Return
-
Title
Installation of a Coordinator in a DMZ domain behind firewall. -
Description
We are planning to install a new Coordinator server in a DMZ Domain behind a Firewall
We would like this Coordinator to send events through the Firewall to the same Change Auditor Installation/SQL Database as the existing internal Coordinator
-
Resolution
- Ensure the DMZ Server where the Coordinator is installed can connect to the SQL Server over the SQL port default (1433).
It is recommended in this case to use Secured Connection to the SQL Server via Certificate
- It will be required to create an SQL Account on the SQL Server and grant it db_owner rights to the CA database
- During the install of the DMZ Coordinator, specify this SQL Account to connect to the database
Please see the Multi-Forest Deployment section of the Install Guide for more information- Also, please make sure to open Port 389 and 3268 for GC / DC communication
- Agent ports have to be opened from Agent Host in order to reach to CA Coordinator
Note:
While this setup is technically possible, it is not recommended to be used due the inherent lack of security of the DMZ itself
If required by Business needs, please check this with our Sales or Professional Services to avoid security issue