Re: SQL through a Pix Firewall
From: Mark J. McGinty (mmcginty_at_spamfromyou.com)
Date: 06/17/05
- Previous message: SOHO: "Re: How to control SQL Server 2000 login and logout Method / Event."
- In reply to: jokes54321: "SQL through a Pix Firewall"
- Next in thread: jokes54321: "Re: SQL through a Pix Firewall"
- Reply: jokes54321: "Re: SQL through a Pix Firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Fri, 17 Jun 2005 00:58:02 -0700
"jokes54321" <jokes54321@nospam.com> wrote in message
news:%237zO2WvcFHA.2980@TK2MSFTNGP10.phx.gbl...
> We are implementing a Pix firewall. The database servers will be attached
> to one port of the Pix, the domain controllers attached to another, and
> the clients attached to yet another port. So far the SQL clients can
> access the server using SQL authentication but not Windows authentication.
> What ports do I need to open and to which devices?
>
> I'm not sure how SQL and Windows Authentication work. Does the client send
> its credentials to the server which in turns validates them against the
> domain controllers?
>
> I know the connectivity is there being SQL authentication works.
I assume you mean that cliemts, DCs and SQL servers will be connected to
separate interfaces on the PIX (not ports.) What model PIX do you have?
Are the DCs and SQLs both on "inside" interfaces?
You really don't want to open-up NTLM to untrusted networks, ideally the SQL
and DC boxes would be on the same side of the firewall. But if they're not,
one way to do it would be to allow any traffic between those hosts. (If
there are multiple hosts on either side, hopefully they can be sub-netted
together.)
I don't know specifically all of ports that are involved -- lsass listens to
a boatload of ports, UDP 389, 500, 4500, 464; TCP 389, 500, 1025, 636...
Some are Kerberos, some are LDAP... it's really a mess. Luckily for me,
it's not something I've ever even considered, if I trust a net well enough
to open up NTLM (et al) then I trust it enough to open all ports..
-Mark
> Thanks,
>
> Denny
>
- Previous message: SOHO: "Re: How to control SQL Server 2000 login and logout Method / Event."
- In reply to: jokes54321: "SQL through a Pix Firewall"
- Next in thread: jokes54321: "Re: SQL through a Pix Firewall"
- Reply: jokes54321: "Re: SQL through a Pix Firewall"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
|
