If LAN is legacy, what is the UN-legacy...?
-
@Dashrender said:
Windows can run completely encrypted on the LAN side if you want - enable certs/keys, etc...
Right... and you are just building a complicated, proprietary SDN
-
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
-
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Tell me how ZT makes you immune to a MITM?
-
@JaredBusch said:
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Tell me how ZT makes you immune to a MITM?
Or at least less susceptible than Azure AD.
-
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Azure AD doesn't have this issue because Azure AD assumes all networks are untrusted, and as such transmits data only in a secure/encrypted manner to the endpoint.
Now of course this doesn't mean it's impossible for a MITM to get in there, its much more difficult.
ZT is really only useful for systems that don't have their secure communication method already in place. And example would be traditional LAN based AD. By default this communication is not encrypted, so using ZT would provide a level of protection that the LAN does not, while at the same time enabling you to be much more mobile at the same time.
-
@scottalanmiller said:
@JaredBusch said:
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Tell me how ZT makes you immune to a MITM?
Or at least less susceptible than Azure AD.
Less susceptible is definitely a better way of stating that.
-
This is an interesting concept. Does anyone have any documentation on this? I'd love to read about what it would take to actually implement something like this.
-
@wirestyle22 said:
This is an interesting concept. Does anyone have any documentation on this? I'd love to read about what it would take to actually implement something like this.
Sadly, no. But it is coming soon
You heard it here first!! -
Oh, we could do a case study pretty easily, though. @ntg does this and has kind of stepped through the "best of breed" network design for a modern company over the years so we are good for that.
I've worked at several companies that have done this, as well, so I have some decent insight into what others are doing, not just one company.
-
@scottalanmiller I have a serious lack of knowledge that I am fervently attempting to make up for so please excuse any misinformation.
Currently we are set-up with a primary Domain and a VM secondary replicated domain at the same site (as well as a few remotely replicated domains for our bigger sites). A file Server, SQL Server using Financial Edge/Blackbaud, A terminal server for remote sites to access e-mail as well as the Network Share, etc. My question would be how would Active Directory look with this? I'm assuming I would I be able to actually connect all of my remote sites to a remote domain with something like this and everything would be managed through the cloud?
Any information at this point is very appreciated
Thank you as always. -
@wirestyle22 I'd like to take a crack at this.
There are three approaches that I can currently see for you.
- LAN/WAN (VPN or dedicated site to site links) to connect all devices "privately" - what you are doing today.
- Pertino/ZeroTier - this would involve installing Pertino/ZT on every device in your environment and using that network to interconnect all of your equipment. The physical network is more or less a way for devices to get on the internet (yes I'm making an assumption here that the SDN will work on the internet) so they can connect to the SDN.
- Use something like Azure AD (only supports Windows 10 endpoints) and other services (OwnCloud/Office 365/DropBox, etc) that assume connections are all coming from untrusted sources and acts according.
-
@Dashrender That makes a lot of sense. Thank you.
Wouldn't every piece of software (especially Financial Edge/Blackbaud--SQL) need to support that? Also, how is this going to access files and run queries? Is it still going to be based on the Local IP/Mac Address or is it going out and then back in? I'm sorry if these are stupid questions.
-
@wirestyle22 said:
Currently we are set-up with a primary Domain and a VM secondary replicated domain at the same site (as well as a few remotely replicated domains for our bigger sites).
I'm assuming that you mean Active Directory domain here?
-
@scottalanmiller Yes sir. Sorry for the lack of clarification.
-
@wirestyle22 said:
@Dashrender That makes a lot of sense. Thank you.
Wouldn't every piece of software (especially Financial Edge/Blackbaud--SQL) need to support that? Also, how is this going to access files and run queries? Is it still going to be based on the Local IP/Mac Address or is it going out and then back in? I'm sorry if these are stupid questions.
Support? sorta. What would be really nice is if every service (your financial package, OwnCloud, etc) all support Azure AD authentication. Then the user would only have to remember one username and pasword.
As for how those systems work, they each would connect to you via a secure tunnel, via TLS, SSH, SSL, whatever... and they would all prompt you for a username and password.
They would all work on a similar principal as the internet at large. Every website you go you, you need to create a secure connection to (hopefully) and then give logon credentials.
-
@wirestyle22 said:
My question would be how would Active Directory look with this?
So the real question is... why would you have Active Directory?
I'm not saying that you can't, but AD is a LAN-based concept. Although Microsoft has already decoupled those concepts in Windows 10 with Azure AD which no longer uses the LAN for AD authentication. But when moving to a new paradigm you often leave things behind. One of the big ones often, but not always, being left behind is AD. Traditional AD has no place in a LAN-less architecture. It requires a LAN (a real one or a LAN-like SDN infrastructure like ZeroTier or Pertino provide, or a complex VPN setup) to work. But there is no reason that AD is a need, lots of businesses don't use AD and increasingly fewer do.
-
@wirestyle22 said:
I'm assuming I would I be able to actually connect all of my remote sites to a remote domain with something like this and everything would be managed through the cloud?
Not really. Maybe as Azure AD becomes more robust. But the idea is moving to a new design, not trying to shoehorn LAN artefacts into a LAN-less system.
-
So this is a somewhat slow migration away from AD as much as possible currently. It's very interesting. I'll have to read some documentation on Azure + Windows 10 as well as Pertino/ZeroTier.
Thank you both for all of the information provided. I really appreciate it.
-
If you're considering moving away from AD completely, might as well move away from Windows completely.
-
@Dashrender If only I could. I'd much rather be learning Red Hat right now but my hands are tied. Some of our users do not retain the information provided or understand concepts unfortunately (typically the much older employees) and with the medical documentation they are expected to do now I just can't ever see my executive director approving it.
