IPSec between DC's

CoryS

Is setting up any IPSec policies between Domain Controllers ideal, recommended? Would this be redundant? Hold my hand as I walk down this unfamiliar concept. Thanks!

dtlokee

It would depend on the situation. If the domain controllers are connected over private leased lines, it may not be needed, if you're using VPNs over the Internet that are already encrypted, again it may not be needed. As long as the additional overhead isn't too much for the servers then go for it. In most cases it is overkill but I understand the desire to secure the domain controller to domain controller replication as well as the GC - GC replication traffic.

CoryS

awesome thanks for the reply, my understanding was that there was already some form of encapsulation going on between DCs (may or may not be true) and as you mentioned this idea came about as an additional step for security of this kind of traffic. The DCs will reside in the same physical site behind cisco and microsoft firewalls. I just wanted to error (network ****) on the side of security.

Again thanks for the reply.

Ahriakin

As long as you are also using Active Directory Integrated for your DNS then I wouldn't worry too much. AD is already RC4 encrypted by default, not the strongest cipher in the world but certainly strong enough to be considered secure on a normal network. If you are not using AD Zones for DNS then I would at least setup an IPSEC policy for Zone Transfers (if you can't migrate to AD Zones natively for some reason).

CoryS

Good deal, thanks for the quick confirmations and advice.

When I need solid security advice this is my first forum stop now, I used to be all over many registered forums but consistantly this place provides top notch advice from dedicated professionals.

Cheers,
Cory