Share via

Isolated Domain

  • Article

Applies To: Windows Server 2008, Windows Server 2008 R2

The isolated domain is the primary zone for trusted computers. The computers in this zone use connection security and firewall rules to control the communications that can be sent between computers in the zone.

The term domain in this context means a boundary of communications trust instead of an Active Directory domain. In this solution the two constructs are very similar because Active Directory domain authentication (Kerberos V5) is required for accepting inbound connections from trusted computers. However, many Active Directory domains (or forests) can be linked with trust relationships to provide a single, logical, isolated domain. In addition, computers that authenticate by using certificates can also be included in an isolated domain without joining the Active Directory domain.

For most implementations, an isolated domain will contain the largest number of computers. Other isolation zones can be created for the solution if their communication requirements differ from those of the isolated domain. Examples of these differences are what result in the boundary and encryption zones described in this guide. Conceptually, the isolated domain is just the largest isolation zone, and a superset to the other zones.

You must create a group in Active Directory to contain members of the isolated domain. You then apply one of several GPOs that contain connection security and firewall rules to the group so that authentication on all inbound network connections is enforced. Creation of the group and how to link the GPOs that apply the rules to its members are discussed in the Planning Group Policy Deployment for Your Isolation Zones section.

The GPOs for the isolated domain should contain the following connection security rules and settings.

GPO settings for isolated domain members running Windows 7, Windows Vista, Windows Server 2008,or Windows Server 2008 R2

GPOs for computers running Windows 7, Windows Vista, Windows Server 2008 R2, or Windows Server 2008 should include the following:

  • IPsec default settings that specify the following options:

    1. Exempt all ICMP traffic from IPsec.

    2. Key exchange (main mode) security methods and algorithm. We recommend that you do not include Diffie-Hellman Group 1, Data Encryption Standard (DES), or MD5 in any setting. They are included only for compatibility with earlier versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems.

    3. Data protection (quick mode) algorithm combinations. We recommend that you do not include DES, or MD5 in any setting. They are included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems.

      If any NAT devices are present on your networks, do not use AH because it cannot traverse NAT devices. If isolated domain members must communicate with hosts in the encryption zone, ensure that you include algorithms that are compatible with the requirements of the encryption mode policies.

    4. Authentication methods. Include at least computer-based Kerberos V5 authentication. If you want to use user-based access to isolated servers, then also include user-based Kerberos V5 as an optional authentication method. Likewise, if any of your isolated domain members cannot use Kerberos V5 authentication, then include certificate-based authentication as an optional authentication method.

  • The following connection security rules:

    • A connection security rule that exempts all computers on the exemption list from authentication. Be sure to include all your Active Directory domain controllers on this list. Enter subnet addresses, where possible, instead of discrete addresses, if applicable in your environment.

    • A connection security rule, from any IP address to any, that requires inbound and requests outbound authentication by using Kerberos V5 authentication.

Important

Be sure to begin operations by using request in and request out behavior until you are sure that all the computers in your IPsec environment are communicating successfully by using IPsec. After confirming that IPsec is operating as expected, you can change the policy to require in, request out.

Note

For a sample template for these registry settings, see Appendix A: Sample GPO Template Files for Settings Used in this Guide.

GPO settings for isolated domain members running Windows 2000, Windows Server 2003, or Windows XP

GPOs for computers running Windows 2000, Windows Server 2003, or Windows XP should include the following:

  • An IPsec Policy that includes the following settings and security rules:

    1. Key exchange settings that specify main mode security methods and algorithms. We recommend that you do not include Diffie-Hellman Group 1, DES, or MD5 in any setting. They are included only for compatibility with previous versions of Windows. You should use the strongest algorithm combinations that are common to all your supported operating systems.

    2. A permit rule for all ICMP traffic using My IP Address to Any IP Address.

    3. A permit rule for all computers on the exemption list. Be sure to include all your Active Directory domain controllers on this list. Take advantage of the ability to enter subnet addresses, if applicable in your environment.

    4. A negotiate rule for all network addresses using My IP Address to communicate with subnet addresses that make up the network address space. The filter action should specify Negotiate security, and then specify the same integrity and encryption protocols that are used by your other computers. We recommend that you do not include DES, or MD5 in any setting. They are included only for compatibility with previous versions of Windows. Use the strongest algorithm combinations that are common to all your supported operating systems. If any NAT devices are present on your networks, do not use AH because it cannot traverse NAT devices.

      To initially make the IPsec policy request authentication for both inbound and outbound traffic, select both Accept unsecured communication and Allow fallback to unsecured communication check boxes. After you have confirmed that all your computers are successfully using IPsec as designed, come back to this setting, and then clear the Accept unsecured communication check box to require inbound authentication.

  • A registry policy that includes the following values:

    1. Enable PMTU discovery. Enabling this setting allows TCP/IP to dynamically determine the largest packet size supported across a connection. The value is found at HKLM\System\CurrentControlSet\Services\TCPIP\Parameters\EnablePMTUDiscovery (dword). The sample GPO preferences XML file in Appendix A: Sample GPO Template Files for Settings Used in this Guide sets the value to 1.

    2. Enforce the default IPsec protocol exemptions. This setting is documented in Knowledge Base article 810207 at https://go.microsoft.com/fwlink/?linkid=110516. The sample GPO preferences XML file in Appendix A: Sample GPO Template Files for Settings Used in this Guide sets this value to 3 on Windows Server 2003, and sets the value to 1 on Windows XP and Windows 2000.

    3. If required by the organization, enable IPsec over NAT-T. This setting is documented in Knowledge Base article 120492 at https://go.microsoft.com/fwlink/?linkid=120492. The sample GPO preferences XML file in Appendix A: Sample GPO Template Files for Settings Used in this Guide sets this value to 0 (the default). To enable IPsec over NAT-T, you must change this value to either 1 or 2, as required by your environment.

    4. Set the Simplified IPsec Policy registry entry to a value of 0x14 to improve the 'fall back to clear' behavior in Windows XP and Windows Server 2003. To use this, you must have already deployed the update available for free download (for Windows Server 2003) from the Knowledge Base article 914841 at https://go.microsoft.com/fwlink/?linkid=110514.

Note

For a sample template for these registry settings, see Appendix A: Sample GPO Template Files for Settings Used in this Guide.

Make sure that in your GPOs for stationary computers, such as desktop and server computers, assign all rules to all profiles. For portable computers, you might want to allow more profile flexibility to enable users to communicate successfully when they are not connected to the organization's network.

Next: Boundary Zone