1 / 18

Windows IP Security Filters

Windows IP Security Filters. October 23, 2002. Joe Klemencic jklemenc@fnal.gov Fermilab Business Services. What are IP Security Filters?. New feature in Windows 2000, XP & .NET Initially created to authenticate and encrypt communications

niveditha
Download Presentation

Windows IP Security Filters

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Windows IP Security Filters October 23, 2002 Joe Klemencicjklemenc@fnal.govFermilab Business Services

  2. What are IP Security Filters? • New feature in Windows 2000, XP & .NET • Initially created to authenticate and encrypt communications • Packet Filtering method adopted by Microsoft during Windows 2000 beta testing

  3. Intended Usage • Authenticate host connections • Negotiate encryption schemes • Filter access to services by host/subnet It is important to note that the Authentication schemes are not User based authentication, but Machine based authentication.

  4. Default Defined Policies • Client (Respond Only) • Request Security (Server) • Require Security (Server) Clients attempting to connect to resources that require Authentication and/or Encryption must have an appropriately configured response policy.

  5. IP Security Policy Creation • Group Policy Editor (gpedit.msc) MMC Snap-In GUI manager • Group Policy Editor within an Active Directory OU Properties • IPSECPOL.EXE command line utility from the W2K Resource Kit (Windows 2000) • IPSECCMD.EXE command line utility from the Support Tools on the media CD (XP & .NET) Proper planning and testing is the key to a successful policy creation and implementation

  6. Anatomy of an IP Security Policy • An IP Security Policy consists of: • IP Filters • Define who, what, where • Source IP/Network Address • Destination IP/Network Address • Protocol/Port/Service • IP Filter Actions • Define how • Permit • Block • Negotiate Security (Authenticate/Encrypt) • Kerberos (Requires W2K Domain) • PKI • Shared Key

  7. IP Security Filter Modes • Dynamic Mode • Adds anonymous rules to the policy agent • Can co-exist with a DS based policy • Static Mode • Creates or modifies the stored policy • Overwrites current named policy or activates new named policy

  8. IP Filter Evaluation Order Rule Evaluation is from Most Granular to Least Specific 1. My IP Address 2. Specific IP Address Defined 3. Specific IP Subnet 4. Any IP Address A. Specific Protocol/Port combination B. Specific Protocol/Any Port C. Any Protocol

  9. IP Filter Evaluation Order (cont) Visualize filter rule processing by applying weights Source/Destination Addresses: My IP Address: 3 Specific IP Address: 2 Specific Network: 1 Any Address: 0 Protocol Used: Specified (TCP/UDP/ICMP/RAW/…): 1 Any Protocol: 0 Source/Destination Service Ports: Specified (23/80/135/137/139/443/445…): 1 Any Port: 0

  10. IP Filter Evaluation Order (cont) Source Src Port Dest Dest Port Protocol Action Any Any MyIP Any Any Block 0 0 3 0 0 = 3 Any Any MyIP 80 TCP Permit 0 0 3 1 1 = 5 10.1.1.0 Any MyIP Any Any Permit 1 0 3 0 0 = 4 10.1.1.0 Any MyIP 139 TCP Block 1 0 3 1 1 = 6 In this example, all traffic from the 10.1.1.0 network, except TCP/139 would be allowed. Also allow TCP/80 traffic from anywhere would be allowed. All other traffic will be blocked.

  11. Mirroring vs. Reverse Rules • The Mirror Rule option is only activated when defining Authentication or Encryption Filter Actions • When creating simple Permit/Block Packet Filters, always create the reverse rule at the same time to prevent inadvertent denial of legitimate traffic • BUT…. The reverse rule may inadvertently allow unsolicited connectivity

  12. Reverse Rule • Consider the following: Src Src-Port Dst Dst-Port Prot Action MyIP Any Any 80 TCP Permit Any 80 MyIP Any TCP Permit Any Any MyIP Any Any Block In this ruleset, we are allowing the local machine to surf the Internet while prohibiting all other communication. An attacker could use a port-redirector and still connect to the local machine’s NetBios service as long as they source their connection from TCP/80.

  13. Sample Implementation Scenarios Simple Packet Filtering Allow Web services from everywhere, but restrict FTP from only certain hosts Src Src-Port Dst Dst-Port Prot Action Any Any MyIP 80 TCP Permit MyIP 80 Any Any TCP Permit MyNet Any MyIP 21 TCP Permit MyNet Any MyIP 20 TCP Permit MyIP 21 MyNet Any TCP Permit MyIP 20 MyNet Any TCP Permit Any Any MyIP 21 TCP Block Any Any MyIP 20 TCP Block

  14. Sample Implementation Scenarios Service Authentication Allow normal traffic from network, but request a Host to Kerberos authenticate from Wireless network Src Src-Port Dst Dst-Port Prot Action WLAN Any MyIP Any Any Kerberos Auth (auto-mirror) This authentication is separate from the Application Authentication Mechanism

  15. Sample Implementation Scenarios Service Encryption Encrypt communications between servers while allowing for unencrypted traffic from workstations. Also, block communications from non-local workstations Src Src-Port Dst Dst-Port Prot Action DC1 Any MyIP Any Any Kerberos Auth & Encrypt (auto-mirror) MyIP Any DC1 Any Any Kerberos Auth & Encrypt (auto-mirror) MyNet Any MyIP Any Any Permit MyIP Any MyNet Any Any Permit Any Any MyIP Any Any Block

  16. Usage Caveats Certain traffic is not inspected by an IP Policy • Anything with a source port of 88 (Kerberos)* • IKE • Multicast Traffic • Broadcast Traffic • RSVP/Quality of Service *This behavior may be changed by setting the following value in the Registry: HKLM\SYSTEM\CurrentControlSet\Services\IPSEC\NoDefaultExempt DWORD=1 See Microsoft Q253169 article for more information

  17. Usage Caveats (cont) • No logging available when using as a Packet Filter • Because of Rule Evaluation Order, an ill-defined rule may allow traffic intended to be blocked • Difficult to implement Packet Filtering on General Use Workstations, but optimal for Kiosks and Servers

  18. Further Reading Securing W2K with IP Filters: Part 1 (Step-by-Step How-To Guide) http://online.securityfocus.com/infocus/1559 Securing W2K with IP Filters: Part 2 (Implementing Encryption) http://online.securityfocus.com/infocus/1566 Using IPSEC to Lock Down a Server http://www.microsoft.com/serviceproviders/columns/using_ipsec.asp Active Directory Replication Over Firewalls http://www.microsoft.com/serviceproviders/columns/config_ipsec_P63623.asp Microsoft Q254949 Article: Domain Controller IPSEC Support http://support.microsoft.com/default.aspx?scid=kb;en-us;Q254949 How to Enable IPSEC Through a Firewall http://support.microsoft.com/default.aspx?scid=kb;en-us;Q233256

More Related