Well, initially, ignore the Win2K3 server. Think of the ports you need to allow as catering to the functionality of the workstations, not the server. In that case, you probably want internet access, so allow ports 80(HTTP) and 443(SHTTP). Other than that, it's based upon the needs of your network... if you run a mail server (Exchange, sendmail, etc.), you want to open ports 25(SMTP) and 110(POP3). It just depends on what your network needs from the outside... ideally, your server (running AD) should not be serving anything to the outside world, so the firewall wouldn't care about it. Thus, no "fine-tuning" for AD.
If you want your DC to connect to DCs in remote locations, then you want to look at VPN solutions for connecting the locations. Most likely, you want to set up site-to-site VPNs between the locations; hopefully, your firewall has the ability to set those up. Hope that helps some. -- N/A -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of dubaisans dubai Sent: Friday, July 20, 2007 1:24 AM To: [email protected] Subject: win2k3 active directory - firewall ports i want to put win2k3 active directory server behind the corporate firewall. we are using windows xp clients and also group policy what ports need to be allowed on firewall ? is there any fine tuning that can be done on AD to make it more firewall friendly? i have some DC is remote locations . what ports need to be allowed between DCs?
