6421 b Module-09
•Download as PPTX, PDF•
1 like•321 views
Module 9: Increasing Security for Network Communication Internet Protocol security (IPsec) is a framework of open standards for protecting communications over IP networks through cryptographic security services. IPsec supports network-level peer authentication, data-origin authentication, data integrity, data confidentiality (encryption), and replay protection. The Microsoft IPsec implementation is based on standards that the Internet Engineering Task Force (IETF) IPsec working group developed. In this module, you will learn how to implement, configure, and troubleshoot IPsec. Lessons Overview of IPsec Configuring Connection Security Rules Configuring NAP with IPsec Enforcement Monitoring and Troubleshooting IPsec Lab : Increasing Security for Network Communication Selecting a Network Security Configuration Configuring IPsec to Authenticate Computers Testing IPsec Authentication After completing this module, students will be able to: Describe when and how to use IPsec. Configure Connection Security rules. Configure IPsec with NAP Enforcement. Describe how to monitor and troubleshoot IPsec.
Report
Share
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to 6421 b Module-09
Similar to 6421 b Module-09 (20)
More from Bibekananada Jena
Recently uploaded
Recently uploaded (20)
6421 b Module-09
- 1. Module 9 Increasing Security for Network Communication
- 2. Module Overview • Configuring IPsec • Configuring Connection Security Rules • Configuring NAP with IPsec Enforcement • Monitoring and Troubleshooting IPsec
- 3. Lesson 1: Overview of IPsec • Benefits of IPsec • Ways to Use IPsec • How Domain Isolation Works • Tools Used to Configure IPsec • Demonstration: How to Configure IPsec Settings
- 4. Benefits of IPsec IPsec is a suite of protocols that allows secure, encrypted communication between two computers over an unsecured network • IPsec has two goals: to protect IP packets and to defend against network attacks • Configuring IPsec on sending and receiving computers enables the two computers to send secured data to each other • IPsec secures network traffic by using encryption and data signing • An IPsec policy defines the type of traffic that IPsec examines, how that traffic is secured and encrypted, and how IPsec peers are authenticated
- 5. Ways to Use IPsec Recommended uses of IPsec include: • Packet filtering • Authenticating and encrypting host-to-host traffic • Authenticating and encrypting traffic to servers • L2TP/IPsec for VPN connections • Site-to-site tunneling • Enforcing logical networks
- 6. How Domain Isolation Works To isolate a domain, configure the following components: • An AD DS domain • Member computers • Group Policy settings • Active IPsec policy settings To deploy domain isolation, configure GPO to require that all incoming connection requests and subsequent data be authenticated and protected by using IPsec
- 7. Tools Used to Configure IPsec To configure IPsec, you can use: • Windows Firewall with Advanced Security MMC (used for Windows Server 2008 R2 and Windows 7) • IP Security Policy MMC (Used for mixed environments and to configure policies that apply to all Windows versions) • Netsh command-line tool
- 8. Demonstration: How to Configure IPsec Settings In this demonstration, you will see how to: • View existing IPsec policies in Group Policy • Create a custom IPsec policy • Create a security rule • Create a new IP filter • Completing the Security Rule Wizard • Completing the IP Security Rule Wizard
- 9. Lesson 2: Configuring Connection Security Rules • What Are Connection Security Rules? • What Are Tunnel and Transport Modes? • Choosing Authentication Requirements • Authentication Methods • Demonstration: How to Configure a Connection Security Rule
- 10. What Are Connection Security Rules? Connection security rules involve: • Authenticating two computers before they begin communications • Securing information being sent between two computers • Using key exchange, authentication, data integrity, and data encryption (optionally) How firewall rules and connection rules are related: • Firewall rules allow traffic through, but do not secure that traffic • Connection security rules can secure the traffic, but creating a connection security rule does not allow traffic through the firewall
- 11. What Are Tunnel and Transport Modes? Encrypted IP Packet ESP TRLR ESP Auth ESP HDR New IP HDR IP HDR Data ESP Tunnel Mode ESP Transport Mode Encrypted Data ESP TRLR ESP Auth ESP HDRIP HDR IP HDR Data
- 12. Choosing Authentication Requirements Option Description Request Authentication for inbound and outbound connections Ask that all inbound/outbound traffic be authenticated, but allow the connection if authentication fails Require authentication for inbound connections and request authentication for outbound connections • Require inbound be authenticated or it will be blocked • Outbound can be authenticated but will be allowed if authentication fails Require authentication for inbound and outbound connections Require that all inbound/outbound traffic be authenticated or the traffic will be blocked
- 13. Choosing an Authentication Method Method Key Points Default Use the authentication method configured on the IPsec Settings tab Computer and User (Kerberos V5) You can request or require both the user and computer authenticate before communications can continue; domain membership required Computer (Kerberos V5) Request or require the computer to authenticate using Kerberos V5 Domain membership required User (Kerberos V5) Request or require the user to authenticate using Kerberos V5; domain membership required Computer certificate • Request or require a valid computer certificate, requires at least one CA • Only accept health certificates: Request or require a valid health certificate to authenticate, requires IPsec NAP Advanced Configure any available method; you can specify methods for First and Second Authentication
- 14. Demonstration: How to Configure a Connection Security Rule In this demonstration, you will see how to: • Enable ICMP traffic on NYC-SVR1 • Create a server to server rule on NYC-SVR1 • Create a server to server rule on NYC-CL1 • Test the rule
- 15. Lesson 3: Configuring IPsec NAP Enforcement • IPsec Enforcement for Logical Networks • How IPsec NAP Enforcement Works • Deploying NAP with IPsec Enforcement
- 16. IPsec Enforcement for Logical Networks SHAs NAP agent NAP ECs Restricted Network Boundary Network Secure Network Non-NAP capable client Non-compliant NAP client NAP enforcement servers Remediation servers Compliant NAP client Secure servers NPS servers HRA VPN 802.1X DHCP NPS proxy SHAs NAP agent NAP ECs NAP administration server Network policies NAP health policies Connection request policies SHVs Certificate services E-mail servers NAP policy servers
- 17. IPsec NAP Enforcement includes: • Policy validation • NAP enforcement • Network restriction • Remediation • Ongoing monitoring of compliance How IPsec NAP Enforcement Works Intranet Remediation Servers Internet NAP Health Policy Server DHCP Server Health Registration Authority IEEE 802.1X Devices Active Directory VPN Server Restricted Network NAP Client with limited access Perimeter Network
- 18. Deploying NAP with IPsec Enforcement To deploy NAP with IPsec and HRA, you must: Configure relevant NPS policies Enable the NAP IPsec client-enforcement agent Install health registration authority Install and configure AD CS Configure Group Policy settings 1 2 3 4 5 Configure WSHVs6
- 19. Lesson 4: Monitoring and Troubleshooting IPsec • Monitoring IPsec by Using Windows Firewall with Advanced Security • Monitoring IPsec by Using IP Security Monitor • Troubleshooting IPsec
- 20. Monitoring IPsec by Using Windows Firewall with Advanced Security • Use the Connection Security Rules and Security Associations nodes to monitor IPsec connections • Security Associations that can be monitored include: • Main Mode • Quick Mode The Windows Firewall in Windows 7 and Windows Server 2008 R2 incorporates IPsec
- 21. Monitoring IPsec by Using IP Security Monitor Options for using the IP Security Monitor: • Modify IPsec data refresh interval to update information in the console at a set interval • Allow DNS name resolution for IP addresses to provide additional information about computers connecting with IPsec • Computers can monitored remotely: • To enable remote management editing, the HKLMsystemcurrentcontrolsetservicespolicyagent key must have a value of 1 • To Discover the Active security policy on a computer, examine the Active Policy Node in the IP Security Monitoring MMC • Main Mode Monitoring monitors initial IKE and SA: • Information about the Internet Key Exchange • Quick Mode Monitoring monitors subsequent key exchanges related to IPsec: • Information about the IPsec driver
- 22. Troubleshooting IPsec Stop the IPsec Policy Agent and use the ping command to verify communications Verify firewall settings Start the IPsec Policy Agent and use IP Security Monitor to determine if a security association exists Verify that the policies are assigned Review the policies and ensure they are compatible 1 2 3 4 5 Use IP Security Monitor to ensure that any changes are applied6
- 23. Lab: Increasing Security for Network Communication • Exercise 1: Selecting a network security configuration • Exercise 2: Configuring IPsec to Authenticate Computers • Exercise 3: Testing IPsec Authentication Estimated time: 45 minutes Logon information Virtual machines 6421B-NYC-DC1 6421B-NYC-SVR1 6421B-NYC-CL1 User name ContosoAdministrator Password Pa$$w0rd
- 24. Lab Scenario Contoso Ltd. has implemented a new web-based Research application that contains confidential information such as product information. The application is secured by authenticating users by using a username and password. To enhance security, the director of Research would like the application to be accessible only from computers in the Research department. To meet the requirements specified by the director of Research, you will create a connection security rule that authenticates the computers in the Research department. Then you will create a firewall rule that ensures only authenticated computers from the Research department can access the application.
- 25. Lab Review • In the lab, you created an OU-specific policy for a specific application. If Contoso wanted to create a domain isolation rule, how would you go about it? • What method of authentication would you select?
- 26. Module Review and Takeaways • Review Questions • Tools