Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am searching for the best practice of securely deploying windows domain controller and exchange in a small-medium size network (50+ users, 20+ virtual servers). The topology is single firewall staying between wan and internal router (l3 switch) and firewall has a dmz leg. We have users, servers etc. vlans. How would you deploy them ?


share|improve this question
up vote 1 down vote accepted

The general rule is simple: Put the publicly-accessible servers in DMZ subnet and put the internally-used servers in the internal subnet. Configure your firewall accordingly.

Domain controller should be put in the internal subnet unless there is a need to make it publicly accessible??

Exchange server can be made publicly accessible or internal only depending on whether your email server is intended for private/public use.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.