IPSec and Group Policy: The Next Step

Editing the IPSec Policy
Now it's time to edit your IPSec policy. On the clients, you need to add an authentication method that permits authentication through a certificate that SqlIPSecCA issues. On the SQL Server system, you need to require authentication through a certificate that SqlIPSecCA issues. To prevent interrupted communications, you need to temporarily enable both the preshared key and certificate authentication methods on the clients and the server. (You can use multiple authentication methods in IPSec policies; Win2K tries each method in the specified order.)

First, configure the clients. Open the Active Directory Users and Computers snap-in, go to the Group Policy tab of the domain root's Properties dialog box, select the Authorized SQL Clients IPSEC GPO, then click Edit. In the Group Policy console, select the Computer Configuration\Windows Settings\Security Settings\IP Security Policies on Active Directory object. In the details pane, select the Authorized SQL Clients policy (I explain how to create and assign this policy in "IPSec and Group Policy: A Stronger Defense") and open the policy's Properties dialog box, which Figure 2 shows. Select the rule in the IP Security Rules window (you'll see only one rule), then click Edit to open the Edit Rule Properties dialog box. Go to the Authentication Methods tab. If you followed the instructions from the previous article, the preshared key authentication method will be listed on this tab. Click Add, select Use a certificate from this certificate authority (CA), then click Browse. Win2K warns you that The Active Directory does not contain a shared certificate store and asks Do you want to select a certificate authority from the local machine certificate store? Click Yes, select SqlIPSecCA's certificate in the Select Certificate dialog box, then click OK. Click OK to close the New Authentication Method Properties dialog box. Click OK to close the Edit Rule Properties dialog box, then click OK to close the Authorized SQL Clients Properties dialog box. In the Group Policy console's details pane, right-click the Authorized SQL Clients policy and select Un-assign. Right-click the policy again and select Assign. These final steps are important because Win2K won't reapply the edited policy to the GPO until you reassign the policy. . . .