Firewall and Windows 2000

[Pheng Yang]

Scenario:

I am setting up a Windows 2000 AD domain controller inside a firewall. On
the other side is the DMZ, and I want my machines in the DMZ to be able to
authenticate against the AD controller within the LAN area of the firewall.
What are the ports that are needed to allow this to work so that new
machines in the DMZ can join the domain within the LAN?

Currently, I have the following ports open from the DMZ to the LAN per the
Microsoft knowledge base article 179442:

UDP ports:
53 - DNS
88 - Kerberos
137 - NetBIOS Name
138 - NetBIOS Netlogon and Browsing
389 - LDAP

TCP ports:
42 - WINS replication
53 - DNS
88 - Kerberos
135 - RPC end point mapper
139 - NetBIOS Session
389 - LDAP
445 - SMB
636 - LDAPS
3268 - Global catalog
3269 - Secure global catalog
5000 - 5020 for RPC static ports as suggested in Microsoft knowledge base
article: 154596

I guess the problem I have right now is that even with the ports described
by the
Microsoft knowledge base articles open, the machines I have in the DMZ are
not able to join the domain. It gives me the following error when I attempt
to join
a machine in the DMZ to the domain:

The following error occurred validating the name "<domain name>".
This condition may be caused by a DNS lookup problem. For information
about troubleshooting common DNS lookup problems, please see the following
Microsoft Web site:
http://go.microsoft.com/fwlink/?LinkId=5171

The specified domain either does not exist or could not be contacted.

I know that DNS is resolving correctly, because I can perform an NSLOOKUP
successfully, and I can ping the internal AD domain controller machine by
name.

Any help would be appreciated.

Thanks in advance,

Pheng Yang
Systems Engineer

 

[Ace Fekay [MVP]]

In

Scenario:

I am setting up a Windows 2000 AD domain controller inside a
firewall. On the other side is the DMZ, and I want my machines in
the DMZ to be able to authenticate against the AD controller within
the LAN area of the firewall. What are the ports that are needed to
allow this to work so that new machines in the DMZ can join the
domain within the LAN?

Currently, I have the following ports open from the DMZ to the LAN
per the Microsoft knowledge base article 179442:

UDP ports:
53 - DNS
88 - Kerberos
137 - NetBIOS Name
138 - NetBIOS Netlogon and Browsing
389 - LDAP

TCP ports:
42 - WINS replication
53 - DNS
88 - Kerberos
135 - RPC end point mapper
139 - NetBIOS Session
389 - LDAP
445 - SMB
636 - LDAPS
3268 - Global catalog
3269 - Secure global catalog
5000 - 5020 for RPC static ports as suggested in Microsoft knowledge
base article: 154596

I guess the problem I have right now is that even with the ports
described by the
Microsoft knowledge base articles open, the machines I have in the
DMZ are not able to join the domain. It gives me the following error
when I attempt to join
a machine in the DMZ to the domain:

The following error occurred validating the name "<domain name>".
This condition may be caused by a DNS lookup problem. For
information about troubleshooting common DNS lookup problems, please
see the following Microsoft Web site:
http://go.microsoft.com/fwlink/?LinkId=5171

The specified domain either does not exist or could not be
contacted.

I know that DNS is resolving correctly, because I can perform an
NSLOOKUP successfully, and I can ping the internal AD domain
controller machine by name.

Any help would be appreciated.

Thanks in advance,

Pheng Yang
Systems Engineer

If you're getting "lookup" errors, usually means that the machines are
looking at the wrong DNS server. You don't have your ISP's listed in your IP
properties? They need to be removed, if so. Just make sure that the DNS
server on your outside DC has a copy of your AD zone or just make the zone
AD Integrated. Otherwise, "lookup" errors can occur.

Honestly, instead of opening up the 30 ports that AD requires (IMO, turns
the firewall into swiss cheese), it might be much easier to create a
transport mode VPN between the outside DC and an inside DC and just open up
those appropriate ports.

I also remember reading somewhere else that RPC can have problems thru a
firewall even after opening up all those ports. I know fpr a fact that NAT
cannot support RPC, LDAP and Kerberos traffic, just in case this is a NAT.

I see there may be one or two more ports you need opened. Here's a couple
more links on firewalls and AD:

Q289241 - A List of the Windows 2000 Domain Controller Default Ports:
http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q289241&

Active Directory Replication over Firewalls - Microsoft Service Providers:
http://www.microsoft.com/SERVICEPROVIDERS/columns/config_ipsec_p63623.asp

Download details Active Directory in Networks Segmented by Firewalls:
http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-
9767-a9166368434e&DisplayLang=en

--
Regards,
Ace

Please direct all replies to the newsgroup so all can benefit.

Ace Fekay, MCSE 2000, MCSE+I, MCSA, MCT, MVP
Microsoft Windows MVP - Active Directory