DMZ join inside Domain

[morganstanleylau]

Hi all ,

I have a queation about the PIX 515e problem , when i try to in DMZ win2000 server join a Inside AD domain is not work , i also try it full access list for this 2 ip address access below :

DMZ w2k server ip and access list :

access-list DMZ permit ip host 172.16.2.2 any

Inside 2003 server ip and access list :

access-list inside permit ip host 172.16.1.20 any

when i try to in DMZ server join Inside domain controller , the error message show can't establish the connection , what seen the problem and which port are need to open ? pls advise

Stanley

[sachinraja]

hello stanley,

If "IP any" is open, all ports are open from one side to another. u need not open any specific ports.

One thing you need to check is NAT. I hope you have done a static or a nonat from inside to dmz. otherwise, try doing this.

nat (inside) 0 access-list insidenonat

access-list insidenonat permit ip host 172.16.1.20 host 172.16.2.2

optional:

nat (dmz) 0 access-list dmznonat

access-list dmznonat permit ip host 172.16.2.2 host 172.16.1.20

By doing this, you can see both the servers on their private IPs. You will be able to ping these servers from each other. Are you able to ping now ??

you can also use statics:

static (inside,dmz) 172.16.1.10 172.16.1.10 netmask 255.255.255.255

You will still have the access-lists on place.. make sure you have applied the access-lists to the interface:

access-group insideACL(ACL name) in interface inside

access-list dmzACL in interface dmz

hope this helps.. all the best..

Raj

[morganstanleylau]

Hi Raj ,

Thanks for your help first ,but i try to your suggestion , i found that i can ping in both side for IP address , in hostname can't is timeout , also i add it the following acl and static

access-list insidenonat permit ip host 172.16.1.20 host 172.16.2.2

access-list dmznonat permit ip host 172.16.2.2 host 172.16.1.20

static (inside,dmz) 172.16.1.20 172.16.1.20 netmask 255.255.255.255

Is it add wins or dns need to config in my both server ???

Regards,

Stanley

[morganstanleylau]

Hi Raj ,

The DMZ server can join the our domain now , thx

but i have a other problem is now i being open full port in between 172.16.2.2 and 172.16.1.20 these computer , i want to be limit the port , also i add it these access-list in my PIX is not , can't be login domain account , is it have any problem ?

access-list inside permit udp host 172.16.1.20 host 172.16.2.2 eq domain

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq domain

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq 88

access-list inside permit udp host 172.16.1.20 host 172.16.2.2 eq 88

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq 123

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq 135

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq ldap

access-list inside permit udp host 172.16.1.20 host 172.16.2.2 eq 389

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq 445

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq 3268

access-list inside permit tcp host 172.16.1.20 host 172.16.2.2 eq netbios-ssn

access-list inside permit udp host 172.16.1.20 host 172.16.2.2 eq netbios-ns

access-list inside permit udp host 172.16.1.20 host 172.16.2.2 eq netbios-dgm

access-list DMZ permit udp host 172.16.2.2 host 172.16.1.20 eq domain

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq domain

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq 88

access-list DMZ permit udp host 172.16.2.2 host 172.16.1.20 eq 88

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq 123

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq 135

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq ldap

access-list DMZ permit udp host 172.16.2.2 host 172.16.1.20 eq 389

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq 445

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq 3268

access-list DMZ permit tcp host 172.16.2.2 host 172.16.1.20 eq netbios-ssn

access-list DMZ permit udp host 172.16.2.2 host 172.16.1.20 eq netbios-ns

access-list DMZ permit udp host 172.16.2.2 host 172.16.1.20 eq netbios-dgm

I open it UDP/TCP 53 , UDP/TCP 88 , TCP 123 , TCP 135 , UDP/TCP 389 , TCP 445 , TCP 3268 , TCP 139 , UDP 137 & 138

Pls advise again, all the best

Stanley