FIM 2010 Active Directory Synchronization over Internet

Hello,



I'd like to ask if FIM Active Directory Management Agents can export AD object data across Internet or will a site-to-site VPN be required?



For example...



I have three forests:

• FIMdomain.com - a separate AD domain for FIM
• ForestA.com - Company A forest with users, no trust or network connection to Company B nor FIMdomain
• ForestB.com - Company B forest with users, no trust or network connection to Company B nor FIMdomain

Goal: To export all users from ForestA and ForestB into FIMdomain. FIMdomain AD will have the consolidated copy of all the users objects from ForestA and ForestB



Question: In order for FIMdomain to export user objects, will I be required to setup trust or private network connection (e.g. site-to-site VPN) to ForestA and ForestB? Or can I connect via Internet and query using LDAPS? Will I be required to configure trusts?



Thank you.