Module 8: Planning and Troubleshooting IPSec

Overview Understanding Default Policy Rules Planning an IPSec Deployment Troubleshooting IPSec Communications

Lesson: Understanding Default Policy Rules Multimedia: Overview of IPSec Rules for an IPSec Connection Default IPSec Policies Client (Respond Only) Default Policy Rules Server (Request Security) Default Policy Rules Secure Server (Require Security) Default Policy Rules

Multimedia: Overview of IPSec The objective of this presentation is to explain that IPSec is a framework of open standards for ensuring secure, private communication over Internet Protocol networks You will learn how to:  Identify the processes for data encryption, decryption, or signing  Explain the functionality of the IPSec policy agents and drivers  Define the functionality of the ISAKMP service  Explain how the IPSec policy triggers the encryption of data between two computers

Rules for an IPSec Connection RuleDescription IP filter list Specifies which network traffic will be secured, by using inbound and outbound filters Filter action Specifies how traffic matching the filter will be handled (dropped, encrypted, and so on) Authentication methods Specifies how two computers will authenticate themselves to each other (Kerberos, preshared key, or X509 certificates) Tunnel endpoint Allows you to specify a tunnel endpoint for IPSec tunnels Connection type Allows the rule to be applied to LAN traffic, WAN traffic, or both

Default IPSec Policies IPSec uses polices and rules to secure network traffic Rules are composed of:  The type of traffic to match  What to do when traffic matches  An authentication method  Either tunnel or transport mode  The connection type (LAN or WAN) Default polices include:  Client (Respond Only)  Server (Request Security)  Secure Server (Require Security) IPSec uses polices and rules to secure network traffic Rules are composed of:  The type of traffic to match  What to do when traffic matches  An authentication method  Either tunnel or transport mode  The connection type (LAN or WAN) Default polices include:  Client (Respond Only)  Server (Request Security)  Secure Server (Require Security)

Client (Respond Only) Default Policy Rules This policy has the following settings: First rule (default response rule) IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All First rule (default response rule) IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All This policy enables the computer on which it is active to respond to requests for secured communications USE

Server (Request Security) Default Policy Rules This policy has the following settings: This policy allows the entire communication to be unsecured if the other computer is not IPSec–enabled USE First rule IP Filter List: All IP Traffic Filter Action: Request Security (Optional) Authentication: Kerberos Tunnel Setting: None Connection Type: All First rule IP Filter List: All IP Traffic Filter Action: Request Security (Optional) Authentication: Kerberos Tunnel Setting: None Connection Type: All Second rule IP Filter List: All ICMP Traffic Filter Action: Permit Authentication: N/A Tunnel Setting: None Connection Type: All Second rule IP Filter List: All ICMP Traffic Filter Action: Permit Authentication: N/A Tunnel Setting: None Connection Type: All Third rule IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All Third rule IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All

Secure Server (Require Security) Default Policy Rules This policy has the following settings: All outbound communication to be secured, allowing only the initial inbound communication request to be unsecured USE First rule IP Filter List: All IP Traffic Filter Action: Require Security Authentication: Kerberos Tunnel Setting: None Connection Type: All First rule IP Filter List: All IP Traffic Filter Action: Require Security Authentication: Kerberos Tunnel Setting: None Connection Type: All Second rule IP Filter List: All ICMP Traffic Filter Action: Permit Authentication: None Tunnel Setting: None Connection Type: All Second rule IP Filter List: All ICMP Traffic Filter Action: Permit Authentication: None Tunnel Setting: None Connection Type: All Third rule IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All Third rule IP Filter List: Filter Action: Default Response Authentication: Kerberos Tunnel Setting: None Connection Type: All

Practice: Using Policy-Based Management In this practice, you will discuss the policy- based management of IPSec

Lesson: Planning an IPSec Deployment Determining the IPSec Policy Deployment Method Determining the Authentication Method to Use Determining IPSec Policy Needs Best Practices for Planning IPSec Guidelines for Planning an IPSec Deployment Using Active Directory Guidelines for Planning an IPSec Deployment Using Local Policies

Determining the IPSec Policy Deployment Method In a heterogeneous environment Active Directory Using Local Policies Using Active Directory

Determining the Authentication Method to Use Authentication method Use Kerberos V5 security protocol Clients and servers running Windows 2000 (and later versions) that are part of an Active Directory domain Public key certificate Internet access Remote access to corporate resources External business partners Computers that do not run the Kerberos V5 security protocol Preshared secret key When both computers must manually configure IPSec

Determining IPSec Policy Needs Identify enterprise needs  Evaluate potential threats to determine if IPSec can mitigate them  Identify rules and settings for your policy Create a new policy or modify an existing policy

Best Practices for Planning IPSec Best practices Evaluate the type of information being sent over your network Determine where your information is stored Evaluate your vulnerability to network attacks Design and document an enterprise-wide network security plan Test the IPSec policies in your security plan

Guidelines for Planning an IPSec Deployment Using Active Directory Evaluate Active Directory–based Group Policy for deployment Identify groups of computers that require security Determine where to assign Group Policy Object Evaluate security threats Determine if IPSec can mitigate threats Define the IPSec Policy

Guidelines for Planning an IPSec Deployment Using Local Policies Determine if local Group Policy is the best method for deployment Identify groups of computers that require security Determine if certificate infrastructure is in place Evaluate security threats Determine if IPSec can mitigate threats Determine how policies will be deployed

Practice: Planning an IPSec Deployment In this practice, you will determine the feasibility of a proposed IPSec deployment plan

Lesson: Troubleshooting IPSec Communications IPSec Troubleshooting Tools Viewing Key Exchange Information Using Event Viewer Verifying That a Policy Is Applied Using RSoP

IPSec Troubleshooting Tools Tool Uses IPSec Monitor snap-in Search for all matches for filters of a specific traffic type IP Security Policy Management snap-in Create, modify, and activate IPSec policies Active Directory Users and Computers and Group Policy Troubleshoot policy precedence issues Determine which policies are available, assigned, or applied Resultant Set of Policy (RSoP) Determine which policies are assigned, but not applied to clients Event Viewer View IPSec policy-related events Oakley log View details of the SA establishment process

Viewing Key Exchange Information Using Event Viewer Use Event Viewer to: Verify that security auditing is enabled View IPSec–related events in Event Viewer Verify that security auditing is enabled View IPSec–related events in Event Viewer

Verifying That a Policy Is Applied Using RSoP Using RSoP Logging mode queries  View all IPSec policies that are assigned to a specific client Planning mode queries  View all IPSec policies that are assigned to members of a Group Policy container

Practice: Troubleshooting IPSec Communications In this practice, you will troubleshoot an IPSec communication issue

Lab A: Troubleshooting IPSec Exercise 1: Planning IPSec for a LAN/WAN Environment Exercise 2: Troubleshooting an IPSec Infrastructure