My company has a firewall. My company don't have any Domain Controller nor Windows Server device.

My boss plans to configure the firewall to let users authenticate with their corporate credential (AD) before accessing company resources. He want to build a Windows server(probably latest version OS) which act as domain controller (DC). The firewall will authenticate against the DC via Kerberos/LDAP/RADIUS protocol. My boss plans to host the server with cloud service provider.

The DC will not place in my company. Can I configure the firewall with the IP address of the DC? Does both device need to be in the same network in order to work? If no, do I need a VPN connection?


It will work, but just plan it correctly. You can usually configure a VPN tunnel to the cloud provider to access the DC. Thus the server will be in another IP scope, but accessible from your local LAN.

The computer will have to have the DC in their DNS entrys and the VPN tunnel to be open.

  • If I don't want to use VPN(means they are not on the sam network), can I just configure the firewall with the DC's public IP address or URL? – Chong Onn Keat Nov 11 '15 at 1:45
  • @ChongO.K. no. It's a firewall to firewall VPN, (site to site vpn) it will be transparent to everyone. you can't put your only dc on a dmz.. if it's your intention. – yagmoth555 Nov 11 '15 at 1:49
  • I know its not safe and not advisable to make DC open to public because it will cause security concerns.I just want to know that whether its technically possible if I configure the firewall(inside my company) to authenticate (Kerberos/LDAP/RADIUS) with the DC's(hosted in cloud provider) public IP address or URL without using VPN? – Chong Onn Keat Nov 11 '15 at 5:59
  • Yes, please see technet.microsoft.com/en-us/library/… for all ports, and open necessary port – yagmoth555 Nov 11 '15 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.