[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [FW1] Citrix/Terminal Server and Hyperion via FW-1
Hyperion is an application used by our company. In order to extend the remote-capabilities of it we are going to be implementing a Windows2000-based terminal server. At the same point in time we will be installing a webserver that has the capability of emulating Citrix in a web browser (using Java, the product is NFuse). We have several scenarios for implementing this system and I'm trying to determine which is a good balance of security and functionality. The biggest problem with implementing this will be that all of the above applications require NT domain authentication. I have several options: (1) Place the webserver on our DMZ. The webserver will need access to our domain controllers for authentication (135 & NBT ports). Once users have authenticated and their Java client is intialized, they will establish a connection DIRECTLY to the terminal server. This would protect the webserver but the terminal server would be exposed to the Internet while it sits on our corporate LAN. Several consultants have recommended this solution to us. (2) Place the webserver and terminal server on our DMZ. This would still require opening ports to our domain controllers for authentication. However, it does seem that this would be a better solution because we can restrict what access the terminal server would have to our internal nets. In either scenerio, the terminal server would need access (on specific ports) to our Hyperion application. I only see merits in the second choice, but for some reason my vendors don't. Do we just allow inbound access to a terminal/Citrix server? It does seem to be common practice from what I have been reading. If there are any documents specifically dealing with Firewall-1 and Citrix, please show me where I can find them! Clayton ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|