IPSec Blocking is not working

I've successfully used IPSec Policies to block specific devices and or ports
from communicating with domain members.

Now there's this new DNS server vulnerability -- one of the suggested
methods is to use IPSec to block ports above 1024.

Now in IPSec I don't know if it's possible to block port ranges. You can
allow/deny individual ports, but I haven't seen any way to specify a range.

In this case I workied around this. I created an IPSec policy that allows
only specific subnets the "allow" rule.

Now in the KB link that is provided it says something like "if you create an
allow rule, you must also create a deny rule, otherwhise it will just allow
all traffic". This indeed was the case.

So I created a second rule in the policy to deny all traffic. I'm thinking
here that the policy engine is smart enough to merge these two together.
After all the KB article suggested this.

However when I did this, it acts as if the "permit" rule is being ignored
and just blocks everything.

Does anyone know if I am doing anything wrong here? How can you combine
allow and deny rules in IPSec to restrict to only specific devices or subnets
for example?

Thanks!

"Kevin K" <(E-Mail Removed)> wrote in message
news:52492C11-6118-4A62-9DEE-(E-Mail Removed)...
> I've successfully used IPSec Policies to block specific devices and or ports
> from communicating with domain members.
>
> Now there's this new DNS server vulnerability -- one of the suggested
> methods is to use IPSec to block ports above 1024.

That would be insane,...plain rediculas,...why would anyone suggest something so
rediculas.

What difference does the so-called vulnerability make when your DNS is on the
internal LAN and not exposed to the Internat and is not the Publicly
Authoritative DNS for whatever Public Domain Name you have, and does not have
public machines/users querying it for resolution of your Public Domain Name?

Patch the machine with the patch when it is released and forget it.


--
Phillip Windell
www.wandtv.com

The views expressed, are my own and not those of my employer, or Microsoft, or
anyone else associated with me, including my cats.
-----------------------------------------------------