If LAN is legacy, what is the UN-legacy...?
-
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Azure AD doesn't have this issue because Azure AD assumes all networks are untrusted, and as such transmits data only in a secure/encrypted manner to the endpoint.
Now of course this doesn't mean it's impossible for a MITM to get in there, its much more difficult.
ZT is really only useful for systems that don't have their secure communication method already in place. And example would be traditional LAN based AD. By default this communication is not encrypted, so using ZT would provide a level of protection that the LAN does not, while at the same time enabling you to be much more mobile at the same time.
-
@scottalanmiller said:
@JaredBusch said:
@dafyre said:
My biggest concerns about having things like AD on Azure would be that traffic (encrypted or not) being hit by a MITM type attack. It makes your information more vulnerable to that, than if you were, say... Running your business infrastructure on ZeroTier.
Tell me how ZT makes you immune to a MITM?
Or at least less susceptible than Azure AD.
Less susceptible is definitely a better way of stating that.
-
This is an interesting concept. Does anyone have any documentation on this? I'd love to read about what it would take to actually implement something like this.
-
@wirestyle22 said:
This is an interesting concept. Does anyone have any documentation on this? I'd love to read about what it would take to actually implement something like this.
Sadly, no. But it is coming soon
You heard it here first!! -
Oh, we could do a case study pretty easily, though. @ntg does this and has kind of stepped through the "best of breed" network design for a modern company over the years so we are good for that.
I've worked at several companies that have done this, as well, so I have some decent insight into what others are doing, not just one company.
-
@scottalanmiller I have a serious lack of knowledge that I am fervently attempting to make up for so please excuse any misinformation.
Currently we are set-up with a primary Domain and a VM secondary replicated domain at the same site (as well as a few remotely replicated domains for our bigger sites). A file Server, SQL Server using Financial Edge/Blackbaud, A terminal server for remote sites to access e-mail as well as the Network Share, etc. My question would be how would Active Directory look with this? I'm assuming I would I be able to actually connect all of my remote sites to a remote domain with something like this and everything would be managed through the cloud?
Any information at this point is very appreciated
Thank you as always. -
@wirestyle22 I'd like to take a crack at this.
There are three approaches that I can currently see for you.
- LAN/WAN (VPN or dedicated site to site links) to connect all devices "privately" - what you are doing today.
- Pertino/ZeroTier - this would involve installing Pertino/ZT on every device in your environment and using that network to interconnect all of your equipment. The physical network is more or less a way for devices to get on the internet (yes I'm making an assumption here that the SDN will work on the internet) so they can connect to the SDN.
- Use something like Azure AD (only supports Windows 10 endpoints) and other services (OwnCloud/Office 365/DropBox, etc) that assume connections are all coming from untrusted sources and acts according.
-
@Dashrender That makes a lot of sense. Thank you.
Wouldn't every piece of software (especially Financial Edge/Blackbaud--SQL) need to support that? Also, how is this going to access files and run queries? Is it still going to be based on the Local IP/Mac Address or is it going out and then back in? I'm sorry if these are stupid questions.
-
@wirestyle22 said:
Currently we are set-up with a primary Domain and a VM secondary replicated domain at the same site (as well as a few remotely replicated domains for our bigger sites).
I'm assuming that you mean Active Directory domain here?
-
@scottalanmiller Yes sir. Sorry for the lack of clarification.
-
@wirestyle22 said:
@Dashrender That makes a lot of sense. Thank you.
Wouldn't every piece of software (especially Financial Edge/Blackbaud--SQL) need to support that? Also, how is this going to access files and run queries? Is it still going to be based on the Local IP/Mac Address or is it going out and then back in? I'm sorry if these are stupid questions.
Support? sorta. What would be really nice is if every service (your financial package, OwnCloud, etc) all support Azure AD authentication. Then the user would only have to remember one username and pasword.
As for how those systems work, they each would connect to you via a secure tunnel, via TLS, SSH, SSL, whatever... and they would all prompt you for a username and password.
They would all work on a similar principal as the internet at large. Every website you go you, you need to create a secure connection to (hopefully) and then give logon credentials.
-
@wirestyle22 said:
My question would be how would Active Directory look with this?
So the real question is... why would you have Active Directory?
I'm not saying that you can't, but AD is a LAN-based concept. Although Microsoft has already decoupled those concepts in Windows 10 with Azure AD which no longer uses the LAN for AD authentication. But when moving to a new paradigm you often leave things behind. One of the big ones often, but not always, being left behind is AD. Traditional AD has no place in a LAN-less architecture. It requires a LAN (a real one or a LAN-like SDN infrastructure like ZeroTier or Pertino provide, or a complex VPN setup) to work. But there is no reason that AD is a need, lots of businesses don't use AD and increasingly fewer do.
-
@wirestyle22 said:
I'm assuming I would I be able to actually connect all of my remote sites to a remote domain with something like this and everything would be managed through the cloud?
Not really. Maybe as Azure AD becomes more robust. But the idea is moving to a new design, not trying to shoehorn LAN artefacts into a LAN-less system.
-
So this is a somewhat slow migration away from AD as much as possible currently. It's very interesting. I'll have to read some documentation on Azure + Windows 10 as well as Pertino/ZeroTier.
Thank you both for all of the information provided. I really appreciate it.
-
If you're considering moving away from AD completely, might as well move away from Windows completely.
-
@Dashrender If only I could. I'd much rather be learning Red Hat right now but my hands are tied. Some of our users do not retain the information provided or understand concepts unfortunately (typically the much older employees) and with the medical documentation they are expected to do now I just can't ever see my executive director approving it.
-
@wirestyle22 said:
@Dashrender If only I could. I'd much rather be learning Red Hat right now but my hands are tied. Some of our users do not retain the information provided or understand concepts unfortunately (typically the much older employees) and with the medical documentation they are expected to do now I just can't ever see my executive director approving it.
As you can move more and more things to cloud/web based services, the easier that will be in the future. Once you don't have the need for any locally installed apps, you could probably move to pure iPads, or some other tablet or a Chromebook, etc.
Printing is the bane of my existence in these cases.
-
@scottalanmiller said:
@wirestyle22 said:
My question would be how would Active Directory look with this?
So the real question is... why would you have Active Directory?
Actually @scottalanmiller -- My question would be why would you NOT want AD -- or any other centralized authentication platform -- especially if your organization is large enough to need active directory?
-
@dafyre said:
Actually @scottalanmiller -- My question would be why would you NOT want AD -- or any other centralized authentication platform -- especially if your organization is large enough to need active directory?
Cost. Complexity. AD ties you to a costly infrastructure. It means that you are paying for servers, CALs and more per user. It means you have to manage internal DNS. I means that you have to either design your entire business around very limited use cases and/or you have to do things like Pertino or ZeroTier or built a hub and spoke VPN model or similar to make people able to connect.
It's starts off easy enough, we want password management. Makes sense. But it comes with a lot of caveats: cost, complexity, performance impacts, overhead, connectivity issues. AD made tons of sense in its time, and it still makes an awful lot of sense a lot of the time. But I think that many businesses overlook just how many other decisions are made, or assumptions are made, based around AD. Remove AD, and suddenly you have a lot of freedom to consider different things. AD might be impacting you more than you think.
-
@scottalanmiller said:
@dafyre said:
Actually @scottalanmiller -- My question would be why would you NOT want AD -- or any other centralized authentication platform -- especially if your organization is large enough to need active directory?
Cost. Complexity. AD ties you to a costly infrastructure. It means that you are paying for servers, CALs and more per user. It means you have to manage internal DNS. I means that you have to either design your entire business around very limited use cases and/or you have to do things like Pertino or ZeroTier or built a hub and spoke VPN model or similar to make people able to connect.
It's starts off easy enough, we want password management. Makes sense. But it comes with a lot of caveats: cost, complexity, performance impacts, overhead, connectivity issues. AD made tons of sense in its time, and it still makes an awful lot of sense a lot of the time. But I think that many businesses overlook just how many other decisions are made, or assumptions are made, based around AD. Remove AD, and suddenly you have a lot of freedom to consider different things. AD might be impacting you more than you think.
I should have clarified in my last comment that I was speaking to using Azure AD, instead of a local instance.
IE: If AD ads all that complexity, why is NTG Using it?
