IPSec security

  • Thread starter Thread starter Peter
  • Start date Start date
P

Peter

Hi,

Not sure if this is the right group to post in if not maybe someone can
guide me in the right direction, I need a basic answer to a well not so
complexed question but by the time you've finished reading it you might be
as confused as me lol

I have a multi site company that needs to link certain clients to a specific
server, these links although internal to the company need to be encrypted
from other departments, the clients are in building A & B and the server is
in building A

The server is connected to other systems that can not be changed IE SMTP
gateways etc but the system that is running that the clients need access to
needs to be secured, it also has the ability to open files that are on the
server so this would require the ability to use the Microsoft File shareing
services.

The system that needs to be connected to may use various IP ports including
Telnet, so SSH was thought of at this time but this causes a problem when
coming to file and print services via the server, hence IPSec...

There are 2 Routers to pass through so if there is any IP ports that need to
be opened then please advise there also

Thanks

Peter Smith
Microsoft Certified Professional
 
I am not sure I see what you are asking, or outlining . . .
If you mean that when one of a set of client machines connects
to a specific server then all traffic in that interchange is supposed
to be encrypted . . .
then just define IPsec rules so that those client machines and that
server require a hard security association and use of payload
encryption.
 
You can create an ipsec policy and specify that traffic only be encrypted
for particular ports such as 137 UDP, 138 UDP, 139 TCP, and 445 TCP for file
and print sharing. As far as firewalls and routers, ipsec traffic used port
500 UDP and protocols 50 for ESP and 51 for AH [if used]. Be sure to test
out any ipsec policy before implementing and keep in mind that domain
controllers need to be exempt from ipsec negotiated traffic to/from domain
members. --- Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;233256 -- ipsec
ports/protocols
http://support.microsoft.com/kb/254949/EN-US/ -- ipsec and domain
controllers


http://support.microsoft.com/default.aspx?scid=kb;en-us;233256
 
Back
Top