Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to configure IPSec between a web and app server in our environment. I want all traffic between these two servers to use IPsec and be encrypted. These servers are on the same domain so i am currently using Kerebos for security, I have also tried pre-defined keys and nothing changed. When I try and ping between the servers I get "Negotiating IP Security" everytime. I have also confirmed that when I change "Require Security" to "Permit" everything works so IPSec is working, I believe its something with my security setup. Under the security tab both servers have the default 3DES keys first and then DES keys. I have also specified tunnel endpoints (the alternate server's IP).

What am I missing? Thanks for any help..

share|improve this question

See the following technet topic: Server and Domain Isolation This should tell you more than you ever needed about how to resolve the issue and if necessary you can follow the link that will allow you to download VMs with this enabled to see exactly how this works with working systems.

In a nutshell do not use a preshared key, set up the group, create the firewall rule for the group, enable DSI via group policy. One of the links is also to a lab setup guide that will allow you to create this in a test environment until you fully understand the process.

share|improve this answer

Sometimes it is easier to configure IPSEC to only be enabled for specific ports (FTP, File transfers, HTTP, Database, etc) instead of configuring it for all ports. Also a pre-shared key is easier to setup than Kerebos. I recommend getting IPSEC to work for just one port like FTP or HTTP and then start adding all the port numbers for services that you want to have encrypted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.