Here's my infrastructure configuration:
- All servers have public IP
- I've setup a GPO to enable IPSec on everyone of them with a "require for inbound and request for outbound" rule, for all server, with the default Authentication.
- Except for the Active Directory server which is on "request/request" because it won't work with "require/request".
My first question is: why do I have to setup the AD Server on "request/request" ? Is it because I use the default Authentication method which is based on Kerberos?
My second question is: is it really safe to go this way ? From my perception the AD is not protected at all by IPSec, so it is vulnerable, right? Is it that dangerous or not?
My third and last question: what do you guys think it's the best way to go to have a full IPSec domain isolation policy on Windows Server ? I was really happy about this technology until I found that the AD was not secured at all...
Thanks for your time!