Internal Network Firewall Best Practice?

[computadorka]

So say for example you have a LAN. This lan is protected by border router and firewalls.

Now internal in the lan we have a department, we can call sales. It is separated from the Main Company Network and assets by an Internal Firewall.

Now obviously the main comany network and domain is very valuable and highly protected. This Sales network has their own domain and different admins.

Now a guy on the main company network needs to work on some sales systems, so requests RDP be opened on the Sales firewall.

He also needs to open 135-139 and 445 for file sharing.

Would you open thos ports? RDP, maybe, but 135-139 and 445? I dont think so.

445 is inherently evil amirite?
That is basically opening the whole windows communication to the Sales network even though it is just 1 IP in the main lan

so what do you think. Open 445 on a firewall even though it is internal?

 

[Nacho]

RDP maybe, 135-139 / 445, no... Too many security risks involved, even though the odds of compromising the primary network being low, it is a risk not needed to be taken.

 

[LoStMaTt]

He can transfer files using RDP's built in Local Resources options.

 

[Ubuntop]

Best practice would be to use RDP over SSL. If the other admin knows what he is doing he can pipe his files through any port you give him.