topic Re: Restrict Access to MS Active Directory Services in Firewall and Security Management

Restrict Access to MS Active Directory Services

s_milidrag — Sun, 28 Oct 2018 07:41:37 GMT

Hello,

I would like to know what Service object do you prefer to use to restrict access to Active Directory services.

In Application Control Blade there is a Application signature "Active Directory"

policy rule:

Or do you prefer to place in Service & Application column all needed services:

Which one is the more secure ?

Thanks

Re: Restrict Access to MS Active Directory Services

Nick_Doropoulos — Sun, 28 Oct 2018 10:02:42 GMT

The answer would depend on how your LDAP server has been configured. If the server listens on TCP and UDP port 389, which is the default configuration, then you would have to include the following services:

ldap_udp(UDP/389)

ldap(TCP/389)

If your question is about which is the most secure protocol, then the answer would be ldap-ssl(TCP/636) as it will allow LDAP-related traffic to be encrypted.

Once again though, the service selected will depend on your LDAP server's configuration.

Re: Restrict Access to MS Active Directory Services

s_milidrag — Sun, 28 Oct 2018 12:32:02 GMT

Thanks Nicholas,

Thanks you for your answer,

Maybe I was not so clear.

There is Application Signature "Active Directory" which should recognized all Active Directory services (tcp/135, tcp/138, ldap_udp, ldap, Kerberos, nbname ......)

So my question is what is more secure/preferable to use in Services & Applications column:

Thanks

Re: Restrict Access to MS Active Directory Services

PhoneBoy — Sun, 28 Oct 2018 13:54:11 GMT

If an Application Control signature exists, you should use it.

In terms of the ports allowed, they are identical.

The signature does provide extra checking.

Re: Restrict Access to MS Active Directory Services

Ilovecheckpoint — Tue, 30 Jan 2024 13:32:26 GMT

I wish it could work properly, but it doesn't.

I created two rules, the first one allowing active directory application.

The second rules allow all Microsoft services.

The second rule matches more times than the first one.

Finally, I has to open by services.

Does anybody has the expected result?