Re: Snort with IPSec

[Frank Knobbe <frank () knobbe us>]

On Tue, 2003-11-04 at 13:02, Josh Berry wrote:
> I understand the overhead and difficulty.  I just want to know if it is
> technically feasible.  The reason I am asking is that one of the directors
> where I work is considering implementing site wide IPSec encryption for
> every connection on the internal network.  This will make internal attacks
> impossible to see, therefore I cannot just sit the IDS behind the VPN
> because essentially the whole network will be one big VPN.

What is the reason/business case behind this? Do the benefits you gain
really outweigh the drawbacks? 

Curious,
Frank

Attachment: signature.asc
Description: This is a digitally signed message part