You are correct. I assumed your DCs were solely DCs. Your file server should not also be a domain controller. Doing anything thing other than using your DCs as domain controllers is a bad idea in general.
Thanks, Brian Desmond [EMAIL PROTECTED] c - 312.731.3132 -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of sdgesa gaeharth Sent: Saturday, October 29, 2005 3:42 PM To: [email protected] Subject: RE: [ActiveDir] secure subnet; no sharing of files or internet access 1)i aggree 2) I have managed linux and checkpoint firewalls and am pretty good at it. I now see what you are saying. You are saying the file server should not be the same server as the dc server. block 445 to the file server and not the dc server. Correct? thanks --- Brian Desmond <[EMAIL PROTECTED]> wrote: > 1. I think you should have multiple DCs for your > domain in whatever subnet > you want so you don't have a single point of > failure. Having only one DC is > a recipe for disaster. > > 2. I realize that, and I've been trying to show you > how to mitigate this > problem. Are you creating these firewall rules or do > you have a firewall > administrator? I get the impression based on your > messages that you've never > managed a production firewall before. You need to > creat rules that permit > TCP445 between the secure SUBNET and the DC > HOST-OBJECTS not between the > secure subnet and the DC subnet. That will mitigate > your problem. > > 3. OK... > > Thanks, > Brian Desmond > [EMAIL PROTECTED] > > c - 312.731.3132 > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On > Behalf Of sdgesa gaeharth > Sent: Friday, October 28, 2005 3:27 PM > To: [email protected] > Subject: RE: [ActiveDir] secure subnet; no sharing > of files or internet > access > > 1)When you say "one domain controller (you should)" > Do > you mean I should have one dc as the primary and > one > for backup? Or are you trying to say one dc should > be > for the secured subnet and one for the other > subnets? > > 2)The problem I am foreseeing is a user on the > secured > subnet putting confidential files on a share located > in the internal dmz. Then someone from one of the > other subnets, taking those files off the same share > thus compromising the files. I know permissions on > the > share might solve this but it seems that there is to > much room for mistake. > > 3) We would like users of the secured subnet to be > able to log onto another computer on one of the > other > subnets so they can check their email, browse the > Internet, etc. When they are done, they can go back > to > the other compputer on the secured subnet and work > with the confidential files. > > Thanks > > > --- Brian Desmond <[EMAIL PROTECTED]> wrote: > > > OK. I assumed you have more than one domain > > controller (you should), it's > > not required, though. > > > > I don't know too much about checkpoint, but, I > think > > the terminology below > > is what they use, if not, it's easily translated. > > > > You should have a couple of host groups here: > > > > Host-group DCs should contain the IP addresses of > > all your domain > > controllers > > > > Host-group Clients should contain all the client > > subnets > > > > Service-group AD should contain all the ports that > > AD uses, DNS, LDAP, > > RPC/SMB, etc. You can then have a rule permitting > > this traffic from the > > clients to the DCs. Deny any other traffic from > the > > clients to the DCs. > > > > Thanks, > > Brian Desmond > > [EMAIL PROTECTED] > > > > c - 312.731.3132 > > > > > > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On > > Behalf Of sdgesa gaeharth > > Sent: Thursday, October 27, 2005 9:57 PM > > To: [email protected] > > Subject: RE: [ActiveDir] secure subnet; no sharing > > of files or internet > > access > > > > Can you expand further? I am a little unsure on > what > > you are trying to say. Do you mean to have two > > different domains(domain controllers)? > > > > Checkpoint Firewall > > > > --- Brian Desmond <[EMAIL PROTECTED]> wrote: > > > > > Yes, there is a better solution. > > > > > > Your firewall rules should look like this: > > > > > > Src dest service > > > Secure Subnet DC1 IP/32 AD Ports > > > Secure Subnet DC2 IP/32 AD Ports > > > Secure Subnet DC1 IP/32 UDP53 > > > Secure Subnet DC2 IP/32 UDP53 > > > > > > Etcetera. What brand of firewall is it anyway? > > > > > > Thanks, > > > Brian Desmond > > > [EMAIL PROTECTED] > > > > > > c - 312.731.3132 > > > > > > > > > > > > -----Original Message----- > > > From: [EMAIL PROTECTED] > > > [mailto:[EMAIL PROTECTED] On > > > Behalf Of sdgesa gaeharth > > > Sent: Wednesday, October 26, 2005 9:30 AM > > > To: [email protected] > > > Subject: RE: [ActiveDir] secure subnet; no > sharing > > > of files or internet > > > access > > > > > > subnet ports are opened to the dmz, not to each > > > other. > > > Am i going the rght way or is there a better > > > solution? > > > > > > thanks > > > > > > --- Brian Desmond <[EMAIL PROTECTED]> > wrote: > > > > > > > Are you opening the ports between the subnets > or > > > > between the subnet and the > > > > dc host IPs? If you do the latter, the only > > place > > > > your users could drop > > > > files and what have you is on the DCs and > they'd > > > > need to be domain admins or > > > > someone has to create a share on the DC that > > they > > > > can access. You'll need to > > > > trust your admins or take away their privs. > > > > > > > > Your firewall rules should be permitting the > > > traffic > > > > from the secure subnet > > > > to host objects for the DCs not from the > secure > > > > subnet to the subnet with > > > > the DCs on them. > > > > > > > > Thanks, > > > > Brian Desmond > > > > [EMAIL PROTECTED] > > > > > > > > c - 312.731.3132 > > > > > > > > > > > > > > > > -----Original Message----- > > > > From: [EMAIL PROTECTED] > > > > [mailto:[EMAIL PROTECTED] On > > > > Behalf Of sdgesa gaeharth > > > > Sent: Tuesday, October 25, 2005 9:31 PM > > > > To: [email protected] > === message truncated === __________________________________ Yahoo! FareChase: Search multiple travel sites in one click. http://farechase.yahoo.com List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/ List info : http://www.activedir.org/List.aspx List FAQ : http://www.activedir.org/ListFAQ.aspx List archive: http://www.mail-archive.com/activedir%40mail.activedir.org/
