Using IPsec to Protect Servers

You can use a block-all-except policy to protect servers. On extremely heavily loaded servers, performance under IPsec block/allow policies can suffer. RRAS packet filters do better but they aren't manageable.

Notes are taken from Protect Your Windows Network : From Perimeter to Data by Jesper M. Johansson, Steve Riley.