- Planning an IPSec Deployment
- Configuring IPSec Policies
- Deploying and Managing IPSec Policies
- Exam Prep Questions
This chapter is from the book
This chapter is from the book
This chapter is from the book
Configuring IPSec Policies
You should understand that IPSec is designed to be an end-to-end security model that secures traffic between clients and servers. The IP address of the computer does not necessarily have to be the entity that is considered; rather, the system that uses the IP address is validated through an authentication process. This allows you to deploy IPSec to a computer, domain, site, or any container within your Active Directory (AD).
In addition, because there are many ways to authenticate, IPSec can be used to secure local area network (LAN) communications, wide area network communications, and remote access communications as well. This is accomplished through the configuration of IPSec policies that contain rules and filters. The rules and filters that you use will depend on what you are securing and how much protection it requires. You should be familiar with the following configuration options using IPSec:
Transport mode
Tunnel mode
IPSec policy rules
Transport Mode
Transport mode is the default mode for IPSec. It is used for end-to-end security between a client and a server within a LAN. IPSec can encrypt the payload of each packet to protect the integrity and confidentiality of the data that it contains. As an alternative, IPSec can simply be used to ensure that the communication came from the indicated source and that the communication hasn't been intercepted or tampered with while in transit. Based on your own security needs, you can configure IPSec for one of the following:
Authentication Header (AH) transport mode
Encapsulating Security Payload (ESP) transport mode
Authentication Header (AH) Transport Mode
Authentication Header (AH) provides for authentication, integrity, and anti-replay of each packet without encrypting the data. In other words, the data remains readable but is protected from modification. AH uses a system of keyed hash algorithms to sign the packet to ensure its integrity. In this way, you can be assured that a packet did originate from its indicated source and that it has not been modified in transit. This is accomplished by placing an AH header in each packet between the IP header and the IP payload. You can configure custom data integrity and encryption settings, as illustrated on Figure 3.8. Configuring custom settings requires the following steps:
Locate or create an IPSec policy in a computer's Local Settings, a domain's Default Security Policy, or a Group Policy Object.
Right-click the IPSec policy.
Click Properties.
Select the Default Response rule.
Click Edit.
On the Security Methods tab, click Edit.
Select Custom.
Click Settings.
NOTE
AH does not encrypt the data within the packets sent.
)
Figure
3.8 PSec can be used to protect the integrity of a packet using AH.
Encapsulating Security Payload (ESP) Transport Mode
Encapsulating Security Payload (ESP) provides everything that AH does and also provides for the confidentiality of the packet during transit. In transport mode, the entire packet is not encrypted or signed; rather, only the data in the IP payload is encrypted and signed. The authentication process ensures that the packet originated from the indicated sender, and the fact that the data was encrypted ensures that it wasn't viewed or modified during transit. This is accomplished by placing an ESP header before the IP payload and an ESP trailer after the IP payload, further encapsulating only the IP payload.
CAUTION
ESP does not sign the entire packet—only the IP payload itself is encrypted.
Tunnel Mode
IPSec tunnel mode encrypts the IP header and the payload during transit. In this way, tunnel mode provides protection for the entire packet. An entire IP packet is first encapsulated with an AH or ESP header, and then the result is encapsulated with an additional IP header. The additional IP header contains the source and destination of the tunnel endpoints. After the packet reaches the first destination at the tunnel endpoint, it can be decapsulated and sent to the final destination by reading the IP address.
This double encapsulation makes tunnel mode suitable for protecting traffic between network systems. It can be used when traffic must pass through an untrusted medium such as the Internet. It is therefore most often used with gateways or end-systems that do not support L2TP/IPSec or PPTP connections. You can use IPSec tunnel mode for the following configurations:
Gateway to gateway
Server to gateway
Server to server
As with transport mode IPSec, tunnel mode IPSec can be used in AH mode or in ESP mode. The concept is very much the same except that the packets are encapsulated twice. You can configure IPSec tunnel mode for the following:
AH tunnel mode
ESP tunnel mode
Authentication Header (AH) Tunnel Mode
AH tunnel mode encapsulates an IP packet by placing an AH header between the internal IP header and the external IP header. AH then signs the entire packet for integrity and authentication. This is illustrated in Figure 3.9.
Encapsulating Security Payload (ESP) Tunnel Mode
ESP mode encapsulates an IP packet with an ESP header, IP header, and ESP trailer. This has the effect of protecting the IP header, trailer, and payload. The entire packet is then encapsulated into a new IP tunnel header, which contains the IP addresses of the endpoints of the tunnel. This is illustrated in Figure 3.10.
TIP
Transport mode IPSec is used for secure communications between client and servers in a LAN, whereas tunnel mode is used for secure communication between networks.
)
Figure
3.9 In AH tunnel mode, authentication headers are placed between the
internal IP header and the external IP header of each packet.
)
Figure
3.10 In ESP tunnel mode, the entire packet is encapsulated into a new IP
tunnel header, which contains the IP addresses of the endpoints of the tunnel.
IPSec Policy Rules
Whether you use transport mode or tunnel mode for IPSec, the behavior of the system will be determined and controlled by the rules that you configure. Windows Server 2003 comes installed with some basic rules, but these are only to be used for examples because they offer no real security for your network. You should configure rules based on the security requirements of your organization. How you configure the rules of a policy will determine how it will be used and ultimately whether it will be in transport mode or tunnel mode.
Each IPSec policy consists of one of more rules that will determine the behavior of the policy. The rules are configured on the Rules tab of the properties of an IPSec policy, as shown in Figure 3.11. You can access the Rules tab by right-clicking a policy and clicking Properties. Each rule can contain settings for the following:
Filter list
Filter action
Authentication methods
Tunnel endpoint
Connection type
)
Figure
3.11 You can configure the properties of each IPSec rule.
Filter List
You configure a filter list by selecting the IP Filter List tab in the properties of an IPSec rule (see Figure 3.12). In the resulting IP Filter List dialog box, a single filter list can contain multiple predefined packet filters that allow traffic to be identified by the list. After the traffic is identified, then the filter action can be applied. Filter lists can identify traffic based on its source, destination, and protocol. You can set both inbound and outbound filters in an IPSec policy.
)
Figure
3.12 You can configure multiple filter lists in a single IPSec policy.
Filter Action
A filter action is set for each type of traffic as identified by a filter list. The filter actions from which you can choose include Permit, Block, or Negotiate Security for the packets that match the filter list. If Negotiate Security is selected, one or more security methods can be selected. Filter actions are configured on the Filter Action tab in the properties of an IPSec rule. As mentioned previously, the system automatically processes multiple filters in order of specificity, starting with the most specific.
Authentication Methods
You can configure one of more authentication methods to be used in main mode during negotiations. The available authentication methods (as discussed previously) are Kerberos V5, certificates, and preshared keys. You should only use preshared keys as a last resort. You can configure these using the Authentication Methods tab in the properties of an IPSec rule.
Tunnel Endpoint
When you configure a tunnel endpoint as part of a rule, you are setting up one end of tunnel mode IPSec. You must also configure the other end of the tunnel with the same rule and its corresponding tunnel endpoint. This establishes the IP addresses that will be used when the packet is encapsulated before being sent through the tunnel. You should configure the tunnel endpoint on the Tunnel Setting tab in the properties of the IPSec rule to which it applies.
Connection Type
The connection type specifies whether this rule applies to LAN communications, dial-up, or both. The connection type setting can be used to specify rules based on the inherent protocols and technologies that your connection uses. In other words, LAN communications will certainly use different protocols (rules) than dial-up communications and will therefore require different IPSec rules as well.