NTLM through Pix

santosh.naidoo · ‎02-27-2003

Hi all,

Can anyone tell me how to configure pix so that I can get NTLM authentication working. I have a web server in my DMZ which needs to talk to my inside network to allow the authentication to function. What ports do I need to open up?

Thanks

Santosh

mostiguy · ‎02-27-2003

So the DMZ web server is a domain member server that needs to talk to a domain controller? tcp and udp ports 135-139 should do the trick

santosh.naidoo · ‎02-28-2003

Yes, the DMZ web server needs to talk to the domain contoller. Port 135 suggests rpc need to be opened as well. Any advice on this?

shannong · ‎02-28-2003

By allowing ports 135 and 139 to your inside DCs, you've eliminated most of the security gained by hosting your web server in the DMZ. Somone hacks IIS [easy] on that server, it has access to your DCs plus valid domain accounts, and voila! Your DCs are owned too with little effort!

You should try to implement in such a manner that your DMZ web server is not on the internal domain.

-Shannon