IPSEC between W2K domain member and W2K stand-alone

[justiono]

Dear All,

I have some doubts, would you please help me to explain:

a. Is it possible to configure IPSec communication between a W2K
Professional (domain member) and W2K Server (stand alone server, not
member of any domain).
b. If so, which certificate server can be used? Standalone root CA in
stand-alone W2K Server?

Many thanks

 

[Roger Abell [MVP]]

a) yes
b) any CA that is trusted for the purpose

Certificates is the reasonable choice, but preshared key would also work.

 

[Brian Komar [MVP]]

a) yes
b) any CA that is trusted for the purpose

Certificates is the reasonable choice, but preshared key would also work.

To further clarify Roger's answer. As long as both servers receive their
IPSec certificate from the same CA (or chain to the same root CA), the
certificate-based auth will work.

Standalone CA will work, but does not have to be on the standalone
server. It can be on a domain member or on a standalone CA.

Are there any other plans for digital certificates in your environment.
Try and not fall into the trap of just setting up CAs for each
application. If you see other certificate uses, plan a proper PKI before
you start setting up "pockets of PKI"

Brian