IIS IPSec question

[dcw@pr]

when setting a security policy, I think I am correct in saying that a Deny will always override a Permit? If this is the case, is there any way of changing that? We have a server where there is a rule that denies any traffic on a particular IP address, on any port. Yet still we are getting data transfer through that address...

[JamieBeeston]

You should never rely on 'inbuilt' security, always go for a hardware solution if you need to be sure that you're only allowing the traffic you want!

[dcw@pr]

not really possilbe when we are hiring a dedicated server from someone else unfortunately

[JamieBeeston]

dcw@pr said:

not really possilbe when we are hiring a dedicated server from someone else unfortunately

any decent dedi server provider will offer shared / dedicated hardware firewalls.

worst case you colo one..

Inbuilt security is nothing more than a chocolate fireguard, the very fact you have to hit the server before it can even start negates the point in it ;(

Denys should be treated first tho. IIRC iis explicitly allows you to set which is allowed tho ie

Only allow from specific IPs

or

Allow all except from specific IPs

neither is more than a joke solution alas tho

if you're serious about any semblance of security you will need to get your provider to firewall you...

I wont even go onto how scary an unfirewalled windows server is these days

GL