IPSec and Group Policy: The Next Step

In "IPSec and Group Policy: A Stronger Defense," August 2002, InstantDoc ID 25730, I discuss how to apply a VPN concept within your network by using IP Security (IPSec) and Windows 2000 Group Policy to protect sensitive network traffic and computers. That article introduces a sample scenario that shows how to lock down communications with a Microsoft SQL Server machine so that only 100 authorized computers can contact the server and so that confidential SQL Server data is encrypted while traveling the network. As I explain in the previous article, you can configure IPSec to use Kerberos, preshared keys, or certificates for initial authentication, depending on your environment and the level of security you want to achieve. For the sample scenario, certificates are probably the strongest—though most complicated—choice. To implement this type of authentication, you need to set up a Certificate Authority (CA), then configure IPSec on the clients and SQL Server system to use certificates to lock down communications. To complete our secure scenario, you need to consider the other doorways into the SQL Server (i.e., ports other than 1433). . . .