We are currently looking to flatten our AD structure a bit to make things a bit more manageable, but we still want to keep our security posture as near as possible to where it is now.
Currently, we have AD forest islands segregated by firewalls and none of the forests talk to each other, except for a few exceptions for offsite replication for DR purposes.
We want to move to a single AD forest design with a root domain and no more than two other domains.
Question is, what's the best way to secure the DC to DC traffic that goes through a firewall boundary?
Here's the kicker. Our current posture is that no lower security zone is allowed to initiate inbound traffic (no ingress) to a higher security zone, so two way communication between DCs would only happen when a DC in a higher security zone wants to talk to the DC in the lower security zone (egress initiated traffic only).
I know that using sites we can control replication so it is initiated one way only, but I want to be sure that this controls the flow of all ports needed for traffic between the two DCs.
I also know that we can use IPSEC tunnels to limit the ports that need to be opened on the firewall and make the tunnel unencrypted so that IDS/IPS can still analyze the traffic.
Given that, I wanted to know if you guys have any thoughts on how to best do this. I highly doubt that we are the only organization that you support that has these requirements.