Privileged Access & Session Management in a DMZ or Secure Access Zone

This article provides recommended network architecture guidelines and firewall configurations for deploying the Heimdal Privileged Access & Session Management (PASM) appliance within a DMZ or Secure Access Zone.

The optimal deployment architecture utilizes a single active network interface (NIC) on the PASM appliance. All routing, Network Address Translation (NAT), network segmentation, and access control policies should remain exclusively managed by your organization's firewalls.

1. Recommended deployment architecture
2. Core design principle
3. Why a single NIC is recommended
4. Recommended network approach
5. Firewall requirements & port rules
6. NTP synchronization requirements
7. HTTPS & TLS certificate guidelines
8. Secure Access Zone best practices
9. Step-by-step deployment workflow
10. Pre-production validation checklist
11. Expected operational outcome

RECOMMENDED DEPLOYMENT ARCHITECTURE

Deploy the Heimdal PASM appliance in a dedicated DMZ or Secure Access Zone configured with the following parameters:

• Interface: One active network interface card (NIC)
• Addressing: One static IPv4/IPv6 address with a single subnet prefix
• Gateway & Routing: One default gateway
• DNS: Fully configured internal/external DNS resolution
• Time Sync: Outbound NTP access (UDP 123) to an authoritative time source
• Management: Inbound HTTPS (TCP 443) for administrator portal access
• Access Control: Explicit firewall rules targeting approved internal resources and required Heimdal cloud services

Expected Traffic Flow:

External Administrator → Firewall / NAT → PASM Appliance (DMZ) → Internal Firewall → Approved Target Systems

Note: The PASM appliance must never be configured to act as a router or bridge between the DMZ and internal networks.

CORE DESIGN PRINCIPLE

Heimdal PASM operates as a secure access gateway, not a network router.

Perimeter and internal firewalls must retain full control over defining which networks, target systems, and services PASM is permitted to access.

WHY A SINGLE NIC IS RECOMMENDED

The network stack of the Heimdal PASM appliance is architected around a single-homed interface configuration (single IP, gateway, and DNS configuration). Introducing a second active NIC significantly increases network complexity and introduces operational risks:

• Ambiguous Egress Paths: Multiple interfaces create competing routes for outgoing traffic.
• Asymmetric Routing: Return traffic may attempt to use a different interface, causing firewall drops and broken sessions.
• Complex Routing Tables: Requires manual management of static routes, route metrics, or policy-based routing (PBR).
• Lack of Management Interface: PASM does not feature an onboard interface for configuring or troubleshooting complex dual-homed routing models.

To ensure session stability and predictable traffic flow, Heimdal strongly recommends keeping the PASM appliance single-homed and offloading all routing decisions to your firewall infrastructure.

RECOMMENDED NETWORK APPROACH

Instead of connecting PASM directly to both the DMZ and internal LAN via separate interface cards:

1. Attach a single PASM NIC directly to the DMZ network.
2. Configure a single default gateway pointing to the DMZ firewall interface.
3. Route all internal target network destinations through the DMZ firewall.
4. Enforce strict least-privilege firewall rules for permitted destinations and protocols.
5. Centralize all routing, session logging, and network security policies on the firewalls.

This approach guarantees predictable traffic flow while maintaining strict perimeter separation.

FIREWALL REQUIREMENTS & PORT RULES

Implement a strict deny-by-default firewall strategy, opening only the explicit ports and flows necessary for PASM operations:

Administrative Access Policies

Restrict inbound management access on TCP 443 exclusively to verified administrator IP ranges or management VPN pools. Never expose administrative services (RDP, SSH, or local OS management interfaces) directly to the public internet.

Internal Target Access Control

Restrict outbound traffic from PASM strictly to specific target hosts rather than broad subnets:

Recommended: PASM DMZ IP → Approved Server (192.168.10.50) → TCP 3389
Discouraged:  PASM DMZ IP → Internal Network (192.168.0.0/16) → ANY

NTP SYNCHRONIZATION REQUIREMENTS

Accurate time synchronization via UDP 123 is a mandatory technical requirement for Heimdal PASM. Several core security functions depend directly on precise clock alignment:

• Authentication & Ticket Validation: Clock skew between PASM and identity providers or target systems can cause Kerberos, OAuth, or SAML authentication failures.
• Just-in-Time (JIT) & Session Controls: Temporary access grants, permission expiries, and session durations rely entirely on accurate server time. Time drift can prematurely terminate or unintentionally extend access windows.
• TLS Certificate Trust: Certificate validity periods and cryptographic timestamp validations fail if the server clock drifts outside valid windows.
• Forensic Audit Alignment: Chronological correlation across PASM session logs, firewall logs, domain controller events, and SIEM ingested data requires microsecond-accurate time stamps.

Required NTP Rule:

PASM DMZ IP → Approved Internal/External NTP Server → UDP 123

HTTPS & TLS CERTIFICATE GUIDELINES

Administrative portal sessions must be encrypted using HTTPS with a trusted TLS certificate matching the PASM Fully Qualified Domain Name (FQDN).

Public CA Certificates (Internet-Facing Access)

If administrators connect to the PASM portal over the public internet (without requiring an initial corporate VPN tunnel), use a TLS certificate issued by a recognized public Certificate Authority (e.g., Let's Encrypt, DigiCert) to prevent untrusted certificate warnings on administrative endpoints.

Internal CA Certificates (Private/VPN Access)

An internal Enterprise CA certificate may be used if PASM is accessible strictly via private routing/VPN tunnels and all connecting admin endpoints trust the internal Root CA.

Certificate Best Practices:

• Ensure the Subject Alternative Name (SAN) matches the exact access URL (e.g., pasm.company.com).
• Configure automated renewal alerts prior to certificate expiration.
• Avoid self-signed certificates in production environments as they degrade security posture and disrupt automated endpoint workflows.

SECURE ACCESS ZONE BEST PRACTICES

When hardening the PASM DMZ environment, adhere to the following security controls:

1. Enforce HTTPS with a valid public/private CA certificate.
2. Mandate Two-Factor Authentication (2FA/MFA) for all user and admin accounts.
3. Apply the principle of least privilege to PASM portal roles.
4. Restrict inbound HTTP/HTTPS access to trusted source networks.
5. Explicitly allow-list outbound connectivity on the perimeter firewall.
6. Verify ongoing NTP synchronization with an authoritative time provider.
7. Forward PASM syslog and firewall traffic logs to a central SIEM platform.

STEP-BY-STEP DEPLOYMENT WORKFLOW

1. Deploy or import the PASM virtual appliance and attach a single network interface to the DMZ network segment.
2. Assign a static DMZ IP address, subnet mask, default gateway, and DNS servers. Do not define secondary routes.
3. Configure stateful firewall rules permitting inbound TCP 443 access for admins, outbound DNS/NTP, Heimdal cloud services, and target access (TCP 3389/22) to specific internal hosts.
4. Create an A/AAAA record pointing the designated administrative FQDN (e.g., pasm.company.com) to the PASM DMZ IP (or public NAT IP).
5. Import a valid, trusted TLS certificate matching the configured FQDN into the PASM management portal.
6. Enforce Multi-Factor Authentication (MFA) and configure administrative role permissions.
7. Register internal target endpoints (Windows Servers, Linux Hosts) within PASM and verify matching firewall permit rules.
8. Permit LDAP/LDAPS only when Active Directory integration is used. Where JIT functionality requires LDAPS, configure TCP 636 outbound from PASM to designated Domain Controllers.
9. Verify active time synchronization via UDP 123 using network diagnostic tools.
10. Validate administrative login, MFA execution, certificate trust, DNS resolution, and active RDP/SSH proxy sessions.

PRE-PRODUCTION VALIDATION CHECKLIST

• PASM operates using a single active production NIC in the DMZ.
• Static IP, subnet mask, and single default gateway are verified.
• Routing between the DMZ and internal LAN is entirely managed by firewalls.
• Inbound portal access is restricted to TCP 443 from approved admin networks.
• The TLS certificate is valid, trusted, and matches the PASM FQDN.
• Two-Factor Authentication (2FA) is enforced for all administrative users.
• Outbound UDP 123 NTP access is operational and system time is synchronized.
• Outbound target rules (TCP 3389 / TCP 22) are scoped strictly to authorized endpoints.
• Active Directory / LDAPS connectivity functions correctly (if implemented).
• Heimdal cloud management endpoints are reachable over TCP 443.
• Firewall audit logs show zero unexpected drops or asymmetric traffic patterns.

EXPECTED OPERATIONAL OUTCOME

Upon completing this deployment guide, your Heimdal PASM installation will:

• Be reachable by administrators over trusted HTTPS.
• Use one active network interface in the DMZ.
• Reach only explicitly approved managed resources and services.
• Maintain accurate time using NTP.
• Leave routing, NAT, and segmentation to the customer firewalls.
• Maintain predictable and auditable privileged-access traffic.