Network ports questions

We have an IIS server 6.0/Windows server 2003 sp1 located in the DMZ and
needs to communicate with following servers on the internal network.

A- IIS will be a member of NT domain, on internal network, and needs to be
able to logon to the domain, on internal network, from DMZ

B- IIS needs to authenticate external users accessing it's Web site, against
NT domain on internal network - from DMZ.

A- IIS needs read/write access from DMZ to a MS SQL server 2000, runs on NT
BDC, on Internal network.

What ports should be open at the firewall level to allow these types of
communications IIS on DMZ network to NT domain and SQL server 2000 on
internal network?

Thanks in advance,
Bruno

"Bruno Nemani" <(E-Mail Removed)> wrote in message
news:%23tMN58%(E-Mail Removed)...
> What ports should be open at the firewall level to allow these types of
> communications IIS on DMZ network to NT domain and SQL server 2000 on
> internal network?

Virtually everything you are never supposed to allow. You would be
effectively sticking your LAN out on the Internet uprotected.

Either have the DMZ machine "VPN" back into the LAN to contact the machines
they need to contact,.....OR.....Use ISA's various Publishing features and
put the IIS machines in the LAN instead of the DMZ. You really wouldn't
even need the DMZ anymore and could run the ISA as an "edge" device that
directly faces the Internet.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------

Sorry, with all those acronyms in there I thought I saw an ISA.
None-the-less, whatever firewall you use,...use the comparable features in
your firewall to do one of the two things I suggested.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------

Hi Philip,
Appreciate your feedback and don't worry about the acronyms.
In fact I am building an internal ISA, back-end firewall, server with a
couple of isolated dmz segments. I am hoping I can move the IIS into a dmz
segment behind the back-end firewall and then create access rules or
publishing rules to make these communication happens.

Thanks again for your feedback,
Bruno

"Phillip Windell" <@.> wrote in message
news:(E-Mail Removed)...
> Sorry, with all those acronyms in there I thought I saw an ISA.
> None-the-less, whatever firewall you use,...use the comparable features in
> your firewall to do one of the two things I suggested.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
>
> Deployment Guidelines for ISA Server 2004 Enterprise Edition
> http://www.microsoft.com/technet/pro...isaserver.mspx
> -----------------------------------------------------
>
>
>