IPsec and DCs

[jamestulloch]

Hi All,

Another request from my cleint is to start a move toward Domain
Isolation by using IPsec to encrypt all traffic between DCs. This
wouldnot include UDP and TCP 53 as all DCs are DNS servers.

Any thoughts? From what I can gather, in domain isolation DC to DC
communication is excepted. But maybe I misread.

Thanks for your input.

James

 

[jamestulloch]

Further to the above. It seems that if Kerberos is used as the
authentication mathod then you need to exempt fromthe IPsec rule any
Kerberos traffic and any LDAP traffic.

If so then why encrypt anything else between the DCs?

 

[jamestulloch]

Hello?

Its all eerily quiet out there.

 

[Roger Abell [MVP]]

Hello?

Its all eerily quiet out there.

Your client is pushing you out into territory few explore, and
from which most likely retreat after a couple experiments.

For one thing, it is probably still true that if you have problems
and try MS support, they will off the top say it is not a supported
config and want to back you out.

 

[jamestulloch]

Roger,

Thanks for that comment, what I might try is going through our MS
account manager to see what they will and will not support.

Cheers

James

 

[Roger Abell [MVP]]

First try a post over in the newsgroup
microsoft.public.windows.server.active_directory