Re: Windows Firewall on Domain Controllers

Jorje, thanks for responding. Quick follow-up: you say "don't run a FW on a
DC", and that was my approach from the beginning. But as I stated, updates
from Microsoft keep turning the Windows Firewall back on. So how does one
turn it off so it stays off?
--
Ron


"Jorge Silva" wrote:

Hi

* Server 2003 defaults to Windows Firewall active.
* Domain Controller doesn't work with firewally active unless it is
manually
confgured for all the AD ports and you do some voodoo with RPC ports.

Don't use firewall on a DC, use a diferent machine, if you can don't join
the FW to the domain unless you have a good FW solution like ISA 2004 in a
back to back configuration.

Assuming the above points are correct on my part, what is the best
practice
for administering the firewall on domain controllers (I have about 30 of
them
scattered all over the country)?

Again you shouldn't use a FW on a DC is a bad practice and represents
security issues. Configuring FW on a DC depends on what you need to do with
it, Applications,DNS,DHCP,Wins,SMB,Replication,etc.

Here's some ports to take:

By default, Active Directory replication over RPC (Remote Procedure Calls)
takes place dynamically over an available port via the RPC Endpoint Mapper
(RPCSS) using port 135;

Application protocol Protocol Ports
Global Catalog Server TCP 3269
Global Catalog Server TCP 3268
LDAP Server TCP 389
LDAP Server UDP 389
LDAP SSL TCP 636
LDAP SSL UDP 636
IPsec ISAKMP UDP 500
NAT-T UDP 4500
RPC TCP 135
RPC randomly allocated high TCP ports TCP 1024 - 65536

832017 Service overview and network port requirements for the Windows
Server system
http://support.microsoft.com/default.aspx?scid=kb;EN-US;832017

224196 Restricting Active Directory replication traffic to a specific port
http://support.microsoft.com/default.aspx?scid=kb;EN-US;224196


--
I hope that the information above helps you

Good Luck
Jorge Silva
MCSA
Systems Administrator

"Ron" <rhardin@xxxxxxxxxxxxxxxxxxxx> wrote in message
news:301A5C97-58EC-426D-B43E-4891BB4E10C0@xxxxxxxxxxxxxxxx
Need input on recommended best practices. Here's what I've figured out:

* Server 2003 defaults to Windows Firewall active.
* Domain Controller doesn't work with firewally active unless it is
manually
confgured for all the AD ports and you do some voodoo with RPC ports.
* Making a 2003 Server a Domain Controller doesn't automatically configure
the firewall
* Turning off the firewall only fixes the problem temporarily because some
Windows Updates automatically turn it back on (without telling you).

Assuming the above points are correct on my part, what is the best
practice
for administering the firewall on domain controllers (I have about 30 of
them
scattered all over the country)?

--
Ron Hardin, CHTP
Director of Technology
Davidson Hotel Company



.

Relevant Pages

  • Re: Interesting webserver intrusion (apache 1.3.31, mod_ssl 2.8.18, php 4.3.7)
    ... > fairly tight(only allowing 4 ports in), but perhaps I could tighten it ... The host systems firewall rules govern the access to the jailed system. ... What connections does your server need to ... Perhaps there is a 0-day for your ftp server out there. ...
    (Incidents)
  • Re: Security Problem...
    ... Your computer is listening on TCP 80. ... firewall is really blocking TCP 80, then maybe this isn't the case, or maybe ... If this was a compromise that came through IIS web services, ... secure a server, all mentioned in the links I gave you]. ...
    (microsoft.public.security)
  • Re: Add 2nd NIC after intial install?
    ... My biggest question with 1 NIC is: even if workstations are protected with individual firewall products, what is protecting the SBS server itself if ports are open for remote access through the Linksys firewall? ...
    (microsoft.public.windows.server.sbs)
  • RE: IM Programs
    ... want to block these ports. ... you don't need an explicit deny for the other ports. ... Access-list 101 deny any tcp any any eq 5000 ... >Now, when applying these to your firewall, make sure the number ...
    (Security-Basics)
  • Re: Source Code to Filter out WindowsMessenger POP-UPS
    ... Zone Alarm does NOT support 'server'. ... Very few ports are open, ... >What you are asking for amounts to a firewall. ... I would NOT search for source code to compile ...
    (microsoft.public.inetserver.iis.security)