Quick Check Facts for Windows Server 2008, Active Directory Network Infrastructure

IPv6 
IPv6 Addressing

• IPv6 address space is 128 bits (16 bytes)
• Large address space. Divided along 16-bit boundaries, converted to 4 digit hexadecimal numbers, separated by colons - known as colon hexadecimal .
• Simpler host configuration. IPv6 supports dynamic client configuration by using DHCPv6 and IPv6 also enables routers to configure hosts dynamically.
• Improved routing efficiency. Reduces how many routes the Internet must process by supporting hierarchical routing.
• Built-in security. IPv6 ensures all hosts encrypt data while in transit by including native IPSec support.
• IPv6 address types
• Unicast. Packets delivered to a unicast address are delivered to a single interface, one-to-one communication
• Multicast. Packets are delivered to multiple interfaces, one-to-many. One-to-many communication between computers that are defined as using the same multicast address. Multicast addresses have the first 8 bits set to 1111 1111 or FF
• Anycast. Identifies multiple interfaces, but delivered to a single interface, the closest one.  Used for locating services or the nearest router.
• Global Unicast address
• Equivalent to IPv4 public addresses
• Identified by the FP (Format Prefix) of 001 (globally routable and reachable on the IPv6 Internet
• The scope of a global unicast address is the entire IPv6 Internet
• The address prefix of a currently assigned global address is 2000::/3
• The combination of the first 3 high-order fixed bits and the 45-bit Global Routing Prefix is a 48-bit prefix assigned to an individual site
• The next 16 bits are the Subnet ID 
• The Interface ID field is the next 64-bits 

Troubleshooting IPSEC

IPSec Monitoring Tools

Tool	Description
IP Security Monitor	Used as a MMC snap-in with Windows XP and higher Administrators can use it locally or remotely to monitor IPSec policy
Ipsecmon	Command-line tool Only available in Windows 2000
Windows Firewall with Advanced Security	New to Windows Vista and Windows Server 2008
Netsh	Perform a trace, located in systemroot\debug\oakley.log Enabled in Windows XP and Windows 2000 with registry modification

IP Security Monitor

The IP Security Monitor snap-in is used to view and monitor IP-Sec policy. The IP Security Monitor can be used to troubleshoot and test IPSec policies you create. 

In previous versions of Windows, we used IP Security Monitor as a snap-in in the MMC. With Windows Server 2008, the IP Security Monitor is now integrated with the Windows Firewall with Advanced Security (WFAS). 

Configuring IPSec

Even though you can encrypt your data stored on your hard drive, how do you protect the data while it is in transmission? IPSec can do this. 

IPSec (Internet Protocol Security) is a set of protocols that give you a level of encryption between two computers while it is being transferred over an unsecured network.  IPSec uses security services and digital certificates with public and private keys. As stated in Mark Russinovich's and David Solomon's Windows Internals Book:

Internet Protocol Security (IPSec), which is integrated with the Windows TCP/IP stack, helps to protect unicast (IPSec itself supports multicast, but the Windows implementation does not) IP data against attacks such as eavesdropping, sniffer attacks, data modification, IP address spoofing, and man-in-th-middle attacks (when the identity of the remote machine can be verified, like a VPN). You can use IPSec to provide defense-in-depth against network-based attacks from untrusted computers; certain attacks that can result in the denial-of-service of applications, services, or the network; data corruption, data theft, and user-credential theft; and the administrative control over servers, other computers, and the network. IPSec helps defend against network-based attacks through cryptography-based security services, security protocols, and dynamic key management.

IPSec was originally designed to secure traffic over public networks. However, IPSec is being used increasingly on private networks. Windows Server 2008 provides enhancements to the IPSec rules.

Windows Internals Book