1. I think you should have multiple DCs for your domain in whatever subnet you want so you don't have a single point of failure. Having only one DC is a recipe for disaster.
2. I realize that, and I've been trying to show you how to mitigate this problem. Are you creating these firewall rules or do you have a firewall administrator? I get the impression based on your messages that you've never managed a production firewall before. You need to creat rules that permit TCP445 between the secure SUBNET and the DC HOST-OBJECTS not between the secure subnet and the DC subnet. That will mitigate your problem. 3. OK... Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of sdgesa gaeharth Sent: Friday, October 28, 2005 3:27 PM To: [email protected] Subject: RE: [ActiveDir] secure subnet; no sharing of files or internet access 1)When you say "one domain controller (you should)" Do you mean I should have one dc as the primary and one for backup? Or are you trying to say one dc should be for the secured subnet and one for the other subnets? 2)The problem I am foreseeing is a user on the secured subnet putting confidential files on a share located in the internal dmz. Then someone from one of the other subnets, taking those files off the same share thus compromising the files. I know permissions on the share might solve this but it seems that there is to much room for mistake. 3) We would like users of the secured subnet to be able to log onto another computer on one of the other subnets so they can check their email, browse the Internet, etc. When they are done, they can go back to the other compputer on the secured subnet and work with the confidential files. Thanks --- Brian Desmond <[EMAIL PROTECTED]> wrote: > OK. I assumed you have more than one domain > controller (you should), it's > not required, though. > > I don't know too much about checkpoint, but, I think > the terminology below > is what they use, if not, it's easily translated. > > You should have a couple of host groups here: > > Host-group DCs should contain the IP addresses of > all your domain > controllers > > Host-group Clients should contain all the client > subnets > > Service-group AD should contain all the ports that > AD uses, DNS, LDAP, > RPC/SMB, etc. You can then have a rule permitting > this traffic from the > clients to the DCs. Deny any other traffic from the > clients to the DCs. > > Thanks, > Brian Desmond > [EMAIL PROTECTED] > > c - 312.731.3132 > > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of sdgesa gaeharth > Sent: Thursday, October 27, 2005 9:57 PM > To: [email protected] > Subject: RE: [ActiveDir] secure subnet; no sharing > of files or internet > access > > Can you expand further? I am a little unsure on what > you are trying to say. Do you mean to have two > different domains(domain controllers)? > > Checkpoint Firewall > > --- Brian Desmond <[EMAIL PROTECTED]> wrote: > > > Yes, there is a better solution. > > > > Your firewall rules should look like this: > > > > Src dest service > > Secure Subnet DC1 IP/32 AD Ports > > Secure Subnet DC2 IP/32 AD Ports > > Secure Subnet DC1 IP/32 UDP53 > > Secure Subnet DC2 IP/32 UDP53 > > > > Etcetera. What brand of firewall is it anyway? > > > > Thanks, > > Brian Desmond > > [EMAIL PROTECTED] > > > > c - 312.731.3132 > > > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On > > Behalf Of sdgesa gaeharth > > Sent: Wednesday, October 26, 2005 9:30 AM > > To: [email protected] > > Subject: RE: [ActiveDir] secure subnet; no sharing > > of files or internet > > access > > > > subnet ports are opened to the dmz, not to each > > other. > > Am i going the rght way or is there a better > > solution? > > > > thanks > > > > --- Brian Desmond <[EMAIL PROTECTED]> wrote: > > > > > Are you opening the ports between the subnets or > > > between the subnet and the > > > dc host IPs? If you do the latter, the only > place > > > your users could drop > > > files and what have you is on the DCs and they'd > > > need to be domain admins or > > > someone has to create a share on the DC that > they > > > can access. You'll need to > > > trust your admins or take away their privs. > > > > > > Your firewall rules should be permitting the > > traffic > > > from the secure subnet > > > to host objects for the DCs not from the secure > > > subnet to the subnet with > > > the DCs on them. > > > > > > Thanks, > > > Brian Desmond > > > [EMAIL PROTECTED] > > > > > > c - 312.731.3132 > > > > > > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On > > > Behalf Of sdgesa gaeharth > > > Sent: Tuesday, October 25, 2005 9:31 PM > > > To: [email protected] > > > Subject: [ActiveDir] secure subnet; no sharing > of > > > files or internet access > > > > > > We have a single office with a single domain. > Our > > > physical network consists of a firewall with a > set > > > of > > > managed switches behind it. I have partitioned > > the > > > network into multiple subnets using vlans. > > > > > > Vlan 1:10.0.1.0/24: internal dmz(AD, DNS, DHCP) > > > Vlan 2:10.0.2.0/24: accounting > > > Vlan 3:10.0.3.0/24: business development > > > Vlan 4:10.0.4.0/24: secured vlan > > > > > > We need to restrict the Vlan 4, "secured vlan" > so > > no > > > confidential files can get out. No Internet , no > > > file > > > sharing with the other subnets, no printers, > etc. > > > > > > I opened dns, dhcp, and AD ports from Vlan 4 to > > Vlan > > > 1 > > > in order to facilitate authenticationa ganist > the > > > DC. > > > > > > However, I am still worried that users could > > > possible > > > be able to get files out. For example, it seems > > > port > > > 445 is needed for authentication and file > sharing. > > > > > > Does anyone have any hints except the obvious > one > > of > > > separating the subnet physically which is not an > > > option? > > > > > > thanks > > > > > > > > > > > > > > > __________________________________ > > > Yahoo! Mail - PC Magazine Editors' Choice 2005 > > > http://mail.yahoo.com > > > List info : http://www.activedir.org/List.aspx > > > List FAQ : > > http://www.activedir.org/ListFAQ.aspx > > > List archive: > > > > > > http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > > > > List info : http://www.activedir.org/List.aspx > > > List FAQ : > > http://www.activedir.org/ListFAQ.aspx > > > List archive: > > > > > > http://www.mail-archive.com/activedir%40mail.activedir.org/ > > > > > > > > > > > > > __________________________________ > > Start your day with Yahoo! - Make it your home > page! > > > > http://www.yahoo.com/r/hs > === message truncated === __________________________________ Start your day with Yahoo! - Make it your home page! http://www.yahoo.com/r/hs List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
