Have the exact same
situation here.
We currently have a
separate NT domain (for a security boundary) for our INET machines.
These machines exist on a DMZ...and run public internet sites that connect to
a SQL backend inside our network. An ISA server provides the firewall
and proxy services.
Im currently having a
fight with the operations staff on design. They want to do the Empty
Root/two subdomain model (because they read a lot of useless MOC Courseware
books).
I can personally see
very little benefit to consolidating these two separate domains into one
forest. They see no logic in having a separate forest/separate domain
for the Internet systems.
Nothing short of a
case study will sway them I believe....any decent documents comparing the
two? Or frankly..any documents that recommend a separate forest for your
internet systems as a security boundary?
-----Original
Message-----
From: Raymond
McClinnis [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10,
2003 11:29
AM
To:
[EMAIL PROTECTED]
Subject: RE: [ActiveDir] what to do with
DMZ servers
I have a
question... (Assuming that the Servers in the DMZ are already away from the
in-house domain)
If
before the upgrade none of the servers needed AD or access to your in-house
domain, why would you want them to have it after the upgrade?
J Just thinking
semi-logically...
Thanks,
Raymond
McClinnis
Network
Administrator
Provident
Credit Union
-----Original
Message-----
From:
[EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
On Behalf Of Roger
Seielstad
Sent:
Thursday, July 10,
2003 7:19
AM
To:
'[EMAIL PROTECTED]'
Subject: RE: [ActiveDir] what to do with
DMZ servers
It
would help if you determined what was going to be public access (via DMZ or
otherwise) and determine the needs of the applications
there.
The
other option we've been talking about is AD Application Mode (ADAM) from
Microsoft.
--------------------------------------------------------------
Roger D. Seielstad -
MTS MCSE MS-MVP
Sr. Systems
Administrator
Inovis
Inc.
-----Original
Message-----
From: Pelle,
Joe [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 10,
2003 8:59
AM
To: ActiveDir
([EMAIL PROTECTED])
Subject: [ActiveDir] what to do with
DMZ servers
Please help:
My company is currently
migrating from an NT domain structure to AD... I have some questions
regarding how some of you went about hooking in your DMZ web servers to AD
securely... What DID YOU DO?!!!!!! What are the recommended best
practices?
The options we have discussed so
far are:
Option1: Join DMZ servers
to AD domain, open a half dozen ports on each server (Kerberos, LDAP,
NetBios, etc) and lose the purpose of having a DMZ
altogether.
Option2: Create a separate
forest for the DMZ servers and create a one-way trust between our two
forests.
Option3: Stand alone DMZ
servers not joined to any domain.
All other options:
??????????????????????????????
Your suggestions are greatly
appreciated!
Is there even a need to hook DMZ
into AD? I've heard MS talk about needing AD for apps like Sharepoint
Portal...
Joe
Pelle
Systems
Analyst
Information
Technology
Valassis /
Targeted Print & Media Solutions
35955
Schoolcraft Rd.
Livonia,
MI
48150
Tel
734.632.3753 Fax
734.632.6240
[EMAIL PROTECTED]
http://www.valassis.com/
This
message may have included proprietary or protected information. This
message and the information contained herein are not to be further
communicated without my express written consent.
