{"id":47,"date":"2006-06-20T21:07:38","date_gmt":"2006-06-20T19:07:38","guid":{"rendered":"http:\/\/contoso.se\/blog\/?p=47"},"modified":"2006-12-28T17:22:14","modified_gmt":"2006-12-28T15:22:14","slug":"mom-och-ipsec","status":"publish","type":"post","link":"https:\/\/contoso.se\/blog\/?p=47","title":{"rendered":"MOM and IPSec"},"content":{"rendered":"<p><font size=\"3\">Do you know which part of MOM that is encrypted?<br \/>\n<\/font><font size=\"3\"><br \/>\n<\/font><font size=\"3\">When a new agent is installed is that traffic not encrypted. When the installation is done the communication is encrypted as default, if the agent is member of a domain. When the information has reached the Management server and is going to the database, the traffic is no longer encrypted. IPSec is a protocol that can provide this security. \u00c2\u00a0<br \/>\n<\/font><\/p>\n<p><em><font size=\"3\" \/><\/em><em><font size=\"3\"><\/p>\n<blockquote><p>IPsec (IP security) is a suite of protocols for securing Internet Protocol (IP) communications by encrypting and\/or authenticating each IP packet in a data stream. IPsec also includes protocols for cryptographic key establishment.<br \/>\n<font size=\"3\">Source: <\/font><a href=\"http:\/\/en.wikipedia.org\/wiki\/IPSec\"><font color=\"#800080\" size=\"3\">Wikipedia<\/font><\/a><font size=\"3\">\u00c2\u00a0<\/font><\/p><\/blockquote>\n<p><\/font><font size=\"3\">IPSec can be used between the following machines<br \/>\n<\/font><\/p>\n<p><\/em><font size=\"3\" \/><font size=\"3\"><\/p>\n<ul>\n<li>Management server and MOM database server<\/li>\n<p><font size=\"3\"><\/p>\n<li>MOM database server and reporting database<\/li>\n<p><\/font><\/p>\n<p><font size=\"3\" \/><font size=\"3\"><\/p>\n<li>Management server and computer without agent<\/li>\n<p><\/font><font size=\"3\" \/><font size=\"3\"><\/p>\n<li>Management server and operator console or administrator console (if they are running from another computer)<\/li>\n<p \/><\/font><\/ul>\n<p><\/font><font size=\"3\"><br \/>\n<\/font><font size=\"3\">Traffic between agent and management server is encrypted by default and don&#8217;t need IPSec.<\/font><\/p>\n<p><font size=\"3\"><br \/>\n<\/font><font size=\"3\">In this example the traffic will be encrypted based on information from the domain. If the machines is not in a common domain you can use shared keys or certification to encrypt the traffic. <\/font><font size=\"3\">Below there is a walkthrough how to enable IPSec. There is other ways, for example Netsh and group policy objects.<\/font><\/p>\n<p><font size=\"3\" \/><font size=\"3\"><\/p>\n<ol>\n<li><font size=\"3\">Start by running MMC and add the &#8220;IP Security on Local Computer&#8221; snap-in<\/font><\/li>\n<li><font size=\"3\">Right-click and choose &#8220;Create IP Security Policy<\/font><\/li>\n<li><font size=\"3\">Input a suitable name, for example MOM IPSec Policy<\/font><\/li>\n<li><font size=\"3\">Uncheck &#8220;Activate the default response rule&#8221;<\/font><\/li>\n<li><font size=\"3\">In &#8220;IP Security Policy Wizard&#8221; verify that &#8220;Edit Properties&#8221; is marked and then click &#8220;Finish&#8221;<\/font><\/li>\n<li><font size=\"3\">In &#8220;Policy Properties&#8221; unmark &#8220;Use Add Wizard&#8221; and verify that &#8221; is unmarked and then click add..<\/font><\/li>\n<li><font size=\"3\">Under &#8220;IP Filter List&#8221; click Add..<\/font><\/li>\n<li><font size=\"3\">Input a suitable name in &#8220;IP Filter List&#8221;, then uncheck &#8220;Use Add Wizard&#8221; and click Add<\/font><\/li>\n<li><font size=\"3\">Choose &#8220;My IP Address&#8221; under &#8220;Source address&#8221; and choose &#8220;A specific IP Address&#8221; under &#8220;Destination address&#8221;. Input the IP of the other server and verify that &#8220;Mirrored&#8221; is marked, then click &#8220;OK&#8221;<\/font><\/li>\n<li><font size=\"3\">In &#8220;IP Filter List&#8221; click OK<\/font><\/li>\n<li><font size=\"3\">Back in &#8220;New Rule Properties&#8221; mark you new rule under &#8220;IP Filter Lists:&#8221;<\/font><\/li>\n<li><font size=\"3\">Under &#8220;Filter Action&#8221; choose &#8220;Require Security&#8221;<\/font><\/li>\n<li><font size=\"3\">Under &#8220;Authentication Methods&#8221; choose &#8220;Kerberos&#8221;<\/font><\/li>\n<li><font size=\"3\">Under &#8220;Tunnel Settings&#8221; choose &#8220;This rule does not specify an IPSec tunnel&#8221;<\/font><\/li>\n<li><font size=\"3\">Under &#8220;Connection Type&#8221; choose &#8220;All network connection&#8221;<\/font><\/li>\n<li><font size=\"3\">Click Apply and then OK<\/font><\/li>\n<li><font size=\"3\">In Properties, choose the new policy and click OK<\/font><\/li>\n<li><font size=\"3\">Right-click the new policy and choose Assign<\/font><\/li>\n<li><font size=\"3\">If you add &#8220;IP Security Monitor&#8221; snap-in in MMC you can verify that your new policy is active<\/font><\/li>\n<\/ol>\n<p><\/font><font size=\"3\"><br \/>\n<\/font><font size=\"3\">Now do the same steps on the other server, don&#8217;t forget to change IP at 9.<br \/>\n<\/font>\u00c2\u00a0<\/p>\n<p>\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0\u00c2\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Do you know which part of MOM that is encrypted? When a new agent is installed is that traffic not encrypted. When the installation is done the communication is encrypted as default, if the agent is member of a domain. When the information has reached the Management server and is going to the database, the &hellip; <a href=\"https:\/\/contoso.se\/blog\/?p=47\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[2],"tags":[],"_links":{"self":[{"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/47"}],"collection":[{"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=47"}],"version-history":[{"count":0,"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=\/wp\/v2\/posts\/47\/revisions"}],"wp:attachment":[{"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=47"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=47"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/contoso.se\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=47"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}