Paul Galvin's (old) SharePoint space [SharePoint

Just another WordPress.com site

Learning the Hard Way — DMZ WFE Must be in a Domain

Although it’s not literally true, as a practical matter, an internet-facing web front end in a DMZ must be in a domain (i.e. not some standalone server in its own little workgroup).  It doesn’t need to be in the same domain as the internal WFE(s) and other servers (and probably shouldn’t), but it needs to be a domain.

My colleagues and I spent an inordinate amount of time on a proposal which included SharePoint pre-requisites.  This included a comprehensive list of firewall configurations that would enable the DMZ server to join the farm and so forth.  Sadly, we failed to add a sentence somewhere that said, to the effect, "the whole bloody point of this configuration is to allow your DMZ WFE server, in a domain, to join the internal farm."

A perfect storm of events, where we basically looked left when we might have looked right, conspired to hide this problem from us until fairly late in the process, thus preventing me from invoking my "tell bad news early" rule.

Sigh.

Subscribe to my blog.

Technorati Tags:

Advertisements

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: