:-)
Unless you are an SBSer [buy spare parts and do drive imaging]
[Sorry the annoying SBSer will now go back to lurking]
Brian Desmond wrote:
1. I think you should have multiple DCs for your domain in whatever subnet
you want so you don't have a single point of failure. Having only one DC is
a recipe for disaster.
2. I realize that, and I've been trying to show you how to mitigate this
problem. Are you creating these firewall rules or do you have a firewall
administrator? I get the impression based on your messages that you've never
managed a production firewall before. You need to creat rules that permit
TCP445 between the secure SUBNET and the DC HOST-OBJECTS not between the
secure subnet and the DC subnet. That will mitigate your problem.
3. OK...
Thanks,
Brian Desmond
[EMAIL PROTECTED]
c - 312.731.3132
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On Behalf Of sdgesa gaeharth
Sent: Friday, October 28, 2005 3:27 PM
To: [email protected]
Subject: RE: [ActiveDir] secure subnet; no sharing of files or internet
access
1)When you say "one domain controller (you should)" Do
you mean I should have one dc as the primary and one
for backup? Or are you trying to say one dc should be
for the secured subnet and one for the other subnets?
2)The problem I am foreseeing is a user on the secured
subnet putting confidential files on a share located
in the internal dmz. Then someone from one of the
other subnets, taking those files off the same share
thus compromising the files. I know permissions on the
share might solve this but it seems that there is to
much room for mistake.
3) We would like users of the secured subnet to be
able to log onto another computer on one of the other
subnets so they can check their email, browse the
Internet, etc. When they are done, they can go back to
the other compputer on the secured subnet and work
with the confidential files.
Thanks
--- Brian Desmond <[EMAIL PROTECTED]> wrote:
OK. I assumed you have more than one domain
controller (you should), it's
not required, though.
I don't know too much about checkpoint, but, I think
the terminology below
is what they use, if not, it's easily translated.
You should have a couple of host groups here:
Host-group DCs should contain the IP addresses of
all your domain
controllers
Host-group Clients should contain all the client
subnets
Service-group AD should contain all the ports that
AD uses, DNS, LDAP,
RPC/SMB, etc. You can then have a rule permitting
this traffic from the
clients to the DCs. Deny any other traffic from the
clients to the DCs.
Thanks,
Brian Desmond
[EMAIL PROTECTED]
c - 312.731.3132
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of sdgesa gaeharth
Sent: Thursday, October 27, 2005 9:57 PM
To: [email protected]
Subject: RE: [ActiveDir] secure subnet; no sharing
of files or internet
access
Can you expand further? I am a little unsure on what
you are trying to say. Do you mean to have two
different domains(domain controllers)?
Checkpoint Firewall
--- Brian Desmond <[EMAIL PROTECTED]> wrote:
Yes, there is a better solution.
Your firewall rules should look like this:
Src dest service
Secure Subnet DC1 IP/32 AD Ports
Secure Subnet DC2 IP/32 AD Ports
Secure Subnet DC1 IP/32 UDP53
Secure Subnet DC2 IP/32 UDP53
Etcetera. What brand of firewall is it anyway?
Thanks,
Brian Desmond
[EMAIL PROTECTED]
c - 312.731.3132
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of sdgesa gaeharth
Sent: Wednesday, October 26, 2005 9:30 AM
To: [email protected]
Subject: RE: [ActiveDir] secure subnet; no sharing
of files or internet
access
subnet ports are opened to the dmz, not to each
other.
Am i going the rght way or is there a better
solution?
thanks
--- Brian Desmond <[EMAIL PROTECTED]> wrote:
Are you opening the ports between the subnets or
between the subnet and the
dc host IPs? If you do the latter, the only
place
your users could drop
files and what have you is on the DCs and they'd
need to be domain admins or
someone has to create a share on the DC that
they
can access. You'll need to
trust your admins or take away their privs.
Your firewall rules should be permitting the
traffic
from the secure subnet
to host objects for the DCs not from the secure
subnet to the subnet with
the DCs on them.
Thanks,
Brian Desmond
[EMAIL PROTECTED]
c - 312.731.3132
-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] On
Behalf Of sdgesa gaeharth
Sent: Tuesday, October 25, 2005 9:31 PM
To: [email protected]
Subject: [ActiveDir] secure subnet; no sharing
of
files or internet access
We have a single office with a single domain.
Our
physical network consists of a firewall with a
set
of
managed switches behind it. I have partitioned
the
network into multiple subnets using vlans.
Vlan 1:10.0.1.0/24: internal dmz(AD, DNS, DHCP)
Vlan 2:10.0.2.0/24: accounting
Vlan 3:10.0.3.0/24: business development
Vlan 4:10.0.4.0/24: secured vlan
We need to restrict the Vlan 4, "secured vlan"
so
no
confidential files can get out. No Internet , no
file
sharing with the other subnets, no printers,
etc.
I opened dns, dhcp, and AD ports from Vlan 4 to
Vlan
1
in order to facilitate authenticationa ganist
the
DC.
However, I am still worried that users could
possible
be able to get files out. For example, it seems
port
445 is needed for authentication and file
sharing.
Does anyone have any hints except the obvious
one
of
separating the subnet physically which is not an
option?
thanks
__________________________________
Yahoo! Mail - PC Magazine Editors' Choice 2005
http://mail.yahoo.com
List info : http://www.activedir.org/List.aspx
List FAQ :
http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ :
http://www.activedir.org/ListFAQ.aspx
List archive:
http://www.mail-archive.com/activedir%40mail.activedir.org/
__________________________________
Start your day with Yahoo! - Make it your home
page!
http://www.yahoo.com/r/hs
=== message truncated ===
__________________________________
Start your day with Yahoo! - Make it your home page!
http://www.yahoo.com/r/hs
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
--
Letting your vendors set your risk analysis these days?
http://www.threatcode.com
List info : http://www.activedir.org/List.aspx
List FAQ : http://www.activedir.org/ListFAQ.aspx
List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
