IPSec Domain Isolation with Windows Server

Question

I'm looking for a good way to secure my servers, I have a set of dedicated servers that are not in my office but hosted by an external provider. ALL the servers have only one public (WAN) IP.

I don't want to use VPN as my users are not willing to have this constraint, so I went to a Firewall configuration of my Windows Server (through a GPO) to enable IPSec in Domain Isolation.

Every server require a secure connection for in-bound, which from my point of view is pretty much secured.

But one thing bothers me, in order to make the default authentication mode (which involves Kerberos) work in my domain isolation I had to setup the firewall of my DNS/DC server with "Request inbound and outbound" (instead of the default "Required inbound and request outbound"). I guess it's necessary for the Kerberos authentication to work.

Again, from my understanding it leaves the DNS/DC server unprotected by IPCSec (though I don't exactly know what really is "request" as opposed to "required").

My first question is: is it safe enough ? Second question: how could I configure IPSec with the DNS/DC server as protected as the other servers?

Thanks for your time.

Answer 1

IPSEC can be configured using multiple authentication methods. I personally prefer using certificates from my internal CA over Kerberos. There are several devices I deal with (Linux, servers in my DMZ, etc) which would be difficult or impossible to set up with Kerberos. An offline IPSEC certificate request is much easier to work with.

The request statement makes it possible to use IPSEC with falling back to unencrypted traffic available. This is a good first step in starting with IPSEC. The require is exactly that - the traffic must be encrypted with IPSEC in order to be allowed. This is good for your most sensitive systems / services.

There are services, etc which you don't want to be covered by IPSEC. This includes anything public facing or which may need to be used prior the encryption being established. That would include DNS and a few of the AD specific services. I don't have a minimum list of services required to remain permitted unencrypted readily at hand. I'm opting to leave my DCs in request mode until I have the time to track that information back down.