Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am working on a client's PCI compliance. One of the failing items is:

3.1.5. ISAKMP Allows Weak IPsec Encryption Settings (ipsecweakencryptionsettings)

The solution given is: "Modify the ISAKMP settings to only allow secure encryption algorithms to be negotiated."

Can someone please give something a little more detailed on how I might fix this issue?

OS is SBS2011, with Exchange 2010, IIS 7.5

share|improve this question
    
Are you using your server as a VPN end point? What did you find when you searched for this on Google? What part of what you found didn't you understand. It is important that you expend some effort on your own doing your homework before you ask a question so you can as a question that is actually useful. –  Zoredache Jul 30 '12 at 23:21
    
Not using the VPN, though it looks like the router's VPN (Ipsec specifically) settings are the issue. Sorry if it looks like I didn't do any homework, but I have been going over a PCI scan failure list as long as my arm for the last 5 hours, researching and resolving items. So ya, I was kinda looking for a few easy answers at the end of the day. Thanks! –  Aegyptus Jul 30 '12 at 23:48
add comment

2 Answers

up vote 1 down vote accepted

You fix this by going to the device or server that serves up your VPN tunnel and "[modifying] the ISAKMP settings to only allow secure encryption algorithms to be negotiated." It probably allows weaker encryption options to be used for legacy support, so you turn that off. It's really starting to sound like you're way out of your depth with this client, honestly.

Not that I want to sound like too much of dick or parrot back the question information at you, but it's really as simple as changing the settings on your VPN tunnel to enforce stronger crypto (more modern algorithms and/or longer keylengths). This might even be as simple as disabling support for DES, which is a common standard from many years ago, that's incredibly insecure now.

It doesn't seem like this would would be found on your SBS/Exchange server (though I've seen stranger things), and I'd suggest looking at the routing gear first, in particular, any firewall or edge equipment that might be being used as the connection point for VPN users, where the VPN tunnel would be negotiated.

share|improve this answer
    
Its on the router, got it, thats all I needed, thanks! –  Aegyptus Jul 30 '12 at 23:44
add comment

Disable DES and MD5​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.