IPsec for Network Protection

Although typically used for VPNs, IP Security (IPsec) can do so much more to help you keep your network secure. You can use IPsec to solve three common problems—to stop worms, to protect servers, and to isolate a domain—and none of these techniques involves performance-sapping encryption. Let's look at the steps involved in each technique.

Using IPsec to Stop Worms
The best way to stop worms is to not get them in the first place. Alas, because some people don't understand or even care about the threats and risks associated with email and Web surfing, worms and other kinds of malicious code are a fact of life right now. Given this unfortunate situation, how can you reduce the damage that such code inflicts? You can thwart malicious code in three ways: prevent it from being installed, prevent the code from being executed, or prevent it from communicating.

In some instances, your only option might be to prevent malicious code from communicating. IPsec policies can help by limiting the kinds of traffic a computer accepts and generates. Rules with filter actions that specify simply to block or allow traffic (without building any IPsec security associations—i.e., authenticating or encrypting traffic) can act as effective basic packet filters on individual computers. Use Group Policy to assign these rules to computers, and you can reduce the amount of malicious traffic propagating throughout your network.

Your choice of IPsec policies depends on which OS you're running. Windows Server 2003 and Windows XP include Windows Firewall, which is more effective than IPsec for blocking inbound traffic, so if you run these OSs and are using Windows Firewall, your IPsec policies need to block only outbound traffic. Windows 2000 doesn't include a host-based firewall, so you should consider IPsec policies that block both inbound and outbound traffic for systems running Win2K.

Consider the Slammer worm. Slammer finds computers running Microsoft SQL Server or Microsoft SQL Server Desktop Engine (MSDE) by blasting the network with messages to UDP port 1434. Microsoft released a patch for this worm, but patching all computers can take some time; an excellent interim mitigation is to use Group Policy to quickly assign an IPsec policy that blocks inbound traffic to the vulnerable port. Of course, because the policy blocks inbound traffic to your SQL Server systems, don't leave this policy enabled on these systems after you've patched them.

To prevent a computer from getting infected by Slammer, assign a policy that blocks all inbound traffic from anywhere to the computer's own IP address with destination port UDP 1434:

• Filter list with one filter: from any-address:any-port to my-address:1434/udp
• Filter action: block
• Rule: link the list with the action; all interfaces; no tunnel; any authentication method (the method doesn't matter because a block filter doesn't have any IPsec security associations)

To create the policy, first open the IPsec management console on the computer you want to protect (the process is the same for Windows 2003, XP or Win2K):

1. Double-click Local Security Policy in the Administrative Tools folder.
2. Click IP Security Policies on Local Computer.

Now create the filter list:

1. Right-click in the right-hand pane of the Local Security Settings window, and select the Manage IP filter lists and filter actions menu option.
2. On the Manage IP Filter Lists tab, click Add.
3. Enter Slammer filter list for the name.
4. Click Add, then click Next at the first IP filter wizard screen.
5. Select Any IP Address for the source.
6. Select My IP Address for the destination.
7. Select UDP for the protocol.
8. Click the To this port option, and enter 1434.
9. Click Finish to end the wizard.
10. Click OK.

Now create the filter action (if you already have an action called Block, skip this part):

1. On the Manage IP filter lists and filter actions dialog box's Manage Filter Actions tab, click Add, then click Next at the first IP Security filter action wizard screen.
2. Enter Block for the name.
3. Select Block for the behavior.
4. Click Finish to end the wizard.
5. Click Close to finish setting up the filter list and action.

Now create the IPsec policy:

1. Right-click in the right-hand pane of the Local Security Settings window, select Create IP Security Policy, and click Next at the first screen of the IP Security policy wizard.
2. Enter Slammer filter for the name.
3. Clear the Activate the default response rule option, and click Next.
4. Leave the Edit properties option selected, and click Finish to end the wizard.

Now add the rule to the policy:

1. The policy's properties dialog box appears. Click Add, then click Next.
2. Leave the next three wizard screens at their defaults.
3. From the list of filter lists, select the Slammer filter list.
4. From the list of filter actions, select Block.
5. Click Finish to end the wizard, and click OK to close the rule properties dialog box.
6. Click Close to close the policy properties dialog box.

Now assign the policy:

Right-click the Slammer filter policy and select Assign.

Scripting IPsec Policy Creation
You can also use a command-line tool to create IPsec policies—this capability is useful for scripting. For Win2K, the tool is ipsecpol.exe from the Microsoft Windows 2000 Resource Kits; for XP, it's ipseccmd.exe from the Windows Support Tools for Microsoft Windows XP; for Windows 2003, it's the Netsh Ipsec tool included with the OS. To apply the Slammer filter in XP, use the following command:

ipseccmd -w REG -p "Block UDP 1434 Filter"
 -r "Block Inbound UDP 1434 Rule"
 -f *=0:1434:UDP -n BLOCK -x

Be sure to use uppercase and lowercase letters as shown; Ipsecpol and Ipseccmd are picky about case. Also note that this command is a single command that should be typed on one line—it's wrapped here to fit the article's column format.

This command creates and assigns a static policy called Block UDP 1434 Filter with a single rule called Block Inbound UDP 1434 Rule that contains the same filter list as above linked to a block filter action. Static policies are stored in the registry and persist between reboots. The policy won't apply until the next boot or restart of the IPsec policy agent, so if you want the policy to be applied immediately, your script should also stop and restart the policyagent service. When you build the policy with the GUI, it's applied immediately.

If a computer does get infected with Slammer, you can use a different IPsec rule to prevent the computer from infecting other computers by blocking outbound communications to destination port UDP 1434:

• Filter list with one filter: from my-address:any-port to any-address:1434/udp
• Filter action: block
• Rule: link the list with the action; all interfaces; no tunnel; any authentication method

Note the subtle difference here: In the earlier (inbound) rule, the filter checks traffic from any-address:any-port to my-address:1434/udp, whereas in the outbound rule, the filter checks traffic from my-address:any-port to any-address:1434/udp. The outbound rule blocks any traffic to UDP port 1434 on any computer. Use the following command to script the rule and add it to the same policy as the first rule:

ipseccmd -w REG -p "Block UDP 1434 Filter"
 -r "Block Outbound UDP 1434  Rule"
 -f 0=*:1434:UDP -n BLOCK

In the first command above, the -x switch indicates a new policy. In this second command, you omit the -x switch because this command is adding another rule to the existing policy. Note also that in the filter list portion of the second command, the asterisk (*) and the 0 are reversed from the first command; this is because the "direction" of the filter is reversed.

   Previous  [1]  2  Next