Learning Windows Server 2003

IP Security

IPSec is designed to secure traffic at the IP layer, transparently to the other layers and applications. By operating at such a low level, user applications and protocols that the OS uses need not be concerned with how security is applied; they can act normally, and the application of IPSec is taken care of on an entirely separate level. IPSec addresses the weaknesses in the plain IP protocol by providing:

• Authentication of hosts before and during communications

• Confidentiality through encryption of IP traffic

• Integrity of IP traffic by identifying modified or spoofed traffic

• Prevention of replay attacks

You might be wondering how VPNs differ from the use of IPSec. If you are concerned only with securing traffic to and from a destination, there is little difference between the use of IPSec and the use of VPN. VPN, however, comes with its own support burden, both on the end user and on the administrator, and in some cases VPNs are just too much to add to an administrator’s current workload. On the other hand, VPNs also enable more complete functionality such as file sharing, browsing on the destination network, and other features that more closely mimic a “local” connection at the destination network. IPSec, meanwhile, supports only security features and does not add any of this type of functionality, and although the processor is pegged a bit more on both the client and server end because of the encryption and decryption routines, it has less of an effect on system ...