Module 10: Windows Firewall and Caching Fundamentals

Overview of Perimeter Security Windows Firewall Overview Creating Windows Firewall Rules Monitoring and Troubleshooting Windows Firewall

Lesson 1: Overview of Perimeter Security Discussion: Security Concerns for a Perimeter Network What Is A Proxy Server? What Is a Reverse Proxy Server? What Is a Host-based Firewall?

Discussion: Security Concerns for a Perimeter Network What are some of the resources that are located in a perimeter network? Why is a perimeter network more at risk than an internal network? What are some specific risks to perimeter network resources?

What Is A Proxy Server? A proxy server: Accepts request on behalf of a client computer Isolates client computers from resources Requires client computers to be configured to use the proxy server Uses caching to increase data access speed Can evaluate contents of packets not only port numbers Web Server Client Computer Proxy Server

What Is a Reverse Proxy Server? A reverse proxy: Accepts requests on behalf of a server Isolates servers from client computers Points to a single server Requires no client computer configuration Uses caching to reduce load on a server Web Server Client Computer Proxy Server

What Is a Host-based Firewall? A host-based firewall: Is a software firewall on the operating system Is effective on the internal network Allows software-based exceptions in addition to IP- and port-based exceptions

Lesson 2: Windows Firewall Overview What Is Windows Firewall? New Features in Windows Firewall Windows Firewall Administration Tools Options Available Through Basic Firewall Configuration Default Windows Firewall Configuration Demonstration: Basic Firewall Configuration

What Is Windows Firewall? Windows Firewall is: A host-based firewall Enabled by default Automatically configured when new roles and features are installed

New Features in Windows Firewall FeatureDescription Outbound rules Rules that control packets leaving the host Disabled by default Integration of IPsec rules Control the creation of IPsec connections Replaces IPsec policies Network profile integration Rules can apply to public, private, and/or domain networks New features in Windows Firewall include:

Windows Firewall Administration Tools Basic firewall configuration: Available through Control Panel Does not control outbound rules or IPsec Resembles earlier versions of Windows Firewall Windows Firewall with Advanced Security: Allows complete configuration of Windows Firewall Allows configuration of IPsec rules

Basic firewall configuration options include: Enable or disable Block all incoming connections Configure exceptions Specify enabled adapters Options Available Through Basic Firewall Configuration

Default Windows Firewall Configuration The default Windows Firewall configuration is: All inbound connections are blocked All outbound connections are allowed Inbound exceptions are automatically modified for new roles and features

Demonstration: Basic Firewall Configuration In this demonstration, you will see how to perform basic firewall configuration

Lesson 3: Creating Windows Firewall Rules What Are Profiles? What Are Rules? What Are Rule Types? Rule Configuration Options What Are Connection Security Rules? Demonstration: Creating a Rule

What Are Profiles?

What Are Rules? Inbound rules: Prevent incoming connections from other hosts Reduce the attack surface Outbound rules: Prevent outgoing connections from this host Stop unauthorized software from communicating outside

What Are Rule Types? Rule types include: Rule typeDescription ProgramCreates a rule for a specific executable file PortCreates a rule for a TCP or UDP ports Predefined Creates a rule for a well known Windows program or service Custom Creates a rule with options that are unavailable when creating other rule types

Rule Configuration Options Rule configuration options include: Configuration optionDescription Action Used to allow, block, or secure a connection Users and Computers Limit connections to specific users or computers Scope Limits rule application to specific local and remote IP addresses ProfilesSpecifies to which profiles the rule applies Interface types Specifies to which interface types this rule applies Edge Traversal Specifies that Teredo should be used for traffic matching this rule to avoid NAT

What Are Connection Security Rules? Connection security rule type Description Isolation Restricts connections based on criteria such as domain membership or health certificates Authentication exemption Designates a computer or IP addresses for which authentication is not required Server-to-server Restricts communication between two computers or groups of computers Tunnel Configures a secure tunnel between two computers that can be used by other computers Custom Allows rule configurations not available through other rule types Connection security rules define the authentication process for IPsec rules

Demonstration: Creating a Rule In this demonstration, you will see how to create a rule

Lesson 4: Monitoring and Troubleshooting Windows Firewall What Is the Monitoring Node? Logging Options for Windows Firewall Restoring Windows Firewall Configuration Settings What Is the Windows Firewall Service? Discussion: Troubleshooting Windows Firewall Demonstration: Monitoring Windows Firewall

What Is the Monitoring Node? The Monitoring node: Provides an overview of current settings Displays active firewall rules Displays Connection Security Rules Displays Security Associations The Monitoring node: Provides an overview of current settings Displays active firewall rules Displays Connection Security Rules Displays Security Associations

Logging Options for Windows Firewall Logging options include: File name and location (%windir%\system32\logfiles\firewall\pfirewall.log) Size limit (4 MB default) Log dropped packets (default: no) Log successful connections (default: no) Logging options include: File name and location (%windir%\system32\logfiles\firewall\pfirewall.log) Size limit (4 MB default) Log dropped packets (default: no) Log successful connections (default: no)

Restoring Windows Firewall Configuration Settings Configuration setting options include: OptionDescription Import Policy Imports a saved Windows Firewall configuration from file Export Policy Exports the current Windows Firewall configuration to file Restore Defaults Resets the Windows Firewall configuration to default settings

What Is the Windows Firewall Service? Windows Firewall Service: Is the service that controls Windows Firewall Must be running to protect the local computer Can be stopped and started if experiencing problems Must have write access to the location of log files

Discussion: Troubleshooting Windows Firewall What steps would you take to troubleshoot Windows Firewall?

Demonstration: Monitoring Windows Firewall In this demonstration, you will see how to monitor Windows Firewall

Lab: Using Windows Firewall Exercise 1: Limiting Access to a Web Application Exercise 2: Distributing Windows Firewall Rules by Using Group Policy Logon information Virtual machine NYC-DC1, NYC-CL1 User nameAdministrator Password Pa$$w0rd Estimated time: 60 minutes

Lab Review How does using Group Policy help you distribute Windows Firewall rules to multiple computers? Can you bypass the Windows Firewall rule that prevents Iexplore.exe from accessing the network?

Module Review and Takeaways Review Questions Real-world Issues and Scenarios Best Practices