Ethical Hacking

Learn to find vulnerabilities before the bad guys do! Gain real world hands on hacking experience in our state of the art hacking lab. Course designed and taught by expert instructors with years of penetration testing experience. 12 student maximum in every class. Certification attempt included in every package.
Computer Forensics Training at InfoSec Institute

Gain the in-demand skills of a certified computer examiner, learn to recover trace data left behind by fraud, theft, and cybercrime perpetrators. Discover the source of computer crime and abuse at your organization so that it never happens again. All of our class sizes are guaranteed to be 12 students or less to facilitate one-on-one interaction with one of our expert instructors.




Network Security Firewalls
[Top] [All Lists]
<prev [Date] next>
[Advanced]
 <prev [Thread] next>

RE: unable to join domain from dmz

from [David Gillett] Network Security [Permanent Link]
Subject: RE: unable to join domain from dmz
Date: Tue, 24 Aug 2004 10:10:16 -0700 
1> conduit permit icmp any any

  This is allowing your pings to work.

2> conduit permit ip host 172.17.0.10 172.16.0.0 255.255.0.0

  This should allow your BDC to connect/respond to the PDC.
(It will also allow anyone who compromises your BDC, in addition 
to obtaining a copy of your domain account/password database, to
run roughshod over your whole internal network unimpeded.  What
a prize!)

3> conduit permit ip host 172.17.0.10 172.17.0.0 255.255.0.0

  This traffic will not need to hit the firewall, so the rule
will never be used.

4> conduit permit tcp host 172.17.0.10 eq smtp any
5> conduit permit tcp host 172.17.0.10 eq pop3 any
6> conduit permit tcp host 172.17.0.10 eq domain any
7> conduit permit udp host 172.17.0.10 eq domain any

  This traffic is all permitted by rule 2 above, so these rules
will never be used.

8> conduit permit ip host 172.17.4.2 host 172.17.0.10

  This appears to be a typo.

  Modern PIX practice is to use access lists rather than conduits.
Best practice is not to put an internal domain controller in a DMZ.

David Gillett




-----Original Message-----
From: Bilal Dar [mailto:bdar@pbad.sbg.com.sa]
Sent: Monday, August 23, 2004 2:13 AM
To: firewalls@securityfocus.com
Subject: unable to join domain from dmz


I am having a problem, i couldn't figure out the reason till 
now. We are
having our NT 4 Primary Domain Controller on the inside 
network, now i am
installing another server in the DMZ as a Backup Domain 
Controller. When i
try to join the domain during installation i get an error stating "The
domain controller for the domain cannot be located"

Dmz = 172.17.0.0/16
Inside = 172.16.0.0/16

PDC = 172.16.4.2
NewServer = 172.17.0.10/16

conduit permit icmp any any
conduit permit ip host 172.17.0.10 172.16.0.0 255.255.0.0
conduit permit ip host 172.17.0.10 172.17.0.0 255.255.0.0
conduit permit tcp host 172.17.0.10 eq smtp any
conduit permit tcp host 172.17.0.10 eq pop3 any
conduit permit tcp host 172.17.0.10 eq domain any
conduit permit udp host 172.17.0.10 eq domain any
conduit permit ip host 172.17.4.2 host 172.17.0.10


I can ping NewServer from Inside network. Am i missing something?


Thanks
[More with this subject...]




<Prev in Thread] Current Thread [Next in Thread>
Previous by Date:  RE: FW failover solution, Fredericks, Michael J
Next by Date:  Re: unable to join domain from dmz, Robert Hajime Lanning
Previous by Thread:  unable to join domain from dmz, Bilal Dar
Next by Thread:  Re: unable to join domain from dmz, Robert Hajime Lanning
Indexes:  [Date] [Thread] [Top] [All Lists]