1

I am currently looking for some best practices installing a SharePoint 2013 farm (two WFEs, one App Server, one OWA, two SQL Server in failover cluster) in a DMZ.

Both farms (internal and the one in the DMZ) shall be completely seperate from each other with one exception: Internal users should access both farms with the same user account.

Am I right that I only need to install an ADFS proxy in the DMZ Or do I need more to achieve this?

Improve this question

2 Answers 2

Reset to default
1

DMZ is poor placement practice for a SharePoint farm. The reason is in a typical deployment you need to authenticate to Active Directory which is most often kept internal. This means there are numerous ports you must open to each DC within the internal network.

The best practice would be to use a pre-auth reverse proxy, such as WAP + ADFS. WAP is the only service that needs to reside in the DMZ.

Improve this answer
2
  • Good point. Would you recommend in my case to implement additionally an "external domain" in the DMZ so all external users are stored there? Internal users are further stored in the internal AD. Commented Feb 26, 2019 at 6:52
  • No. The issue isn't external vs. internal, the issue is that you need to open up numerous ports on the backchannel firewall due to the ports required for the SharePoint servers to be domain members. Instead, just put all SharePoint servers on the internal network. Commented Feb 26, 2019 at 16:09
1

You should also consider using Azure AD Application Proxy instead of the OnPrem ADFS + WebApplicationProxy combination.

AAD-Proxy completely eliminates the need of any inbound ports. It also enables Kerberos-Authentication, which does not bring the bunch of drawbacks that come with ADFS&WAP&SAML.

Improve this answer
1
  • 1
    Unfortunately AAD isn't applicable in this scenario (I tried to get them to Office 365, but no). We're working in a quite picky environment with some special requirements regarding storage and accessability by law. Commented Feb 26, 2019 at 6:47

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.