Deploying IPSec

EXAM 70-293 OBJECTIVE 3.3.1, 5, 5.1, 5.1.1, 5.1.2, 5.2.1, 5.3.2, 5.6, 5.6.2

With Windows Server 2003, Microsoft has made it relatively easy to deploy security for transmitted data throughout your organization by using the IP Security Policy Management MMC. However, before you begin to deploy IPSec on your network, you need to do your homework and determine the needs of your particular organization.

Determining Organizational Needs

It is very important to find a balance between protecting unauthorized access to data and choosing to make the information available to the largest group of users. The network administrator’s dilemma is that security and accessibility are always at opposite ends of the continuum, and increasing one inevitably decreases the other.

To determine your organization’s security policy needs, you should take the following steps:

• Assess the risk level.

• Determine the appropriate amount of security for your organization, based on risk level, acceptable risk, and accessibility needs.

• Define security policies that use your risk-management criteria and protect the identified information.

• Determine how you can best implement security policies within your organization.

• Identify the valuable and sensitive information on your network.

• Strive to provide all users with both secure and efficient access to the appropriate resources based on their computing needs.

After you’ve identified your organizational needs, you can begin to configure your policy. Only one policy configuration can be assigned at each of the following levels: domain, site, Organizational Unit (OU), and local level. Each IPSec policy consists of one or more IPSec rules. Each IPSec rule consists of the following:

• Selected filter list

• Selected filter action

• Selected authentication method or methods

• Selected connection type

• Selected tunnel setting

To configure IPSec policy, you can create a new policy, and then define the set of rules for the policy by adding filter lists and filter actions. Alternatively, you can create the set of filter lists and filter actions first, and then create the IPSec policies. Finally, you add rules that combine the appropriate filter list with the appropriate filter action. Additionally, you specify authentication methods, connection types, and tunnel settings.

Security Levels

When you begin to consider security levels within your organization, you must take into account the type of data each computer typically will be processing. For example, the configuration you would need for a Web server is different from the one you would need for a domain controller. When planning to deploy IPSec on your network, take into account the following general guidelines for each type of computing environment:

• Minimal security No sensitive data is exchanged and IPSec is not active by default.

• Standard security This guideline is most appropriate for file servers and similar computers. You need these servers to be secure because of the data that is stored on them, but you need users to be able to access the data without complications. You can implement the Client (Respond Only) option or Server (Request Security) option for your IPSec policies. These policies enforce security when the client supports it, but they are also efficient because they do not require security if the client is not IPSec-enabled.

• High security The computers that need high security are the ones that contain sensitive or valuable data and/or are located in a public network setting. You can implement the Secure Server (Require Security) default policy on these machines. This requires IPSec protection for all traffic being sent to or received from the server (except initial inbound communication) with stronger security methods. Because unsecured communication with a non-IPSec-aware computer is not allowed, the server has a high level of security.