Domain Controller on DMZ

Unanswered Question
Nov 21st, 2006

Hi

I have a problem with Domain Controller when its on dmz and client of DC on inside,i ve configured an access-list to permit conversation between DC and Clients but they cant join to domain.

The DC ip address is 172.16.1.9 which i nat it to 10.9.0.15 ,and users subnet is 10.9.0.0/16 ,i also define dhcp server on DC and clients can take their ip address from dhcp but they can't join to domain.

please help me.

Thanks.

Attachment: 
I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
vadi_ag Tue, 11/21/2006 - 05:37

Hi

I cannot see any acl entry for port 53 udp/tcp this port is for DNS and allow port 500 and 50 and u hav to allow ports 88 tcp/udp for kerberos for time being u can allow tcp/udp echo port check out if this works then rate my reply if not we will try somethinf else

Raj

mrmozaffari Wed, 11/22/2006 - 00:10

Hi Vadi

Thank you for your reply but after i saw your comments I've changed my access-list and add permit ip any any to my access list but again i saw that the clients could not join to domain.

Thanks.

vadi_ag Tue, 11/28/2006 - 23:57

Hi

If u have allowed any any in ur acl then it should work now i am suspecting ur DC for testing purpose u can take one client and assign IP of ur DMZ and place this client on DMZ and then u try to add this client to ur domain if this works fine then we hav to look at ur config again if this does not works then u can check ur DC

jgervia_2 Wed, 11/29/2006 - 16:59

Hello,

If you don't have an access-list applied to your inside interface, going to the DMZ should be allowed on all ports/protocols, so it shouldn't be an access list issue.

Make sure you've disabled nat unless you need it :

no nat-control

By default, you need nat from a high-->low interface unless you turn it off. The static doesn't really cover that (you have to tell the pix what the ip addresses on the inside will be when they are on the dmz).

Also, make sure when they are getting their DHCP address from the server that they are getting the *translated* address as the WINS server, not the real one. I don't know if this would be an issue - are you not routing the DMZ network internally?

--Jason

Please rate this message if it answered some or all of your question/issue.

Actions

Login or Register to take actions

This Discussion

Posted November 21, 2006 at 3:53 AM
Stats:
Replies:5 Avg. Rating:
Views:367 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard

Rank Username Points
1 7,861
2 6,140
3 3,170
4 1,473
5 1,446