I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?
config firewall service group
edit "Windows AD"
set member "DCE-RPC" "DNS" "KERBEROS" "LDAP" "LDAP_UDP" "SAMBA" "SMB"
next
end
L.E. i think once or twice i had to create a custom port range, 1024-65535 for TCP , but if any other ports are required, usually you can catch them in a deny rule which logs traffic or doing a debug.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
