IIS/SQL encrypt traffic between servers?

[gatoradeguy]

How are most of you encrypting the traffic between your IIS box and backend SQL databases? if u are.

I have done some research and I've typically found these:

IPSec- this will work fine in our environment but has anyone experienced any performance overhead?

SSL connection - has anyone tried this?

server certificate

Other?

Any feedback will be greatly appreciated. It's absolutely required that I encrypt all traffic between the web and backend database server.

 

[gatoradeguy]

does anyone encrypt traffic between the two boxes?

 

[mrdenny]

I've never actually encrypted the traffic between the two. I've always had them on the same network.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)

 

[drtree]

I've never tried this before either, but I would imagine that using IPSec would increase overhead - the processor will have to encrypt/decrypt the data. Depending on your setup, you could set the SQL Server to Request Encryption and the IIS box to use the Client (Respond) policy - this would allow all communications between the 2 boxes to be encrypted and would let your clients, who are not using IPSec, to connect to the IIS box. I'd get 2 other computers in your domain and set them up before doing anything to the production boxes.

HTH,

Doc Tree

 

[mrdenny]

There are network cards out there that can handle the IPSec at a hardware level thereby removing the load from the CPU. These would probably be a good bet for you. Check with for server vendor for more info.

Denny
MCSA (2003) / MCDBA (SQL 2000)

--Anything is possible. All it takes is a little research. (Me)

http://www.mrdenny.com

(My very old site)