDP
Kerberos: port 88 TCP, UDP
SMB over IP (Microsoft-DS): port 445 TCP

I can understand to allow in firewall above port list. But i don't understand why we need to allow dynamic port range for AD ( 49152 - 65535 range). 

let me know should we allow this port range in firewall ? let me know any security concern for those dynamic port ?

[Rob Ingram]

Hi,
Active Directory uses random ports (for RPC from memory), so that is why you need to open up a range of ports.

If it's for a Domain trust, then the port range is actually 1024-65535, reference here.

I personally would be concerned about doing this, what is the use case?
Are you permitting this traffic to a DMZ? Or a WAN connection to a 3rd party?

HTH

[MrBeginner]

Hi ,

Sorry for wrong question.

they are using remote assistance. port

so they told me to open TCP/UDP ports 49152 to 65535 for Remote Assistance.