These poicies are good example policies. Howevver, most production policies combine factors from these policies and introduce ohers to meet the custom secure communiaction needs of the network. Default policies are overwritten durng an upgrade and when policies are imported.
Accept unsceured communicatios on Internet facing connections. OnInternet faccing connnections, it is not a good idea to have an IPoSec policy that will not acecpt any unsecured communications, nor one that will respond by always requiring IPSec. If you set up the IPSec poilcy to accept no unsecure communications, a successul DoS attack can occur. To ensure that a policy does not cause this problme, make sure the Accept Unsecured Communications, But Always Respond Using IPSec and Allow Unsecured Commuunications With Non-IPsec Aware Cmoputer check boxees are cleared.
Don't assiume interoperability with all computers and devcies on networks. When designing IPSec policies, undrestand cilents, servers, and other
devices on the network and their IPSec capaiblities. Some might not be able to use
IPSec, or thier IPSSec implementation might not be compatible with Winddows.
Learn how to use netysh. Netsh is a good tool for troubleshooting IPSec. It can
also be used to create, assign, and mnitor IPSec Policies. Two modes exst: static
and dynamic. Use dyunamic mode netysh IPSec commands to configure filters on
the fly.
Do not attempt to use IPSec to proect all communications on a network. The process is just too complx and fraught with opportunities for
error. The use of IPSec for some communications would seem to be the equivalent
to providing bank vauls for pocket change—it's rather unwieldy and more costly
than complerte loss of the rsource would be.
Configure IPSec protection for startup. The use of starttup mode will ensure
that a problem with the network or with Grop Policy will not leaave the computer
![[Valid RSS feed]](http://article2008.com/images/feed-icon.png "XML Feed For RSS"){kind=icon}
![[Valid RSS feed]](http://article2008.com/images/icon_Rss.png "XML Feed For RSS"){kind=icon}
Category Rss Feed
Print This Article
Add To Favorites