Printable View
Hi all. I have a small office with a few domain client PCs. The DCs are
housed in my main office. The small office is located in another location
away from the main office and both offices are connected using a lease line.
We are using a firewall to restrict traffic coming from the small office into
the main office. Hence i would like to know what port should i open to allow
the domain PCs in the small office to be able to authenticate to the DC upon
logon. Thks in advance.
In news:77C5F8C7-CC7F-4AB5-824E-4D256BE7AF2C@microsoft.com,
inenewbl <inenewbl@discussions.microsoft.com> typed:
> Hi all. I have a small office with a few domain client PCs. The DCs
> are housed in my main office. The small office is located in another
> location away from the main office and both offices are connected
> using a lease line. We are using a firewall to restrict traffic
> coming from the small office into the main office. Hence i would like
> to know what port should i open to allow the domain PCs in the small
> office to be able to authenticate to the DC upon logon. Thks in
> advance.
There are about 29 ports, including UDP >1023 all inclusive. Your better bet
is to create a wide open VPN tunnel between your hardware firewalls, that is
if they are capable of doing so. This way they will connect the two offices
by their internal subnets and not thru the firewall. And if you are using
NAT, you will NEED a VPN because necessary traffic CANNOT traverse a NAT
unless using a tunnel based VPN that uses the NAT devices as the endpoint.
If you really want to know what ports they are, here you go. But I think it
will swiss cheese the firewall with too many ports opened.
Active Directory Replication over Firewalls
http://technet.microsoft.com/en-us/l.../bb727063.aspx
--
Regards,
Ace
This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.
Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
MVP Microsoft MVP - Directory Services
Microsoft Certified Trainer
For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.
Infinite Diversities in Infinite Combinations
Hi Ace,
Thk you for the reply.
Your website seems to be for win2000 server, can it be applied for win2003
as well? My DC is of win2003.
"Ace Fekay [MVP]" wrote:
> In news:77C5F8C7-CC7F-4AB5-824E-4D256BE7AF2C@microsoft.com,
> inenewbl <inenewbl@discussions.microsoft.com> typed:
> > Hi all. I have a small office with a few domain client PCs. The DCs
> > are housed in my main office. The small office is located in another
> > location away from the main office and both offices are connected
> > using a lease line. We are using a firewall to restrict traffic
> > coming from the small office into the main office. Hence i would like
> > to know what port should i open to allow the domain PCs in the small
> > office to be able to authenticate to the DC upon logon. Thks in
> > advance.
>
> There are about 29 ports, including UDP >1023 all inclusive. Your better bet
> is to create a wide open VPN tunnel between your hardware firewalls, that is
> if they are capable of doing so. This way they will connect the two offices
> by their internal subnets and not thru the firewall. And if you are using
> NAT, you will NEED a VPN because necessary traffic CANNOT traverse a NAT
> unless using a tunnel based VPN that uses the NAT devices as the endpoint.
>
> If you really want to know what ports they are, here you go. But I think it
> will swiss cheese the firewall with too many ports opened.
>
> Active Directory Replication over Firewalls
> http://technet.microsoft.com/en-us/l.../bb727063.aspx
>
> --
> Regards,
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
> MVP Microsoft MVP - Directory Services
> Microsoft Certified Trainer
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> Infinite Diversities in Infinite Combinations
>
>
>
"inenewbl" <inenewbl@discussions.microsoft.com> wrote in message
news:F4F6267D-D1EC-4F03-8B78-2CE440841F6C@microsoft.com...
> Hi Ace,
>
> Thk you for the reply.
> Your website seems to be for win2000 server, can it be applied for win2003
> as well? My DC is of win2003.
They are largely the same. Win2003 has some very nice additional
featurs but 2003 and even 2008 are not major departures from Win2000.
> "Ace Fekay [MVP]" wrote:
>
>> In news:77C5F8C7-CC7F-4AB5-824E-4D256BE7AF2C@microsoft.com,
>> inenewbl <inenewbl@discussions.microsoft.com> typed:
>> > Hi all. I have a small office with a few domain client PCs. The DCs
>> > are housed in my main office. The small office is located in another
>> > location away from the main office and both offices are connected
>> > using a lease line. We are using a firewall to restrict traffic
>> > coming from the small office into the main office. Hence i would like
>> > to know what port should i open to allow the domain PCs in the small
>> > office to be able to authenticate to the DC upon logon. Thks in
>> > advance.
>>
>> There are about 29 ports, including UDP >1023 all inclusive. Your better
>> bet
>> is to create a wide open VPN tunnel between your hardware firewalls, that
>> is
>> if they are capable of doing so. This way they will connect the two
>> offices
>> by their internal subnets and not thru the firewall. And if you are using
>> NAT, you will NEED a VPN because necessary traffic CANNOT traverse a NAT
>> unless using a tunnel based VPN that uses the NAT devices as the
>> endpoint.
>>
>> If you really want to know what ports they are, here you go. But I think
>> it
>> will swiss cheese the firewall with too many ports opened.
>>
>> Active Directory Replication over Firewalls
>> http://technet.microsoft.com/en-us/l.../bb727063.aspx
>>
>> --
>> Regards,
>> Ace
>>
>> This posting is provided "AS-IS" with no warranties or guarantees and
>> confers no rights.
>>
>> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT,
>> MVP Microsoft MVP - Directory Services
>> Microsoft Certified Trainer
>>
>> For urgent issues, you may want to contact Microsoft PSS directly. Please
>> check http://support.microsoft.com for regional support phone numbers.
>>
>> Infinite Diversities in Infinite Combinations
>>
>>
>>
In news:uuyrQzPsIHA.1236@TK2MSFTNGP02.phx.gbl,
Herb Martin <news@learnquick.com> typed:
> "inenewbl" <inenewbl@discussions.microsoft.com> wrote in message
> news:F4F6267D-D1EC-4F03-8B78-2CE440841F6C@microsoft.com...
> > Hi Ace,
> >
> > Thk you for the reply.
> > Your website seems to be for win2000 server, can it be applied for
> > win2003 as well? My DC is of win2003.
>
> They are largely the same. Win2003 has some very nice additional
> featurs but 2003 and even 2008 are not major departures from Win2000.
I agree!
Ace