IPSec experience in internal networks

I have been reading documentation on enabling IPSec on AD environment via
group policies (client-to-client, server-to-client, server-to-server).

In general, for a 3,500+ PCs environment, with 120 Win2000/Win2003 servers,
what would be the maintenance involved when enabling IPSec ?
Do you think that encrypting data internally with IPSec is that something
organizations are really doing successfully these days ?

Steve
Mon Nov 08 13:44:24 CST 2004

These questions are not necessarily related.

You are not required to encrypt if you choose to implement IPsec. You can
use ESP with null encryption (specified in RFC 2410) and use NAT-T.

It's perfectly viable. We use ESP with and without encryption for 50+
thousand users here at Microsoft.

Your biggest maintenance headaches will vary. Usually, there is a spike in
helpdesk calls related to the IPsec rollout. This is normal (as it is with
any change across the enterprise) and after the helpdesk and user base
normalize, the calls should return to pre-rollout levels.

The beauty of IPsec transport mode is that it can be made nearly transparent
to the user. Unless you have a watch and start timing things like "fall
back to clear" you'll have a hard time knowing it is running.



"Marlon Brown" <marlon_brown@hotmail.com> wrote in message
news:uJz0pncxEHA.3224@TK2MSFTNGP14.phx.gbl...
>I have been reading documentation on enabling IPSec on AD environment via
> group policies (client-to-client, server-to-client, server-to-server).
>
> In general, for a 3,500+ PCs environment, with 120 Win2000/Win2003
> servers,
> what would be the maintenance involved when enabling IPSec ?
> Do you think that encrypting data internally with IPSec is that something
> organizations are really doing successfully these days ?
>
>