I'm looking to protect data in transit around the LAN from file servers both Linux and Windows based. I think the correct solution is IPSEC as I want a blanket solution for both types of operating system rather than lots of individual application layer solutions all differing from each other and having higher support overheads. I'm guessing to get a desktop PC to talk to the file server I will need to setup a new vpn style connection (possibly pushed out via Active Directory) and on the server have samba listening on the IPSEC tunnel. Is this achievable with multiple desktops or will this only work for 1 at a time?


IPSEC will work for multiple concurrent desktops.

Your scenario needs some consideration though. VPNs are used when the networks between endpoints are considered public/untrusted. LANs, in general (even after considering VXLANs) are considered already private in the sense that eavesdropping is not considered a big enough threat.

However, if you still consider it a threat, you might consider "detecting and isolating eavesdroppers" using Network Access Control solutions. Do keep in mind that in modern switched LANs, it is not easy for one node on a LAN to listen-in on traffic between any other nodes (barring broadcast traffic). If you consider the network administrator as a threat (they could set up SPAN ports to sniff traffic), that's an exception with its own implications.

So you might want to carefully check whether your threats are real or imaginary - since managing a large multi-node VPN is not a trivial effort. VPNs need both Authentication and Encryption to stay secure. Encryption relatively simpler in the sense that you can set it one time and leave it alone for a long time. Authentication on the other hand, means that you need your endpoint identities to be managed regularly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.