DCE-RPC for Active Directory Traffic

[ataro]

I am using Fortigate Firewalls between Windows clients and domain controllers. In this case by allowing DCE-RPC, does the firewall allow the required return sessions without allowing dynamic port range? What are the requirements like firmware, IPS etc?

[sjoshi]

Hi ataro,

You may refer below article:-

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DCE-RPC-session-helper/ta-p/198374

[ataro]

As per the article it seems like FG will allow dynamic traffic. Is there anyone practically implemented this for Windows systems between Domain Controller and Clients? That is, without allowing dynamic port range, all functionalities work fine for Active Directory?.

[funkylicious]

from my experience, using the service group built-in/default Windows AD is enough for devices to communicate with the DC.

[ataro]

Please share the port list of default WIndows AD Group

[funkylicious · Accepted solution]

config firewall service group
edit "Windows AD"
set member "DCE-RPC" "DNS" "KERBEROS" "LDAP" "LDAP_UDP" "SAMBA" "SMB"
next
end

L.E. i think once or twice i had to create a custom port range, 1024-65535 for TCP , but if any other ports are required, usually you can catch them in a deny rule which logs traffic or doing a debug.