[fw-wiz] Backup exec agent in dmz

From: yehuda (yehuda_at_essutton.com)
Date: 06/10/03

  • Next message: Paul Robertson: "RE: [fw-wiz] Re: SMTP Proxies and Application Proxies for Lotus Domino" 
    To: "'firewall-wizards@honor.icsalabs.com'" <firewall-wizards@honor.icsalabs.com>
Date: Tue, 10 Jun 2003 11:45:17 -0400

    Hi, I was wondering if anyone has ideas or a solution for this problem:

    I'm trying to set up reliable backup of 3 servers in a dmz network: a
    mail/antivirus server, a dns server, and a web server.
    The mail server is running windows NT and the other two are Redhat linux.

    I have a windows 2000 server running backup exec version 9 on the primary
    network connected to a ten thousand dollar tape loader, and I'd rather not
    have to set up a separate backup system for the dmz computers.

    The networks are segmented by a pix 515 with three interfaces, one for the
    inside, one for the outside, and one for the dmz.

    The primary network has unrestricted access to the dmz, but computers on the
    dmz network need specific permission - by ip and port - to connect to
    servers in the primary network.

    I installed the backup exec unix agent on the two linux machines in the dmz.
    According to veritas's website,
    (http://seer.support.veritas.com/docs/243611.htm), I need to open port 6101
    and 1024-65535 both ways, because the unix agent uses rpc.

    I don't have a problem giving dmz machines access to port 6101 on the backup
    server, but I'd rather not give the dmz machines access to 1024-65535 on the
    backup server. The backup server is a domain controller for our active
    directory, as well as an internal ms-exchange mail server. I could filter
    off the listening ports over 1024, but then if I don't keep watching it,
    someone might install an app that listens above 1024, which would then be
    available to the dmz.

    They have a workaround for windows, by reconfiguring dcom and rpc to only
    use specific ports, but it seems from the above-referenced document that
    such an option isn't available for the unix agent.

    Any ideas?
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Paul Robertson: "RE: [fw-wiz] Re: SMTP Proxies and Application Proxies for Lotus Domino"

    Relevant Pages

    • RE: HTTP 404 errors
      ... NIC (network Interface Card) in our configuration. ... "Company Web Page" or to list the backup results in the "Server ... Backup program is functioninng properly, but the part that lists the results ... Server Management -Backup - Monitoring and Reporting ...
      (microsoft.public.windows.server.sbs)
    • Thanks to All Or How I saved my AD
      ... and do rebuild of Windows 2000 Server and Service Packs. ... Explorer 5.5, Backup Exec, Diskkeeper and McAfee. ... But Exchange was unable to Mount ... receiving complaints from all over the network about all kinds of problems. ...
      (microsoft.public.win2000.active_directory)
    • Thanks to All Or How I saved my AD
      ... and do rebuild of Windows 2000 Server and Service Packs. ... Explorer 5.5, Backup Exec, Diskkeeper and McAfee. ... But Exchange was unable to Mount ... receiving complaints from all over the network about all kinds of problems. ...
      (microsoft.public.exchange2000.active.directory.integration)
    • Re: DR procedure per smallbizserver.net
      ... the server logon screen has now appeared and I can ... I suspect thus that the system still thinks there is another network ... before we did we tried to do a restore from our backups ... >> because of our method of backup we were completely ill prepared for a DR ...
      (microsoft.public.windows.server.sbs)
    • RE: fedora-list Digest, Vol 6, Issue 266
      ... Re: OT: Setting up a forwarding mail domain in DMZ without ... Re: Sound Problem ... downloaded the yum.conf for fedora from Redhat's website. ... Server: Fedora.us Extras ...
      (Fedora)
    • Quantcast