Hi.. I would like to join the pc at the remote office as a client pc for the windows domain controller available at the head office.

HI,

You have to allow domain and Active directory ports in firewall to make it success.

Create a acl saying that mention your souce network(remote network address), destination as your windows server and you need to allow the below ports in your firewall.

And apply the ACL in your outside interface.(the interface is connected to router).

TCP and UDP/389  - LDAP
TCP/636    -- LDAP SSL
TCP/3268  --  GC
TCP&UDP/88
TCP and UDP/ 53
TCP and UDP 445   
SMB over IP
TCP 135, Dynamic

Regards

Karuppu

Is there any way that i can map all these ports to the internal DC using single / fewer commands..? may be using object-groups equalent..?

Or do i have to use single line for each and every ports for the mappings..??

Hi,

Yes.you can create object group for all these ports and map into the ACL in a single line.

Regards

Karuppu

Hi, Actually i refered to port mappings. I have already done the access-list using object-groups.

At the same time i have to map the prots to the internal DC. My question was, do i have to use single line or each adnevery port.?

Cant i combine everything in one line..?

Hi,

The following is the config i have in my firewall.

object-group service DC_Access
service-object tcp-udp eq 389
service-object tcp-udp eq 88
service-object tcp-udp eq domain
service-object tcp-udp eq 445
service-object tcp eq ldaps
service-object tcp eq 3268
service-object tcp eq 135

access-list inbound extended permit object-group DC_Access any any
access-group inbound in interface outside

static (inside,outside) 192.168.2.1 192.168.1.1 netmask 255.255.255.255     (where 192.168.2.1 is external IP and 1.1 is the DC IP)

When i tried to connect the PC outside the firewall to the DC, i got a error message saying,

"The following domain controllers were identified by the query.

dc.abcd.com

However no domain controllers couldnot be contacted."

Any suggestions..??

Any one has any updates about this?

I have done a nat0 access-list to expose internal network behind the firewall to the external network on the outside interface of the PIX. Then, i pointed the DNS IP to the real IP address of the DNS server. After tht, i could bt able to join the domain.

But once i joined the computer, I am getting an error message saying "Changing the primary Domain DNS name of this computer to ""
failed. The name will remain domainname.com.

There after, once i restart the PC and try to login to the PC using domain credintioals, I am getting an error message saying,  "The security Database on the server does not have a computer account  for this workstation trust relationship."

However, I could see this new PC is listed in the Domain's AD Users & computers.

Any suggestions for this?

You might want to check if the dns name resolves to the correct ip  address. What if you try to ping to the external ip address of the DC,  does it work? What about telnet on port 445 towards the DC, does it connect?

I would suggest that on the outside ACL, you allow all IP towards the external IP of the DC to start with, when that works, you can tight down with ports that the DC uses? "permit ip any host "