|
mserafine -> RE: ipsec & SMS (5/11/2008 11:09:48 PM)
|
Establishing IPSec tunnels for the site servers is all done outside of SMS, so there really isn't anything that needs to be done differently from the usual process of setting one up.
If there's a firewall between the two endpoints, you'll want to make sure that TCP ports 50 and 51, as well as UDP 500 are open. TCP 50 is for Encapsulating Security Protocol (ESP) traffic. TCP 51 is for Authentication Header (AH) traffic. And UDP 500 is for Internet Key Exchange (IKE) negotiation traffic.
When you only have a handful of servers that you need to tunnel, you can get away with using local IPSec policies w/o things getting too much of a hassle to administer. Otherwise, centralize the tunnel configurations within a group policy.
For authentication, the securest method is using certificates, but if you don't have a PKI infrastructure, use Kerberos. Using preshared keys for authentication isn't recommended because the key value is stored in plain text within the IPSec policy, and anyone with sufficient privileges or a system service with Local System user rights can read it.
|
|
|
|
