Blog Post

Core Infrastructure and Security Blog
8 MIN READ

Securing DC to DC communication with IPsec using Windows Firewall with Advanced Security (WFAS) Connection Security Rules

Mark Morowczynski's avatar
Mark Morowczynski
Icon for Microsoft rankMicrosoft
Sep 20, 2018
First published on TechNet on Dec 14, 2014   Hi folks, Lakshman Hariharan and Martin Solis here with a post on how to secure domain controller to domain controller communications using Windows ...
Updated Feb 20, 2020
Version 4.0
LakshmanHariharan
MartinSolis
thesquirrel1130's avatar
thesquirrel1130
Copper Contributor
Sep 27, 2024

You should know that GPO clears and re-establishes the IPsec tunnel at every GPO refresh, which on DCs is every 15 minutes.  We've implemented this for SMB, RDP, RPC, and WinRM.  We had to change these to be pushed out by PowerShell commands to prevent a short disconnect between two machines when either side does a GPO refresh.  Dumb how MS implemented this.