Internal and DMZ domain

[Hau Nguyen]

Hello all,
I'm recently debating whether creating a subdomain or a
new domain for our DMZ segment, which is seperated from
our internal network by a firewall. A new domain will not
involve additional setting on the firewall but double work
managing user account/password. In the other hand, a
subdomain may pose security risk to the internal network.
Does anyone has experience on this issue? And what is the
minimum requirements for DCs to communicate over a
firewall. Thanks for your help!

Hau

 

[Matjaz Ladava [MVP]]

http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.asp
explains needed ports. They are quite few. Personally I don't like my domain
(even subdomain) to extend into DMZ zone. If I need one, I rather create a
separate forest in DMZ.
Just out of the curiosity. Why do you need a domain in DMZ ?
--

Regards

Matjaz Ladava, MCSA, MCSE, MCT, MVP
Microsoft MVP Windows Server - Active Directory
(e-mail address removed), (e-mail address removed)

 

[Hau Nguyen]

I agree with you. I have several servers in the DMZ
segment that service www, ftp, email content filtering,
and other front-end interface for web applications. So a
domain or a solution to allow me centrally manage users
(instead of duplicating local users/passwords to multiple
servers) becomes quite useful. BTW, I'm a newbie with MS
AD. Thanks again for your advice!

Hau