Web Interface and Administration Console in DMZ Setup

Question

I've got a few questions regarding the setup for the web interface and admin console in the DMZ found here.

1. If we don't want the Admin Console accessible outside the network will leaving this internal affect this configuration at all?

2. How is the Read Only Domain Controller being accessed by Adaxes in the DMZ?

3. Would internal users also hit the RODC in the DMZ or would they use the internal DCs?

Thanks!

Answer 1

Hello,

If we don't want the Admin Console accessible outside the network will leaving this internal affect this configuration at all?

No, you can only install the Web Interface component in the DMZ. There will be no effect on your internal Adaxes configuration.

How is the Read Only Domain Controller being accessed by Adaxes in the DMZ?

The RODC is required to join the computer where Adaxes Web Interface will be installed to an AD domain. Additionally, it will be used by the Web Interface to obtain service connection points (SCPs) for Adaxes service. Operations will be performed through the Adaxes service installed internally which in its turn will connect to an internal DC.

Would internal users also hit the RODC in the DMZ or would they use the internal DCs?

Adaxes service will not have access to the RODC in the DMZ and thus it will always connect to one of the internal DCs. If you want, you can predefine the DCs to be used by Adaxes as described in the following help article: https://www.adaxes.com/help/?HowDoI.ManageActiveDirectory.ManageDomains.SpecifyDCsForDomain.html.

Comments

why is Adaxes component such as Adaxes Service and Adaxes Web Interface has to join domain?

what will the implication, if we deploy web interface in DMZ without RODC? (join domain to internal DC)

---

Hello,

why is Adaxes component such as Adaxes Service and Adaxes Web Interface has to join domain?

This is just how Adaxes works. It is a requirement for all Adaxes components.

what will the implication, if we deploy web interface in DMZ without RODC?

The approach is not recommended as it will require opening additional ports to the internal DCs. For details about the ports used by Adaxes, see https://www.adaxes.com/questions/20/what-ports-does-adaxes-use.