Web server on a DMZ and Active Directory

Similar Questions

• Cannot access the Web server in the DMZ from the inside using IP global

  Hi all

  I hope it's a very simple question.

  I'm running a PIX 515 firewall v6.3. I set up a Web server in my DMZ and use static NAT for re-branded it overall static IP address. Access from the outside of the demilitarized zone works remarkably well. I can access inside the interface Web site using the internal IP, but I can't access it from inside interface using the global IP are entrusted to him.

  Is there a particular reason why this would not be allowed? My feeling was that the request would be forwarded via the external interface (as it is a global IP address) and then be bounced back by my sense of the ISP the request would come to the new external interface (as the static NAT is applied to the external interface).

  However if I try and access the global IP from my inside interface, then the browser can not find the server.

  can someone explain why this is so? Any information would be appreciated.

  see you soon,

  Wayne

  ---------------------------------

  6.3 (3) version PIX

  interface ethernet0 100full

  interface ethernet1 100full

  interface ethernet2 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  nameif dmz security50 ethernet2

  hostname helmsdeep

  domain p2h.com.sg

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol they 389

  no correction protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  No fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  acl_out list access permit tcp any host 203.169.113.110 eq www

  access-list 90 allow the host tcp 10.1.1.27 all

  pager lines 24

  debug logging in buffered memory

  Outside 1500 MTU

  Within 1500 MTU

  MTU 1500 dmz

  IP address outside pppoe setroute

  IP address inside 192.168.1.1 255.255.255.0

  dmz 10.1.1.1 IP address 255.255.255.0

  no failover

  failover timeout 0:00:00

  failover poll 15

  No IP failover outdoors

  No IP failover inside

  no failover ip address dmz

  location of PDM 202.164.169.42 255.255.255.255 inside

  location of PDM 202.164.169.42 255.255.255.255 dmz

  location of PDM 10.1.1.26 255.255.255.255 dmz

  location of PDM 10.1.1.26 255.255.255.255 outside

  location of PDM 172.16.16.20 255.255.255.255 outside

  location of PDM 192.168.1.222 255.255.255.255 inside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  Global (dmz) 1 10.1.1.101 - 10.1.1.125

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  NAT (dmz) 0-list of access 90

  NAT (dmz) 1 0.0.0.0 0.0.0.0 0 0

  static (dmz, external) 203.169.113.110 10.1.1.27 netmask 255.255.255.255 0 0

  Access-group acl_out in interface outside

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  RADIUS Protocol RADIUS AAA server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.1.222 255.255.255.255 inside

  enable floodguard

  string fragment 1

  Console timeout 0

  Terminal width 80

  Code v6 pix or less don't let you have traffic "back" or return flow via the same interface on which it was sent. Having also your bounce back off of an external server traffic is never a good idea, because you won't be able to distinguish which and rogue attacks by spoofing someone outside your network.

  Since you are using pix 6.3 code, you may be able to outside the NAT. Add this static to your config:

  static (dmz, upside down) 203.169.113.110 10.1.1.27 netmask 255.255.255.255 0 0

  You may need to run a clear xlate after adding the new static statement. Note that the interfaces: it's demilitarized zone, inside inside, dmz.

  I would like to know if it works.

• Is there another solution to integrate NAC Appliance and Active Directory on Windows 2008 64 bit

  I'm trying to integrate a device of the NAC solution in a network where all domian servers and application servers are Windows 2008 64-bit.

  Could someone help me to confirm if Active Directory (AD) on Windows 2008 is not taken in charge and tell me what alternatives exist to authenticate users who consider that it is not possible to make any changes on the server. They will continue to be Windows 2008 64 bit.

  The original idea was to use AD SSO to authenticate users, but I read that it is not supported on Windows 2008 64 bit.

  I'd appreciate any help or suggestions.

  Concerning

  Arturo Monroy

  Arturo,

  You can use LDAP. Configure an LDAP authentication provider and have your customers to provide their credentials.

  It will not however a single code access scenario. They would have to enter their credentials again on the NAC agent.

  Support for 64 - bit is on its way and will be out in the new versions soon.

  HTH,

  Faisal

• second Web server on the DMZ not visible outside

  With the help of a PIX 515e

  I have several Web servers in the DMZ, the first web server and the mail server are set up with the port mapping for the PIX outside IP address of the interface.

  The second and third (inside interface) of the Web servers are configured with static mappings and access lists.

  I can see the first n the mail very good server webserver, but I can not see servers in second or third.

  What have I done wrong?

  I suggest you analysze traffic with the command to 'capture' PIX and sniff traffic on the DMZ and outside traffic.

  Check if packets arrive to the external interface, if it reaches the web server and is at - it a response.

  example of

  IP access-list 120 allow any HOST 207.236.60.35

  capture the access-list 120 vpncap OUTSIDE interface

  See the access-list 120 retail vpncap capture

  or

  https://PIX-IP-address/capture/vpncap [/pcap]

  To remove the capture:

  No vpncap capture

  sincerely

  Patrick

• ESX and Active Directory

  Hello

  I have a succession of VMware ESX ESX 3.5 70 servers and I want to be able to manage better the connection, I am familiar with the addition of the accounts of users and groups by VI or by using a command. What I want to do is if possible to create different groups and modify it permissions on each host via a script, and then if possible to add users to the same group in Active Directory and user management centrally via AD. If this is not possible, I would like to script adding user accounts and change the permissions of the user. I like to keep as manageable as possible to control the user accounts and permissions, more than 70 servers may prove to be multitasking.

  Thanks in advance

  This is the best post I've seen on this task.

  http://blog.scottlowe.org/2007/07/10/ESX-Server-ad-integration/

  You can also watch Centrify.

  http://www.Centrify.com/DirectControl/vmware_esx.asp

• Cloning and Active Directory

  I just came across trouble cloning a win2003 server in Active Direcory. Once I renamed the cloned that he renamed the initial account of the server in Active Directory, so I could not connect to the source server over.

  I've always had to run newsid.exe after a clone or the Configuration Wizard can do?

  If you use the feature to customize comments, it will generate a new SID for the clone if you ask.

  I misread your post origionally and was about to recoment that you clone servers Active Directory (for example, domain controllers)

• ISE personas and Active directory

  Hello everyone,

  just a question...

  Which character has need of more bandwidth with Active Directory?

  Assuming that I have admin / - fire guard - political service monitor

  wich side place AD? (cause of firewall bandwidth limits)?

  Thanks in advance for your answer

  The node primary admin and the political service nodes. All nodes join the AD, but when you create groups in AD and build your policies which is made from the node of the main admin, PSN nodes are responsible for enforcing those policies. It is my personal opinion.

  Thank you

  Tarik Admani
  * Please note the useful messages *.

• DMVPN and active directory (logon)

  Hi all

  We have a DMVPN configuration between a few sites and everything seems fine, except that the logons through the VPN for a new domain active directory are very slow (10-15 minutes). I believe that the problem may be with the fragmentation of tunnel and packages such as AD is configured correctly.

  I am looking for some recommendations or advice on the MTU and TCP MSS settings see if it solves the problem.

  both the hub and the spokes are currently with the following settings MTU and MSS (ive removed some irrelevant information) Tunnel0 was originally a mtu of 1440 but if whatever it is 1400 is even worse.

  Thank you

  interface Tunnel0

  IP 1400 MTU

  IP nat inside

  authentication of the PNDH IP SP1

  dynamic multicast of IP PNDH map

  PNDH network IP-1 id

  IP virtual-reassembly in

  No cutting of the ip horizon

  source of Dialer0 tunnel

  multipoint gre tunnel mode

  0 button on tunnel

  Profile of ipsec protection tunnel 1

  interface Dialer0

  MTU 1492

  the negotiated IP address

  NAT outside IP

  IP virtual-reassembly in

  encapsulation ppp

  IP tcp adjust-mss 1452

  Dialer pool 1

  Dialer-Group 1

  Darren,

  In general the prolem is due to Kerberos on UDP traffic.

  There are several ways you can solve the problem:

  (1) transition to Kerberos over TCP. (suggested)

  (2) setting the MSS on the interface of tunnel not on telephone transmitter (recommended)

  (3) allowing the PMTUD tunnel (strongly recommended).

  M.

• VSphere 5.5 and active directory

  Hello

  I'm having a problem trying to set up a new device Center 5.5 use AD permissions. My ad is 2012, I gave the host in which the vc unit sits on a COMPLETE domain name and it is joined to the domain, then, I'm going to the VC unit and join it to AD that she is successful. When I go to add permissions the ad domain is here not only local and sphere.local appears.

  When I look in the AD, I noticed that the host and the VC have not computer accounts even if they seem to be joined to the domain successfully.

  Any ideas would be appreciated.

  Paul

  Hello

  Please lookinto this link, hope this helps you:

  http://wahlnetwork.com/2013/09/09/using-Active-Directory-integrated-Windows-authentication-SSO-5-5/

• Problems of ESXi 5.5 and Active Directory

  Something has clearly changed in the behavior of default Active Directory for ESXi 5.5

  I can successfully join a freshly installed ISO standalone ESXi 5.5 (1331820) to my domain name by using the vSphere Client. Time is correct on the host computer and the domain controller, so it isn't that. I also see the default group esx ^ admins is automatically configured as an administrator on the host authorization tab (because this group is configured in AD since approximately 2009).

  Unfortunately, connect to ESXi with the vSphere client "use Windows logon credentials" is uneven at best - it seems to have worked once or twice - and logging in the shell or SSH using the windows credentials (we tried [email protected] and mon_domaine\compte) does not work.

  We thought we were crazy, so we went back and installed 5.1 all over again - and it worked fine. We compared the: / etc/hosts and files /etc/krb5.conf on both machines and could not find any differences.

  Does anyone have an idea?

  THX

  Simple solution:

  Reboot the host or execute: /usr/sbin/services.sh restart

  This was not necessary because the directory-based authentication was supported in the GUI, but it is now. After a re-start AD works as it should.

• Continuation with VIO and Active Directory reference error

  While deploying the instance OpenStack de VIO, I get the following error message when checking the parameters of authentication source:

  Cannot find the specified user (Group). Details: The LDAP search request failed. Further reference

  This seems to be a problem, I met several times, where AD would send a reference instead of the response that the client must follow. But I don't see any option to allow removal with Active Directory. Is there a way around this?

  Concerning

  Gerald

  I found a work around for the problem:

  The query is successful when you use the ports for the Active Directory Global catalog.

  The ports are:

  • 3268 (without encryption)

  or

  • 3269 (with SSL)

  Disadvantage: You can't just use your do domain name address all the domain controller, you must specify one with its host name.

• WLC4402, SSC 4.0, EAP FAST with ACS 4.1.23 and Active Directory

  Hi all

  I have a problem where my client software SSC (Cisco Secure Services)-wireless on laptops don't will authenticate the windows domain users if they enter the user name and passwords manually. The unique signature feature will not work. I am using EAP-FAST. It is an ACS appliance based server that I restored from the recovery CD.

  When I look at the failure of authentication request I can see that she is trying to send [email protected] / * / during an attempt to SSO on. The log shows that it is a bad user name or password. Note that the end of the domain name is missing.

  I can see the authentication attempt in the log of the remote agent (CSWINagent.log) on the domain controller, so I don't know that it sends the connection request to the domain controller. The Remote Agent is the same version as the ACS server. When I authenticate successfully (manually) it sends not the domain part of the user.

  This is a new installation. Initially, I had 2 remote agents, both on the service domain controllers has been run under an account with sufficient privileges windows domain administrator. After a planned turn off weekend windows authentication has stopped working completely. I found a post in this forum that says to use the local system to start the remote agent service. This led windows authentication to life, but now I have this problem. I don't know that until I changed it the manual connection is also required in domain (IE user domain\username). I can't be sure that this is the case!

  Can anyone help me to get windows AD to accept these credentials, because they are sent to the client connection? Otherwise if I can make it work with the user account, he worked with initially then that would be great.

  Thank you very much

  As you mentioned that SSC transmits the username "[email protected] / * /" in SSO.

  Is what I think for the moment, to use the feature of Distribution of Proxy on ACS.

  that is, demand to come as it is "[email protected] / * /', let's make ACS Stip off"@domaine"and"username"to RA for AD verification."

  http://www.Cisco.com/en/us/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4.1/user/NetCfg.html#wp342969

  After stripping '@domaine' send the request back to the ACS it itself, i.e. in the column forward to, ensure that we have input of the ACS.

  And let me know if it works for you?

  Kind regards

  Prem

• ACS 4.2 and Active Directory

  I'm putting in place our new ACS 4.2 server. This is version 4.2 Build 124, running on a Windows 2003 server. I'm having some trouble with the enumeration of the groups and just may not know what Miss me. We have 7 different areas, and I can only list one of them groups. We do not run ACS on one of our domain controllers, but the server is a member of the domain controllers. I even added a service account is a domain administrator and services run as account but I still cannot enumerate groups. Any help would be greatly appreciated.

  Hello

  I know that you have a domain administrator account that is running the services ACS. But I'd like to as go you through the steps listed below again.

  ------------------------------------------

  -You should have a user on AD.

  -To make it difficult to hack, give him a very complicated password for a long time.

  -Make the user member of the Domain Admins group.

  -Make the user member of the Administrators group.

  -Make the user member of the Enterprise Administrators group.

  On to Windows 2000/2003 server running ACS:

  -Add the new user to the appropriate local group.

  -Open "Administrative Tools" in the control panel.

  -Open "Computer management".

  -Open 'Local users and groups' and then 'groups '.

  -Double-click the group "Administrators".

  -Click on 'Add '.

  -Choose the domain in the box "search in".

  -Double-click the user created above to add it.

  -Click OK.

  -Give special rights to the new user on the ACS server.

  -Open "Administrative Tools" in the control panel.

  -Open "local security policy".

  -Open "local policies".

  -Open "User rights assignment."

  -Double-click "Act as part of operating system"

  -Click on 'Add '.

  -Choose the domain in the box "search in".

  -Double-click the user created above to add it.

  -Click OK.

  -Double click on "Log on as a service."

  -Click on 'Add '.

  -Choose the domain in the box "search in".

  -Double-click the user created above to add it.

  -Click OK.

  -Set the ACS services to run as long as the user created.

  -Open "Administrative Tools" in the control panel.

  -Open "Services".

  -Double-click the CSADMIN entry.

  -Click the 'connection '.

  -Click on "This account", and then on the button 'Browse '.

  -Choose the field, double-click the user created previously.

  -Click 'OK '.

  -Repeat for the rest of the CS services.

  -Wait for Windows to apply the security policy changes, or restart the server.

  -If you restarted the server, skip the rest of these instructions.

  -Stop and then start the CSADMIN service.

  -Open the GUI of the ACS.

  -Click on System Configuration.

  -Click on the Service order.

  -Click "restart."

  Note If domain security policy is set to override settings for "Act as part of operating system" and "Log on as a service" rights, rights of user changes listed above will also be to do here.

  If you log on several areas, a full two-way trust must exist between the domains, the user (ACS account) must be created and given the high access in each domainbto be questioned and FULL domain each domain must be listed as a DNS suffix in the properties of the IP Address of the server on which the ACS is installed (restart netlogon service after adding the FULL domain name).

  HTH

  JK

  Please help the rate of messages-

• VMotion and Active Directory

  Hi all

  First post here.  I read up on top of the communities here as well as the Google search to find the answer to my VMware / AD question but have not found a definitive answer for her:

  Most said that it is NOT recommended to enable the snapshots on a VM AD as AD may be damaged.  If this is the case, does AD VMs should not be VMotioned as well because when you VMotion, you take a snapshot?

  What are the recommendations/experiences with VMotion and AD that you all have?

  Thank you

  VEEI

  It does not have a Flash disk for vmotion.  It does take a bitmap of ram, send that to the target esx server, copy becomes more ram for the vmotion and executed treatment hand.

  I don't take pictures of my ad for any reading except for the purposes of this component snap in a test environment. You wouldn't put snaps of online advertising, it is simply not good in my opinion.

  I wouldn't ban the shots, so I'm not going to one of the modes of drive.

• Snapshots and Active Directory member servers

  I work in a test environment and install new application relies on our servers windows 2003 comments at least daily. There are 3 guests for each application system. We use snapshots on theses customers, who are members of domain servers, so that we install each generation of the same question every time.

  We found that we also had to remove each Member of the AD domain server and add it in each time. This allows our application to work, but it adds a bit of time for the installation of generation process.

  We never instant domain controllers.

  I was wondering if anyone has another way to remove/add member servers of the field without going through the GUI and all required reboots.

  The best way to solve this problem is to disable machine account password changes.

  See

  http://technet2.Microsoft.com/WindowsServer/en/library/2EE8CF56-7DCC-4C79-AF46-737C40ABBF8B1033.mspx

  http://support.Microsoft.com/kb/154501

  Article is for Windows 2000 and NT, but works for 2003 and XP.

  I wouldn't do this in a production environment.