ADFS - move productive WAP to DMZ

Question

Hello community,

A customer has an existing ADFS farm with 2 WAP servers. The WAP servers were installed in a DMZ network but as domain members and then configured for WAP.

My task is to take the two WAP out of the domain.

My first consideration was the following:

• Take the WAP servers out of the domain
• put the name and IP of the ADFS and the redundant WAP in the hosts file.
• add the name and the IP of the WAP servers in the DNS

Is that it? Or have I not considered something?

Do I have to proceed differently for this project?

Greetings

Chris

Answer 1

Hi @Anonymous

Before moving WAP server to DMZ zone , you should check if :

• Certificate and CRL settings is ok
• Required network ports is opened as mentioned in the following link Best practices for securing Active Directory Federation Services
• DNS resolution still working after the move to DMZ (modify Host file or create static DNS record)

You can follow this link if you need to reinstall WAP proxy service correctly : How to install and configure Web Application Proxy for ADFS

Please don't forget to mark helpful answer as accepted