0

We have a web server that is on the DMZ but that will need to query a database that resides inside the network. Now the network team wont allow port 1433 from the web server to the Database server. The database server is on the Always on availability group and uses a specific listener port. Now my question is if my network team only allows only the Always on availability group listener port will that be a problem and what if the network team dont allow access to that port what are my options.

1

Now my question is if my network team only allows only the Always on availability group listener port will that be a problem

You can configure an AG Listener to use whatever port you want, and you can configure your application to connect using a non-standard port.

what if the network team dont allow access to that port

A "normal" DMZ has external access to hosts in the DMZ and limited access from the DMZ to the internal network. If the network team won't allow connectivity from the web server to the databse server, you can put the database server in the DMZ or use a cloud hoster instead of a DMZ.

For instance you can use Azure App Service for hosting, and use Azure App Services Hybrid Connections for secure access to on-prem resources

| improve this answer | |
  • "...you can put the database server in the DMZ." triggered dot gif – Peter Vandivier Oct 27 at 15:00
  • You can still have a segmented network inside the DMZ. IE it's quite common in Azure to have front-end and back-end subnets with firewalls between. – David Browne - Microsoft Oct 27 at 15:05
  • You can do anything you want. Putting something sensitive inside a network segment undercuts your rationalisation in calling it a "DMZ" though. It's common to use any-any rules "just for the demo". Doesn't make it right though. – Peter Vandivier Oct 27 at 15:39
  • Right. If it is completely isolated from the internal network, it's not really a DMZ. – David Browne - Microsoft Oct 27 at 15:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.