2

We are currently looking to flatten our AD structure a bit to make things a bit more manageable, but we still want to keep our security posture as near as possible to where it is now.

Currently, we have AD forest islands segregated by firewalls and none of the forests talk to each other, except for a few exceptions for offsite replication for DR purposes.

We want to move to a single AD forest design with a root domain and no more than two other domains.

Question is, what's the best way to secure the DC to DC traffic that goes through a firewall boundary?

Here's the kicker. Our current posture is that no lower security zone is allowed to initiate inbound traffic (no ingress) to a higher security zone, so two way communication between DCs would only happen when a DC in a higher security zone wants to talk to the DC in the lower security zone (egress initiated traffic only).

I know that using sites we can control replication so it is initiated one way only, but I want to be sure that this controls the flow of all ports needed for traffic between the two DCs.

I also know that we can use IPSEC tunnels to limit the ports that need to be opened on the firewall and make the tunnel unencrypted so that IDS/IPS can still analyze the traffic.

Given that, I wanted to know if you guys have any thoughts on how to best do this. I highly doubt that we are the only organization that you support that has these requirements.

2
  • One possible solution to control the flow is Read Only Domain Controllers (RODCs).
    – ITBlogger
    Nov 9, 2011 at 18:42
  • If you can only replicate one way, you're going to run into problems no matter what.
    – MDMarra
    Nov 11, 2011 at 20:13

1 Answer 1

1

I had a similar requirement in a project several years ago. The accepted solution was to put the DCs in the lower level zone in a sort of DMZ. We then restricted the ports used by active directory replication, set up an IPSEC policy for those ports and and other ports when talking to some predefined IP addresses of DCs in the higher level domain. The clients on the lower domain had to go through a transparent firewall to talk to the DCs in the DMZ.

Thinking outside of the box for a moment - could you have a VPN server on the lower domain that only the higher domain DCs could connect into? I.e. the higher leven DCs would be VPN clients. You could use an unencrypted transport to satisfy your IDS/IPS requirements. Once the higher level DCs connect then two way coms could be established and AD could function as usual. Or is that encapsulating the problem?! :)

1
  • The second part of your answer gets off of the beaten path a bit :) but +1 for the first part. It is exactly what I was going to link to and recommend.
    – MDMarra
    Dec 8, 2011 at 19:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .