11 SECURING NETWORK TRAFFIC WITH IPSEC Chapter 6

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC2 GOALS OF IPSEC  Protects the contents of IP packets  Provides defense against network attacks  Protects the contents of IP packets  Provides defense against network attacks

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC3 PROTECTING AGAINST SECURITY ATTACKS

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC4 WHAT IS IPSEC? IPSec is an architectural framework that provides cryptographic security services for IP packets.

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC5 IPSEC SECURITY FEATURES  Automatic security association (SA)  IP packet filtering  Network layer security  Peer authentication  Data origin authentication  Data integrity  Data confidentiality  Anti-replay  Key management  Automatic security association (SA)  IP packet filtering  Network layer security  Peer authentication  Data origin authentication  Data integrity  Data confidentiality  Anti-replay  Key management

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC6 NEW IPSEC FEATURES IN MICROSOFT WINDOWS SERVER 2003  The IP Security Monitor snap-in  Stronger cryptographic master key  The Netsh command-line tool  Computer startup security  Persistent policies  Improved IPSec functionality over Network Address Translation (NAT)  Improved load balancing  Resultant Set of Policies (RSoP)  The IP Security Monitor snap-in  Stronger cryptographic master key  The Netsh command-line tool  Computer startup security  Persistent policies  Improved IPSec functionality over Network Address Translation (NAT)  Improved load balancing  Resultant Set of Policies (RSoP)

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC7 IPSEC PROTOCOLS  Authentication Header (AH)  Encapsulating Security Payload (ESP)  Authentication Header (AH)  Encapsulating Security Payload (ESP)

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC8 IPSEC MODES  Transport mode  Tunnel mode  Transport mode  Tunnel mode

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC9 SECURITY ASSOCIATIONS (SAs)  Internet Security Association and Key Management Protocol (ISAKMP)  IPSec  Security Parameters Index (SPI)  Internet Security Association and Key Management Protocol (ISAKMP)  IPSec  Security Parameters Index (SPI)

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC10 INTERNET KEY EXCHANGE (IKE)  Oakley Key Determination Protocol  Diffie-Hellman key exchange  Dynamic rekeying  Oakley Key Determination Protocol  Diffie-Hellman key exchange  Dynamic rekeying

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC11 IPSEC POLICY AGENT SERVICE

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC12 IPSEC DRIVER

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC13 SECURITY NEGOTIATION PROCESS

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC14 IPSEC SECURITY POLICIES

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC15 COMPONENTS OF IPSEC POLICIES

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC16 DEFAULT IPSEC SECURITY POLICIES  Server (Request Security)  Client (Respond Only)  Secure Server (Require Security)  Server (Request Security)  Client (Respond Only)  Secure Server (Require Security)

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC17 DEPLOYING IPSEC POLICIES  Using local policies  Using the Active Directory directory service  Mixed-mode environment  Persistent policies  Using local policies  Using the Active Directory directory service  Mixed-mode environment  Persistent policies

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC18 IMPLEMENTING IPSEC USING CERTIFICATES  X.509 certificates  Role of a certification authority (CA)  X.509 certificates  Role of a certification authority (CA)

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC19 CONFIGURING IPSEC TO USE A CERTIFICATE

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC20 IPSEC AND NAT  Problems associated with IPSec and NAT  IKE over NAT  Problems associated with IPSec and NAT  IKE over NAT

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC21 MONITORING IPSEC USING IP SECURITY MONITOR

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC22 IPSEC-RELATED EVENTS IN EVENT VIEWER

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC23 USING NETSH AND NETDIAG TO MANAGE AND MONITOR IPSEC

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC24 SUMMARY  The purpose and features of IPSec in a Windows Server 2003 environment  IPSec protocols—AH and ESP  IPSec modes—transport and tunnel  SAs  IKE  IPSec Policy Agent  The purpose and features of IPSec in a Windows Server 2003 environment  IPSec protocols—AH and ESP  IPSec modes—transport and tunnel  SAs  IKE  IPSec Policy Agent

Chapter 6: SECURING NETWORK TRAFFIC WITH IPSEC25 SUMMARY (continued)  IPSec security policies  Deploying IPSec security policies  IPSec and NAT  Tools for managing and monitoring IPSec  IPSec security policies  Deploying IPSec security policies  IPSec and NAT  Tools for managing and monitoring IPSec