Re: not able to browse domain

From: Steven L Umbach (n9rou_at_nospam-comcast.net)
Date: 11/02/05 

Date: Wed, 2 Nov 2005 16:55:54 -0600

If you are in a domain you need to make sure that your domain controllers
are exempt from the ipsec policy because domain controllers can not use
ipsec to communicate with domain member computers and even an ipsec request
policy will cause problems. Even a properly configured ipsec policy can
cause some problems since there is lag involved in setting up the security
associations or if the initial attempt to use ipsec fails because the
computer trying to access it does not have an ipsec policy that will allow
ipsec to be used such as a client/respond ipsec policy. The lag time can
cause some communications to fail. There is an excellent resource on
troubleshooting ipsec in the ipsec domain isolation guide in chapter 7 at
the link below. --- Steve

http://www.microsoft.com/technet/security/topics/architectureanddesign/ipsec/ipsecch7.mspx

"Bill" <Bill@discussions.microsoft.com> wrote in message
news:47626383-8DC2-45B9-8EF6-E42400753CB0@microsoft.com...
>I have a file server, 2003 sp2, that has backup software and a tape drive
>we
> want to use to backup another server. This file server is unable to
> browse
> the network to add that server through the backup application or through
> network neighborhood. It's only when I remove the "server request
> security"
> IPSec policy that it is able to browse the network. Does anyone know why
> this behavour might be occurring?
>
> Thank you

Relevant Pages

  • Re: Securing the communication between all workstations in a domain
    ... I am no expert at Ipsec. ... I would try using the server (request ... security) policy in that OU - the secure policy is rather extreme and can ... exempt the domain controllers from ipsec traffic - a request policy may work ...
    (microsoft.public.win2000.security)
  • Re: RE: Front End/Back End communication
    ... and stick that in your DMZ. ... your internal mail server. ... If you are thinking about IPSec policies in Windows then you have to ...
    (Focus-Microsoft)
  • Re: IPSec / domain isolation: confusing MS documents
    ... right for access this computer from the network will not work for computer ... If the domain controllers are Windows 2003 I would use Software ... If anyone has another idea how to protect the file server ressources on ... Windows XP systems at a customer location with IPSec. ...
    (microsoft.public.windows.server.security)
  • Re: RE: Front End/Back End communication
    ... between FE/BE via IPSEC then IF the front end server is compromised then ... If you are thinking about IPSec policies in Windows then you have to ... Depending on the attack options (did the attacker ...
    (Focus-Microsoft)
  • Re: IPSEC Problems
    ... You may want to try and rebuild the ipsec policy. ... ipsec negotiation traffic between domain members and domain controllers as ... > this server and any communication was shown correctly in ipsecmon. ...
    (microsoft.public.windows.server.security)
Quantcast