Setup new dmz

[ful56_uk]

Hello

 

I'm after some advice please.

 

Looking at introducing a dmz. Not sure what best practices are with dmz. Is it good practice to put web servers that are domain joined. Also looking to put remote apps in there as well.

 

We also want to be able to maintain these servers through the domain if possible( like I said not sure if best Practice)

 

Also if we had an external services that needs to use ldaps would I put a rodc in there dmz? Or do I create a new firewall rule that only allows the external service ip to our dc and open up ldaps port only?

 

Currently have one firewall so was going to create the dmz zone there, then connect that port to our core on its own vlan, then add a VM host nic to that vlan. Should I be using two firewalls?

 

Cheers

 

Mark