We have some IIS servers on our DMZ and want to restrict as much as possible
the port communication between them and our domain.

We require the ability to authenticate with a domain user. Can anyone
advise which ports are required for the server on the DMZ to communicate
with the internal domain?

Many Thanks
Glen

You need the firewall opened up to allow "AD speak". The minimum would be the
following:

389/TCP : LDAP to Directory Service
389/UDP : LDAP to Directory Service
3268/TCP : LDAP to Global Catalog Server
88/TCP : Kerberos Authentication
88/UDP : Kerberos Authentication
53/TCP : DNS Lookup
53/UDP : DNS Lookup
135/TCP : RPC port endpoint mapper
1024+/TCP : RPC dynamic

Note that it is advisable to restrict RPC traffic by opening one port only
rather than all ports above 1024. See
http://support.microsoft.com/?kbID=224196 how to do this. Howver, in your
case, since you are concerned with a DMZ server, you may decide this is not
necessary. Also note that the ports listed have not allowed for any web
browsing of IIS servers in your DMZ.


"GKnight" wrote: