Is it possible to use Microsoft's "Secure Connection Rules" (IPSec) with VPN?
Is it possible to use Microsoft's "Secure Connection Rules" to authenticate/encrypt connections while using VPN at the same time?
What are the configurations necessary?
It should look like this:
Client A <-- VPN --> VPN Gateway <-- LAN --> Client B
FTPd <------------- IPSec -------------> FTP
(I know there are other ways to secure FTP, I just use it for testing)
Thanks
Update 1:
To clarify the objectives:
- Traffic in the LAN should be authenticated and have integrity, but should not be encrypted (because of the IDS)
- Traffic passing the internet or other strange networks should have confidentiality
Solution 1:
IPSec policies are applied based on source/destination addresses, so they should just not care about where the traffic is actually flowing; so, yes, applying them to computers whose communications happens via a VPN should work.
But why would you need such a thing, when you can encrypt the VPN itself?
Edit:
In order for IPSec to work, some traffic needs to flow between the involved machines:
- UDP port 500
- UDP port 88 (if you're using Kerberos authentication)
- IP protocols 50 and 51
More info here.
I don't know if this can be achieved through a VPN... the low-level IP protocols look very much like a possible problem here.