21-21 configuration of IPSec Security Policies in the Network Security Series

1, UnderstandIPSecSecurity Policy

IPSec and Internet Protocol Security are an open standard in the network security industry. By using the encrypted security service, the confidentiality and security of network communication are ensured. IPSec works at the network layer and is transparent to users and applications. It can provide restricted access to servers and customize security configurations. IPSec has two working modes: Transmission Mode and tunnel mode. Transmission mode is used to protect the communication between the host and the host. It implements end-to-end communication. During transmission, the IP address header is not encrypted, but the data part is encrypted; the Tunneling mode is used to protect the communication between the host and the network or between the two networks, that is, to implement the VPN function. This mode encrypts the entire IP data packet and re-encapsulates the data packets.

In the win2003 system, IPSec needs to be configured in the Group Policy. Open the Group Policy Editor and configure IPSec in Computer Configuration \ Windows Settings \ Security Settings \ IP Security Policy.

The IPSec function is implemented through different IPSec policies. By default, three IPSec policies exist in windows ,.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979018whtL.png "width =" 356 "Height =" 74 "/>

The three default IPSec policies do not need to be modified. In most cases, new IPSec policies are used to meet our requirements.

The following describes how to configure an IPSec security policy by using a client that only has a specified IP address to access the remote desktop service on the win2003 server.

 

2Restrict the access of the specified client to the Remote Desktop

When we enable the remote desktop service, we can easily manage remote servers, but it also brings some threats to servers. For server security, we can set security policies to restrict the IP addresses and networks connected to the remote desktop service.

Assume that the IP address of the server is 192.168.100.33. For server security, we only Allow Remote Desktop Connection at 192.168.100.34.

First, we need to create a policy in the IP policy,

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979018YHA6.png "width =" 442 "Height =" 332 "/>

Go to the IP Security Policy wizard as shown in, click Next-next (name the policy iprule), and select "yes"-"Next" when a warning is displayed ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790195D4I.png "width =" 449 "Height =" 338 "/>

Click "finish" to view the newly created IP policy, and right-click "properties ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979019ypbD.png "width =" 355 "Height =" 370 "/>

The IPSec Security policy function is mainly implemented by IP Security rules. A default dynamic rule exists in the new policy, but is not enabled.

IP Security rules mainly include "IP Filter list" and "filter operation.

The filter is used to define the data type and filter out the data that meets the requirements. The filter operation is used to specify the operations on the filtered data.

Therefore, IP Security rules can be defined in two steps: first, define the IP Filter, and then define the operation on the filter.

Next, we need to define two security rules. One rule rejects any IP addresses from connecting to port 3389 of the local machine, and the other rule only allows the IP address 192.168.100.34 to connect to port 3389 of the server, in this way, an IP address is filtered at the top of the deny rule.

First, create a rule to deny any IP addresses from connecting to the server's port 3389.

Click Add to open the new rule wizard.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979020VvrP.png "width =" 437 "Height =" 345 "/>

Next step:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979020HRzf.png "width =" 436 "Height =" 341 "/>

Next step:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979021uT0v.png "width =" 430 "Height =" 338 "/>

Select "add" to create a filter:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979021PsW0.png "width =" 434 "Height =" 339 "/>

Click "add" to bring up the IP Filter list.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979022QVPK.png "width =" 443 "Height =" 324 "/>

Click "add"-"Next"-"Next", and select "any IP Address" in the source address bar"

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979022KTWc.png "width =" 455 "Height =" 342 "/>

Click "Next" and select my IP address as the destination address.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979023YwRe.png "width =" 448 "Height =" 340 "/>

Click "Next" and select the TCP protocol for the IP protocol type.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979023g0e6.png "width =" 448 "Height =" 339 "/>

Click "Next" and change the target port to 3389.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979024qZbB.png "width =" 396 "Height =" 295 "/>

Click "Next", and then click "finish"-"OK ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790241Bd9.png "width =" 443 "Height =" 339 "/>

Click "OK", select the newly created IP address filtering list, and click "Next ",

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979025YB7L.png "width =" 444 "Height =" 350 "/>

The "ip" filter operation is displayed. Click "add"

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979025TEPx.png "width =" 407 "Height =" 320 "/>

Click "Next" to set the operation name for the filter,

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979026xoFA.png "width =" 428 "Height =" 326 "/>

Select "Block" and click "Next"

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979026tCui.png "width =" 422 "Height =" 321 "/>

Click Finish ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979026dmF4.png "width =" 427 "Height =" 321 "/>

Click "finish", select "Block" on the filter panel, and click "Next"

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979027n4Bn.png "width =" 429 "Height =" 333 "/>

Click "Next"-and then click "finish ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979027u6iz.png "width =" 436 "Height =" 344 "/>

Click "OK" and Right-click "iprule" to assign the policy you just created to take effect.

Note: Open the command line before assigning, enter services. msc, set IPSec service to automatic or manual, and enable the service.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790287LfC.png "width =" 491 "Height =" 345 "/>

Assignment policy:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790286TbU.png "width =" 505 "Height =" 277 "/>

After the above policy is created and assigned, no IP port can be connected to port 3389 of the server. Therefore, we need to create a rule to allow the specified IP address to access port 3389 of the server.

Double-click iprule to add rules in the property panel.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979029jG9n.png "width =" 370 "Height =" 386 "/>

Click "Next" until, as shown in, to add an IP address filtering list.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979029bXMK.png "width =" 469 "Height =" 372 "/>

Enter IP address filtering information.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790300DXG.png "width =" 490 "Height =" 334 "/>

Click "Next" and select the specified source address 192.168.100.34.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979030qLpi.png "width =" 487 "Height =" 366 "/>

After specifying the source address, click "Next" and select the target address as my IP address, the Protocol is TCP, and the port is 3389.

Target address:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979031jH8L.png "width =" 451 "Height =" 339 "/>

TCP protocol:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979031UmG4.png "width =" 460 "Height =" 350 "/>

Port 3389:

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979032CaaB.png "width =" 460 "Height =" 346 "/>

Click "finish ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979032763j.png "width =" 464 "Height =" 351 "/>

Return to the security rule wizard, select the IP address filtering list that allows the specified IP address to access port 3389 of the server, and click "Next ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979033wGFc.png "width =" 465 "Height =" 367 "/>

Select "License" and then "Next ".

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_1414979033PSaX.png "width =" 470 "Height =" 371 "/>

After setting the preceding settings, click Next to complete the operation and view the newly created policy.

650) This. width = 650; "style =" border-top-width: 0px; border-bottom-width: 0px; border-left-width: 0px; "Title =" image "border =" 0 "alt =" image "src =" http://img1.51cto.com/attachment/201411/3/70821_14149790348Zls.png "width =" 449 "Height =" 469 "/>

During viewing, make sure that the allowed rules are above the blocking rules. Because the rule is executed in the order from top to bottom, the two rules can be used at the same time to restrict IP Access to the Remote Desktop of the server.

Click "OK", restart the rule, disable the assignment, and then re-assign. Now, all accesses to the remote desktop service are restricted.

We can use the above method to limit that only one CIDR block is allowed to access the Remote Desktop. You only need to select the source address as a CIDR block.

This article is from the "one pot of turbidity wine" blog. For more information, please contact the author!

21-21 configuration of IPSec Security Policies in the Network Security Series