Re: How to decide on which network interface domain controller is available


Fair enough. I still think it is the wrong decision - you *will* as you have found have problems with multi-homed DCs as you have found - since you expose your DC even if only a little bit. I hope that someone can answer the original question for you.

Cheers,

Cliff

RAP wrote:
Hi Cliff,

I am aware that our setup is not optimal from a security point of view,
but we are a private network with limited resources, from hardware to
software everything is 2nd hand.

We are having two servers (normal PCs) and I decided that for us it is
more important to have fault-tolerance (since I am away often and a
hardware failure could mean a downtime of several weeks) then to
increase security. Therefore we dedicated both machines to both jobs
(DC and Internet Gateway/Servers).

Regards, Robert

Enkidu wrote:

RAP wrote:

Hi,

I have two domain controllers, both are connected to an internal (LAN
with clients) and an external (a DMZ) network.

How can I configure the servers in a way that the domain controller
functionality is only available on the internal network?

My current problem is that the DNS server has both IP addresses for
each server under one name. I cannot remove the external one, Windows
automatically re-creates the entry. Now, when I resolve the name of
server2 on server1 with nslookup it results in both IP addresses. For
some reason the external address is choosen and any communication (e.
g. ping or mount network drive) goes via the external network. This is
not what I want, it should go via the internal (much faster) network.

I was hoping that when I deactivate the domain controller functionality
on the external interface it will not re-create the entry in the DNS,
however I'd be happy about any other solution for my problem as well.


Multi-homed DCs are always a bad idea, unless you cannot think of any
other way of doing it. The way that you are doing it is essentially
nullifying the security of having a DMZ, since if the DC on the DMZ
(which is not absolutely trusted) is compromised, the attacker has a
machine on your LAN!

Of course you may have reasons for doing it that way that I know nothing
about, in which case my comments may help others. Just please disregard
them.

.

Relevant Pages

  • RE: 504 Proxy timeout only with SSL traffic
    ... the DMZ network is considered External to the ... this may have an effect when you access the DMZ. ... And can access all other HTTPS sites on the internet? ... that there may be something wrong with the proxy engine on the ISA, ...
    (microsoft.public.isa)
  • Re: VPN equals slow network folder access
    ... primary and secondary WINS servers are the same as the DNS servers. ... At home the VPN has a fixed 10.0.xx.xx address. ... Pressing F5 in My Network Places ... Likewise Internet Explorer ...
    (microsoft.public.windowsxp.work_remotely)
  • Re: SBS2000 and a DMZ
    ... the mission critical network. ... The remote/mobile users can trapse all over the internet and collect all ... > appropriate registry entries on the clients, the ability for the DMZ ... >> The W2K3 server is a recent addition and wanted it for storage of the ...
    (microsoft.public.backoffice.smallbiz2000)
  • Re: Security Issue with ISA and Exchange Front end
    ... >Dedicated Firewallprotecting our network. ... >the only ports I open for the Internet users to the FE, ... >ISA in DMZ and not a member server of my Domain, FE and BE in the Internal ...
    (microsoft.public.exchange.setup)
  • Re: Security Issue with ISA and Exchange Front end
    ... >Dedicated Firewallprotecting our network. ... >the only ports I open for the Internet users to the FE, ... >ISA in DMZ and not a member server of my Domain, FE and BE in the Internal ...
    (microsoft.public.isa.clients)