Background - "Extranet"
We have about a dozen users that are on what I would call an Extranet. It is an air-gapped LAN that is physically in the same location as our primary LAN. We share the Extranet LAN with a sister agency which is in another building and while we own the equipment they administratively manage the actual routers and switches. Once the connection leaves our building it travels through our sister agency's infrastructure where our user's traffic is mingled with with their user's traffic. Finally it is routed out to a financial institution's network via a dedicated circuit so all of our users can do financial stuff. We have informal and formal agreements in place with both our sister agency and the financial institution which include these restrictions:
- To limit Internet usage of our users to a reasonable amount since they are using our sister agency's Internet connection when doing general web stuff
- That we never under any circumstance permit packets to be routed from our primary LAN to the Extranet LAN.
Lack of Manageability: Extranet or Extra Headache?
The Extranet computers are on what is more or less an air-gapped DMZ, they are not managed with Active Directory and get their file, printer and WSUS services from a standalone rackmount server. This limits the manageability of their computers. Restriction #2 requires us to go to some contortions to perform backups and general administrative work. This was all well and good when that division had IT staff but now they do not (YAY! Budget Cuts!). My supervisor and I agree the best way to move forward would be to move them over to our existing platform/s wherever possible so we are only maintaining one system and not two or three.
There is an additional Disaster Recovery and Business Continuity concern. The standing plan is essentially to take a LTO tape containing backups and go somewhere and then recover the data and away we go. My supervisor and I both agree there is some detail that is missing from this plan before it is workable. It would be nice to address this concern along with the file services at the same time.
Last but not least... financial stuff is time sensitive and important. As in millions of dollars worth of important. Standardization, reliability and security of their computers and the Extranet LAN is a requirement, even more so now that we do not have IT staff that can be on-site during the initial hours of their shift who could immediately respond to an issue.
The technical requirements of our Extranet users is pretty mundane: Windows 7 workstations, file, print and update services, internet access and a few 3rd party applications provided by our financial partner.
Goals
I want to accomplish the following:
- Eliminate their standalone server and provide file, print and update services through another methodology
- Get some kind of warm standby file services for DR/BC purposes
- Increase our visibility and manageability of their machines
- Do all this without violating our agreements with our sister agency and financial partner
The Actual Question
What kind of combination of technologies and architecture would work for this?
While I know this sounds suspiciously like a shopping recommendation I am doing my best to frame it as an architectural question and avoid the X/Y trap, please feel free to edit as appropriate.
File / Print Services
I can see a number of solutions for the file and print services - I believe that we can just extend the Extranet as a VLAN onto our virtulization platform and then we can eliminate the rackmount server and associated equipment. Unfortunately this does not cover the DR/BC services - I am looking at things like Azure File Storage, an Azure-based Virtual Machine that we use as a DFS target or even OneDrive for Business. I just cannot figure out how to glue these technologies together to address our requirements.
Ideally we could just use some kind "cloud" service for file access but I am concerned with internet usage (restriction #1) and the lack of ability of having a local copy on-network in case of a service outage. I feel like there is "have my cake and eat it too" solution here but I just do not see it.
Visibility and Management
I would, love, love, love to have these computers joined to our Active Directory domain but I cannot see a way to do that considering restriction #2. I have started looking at Active Directory in Azure but admittedly I do not really understand it and it seems just limited to Single Sign-On services. What I really want is a way to get GPOs to those machines and have a central authentication store. I am further limited in that our Active Directory domain is managed by another group so any proposal to "extend it" would be politically and bureaucratically difficult but not impossible. Our AD team is working on an organization-wide Office 365 tenancy which will implement a DirSync of some kind but I cannot see what that would buy me other than OneDrive for Business (which could address file services but not configuration management).
I am currently working on implementing Internet-based Configuration Management which if I can manage the bandwidth issues (restriction #1), I will get some visibility with Hardware Inventory, Windows Updates and 3rd Party Application deployments. Configuration Items are a pretty hacky way to replace Group Policy but I suppose, push comes to shove that would work.
We have a lot stuff available to try an address this problem. A pretty beefy virtualization environment (Cisco UCS, vSphere and NetApp), SCCM, Microsoft Azure, Office 365 (hopefully soon) and just about any Microsoft technology out there we should already be licensed for.
Maybe you guys can see something that I missed.