I am trying to configure IPSec between a web and app server in our environment. I want all traffic between these two servers to use IPsec and be encrypted. These servers are on the same domain so i am currently using Kerebos for security, I have also tried pre-defined keys and nothing changed. When I try and ping between the servers I get "Negotiating IP Security" everytime. I have also confirmed that when I change "Require Security" to "Permit" everything works so IPSec is working, I believe its something with my security setup. Under the security tab both servers have the default 3DES keys first and then DES keys. I have also specified tunnel endpoints (the alternate server's IP).

What am I missing? Thanks for any help..


See the following technet topic: Server and Domain Isolation This should tell you more than you ever needed about how to resolve the issue and if necessary you can follow the link that will allow you to download VMs with this enabled to see exactly how this works with working systems.

In a nutshell do not use a preshared key, set up the group, create the firewall rule for the group, enable DSI via group policy. One of the links is also to a lab setup guide that will allow you to create this in a test environment until you fully understand the process.


Sometimes it is easier to configure IPSEC to only be enabled for specific ports (FTP, File transfers, HTTP, Database, etc) instead of configuring it for all ports. Also a pre-shared key is easier to setup than Kerebos. I recommend getting IPSEC to work for just one port like FTP or HTTP and then start adding all the port numbers for services that you want to have encrypted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.