{"id":6141,"date":"2022-05-16T07:59:49","date_gmt":"2022-05-16T05:59:49","guid":{"rendered":"https:\/\/www.teal-consulting.de\/?p=6141"},"modified":"2022-08-02T13:18:42","modified_gmt":"2022-08-02T11:18:42","slug":"ipsec-best-practices-update","status":"publish","type":"post","link":"https:\/\/www.teal-consulting.de\/en\/2022\/05\/16\/ipsec-best-practices-update\/","title":{"rendered":"Securing (E)SAE Environments &#8211; IPSec Best Practices Update"},"content":{"rendered":"<div class=\"wpb-content-wrapper\" id=\"wpb-content-root\">[vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;full_width&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;left&#8221; background_image_as_pattern=&#8221;without_pattern&#8221;][vc_column][vc_empty_space height=&#8221;30&#8243;][vc_row_inner row_type=&#8221;row&#8221; type=&#8221;full_width&#8221; text_align=&#8221;left&#8221; css_animation=&#8221;&#8221; padding_top=&#8221;20&#8243; padding_bottom=&#8221;20&#8243;][vc_column_inner][vc_column_text][\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]In this article on <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/win32\/fwp\/ipsec-configuration\" target=\"_blank\" rel=\"noopener\">IPSec<\/a>, we want to pick up our March 2019 article <a href=\"https:\/\/www.teal-consulting.de\/en\/2019\/03\/15\/esae-series-part-5-windows-ipsec\/\" target=\"_blank\" rel=\"noopener\">ESAE Series Part 5 &#8211; Windows<\/a> <a href=\"https:\/\/www.teal-consulting.de\/2019\/03\/15\/esae-serie-teil-5-windows-ipsec\/\">IPSec <\/a>and add some additional considerations. As written about in this post, IPSec (short for &#8220;Internet Protocol Security&#8221;) is an extension to the TCP\/IP protocol suite designed to enable secure communications over potentially insecure IP networks such as the Internet. The context of this and the linked predecessor article on IPSec is securing communications within a Tier 0 environment.<\/p>\n<p>While the solution described in the previous article requires IPSec for inbound and outbound connections within Tier 0, this article presents a solution that is less restrictive and only requests IPSec, making it somewhat easier to implement and maintain in operation.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h2><span style=\"font-size: 22px;\">Advantages and disadvantages<\/span><\/h2>\n<p>In this section, we briefly summarize the main advantages and disadvantages of IPSec without going into too much detail.<\/p>\n<p>IPSec offers the following advantages:<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>IPSec offers two-way authentication between two communication partners with Kerberos v5 protocol, with x.509 certificates or a preshared key. The last method with a preshared key is not recommended for security reasons and is usually only used in practice for test<\/li>\n<li>Optional encryption of data at IP<\/li>\n<li>Since IPSec is implemented at the IP layer, it works independently of the applications<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>The following disadvantages exist in connection with IPSec:<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>The connection security rules for IPSec are usually distributed to the end devices via Group Policy Objects (GPO). This requires the end device to be a member of an Active Directory This is the case in most enterprises anyway, but may prove to be a minor disadvantage in certain environments, such as a DMZ, where not all Windows systems may be AD domain members.<\/li>\n<li>If x.509 certificates are used for authentication, either an internal PKI is required or certificates must be purchased externally from an appropriate<\/li>\n<li>Using IPSec adds complexity and can sometimes complicate<\/li>\n<li>When using IPSec encryption, the CPU load is higher on the systems<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h2>Effort vs. benefit<\/h2>\n<p>Now we want to compare again the effort for the configuration with the benefit.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h3>Authentication<\/h3>\n<p>The communication partners are authenticated on both sides in IPSec via Kerberos v5 or with certificates. It is possible to specify whether authentication is only requested or whether it is required. In the first case, an IP connection between two end devices will be established even if authentication fails, for example, if no valid certificate is installed on one of the end devices in the case of certificate-based authentication. In the second case, no IP connection to the target system will be possible in the event of an error.<\/p>\n<p>The implementation of rules that only request authentication, but do not require it, only provide a security gain if the IPSec connection is encrypted.<\/p>\n<p>If a two-way connection is mandatory, significantly improved security is achieved because a connection is rejected by the target system. Above all, when certificates are used, a connection is only possible if a valid certificate is installed on the system.<\/p>\n<p>The disadvantage of this configuration is that no connection is possible in the event of a misconfiguration, which results in high complexity and a lot of effort in operation for troubleshooting and fault clearance.<\/p>\n<p>In practice, an internal PKI is probably a prerequisite in most cases when using certificates. The acquisition of certificates from an external certificate provider is only economical if it does not involve a large number of systems, as is the case, for example, with servers in a DMZ which only offers a limited number of public services.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h3>Encryption<\/h3>\n<p>An IPSec connection can be optionally encrypted. When using current operating systems and applications, old protocols in which passwords are transmitted in plain text should generally no longer be used. With currently supported Windows versions, care should be taken to use Kerberos throughout and to disable NTLMv2 if possible. The additional advantage of encryption with IPSec is that the user data is also encrypted. Whether this advantage is worth the additional configuration effort must then be evaluated individually on a case-by-case basis.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h2>Restricting remote administration to authenticated systems<\/h2>\n<p>In conjunction with inbound rules in Windows Defender Firewall, IPSec provides the ability for only two-way IPSec authenticated systems to have remote administrative access to Tier 0 systems.<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>A connection security rule is created that requests certificate-based<\/li>\n<li>The inbound rules for the Remote Administration Services RDP (port 3389) and PowerShell Remoting (port 5985) are configured to allow only IPSec authenticated connections.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner row_type=&#8221;row&#8221; type=&#8221;full_width&#8221; text_align=&#8221;left&#8221; css_animation=&#8221;&#8221; padding_top=&#8221;20&#8243; padding_bottom=&#8221;20&#8243;][vc_column_inner width=&#8221;1\/2&#8243;][vc_column_text css=&#8221;.vc_custom_1652626557440{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6115 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild1.png\" alt=\"\" width=\"548\" height=\"440\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild1.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild1-300x241.png 300w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/440;\" \/>[\/vc_column_text][\/vc_column_inner][vc_column_inner width=&#8221;1\/2&#8243;][vc_column_text css=&#8221;.vc_custom_1652626547973{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6113 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild2.png\" alt=\"\" width=\"548\" height=\"580\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild2.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild2-283x300.png 283w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/580;\" \/>[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][vc_row_inner row_type=&#8221;row&#8221; type=&#8221;full_width&#8221; text_align=&#8221;left&#8221; css_animation=&#8221;&#8221; padding_top=&#8221;20&#8243; padding_bottom=&#8221;20&#8243;][vc_column_inner][vc_column_text]This ensures that Tier 0 systems can only be administered by systems with a valid certificate. These are then in particular the Privileged Access Workstations (PAW) that are intended for administration.<\/p>\n<p>The procedure is described again below.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h3>Connection Security Rule<\/h3>\n<p>Encryption with IPSec is configured and a connection security rule is created in a GPO.<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li>Create a new GPO.<\/li>\n<li>Navigate to <strong>Computer Configuration -&gt; Policies -&gt; Windows Settings -&gt; Security Settings -&gt; Windows Defender Firewall with Advanced Security -&gt; Windows Defender Firewall with Advanced Security &#8211; LDAP:\/\/CN=&lt;CN&gt;<\/strong>.<\/li>\n<li>Right-click the child entry for <strong>Windows Defender Firewall with Advanced Security &#8211; LDAP:\/\/CN=&lt;CN&gt; <\/strong>and select <strong>Properties<\/strong>.<\/li>\n<li>On the IPSec Settings tab, select <strong>Yes for the Exempt ICMP form IPSec <\/strong>option and then click <span lang=\"EN-US\"><strong>Customize<\/strong>.<\/span><\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652630075533{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6137 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update-bild3.png\" alt=\"\" width=\"548\" height=\"493\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update-bild3.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update-bild3-300x270.png 300w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/493;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641881068{margin-left: 15px !important;}&#8221;]5. Under <strong>Key exchange (Main Mode), <\/strong>select <strong>Advanced <\/strong>and click <strong>Customize<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652627381540{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6109 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild4.png\" alt=\"\" width=\"548\" height=\"595\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild4.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild4-276x300.png 276w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/595;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641898569{margin-left: 15px !important;}&#8221;]6. Click on <strong>Add<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652627449839{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6107 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild5.png\" alt=\"\" width=\"548\" height=\"420\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild5.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild5-300x230.png 300w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/420;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641924254{margin-left: 15px !important;}&#8221;]7. Select the strongest algorithm here. <strong>SHA-384 <\/strong>as <strong>Integrity algorithm<\/strong>, <strong>AES-CBC 256 <\/strong>as <strong>Encryption algorithm <\/strong>and <strong>Elliptic Curve Diffie-Hehllman P-384 <\/strong>as <strong>Key exchange algorithm<\/strong>. Confirm with <strong>OK<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652627489608{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6105 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild6.png\" alt=\"\" width=\"656\" height=\"712\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild6.png 656w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild6-276x300.png 276w\" data-sizes=\"(max-width: 656px) 100vw, 656px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 656px; --smush-placeholder-aspect-ratio: 656\/712;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641941885{margin-left: 15px !important;}&#8221;]8. Move the newly created security method to the first position.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652627554354{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6103 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild7.png\" alt=\"\" width=\"548\" height=\"415\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild7.png 548w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild7-300x227.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild7-500x380.png 500w\" data-sizes=\"(max-width: 548px) 100vw, 548px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 548px; --smush-placeholder-aspect-ratio: 548\/415;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641968846{margin-left: 15px !important;}&#8221;]9. Under <strong>Data protection (Quick Mode), <\/strong>select <strong>Advanced <\/strong>and click <strong>Customize<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628077947{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6101 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild8.png\" alt=\"\" width=\"656\" height=\"722\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild8.png 656w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild8-273x300.png 273w\" data-sizes=\"(max-width: 656px) 100vw, 656px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 656px; --smush-placeholder-aspect-ratio: 656\/722;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652641994451{margin-left: 15px !important;}&#8221;]10. Select the Require encryption for all connection security rules that use these settings option and click <strong>Add<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628127744{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6099 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild9.png\" alt=\"\" width=\"615\" height=\"345\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild9.png 615w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild9-300x168.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild9-539x303.png 539w\" data-sizes=\"(max-width: 615px) 100vw, 615px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 615px; --smush-placeholder-aspect-ratio: 615\/345;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642083731{margin-left: 15px !important;}&#8221;]11. Again, select the strongest <strong>AES-GCM 256 <\/strong>as <strong>encryption algorithm <\/strong>and also as <strong>integrity algorithm<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628158900{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6097 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild10.png\" alt=\"\" width=\"656\" height=\"766\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild10.png 656w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild10-257x300.png 257w\" data-sizes=\"(max-width: 656px) 100vw, 656px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 656px; --smush-placeholder-aspect-ratio: 656\/766;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642102081{margin-left: 15px !important;}&#8221;]12. And again move the newly created configuration to the first position.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628216527{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6095 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11.png\" alt=\"\" width=\"630\" height=\"345\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11.png 630w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11-300x164.png 300w\" data-sizes=\"(max-width: 630px) 100vw, 630px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 630px; --smush-placeholder-aspect-ratio: 630\/345;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642176498{margin-left: 15px !important;}&#8221;]13. Click <strong>OK<\/strong>.<\/p>\n<p>14. Click <strong>OK<\/strong>.<\/p>\n<p>15. Click <strong>OK<\/strong>.<\/p>\n<p>16. Navigate to <strong>Computer Configuration -&gt; Policies -&gt; Windows Settings -&gt; Security Settings -&gt; Windows Defender Firewall with Advanced Security -&gt; Windows Defender Firewall with Advanced Security &#8211; LDAP:\/\/CN=&lt;CN&gt; -&gt; Connection Security Rules<\/strong>.<\/p>\n<p>17. Right mouse click on <strong>Connection Security Rules <\/strong>-&gt; <strong>New Rule<\/strong>.<\/p>\n<p>18. On the <strong>Rule Type <\/strong>page, select the <strong>Isolation <\/strong>option.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628216527{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6095 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11.png\" alt=\"\" width=\"630\" height=\"345\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11.png 630w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild11-300x164.png 300w\" data-sizes=\"(max-width: 630px) 100vw, 630px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 630px; --smush-placeholder-aspect-ratio: 630\/345;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642196680{margin-left: 15px !important;}&#8221;]19. On the <strong>Requirements <\/strong>page, select <strong>Request authentication for inbound and outbound<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652628960854{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6091 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild13.png\" alt=\"\" width=\"500\" height=\"255\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild13.png 500w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild13-300x153.png 300w\" data-sizes=\"(max-width: 500px) 100vw, 500px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 500px; --smush-placeholder-aspect-ratio: 500\/255;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642246225{margin-left: 15px !important;}&#8221;]20. On the Authentication <strong>Method <\/strong>page, select <strong>Advanced <\/strong>and click <strong>Customize<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629004890{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6089 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild14.png\" alt=\"\" width=\"500\" height=\"293\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild14.png 500w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild14-300x176.png 300w\" data-sizes=\"(max-width: 500px) 100vw, 500px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 500px; --smush-placeholder-aspect-ratio: 500\/293;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642234626{margin-left: 15px !important;}&#8221;]21. On the left side under <strong>First authentication <\/strong>click <strong>Add<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629052822{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6087 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild15.png\" alt=\"\" width=\"543\" height=\"283\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild15.png 543w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild15-300x156.png 300w\" data-sizes=\"(max-width: 543px) 100vw, 543px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 543px; --smush-placeholder-aspect-ratio: 543\/283;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642291398{margin-left: 15px !important;}&#8221;]22. Select the <strong>Computer certificate from this certification authority (CA) <\/strong>option and click <strong>Browse<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629106438{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6085 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16.png\" alt=\"\" width=\"586\" height=\"586\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16.png 586w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16-300x300.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16-150x150.png 150w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16-570x570.png 570w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild16-500x500.png 500w\" data-sizes=\"(max-width: 586px) 100vw, 586px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 586px; --smush-placeholder-aspect-ratio: 586\/586;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642301142{margin-left: 15px !important;}&#8221;]23. In this dialog box, select the correct root certificate (if in doubt, check the properties of the certificate and, if necessary, the thumbprint).[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629192767{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6083 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild17.png\" alt=\"\" width=\"495\" height=\"285\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild17.png 495w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild17-300x173.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild17-345x198.png 345w\" data-sizes=\"(max-width: 495px) 100vw, 495px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 495px; --smush-placeholder-aspect-ratio: 495\/285;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642320263{margin-left: 15px !important;}&#8221;]24. Confirm configuration with <strong>OK<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629260935{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6081 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild18.png\" alt=\"\" width=\"540\" height=\"552\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild18.png 540w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild18-293x300.png 293w\" data-sizes=\"(max-width: 540px) 100vw, 540px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 540px; --smush-placeholder-aspect-ratio: 540\/552;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642373410{margin-left: 15px !important;}&#8221;]25. Click <strong>OK<\/strong>.<\/p>\n<p>26. On the Authentication <strong>Method <\/strong>page, click <strong>Next<\/strong>.<\/p>\n<p>27. On the <strong>Profiles <\/strong>page, click\u00a0<strong>Next<\/strong>.<\/p>\n<p>28. On the <strong>Name <\/strong>page, select a name such as <strong>Request certificate authentication for inbound and outbound connections and <\/strong>click <strong>Finish<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text]\n<h3>Inbound rules<\/h3>\n<p>The inbound rules for RDP and Windows Remote Management are also most easily created via GPO.<\/p>\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li style=\"list-style-type: none;\">\n<ol>\n<li>Create a new GPO.<\/li>\n<li>Navigate to <strong>Computer Configuration -&gt; Policies -&gt; Windows Settings -&gt; Security Settings -&gt; Windows Defender Firewall with Advanced Security -&gt; Windows Defender Firewall with Advanced Security &#8211; LDAP:\/\/CN=&lt;CN&gt; -&gt; Inbound Rules<\/strong>.<\/li>\n<li>Right mouse click on <strong>Inbound Rules <\/strong>-&gt; <strong>New Rule<\/strong>.<\/li>\n<li>On the <strong>Rule Type <\/strong>page, select <strong>Predefined <\/strong>and the <strong>Remote Desktop\u00a0<\/strong>group.<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n<\/li>\n<\/ol>\n[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629462118{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6079 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild19.png\" alt=\"\" width=\"770\" height=\"404\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild19.png 770w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild19-300x157.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild19-768x403.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild19-700x367.png 700w\" data-sizes=\"(max-width: 770px) 100vw, 770px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 770px; --smush-placeholder-aspect-ratio: 770\/404;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642444707{margin-left: 15px !important;}&#8221;]5. On the <strong>Predefined Rules <\/strong>page, all rules in the <strong>Remote Desktop <\/strong>group are now displayed and all are selected. Accept the selection and click\u00a0<strong>Next<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629507117{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6077 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild20.png\" alt=\"\" width=\"770\" height=\"324\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild20.png 770w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild20-300x126.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild20-768x323.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild20-700x295.png 700w\" data-sizes=\"(max-width: 770px) 100vw, 770px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 770px; --smush-placeholder-aspect-ratio: 770\/324;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642470859{margin-left: 15px !important;}&#8221;]6. On the <strong>Action <\/strong>page, select the <strong>Allow the connection if it is secure\u00a0<\/strong>option.<\/p>\n<p>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629553952{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6075 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild21.png\" alt=\"\" width=\"770\" height=\"356\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild21.png 770w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild21-300x139.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild21-768x355.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild21-700x324.png 700w\" data-sizes=\"(max-width: 770px) 100vw, 770px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 770px; --smush-placeholder-aspect-ratio: 770\/356;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652642502009{margin-left: 15px !important;}&#8221;]7. On the <strong>Users <\/strong>page, click <strong>Next<\/strong>.<\/p>\n<p>8. On the <strong>Computers <\/strong>page, click <strong>Finish<\/strong>.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text]Repeat these steps for the inbound rules of the Windows Remote Management group. PowerShell Remoting is based on Windows Remote Management.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text]\n<h3>Distribute GPO and certificates<\/h3>\n<p>All systems in Tier 0 then receive valid certificates and can authenticate each other and communicate with each other in encrypted form. For the certificates, it must be noted that at least the following purposes are entered in the Enhanced Key Usage Extension:<\/p>\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>Server Authentication (1.3.6.1.5.7.3.1)<\/li>\n<li>Client Authentication (1.3.6.1.5.7.3.2)<\/li>\n<li>IP security IKE intermediate (1.3.6.1.5.8.2.2)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n[\/vc_column_text][vc_empty_space height=&#8221;10&#8243;][vc_column_text]The GPOs with the connection security and inbound rules are then distributed to all systems in Tier 0, i.e., they are linked to all OUs containing computer accounts of Tier 0 systems.<\/p>\n<p>When Tier 0 systems receive the inbound rules via GPO, they are duplicated in Windows Defender Firewall, with the rules from the GPO locked.[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text css=&#8221;.vc_custom_1652629686867{margin-right: 30px !important;margin-left: 30px !important;}&#8221;]<img decoding=\"async\" class=\"aligncenter size-full wp-image-6073 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild22.png\" alt=\"\" width=\"904\" height=\"116\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild22.png 904w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild22-300x38.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild22-768x99.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild22-700x90.png 700w\" data-sizes=\"(max-width: 904px) 100vw, 904px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 904px; --smush-placeholder-aspect-ratio: 904\/116;\" \/><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-6071 lazyload\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild23.png\" alt=\"\" width=\"904\" height=\"88\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild23.png 904w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild23-300x29.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild23-768x75.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2022\/05\/teal_esae_ipsec-update_bild23-700x68.png 700w\" data-sizes=\"(max-width: 904px) 100vw, 904px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 904px; --smush-placeholder-aspect-ratio: 904\/88;\" \/>[\/vc_column_text][vc_empty_space height=&#8221;20&#8243;][vc_column_text]If there are multiple rules for a service or port, <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-firewall\/best-practices-configuring\" target=\"_blank\" rel=\"noopener\">the more specific rule <\/a>is <a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/windows-firewall\/best-practices-configuring\" target=\"_blank\" rel=\"noopener\">applied<\/a>. In this case, the more specific rule is the one with the restriction to secure authentication that we created earlier in the GPO. This means that the locally existing default rule is thus ignored for RDP and PowerShell Remoting.[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h2>Recommendation \/ Opinion<\/h2>\n<p>In the configuration presented above, systems in Tier 0 can only be administered by other Tier 0 or privileged access workstations with a valid certificate via RDP and PowerShell remoting. In addition, all connections between Tier 0 systems are encrypted via IPSec. Since the connection security rule for IPSec only requires authentication, but does not make it necessary, systems without a valid certificate from Tier 1 and 2 can still communicate with the Tier 0 systems as usual.<\/p>\n<p>From our point of view, this is a sensible way to secure a Tier 0 environment, since important protocols for administration (RDP, PowerSell Remoting) can only be accessed from defined systems. If an attacker takes over a poorly secured Tier 2 system, for example, it is not possible to gain administrative access to a Tier 0 system from there. At the same time, the additional administrative effort remains manageable. Application-specific communication is only secured if a valid certificate is available. Tier 2 clients, however, can communicate with the server system as usual. This is not critical, since the vast majority of modern applications communicate in encrypted form anyway, and the IPSec tunnel is only a useful addition.<\/p>\n<p>With the current article, we have slightly adjusted our initial approach of introducing IPSec and proceeding as restrictively as possible, thus achieving the best from a cost\/benefit perspective. Nevertheless, the <a href=\"https:\/\/www.teal-consulting.de\/2019\/03\/15\/esae-serie-teil-5-windows-ipsec\/\" target=\"_blank\" rel=\"noopener\">initial article<\/a>\u00a0may still have its raison d&#8217;\u00eatre. If you are thinking about very regulated or high-security environments, it may make sense to continue to proceed as strictly as possible and to accept administrative complications in return.[\/vc_column_text][\/vc_column_inner][\/vc_row_inner][\/vc_column][\/vc_row][vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;full_width&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;left&#8221; background_image_as_pattern=&#8221;without_pattern&#8221;][vc_column][vc_empty_space height=&#8221;50&#8243;][vc_raw_html]JTNDYSUyMGhyZWYlM0QlMjJqYXZhc2NyaXB0JTNBaGlzdG9yeS5iYWNrJTI4JTI5JTIyJTNFJTNDc3BhbiUyMHN0eWxlJTNEJTIyY29sb3IlM0ElMjAlMjNmZjIwNzAlM0IlMjIlM0UlM0MlM0MlMjBCYWNrJTNDJTJGc3BhbiUzRSUzQyUyRmElM0U=[\/vc_raw_html][vc_empty_space height=&#8221;50&#8243;][vc_separator type=&#8221;small&#8221; position=&#8221;center&#8221; color=&#8221;#eeeeee&#8221; thickness=&#8221;2&#8243; width=&#8221;1100&#8243;][vc_empty_space height=&#8221;50&#8243;][\/vc_column][\/vc_row][vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;full_width&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;center&#8221; background_image_as_pattern=&#8221;without_pattern&#8221; z_index=&#8221;&#8221;][vc_column width=&#8221;1\/2&#8243; offset=&#8221;vc_hidden-sm vc_hidden-xs&#8221;][vc_column_text] <\/p>\n<div class=\"brlbs-cmpnt-container brlbs-cmpnt-content-blocker brlbs-cmpnt-with-individual-styles\" data-borlabs-cookie-content-blocker-id=\"default\" data-borlabs-cookie-content=\"PGlmcmFtZSB0aXRsZT0iRWluZ2ViZXR0ZXRlciBCZWl0cmFnIiBzcmM9Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9lbWJlZC9mZWVkL3VwZGF0ZS91cm46bGk6dWdjUG9zdDo2NjQ4NjA3OTIwNDc5MTA1MDI0P2NvbXBhY3Q9MSIgd2lkdGg9IjUwNCIgaGVpZ2h0PSIyODQiIGZyYW1lYm9yZGVyPSIwIiBhbGxvd2Z1bGxzY3JlZW49ImFsbG93ZnVsbHNjcmVlbiIgZGF0YS1tY2UtZnJhZ21lbnQ9IjEiPjwvaWZyYW1lPg==\">\n<div class=\"brlbs-cmpnt-cb-preset-a\">\n<p class=\"brlbs-cmpnt-cb-description\">You are currently viewing a placeholder content from <strong>Default<\/strong>. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.<\/p>\n<div class=\"brlbs-cmpnt-cb-buttons\"> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-unblock role=\"button\">Unblock content<\/a> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-accept-service role=\"button\" style=\"display: none\">Accept required service and unblock content<\/a> <\/div>\n<p> <a class=\"brlbs-cmpnt-cb-provider-toggle\" href=\"#\" data-borlabs-cookie-show-provider-information role=\"button\">More Information<\/a> <\/div>\n<\/div>\n[\/vc_column_text][\/vc_column][vc_column width=&#8221;1\/2&#8243; offset=&#8221;vc_hidden-sm vc_hidden-xs&#8221;][vc_column_text] <\/p>\n<div class=\"brlbs-cmpnt-container brlbs-cmpnt-content-blocker brlbs-cmpnt-with-individual-styles\" data-borlabs-cookie-content-blocker-id=\"default\" data-borlabs-cookie-content=\"PGlmcmFtZSB0aXRsZT0iRWluZ2ViZXR0ZXRlciBCZWl0cmFnIiBzcmM9Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9lbWJlZC9mZWVkL3VwZGF0ZS91cm46bGk6dWdjUG9zdDo2NTg5ODY5NzI5MTY1Mzg5ODI0P2NvbXBhY3Q9MSIgd2lkdGg9IjUwNCIgaGVpZ2h0PSIyODQiIGZyYW1lYm9yZGVyPSIwIiBhbGxvd2Z1bGxzY3JlZW49ImFsbG93ZnVsbHNjcmVlbiIgZGF0YS1tY2UtZnJhZ21lbnQ9IjEiPjwvaWZyYW1lPg==\">\n<div class=\"brlbs-cmpnt-cb-preset-a\">\n<p class=\"brlbs-cmpnt-cb-description\">You are currently viewing a placeholder content from <strong>Default<\/strong>. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.<\/p>\n<div class=\"brlbs-cmpnt-cb-buttons\"> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-unblock role=\"button\">Unblock content<\/a> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-accept-service role=\"button\" style=\"display: none\">Accept required service and unblock content<\/a> <\/div>\n<p> <a class=\"brlbs-cmpnt-cb-provider-toggle\" href=\"#\" data-borlabs-cookie-show-provider-information role=\"button\">More Information<\/a> <\/div>\n<\/div>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;grid&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;center&#8221; background_image_as_pattern=&#8221;without_pattern&#8221; z_index=&#8221;&#8221;][vc_column width=&#8221;1\/2&#8243; offset=&#8221;vc_hidden-lg vc_hidden-md&#8221;][vc_column_text] <\/p>\n<div class=\"brlbs-cmpnt-container brlbs-cmpnt-content-blocker brlbs-cmpnt-with-individual-styles\" data-borlabs-cookie-content-blocker-id=\"default\" data-borlabs-cookie-content=\"PGlmcmFtZSB0aXRsZT0iRWluZ2ViZXR0ZXRlciBCZWl0cmFnIiBzcmM9Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9lbWJlZC9mZWVkL3VwZGF0ZS91cm46bGk6dWdjUG9zdDo2NjQ4NjA3OTIwNDc5MTA1MDI0P2NvbXBhY3Q9MSIgd2lkdGg9IjMwNCIgaGVpZ2h0PSIyODQiIGZyYW1lYm9yZGVyPSIwIiBhbGxvd2Z1bGxzY3JlZW49ImFsbG93ZnVsbHNjcmVlbiIgZGF0YS1tY2UtZnJhZ21lbnQ9IjEiPjwvaWZyYW1lPg==\">\n<div class=\"brlbs-cmpnt-cb-preset-a\">\n<p class=\"brlbs-cmpnt-cb-description\">You are currently viewing a placeholder content from <strong>Default<\/strong>. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.<\/p>\n<div class=\"brlbs-cmpnt-cb-buttons\"> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-unblock role=\"button\">Unblock content<\/a> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-accept-service role=\"button\" style=\"display: none\">Accept required service and unblock content<\/a> <\/div>\n<p> <a class=\"brlbs-cmpnt-cb-provider-toggle\" href=\"#\" data-borlabs-cookie-show-provider-information role=\"button\">More Information<\/a> <\/div>\n<\/div>\n[\/vc_column_text][\/vc_column][vc_column width=&#8221;1\/2&#8243; offset=&#8221;vc_hidden-lg vc_hidden-md&#8221;][vc_column_text] <\/p>\n<div class=\"brlbs-cmpnt-container brlbs-cmpnt-content-blocker brlbs-cmpnt-with-individual-styles\" data-borlabs-cookie-content-blocker-id=\"default\" data-borlabs-cookie-content=\"PGlmcmFtZSB0aXRsZT0iRWluZ2ViZXR0ZXRlciBCZWl0cmFnIiBzcmM9Imh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9lbWJlZC9mZWVkL3VwZGF0ZS91cm46bGk6dWdjUG9zdDo2NTg5ODY5NzI5MTY1Mzg5ODI0P2NvbXBhY3Q9MSIgd2lkdGg9IjMwNCIgaGVpZ2h0PSIyODQiIGZyYW1lYm9yZGVyPSIwIiBhbGxvd2Z1bGxzY3JlZW49ImFsbG93ZnVsbHNjcmVlbiIgZGF0YS1tY2UtZnJhZ21lbnQ9IjEiPjwvaWZyYW1lPg==\">\n<div class=\"brlbs-cmpnt-cb-preset-a\">\n<p class=\"brlbs-cmpnt-cb-description\">You are currently viewing a placeholder content from <strong>Default<\/strong>. To access the actual content, click the button below. Please note that doing so will share data with third-party providers.<\/p>\n<div class=\"brlbs-cmpnt-cb-buttons\"> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-unblock role=\"button\">Unblock content<\/a> <a class=\"brlbs-cmpnt-cb-btn\" href=\"#\" data-borlabs-cookie-accept-service role=\"button\" style=\"display: none\">Accept required service and unblock content<\/a> <\/div>\n<p> <a class=\"brlbs-cmpnt-cb-provider-toggle\" href=\"#\" data-borlabs-cookie-show-provider-information role=\"button\">More Information<\/a> <\/div>\n<\/div>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;full_width&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;center&#8221; background_image_as_pattern=&#8221;without_pattern&#8221; z_index=&#8221;&#8221;][vc_column width=&#8221;1\/2&#8243;][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<blockquote class=\"instagram-media\" style=\"background: #FFF; border: 0; border-radius: 3px; box-shadow: 0 0 1px 0 rgba(0,0,0,0.5),0 1px 10px 0 rgba(0,0,0,0.15); margin: 1px; max-width: 540px; min-width: 326px; padding: 0; width: calc(100% - 2px);\" data-instgrm-permalink=\"https:\/\/www.instagram.com\/p\/Ca4gdX2AoOH\/?utm_source=ig_embed&amp;utm_campaign=loading\" data-instgrm-version=\"14\">\n<div style=\"padding: 16px;\">\n<p>&nbsp;<\/p>\n<div style=\"display: flex; flex-direction: row; align-items: center;\">\n<div style=\"background-color: #f4f4f4; border-radius: 50%; flex-grow: 0; height: 40px; margin-right: 14px; width: 40px;\"><\/div>\n<div style=\"display: flex; flex-direction: column; flex-grow: 1; justify-content: center;\">\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; margin-bottom: 6px; width: 100px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; width: 60px;\"><\/div>\n<\/div>\n<\/div>\n<div style=\"padding: 19% 0;\"><\/div>\n<div style=\"display: block; height: 50px; margin: 0 auto 12px; width: 50px;\"><\/div>\n<div style=\"padding-top: 8px;\">\n<div style=\"color: #3897f0; font-family: Arial,sans-serif; font-size: 14px; font-style: normal; font-weight: 550; line-height: 18px;\">Sieh dir diesen Beitrag auf Instagram an<\/div>\n<\/div>\n<div style=\"padding: 12.5% 0;\"><\/div>\n<div style=\"display: flex; flex-direction: row; margin-bottom: 14px; align-items: center;\">\n<div>\n<div style=\"background-color: #f4f4f4; border-radius: 50%; height: 12.5px; width: 12.5px; transform: translateX(0px) translateY(7px);\"><\/div>\n<div style=\"background-color: #f4f4f4; height: 12.5px; transform: rotate(-45deg) translateX(3px) translateY(1px); width: 12.5px; flex-grow: 0; margin-right: 14px; margin-left: 2px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 50%; height: 12.5px; width: 12.5px; transform: translateX(9px) translateY(-18px);\"><\/div>\n<\/div>\n<div style=\"margin-left: 8px;\">\n<div style=\"background-color: #f4f4f4; border-radius: 50%; flex-grow: 0; height: 20px; width: 20px;\"><\/div>\n<div style=\"width: 0; height: 0; border-top: 2px solid transparent; border-left: 6px solid #f4f4f4; border-bottom: 2px solid transparent; transform: translateX(16px) translateY(-4px) rotate(30deg);\"><\/div>\n<\/div>\n<div style=\"margin-left: auto;\">\n<div style=\"width: 0px; border-top: 8px solid #F4F4F4; border-right: 8px solid transparent; transform: translateY(16px);\"><\/div>\n<div style=\"background-color: #f4f4f4; flex-grow: 0; height: 12px; width: 16px; transform: translateY(-4px);\"><\/div>\n<div style=\"width: 0; height: 0; border-top: 8px solid #F4F4F4; border-left: 8px solid transparent; transform: translateY(-4px) translateX(8px);\"><\/div>\n<\/div>\n<\/div>\n<div style=\"display: flex; flex-direction: column; flex-grow: 1; justify-content: center; margin-bottom: 24px;\">\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; margin-bottom: 6px; width: 224px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; width: 144px;\"><\/div>\n<\/div>\n<p>&nbsp;<\/p>\n<p style=\"color: #c9c8cd; font-family: Arial,sans-serif; font-size: 14px; line-height: 17px; margin-bottom: 0; margin-top: 8px; overflow: hidden; padding: 8px 0 7px; text-align: center; text-overflow: ellipsis; white-space: nowrap;\"><a style=\"color: #c9c8cd; font-family: Arial,sans-serif; font-size: 14px; font-style: normal; font-weight: normal; line-height: 17px; text-decoration: none;\" href=\"https:\/\/www.instagram.com\/p\/Ca4gdX2AoOH\/?utm_source=ig_embed&amp;utm_campaign=loading\" target=\"_blank\" rel=\"noopener\">Ein Beitrag geteilt von TEAL Technology Consulting (@tealconsulting)<\/a><\/p>\n<\/div>\n<\/blockquote>\n<p><script async src=\"\/\/www.instagram.com\/embed.js\"><\/script>[\/vc_column_text][\/vc_column][vc_column width=&#8221;1\/2&#8243;][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<blockquote class=\"instagram-media\" style=\"background: #FFF; border: 0; border-radius: 3px; box-shadow: 0 0 1px 0 rgba(0,0,0,0.5),0 1px 10px 0 rgba(0,0,0,0.15); margin: 1px; max-width: 540px; min-width: 326px; padding: 0; width: calc(100% - 2px);\" data-instgrm-permalink=\"https:\/\/www.instagram.com\/p\/CarqiU_AwlN\/?utm_source=ig_embed&amp;utm_campaign=loading\" data-instgrm-version=\"14\">\n<div style=\"padding: 16px;\">\n<p>&nbsp;<\/p>\n<div style=\"display: flex; flex-direction: row; align-items: center;\">\n<div style=\"background-color: #f4f4f4; border-radius: 50%; flex-grow: 0; height: 40px; margin-right: 14px; width: 40px;\"><\/div>\n<div style=\"display: flex; flex-direction: column; flex-grow: 1; justify-content: center;\">\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; margin-bottom: 6px; width: 100px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; width: 60px;\"><\/div>\n<\/div>\n<\/div>\n<div style=\"padding: 19% 0;\"><\/div>\n<div style=\"display: block; height: 50px; margin: 0 auto 12px; width: 50px;\"><\/div>\n<div style=\"padding-top: 8px;\">\n<div style=\"color: #3897f0; font-family: Arial,sans-serif; font-size: 14px; font-style: normal; font-weight: 550; line-height: 18px;\">Sieh dir diesen Beitrag auf Instagram an<\/div>\n<\/div>\n<div style=\"padding: 12.5% 0;\"><\/div>\n<div style=\"display: flex; flex-direction: row; margin-bottom: 14px; align-items: center;\">\n<div>\n<div style=\"background-color: #f4f4f4; border-radius: 50%; height: 12.5px; width: 12.5px; transform: translateX(0px) translateY(7px);\"><\/div>\n<div style=\"background-color: #f4f4f4; height: 12.5px; transform: rotate(-45deg) translateX(3px) translateY(1px); width: 12.5px; flex-grow: 0; margin-right: 14px; margin-left: 2px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 50%; height: 12.5px; width: 12.5px; transform: translateX(9px) translateY(-18px);\"><\/div>\n<\/div>\n<div style=\"margin-left: 8px;\">\n<div style=\"background-color: #f4f4f4; border-radius: 50%; flex-grow: 0; height: 20px; width: 20px;\"><\/div>\n<div style=\"width: 0; height: 0; border-top: 2px solid transparent; border-left: 6px solid #f4f4f4; border-bottom: 2px solid transparent; transform: translateX(16px) translateY(-4px) rotate(30deg);\"><\/div>\n<\/div>\n<div style=\"margin-left: auto;\">\n<div style=\"width: 0px; border-top: 8px solid #F4F4F4; border-right: 8px solid transparent; transform: translateY(16px);\"><\/div>\n<div style=\"background-color: #f4f4f4; flex-grow: 0; height: 12px; width: 16px; transform: translateY(-4px);\"><\/div>\n<div style=\"width: 0; height: 0; border-top: 8px solid #F4F4F4; border-left: 8px solid transparent; transform: translateY(-4px) translateX(8px);\"><\/div>\n<\/div>\n<\/div>\n<div style=\"display: flex; flex-direction: column; flex-grow: 1; justify-content: center; margin-bottom: 24px;\">\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; margin-bottom: 6px; width: 224px;\"><\/div>\n<div style=\"background-color: #f4f4f4; border-radius: 4px; flex-grow: 0; height: 14px; width: 144px;\"><\/div>\n<\/div>\n<p>&nbsp;<\/p>\n<p style=\"color: #c9c8cd; font-family: Arial,sans-serif; font-size: 14px; line-height: 17px; margin-bottom: 0; margin-top: 8px; overflow: hidden; padding: 8px 0 7px; text-align: center; text-overflow: ellipsis; white-space: nowrap;\"><a style=\"color: #c9c8cd; font-family: Arial,sans-serif; font-size: 14px; font-style: normal; font-weight: normal; line-height: 17px; text-decoration: none;\" href=\"https:\/\/www.instagram.com\/p\/CarqiU_AwlN\/?utm_source=ig_embed&amp;utm_campaign=loading\" target=\"_blank\" rel=\"noopener\">Ein Beitrag geteilt von TEAL Technology Consulting (@tealconsulting)<\/a><\/p>\n<\/div>\n<\/blockquote>\n<p><script async src=\"\/\/www.instagram.com\/embed.js\"><\/script>[\/vc_column_text][\/vc_column][\/vc_row][vc_row css_animation=&#8221;&#8221; row_type=&#8221;row&#8221; use_row_as_full_screen_section=&#8221;no&#8221; type=&#8221;full_width&#8221; angled_section=&#8221;no&#8221; text_align=&#8221;left&#8221; background_image_as_pattern=&#8221;without_pattern&#8221;][vc_column][vc_empty_space height=&#8221;30&#8243;][vc_column_text]\n<h4>LATEST POSTS<\/h4>\n[\/vc_column_text][vc_empty_space height=&#8221;30&#8243;]\n<div class='latest_post_holder boxes three_columns one_row' >\n    <ul>\n    \n        <li class=\"clearfix\">\n            <div class=\"boxes_image\">\n                                <a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/09\/02\/tiering-isnt-dead\/\"><img decoding=\"async\" width=\"539\" height=\"303\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-539x303.jpg\" class=\"attachment-latest_post_boxes size-latest_post_boxes wp-post-image lazyload\" alt=\"\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-539x303.jpg 539w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-300x169.jpg 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-1024x575.jpg 1024w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-768x432.jpg 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-1536x863.jpg 1536w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-700x393.jpg 700w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows.jpg 1920w\" data-sizes=\"(max-width: 539px) 100vw, 539px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 539px; --smush-placeholder-aspect-ratio: 539\/303;\"><\/a>\n            <\/div>\n            <div class=\"latest_post\"  >\n                <div class=\"latest_post_text\">\n                    <div class=\"latest_post_inner\">\n                        <div class=\"latest_post_text_inner\">\n                            <h4 itemprop=\"name\" class=\"latest_post_title entry_title\"><a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/09\/02\/tiering-isnt-dead\/\">Microsoft is backtracking: Tiering isn&#8217;t dead\u2014it&#8217;s essential for survival<\/a><\/h4>\n                            <p class=\"excerpt\">Microsoft releases an Active Directory Tier Model on GitHub. To many, this sounds like just another tool. For us, it\u2019s official proof of something we\u2019ve been saying for years: if you don\u2019t strictly isolate ...<\/p>\n                            <span class=\"post_infos\">\n                                                                    <span class=\"date_hour_holder\">\n                                        <span itemprop=\"dateCreated\" class=\"date entry_date updated\">02 September, 2026 <meta itemprop=\"interactionCount\" content=\"UserComments: 0\"\/><\/span>\n                                    <\/span>\n                                                                                                \n                                \n                                                            <\/span>\n                        <\/div>\n                    <\/div>\n                <\/div>\n            <\/div>\n        <\/li>\n    \n        <li class=\"clearfix\">\n            <div class=\"boxes_image\">\n                                <a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/08\/06\/microsoft-sms-mfa-obsolete\/\"><img decoding=\"async\" width=\"539\" height=\"303\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-539x303.jpg\" class=\"attachment-latest_post_boxes size-latest_post_boxes wp-post-image lazyload\" alt=\"\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-539x303.jpg 539w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-300x169.jpg 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-1024x575.jpg 1024w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-768x432.jpg 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-1536x863.jpg 1536w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows-700x393.jpg 700w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2025\/10\/blog_header_microsoft-windows.jpg 1920w\" data-sizes=\"(max-width: 539px) 100vw, 539px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 539px; --smush-placeholder-aspect-ratio: 539\/303;\"><\/a>\n            <\/div>\n            <div class=\"latest_post\"  >\n                <div class=\"latest_post_text\">\n                    <div class=\"latest_post_inner\">\n                        <div class=\"latest_post_text_inner\">\n                            <h4 itemprop=\"name\" class=\"latest_post_title entry_title\"><a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/08\/06\/microsoft-sms-mfa-obsolete\/\">Microsoft pulls the plug: why SMS MFA is now finally obsolete<\/a><\/h4>\n                            <p class=\"excerpt\">Starting September 1, 2026, passkeys will gradually become the default authentication method in Microsoft Entra ID. At the same time, Microsoft has announced that it will discontinue native support for SMS and voice MFA....<\/p>\n                            <span class=\"post_infos\">\n                                                                    <span class=\"date_hour_holder\">\n                                        <span itemprop=\"dateCreated\" class=\"date entry_date updated\">06 August, 2026 <meta itemprop=\"interactionCount\" content=\"UserComments: 0\"\/><\/span>\n                                    <\/span>\n                                                                                                \n                                \n                                                            <\/span>\n                        <\/div>\n                    <\/div>\n                <\/div>\n            <\/div>\n        <\/li>\n    \n        <li class=\"clearfix\">\n            <div class=\"boxes_image\">\n                                <a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/07\/01\/one-click-desaster-in-microsoft-365-copilot\/\"><img decoding=\"async\" width=\"539\" height=\"303\" data-src=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-539x303.png\" class=\"attachment-latest_post_boxes size-latest_post_boxes wp-post-image lazyload\" alt=\"\" data-srcset=\"https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-539x303.png 539w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-300x169.png 300w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-1024x575.png 1024w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-768x432.png 768w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-1536x863.png 1536w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot-700x393.png 700w, https:\/\/www.teal-consulting.de\/wp-content\/uploads\/2026\/06\/header_blog_teal_copilot.png 1920w\" data-sizes=\"(max-width: 539px) 100vw, 539px\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" style=\"--smush-placeholder-width: 539px; --smush-placeholder-aspect-ratio: 539\/303;\"><\/a>\n            <\/div>\n            <div class=\"latest_post\"  >\n                <div class=\"latest_post_text\">\n                    <div class=\"latest_post_inner\">\n                        <div class=\"latest_post_text_inner\">\n                            <h4 itemprop=\"name\" class=\"latest_post_title entry_title\"><a itemprop=\"url\" href=\"https:\/\/www.teal-consulting.de\/en\/2026\/07\/01\/one-click-desaster-in-microsoft-365-copilot\/\">One-Click Disaster in Microsoft 365 Copilot: When AI becomes a hacker&#8217;s best friend<\/a><\/h4>\n                            <p class=\"excerpt\">AI agents like Microsoft 365 Copilot are revolutionizing our daily work and promise unprecedented productivity. But what happens if this very smart assistant system quietly turns into the ultimate spy? ...<\/p>\n                            <span class=\"post_infos\">\n                                                                    <span class=\"date_hour_holder\">\n                                        <span itemprop=\"dateCreated\" class=\"date entry_date updated\">01 July, 2026 <meta itemprop=\"interactionCount\" content=\"UserComments: 0\"\/><\/span>\n                                    <\/span>\n                                                                                                \n                                \n                                                            <\/span>\n                        <\/div>\n                    <\/div>\n                <\/div>\n            <\/div>\n        <\/li>\n        <\/ul>\n<\/div>[\/vc_column][\/vc_row]\n<\/div>","protected":false},"excerpt":{"rendered":"<p>In this article on IPSec, we want to pick up our March 2019 article ESAE Series Part 5 &#8211; Windows IPSec and add some additional considerations. As written about in this post IPSec (short for &#8220;Internet Protocol<\/p>\n","protected":false},"author":14,"featured_media":6153,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[10],"tags":[],"class_list":["post-6141","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/posts\/6141","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/comments?post=6141"}],"version-history":[{"count":9,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/posts\/6141\/revisions"}],"predecessor-version":[{"id":6159,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/posts\/6141\/revisions\/6159"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/media\/6153"}],"wp:attachment":[{"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/media?parent=6141"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/categories?post=6141"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.teal-consulting.de\/en\/wp-json\/wp\/v2\/tags?post=6141"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}