Lockdown network access to non-production PCs

If you have non-production machines connected to your LAN, you can lock them out by using IPSec authentication header.

I was recently employed by a client to try and find a way to stop their developers from connecting to their production LAN. They had just deployed a 10,000 seat Win2k environment and fully standardized on server and client builds. The new environment is very tightly controlled with proper procedures (change management, etc.) for everything. They have very tight group policy control on desktops as well. So, they just deployed a nice shiny new environment and had full control -- or so they thought!

They found that their developers could still connect to their production environment with their "non-standard" PCs. Developers had autonomy to install whatever OS they wanted on their PCs in order to simulate their client's environments for full product testing. The IT team were worried about viruses and access control, among many other concerns. So how could the client's IT team stop these non-production machines from accessing production servers?

The answer was IPSec. We locked them out from a whole range of servers by using IPSec -- authentication header. You can't install IPSec on a Windows 2000 domain controller, but that wasn't too much of an issue since the domain controllers were dedicated controllers, and had no file/print sharing or other services.

To save overhead on the network and servers we didn't configure encryption -- we just used the authentication feature of IPSec.

So, install & configure IPSec on the servers you want to protect, but be careful not to include domain controllers -- and don't configure encryption to save the overhead.

Click here for more information.

This was first published in November 2002

There are Comments. Add yours.

TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.