subnet ports are opened to the dmz, not to each other. Am i going the rght way or is there a better solution?
thanks --- Brian Desmond <[EMAIL PROTECTED]> wrote: > Are you opening the ports between the subnets or > between the subnet and the > dc host IPs? If you do the latter, the only place > your users could drop > files and what have you is on the DCs and they'd > need to be domain admins or > someone has to create a share on the DC that they > can access. You'll need to > trust your admins or take away their privs. > > Your firewall rules should be permitting the traffic > from the secure subnet > to host objects for the DCs not from the secure > subnet to the subnet with > the DCs on them. > > Thanks, > Brian Desmond > [EMAIL PROTECTED] > > c - 312.731.3132 > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of sdgesa gaeharth > Sent: Tuesday, October 25, 2005 9:31 PM > To: [email protected] > Subject: [ActiveDir] secure subnet; no sharing of > files or internet access > > We have a single office with a single domain. Our > physical network consists of a firewall with a set > of > managed switches behind it. I have partitioned the > network into multiple subnets using vlans. > > Vlan 1:10.0.1.0/24: internal dmz(AD, DNS, DHCP) > Vlan 2:10.0.2.0/24: accounting > Vlan 3:10.0.3.0/24: business development > Vlan 4:10.0.4.0/24: secured vlan > > We need to restrict the Vlan 4, "secured vlan" so no > confidential files can get out. No Internet , no > file > sharing with the other subnets, no printers, etc. > > I opened dns, dhcp, and AD ports from Vlan 4 to Vlan > 1 > in order to facilitate authenticationa ganist the > DC. > > However, I am still worried that users could > possible > be able to get files out. For example, it seems > port > 445 is needed for authentication and file sharing. > > Does anyone have any hints except the obvious one of > separating the subnet physically which is not an > option? > > thanks > > > > > __________________________________ > Yahoo! Mail - PC Magazine Editors' Choice 2005 > http://mail.yahoo.com > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: > http://www.mail-archive.com/activedir%40mail.activedir.org/ > > List info : http://www.activedir.org/List.aspx > List FAQ : http://www.activedir.org/ListFAQ.aspx > List archive: > http://www.mail-archive.com/activedir%40mail.activedir.org/ > __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
