RE: Intra domain communications
- From: "JosephK" <josephk@xxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Wed, 11 May 2005 11:26:38 -0700
Hi Thomas,
Here is some additional information in regards to setting up the type of
functions as in your article.
1. I had to change my network rules
I already had DMZ>>INT as a route relationship. And when you read
the description of route it states bi-directional. To me that means you
should only need that description because the route will or at least
should be automatically both ways. But, I had to change my INT>>DMZ
rule from NAT To route. I thought that having a ROUTE and not NAT
going into the DMZ was not the way to go.
So, what really does it mean for bi-directional relationship when
setting up
Network rules with ROUTE as it pertains to ISA Server?
I actually think that web content when accessing SQL behind internal is
more secure this way. I will be hammering on this while I research the
results in log files.
Any other tips for this type of setup?
Thank you,
Joseph
-----Original Message-----
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: Wednesday, May 11, 2005 10:02 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: Intra domain communications
http://www.ISAserver.org
Hi Joseph,
What DNS server address is the client using?
Is there a route relationship between source and destination networks?
DMZ hosts shouldn't be contacting the external zone.
Thanks for getting the book and we'll get the name right next time :)
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
-----Original Message-----
From: JosephK [mailto:josephk@xxxxxxxxx]
Sent: Wednesday, May 11, 2005 11:51 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] Intra domain communications
http://www.ISAserver.org
Hi Thomas,
Long time for me to ask a question. I've been working with this
article: http://www.isaserver.org/articles/2004perimeterdomain.html
Creating the rules and all that went with the article was a snap. Thanks
for the good writing! I do have questions though.
I actually want to add my web server in my internal DMZ to the AD domain
to make things easier and hopefully more secure when webs need assess to
the sql database and that's why I thought that this article would do the
trick.
I setup DC with 50000 and created all the protocols and access rules. I
then went to my web server and tried to add that machine to the domain.
I received :
The following error occurred when DNS was queried for the service
location (SRV) resource record used to locate a domain controller for
domain INTERNAL.CISMIC.COM:
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for
_ldap._tcp.dc._msdcs.INTERNAL.CISMIC.COM
Common causes of this error include the following:
- The DNS SRV records required to locate a domain controller for the
domain are not registered in DNS. These records are registered with a
DNS server automatically when a domain controller is added to a domain.
They are updated by the domain controller at set intervals. This
computer is configured to use DNS servers with following IP addresses:
172.16.0.2
- One or more of the following zones do not include delegation to its
child zone:
INTERNAL.CISMIC.COM
CISMIC.COM
COM
. (the root zone)
For information about correcting this problem, click Help.
Could all this be a split DNS issue? If so, It would be nice to see some
actual diagrams included with an update to this article that would help
solve this stuff.
Thank you,
Joseph Kravis and not Kravitz(to be fixed in next printing of your
book??) <grin>
I've been trying to trouble shoot this issue for awhile before asking
the list.
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
tshinder@xxxxxxxxxxxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
------------------------------------------------------
List Archives: http://www.webelists.com/cgi/lyris.pl?enter=isalist
ISA Server Newsletter: http://www.isaserver.org/pages/newsletter.asp
ISA Server FAQ: http://www.isaserver.org/pages/larticle.asp?type=FAQ
------------------------------------------------------
Other Internet Software Marketing Sites:
World of Windows Networking: http://www.windowsnetworking.com
Leading Network Software Directory: http://www.serverfiles.com
No.1 Exchange Server Resource Site: http://www.msexchange.org
Windows Security Resource Site: http://www.windowsecurity.com/
Network Security Library: http://www.secinf.net/
Windows 2000/NT Fax Solutions: http://www.ntfaxfaq.com
------------------------------------------------------
You are currently subscribed to this ISAserver.org Discussion List as:
josephk@xxxxxxxxx
To unsubscribe visit http://www.webelists.com/cgi/lyris.pl?enter=isalist
Report abuse to listadmin@xxxxxxxxxxxxx
Other related posts:
