IPSec under Windows

Four standards in the category of network security

Data privacy

Data integrity

Certification

Non-repudiation

___________________________

1 Basic Concepts

2 Configuration Example: Restricting connections (shutting down port 3389)

3 Configuration Example: Restrict connection (Close port 139)

4 Configuration Example: Encrypt the connection

___________________________

1 Basic Concepts

IPSec is based on cryptographic protection services, security protocols, and dynamic key management to achieve its security. The protocol works on the third layer of the OSI model and can be secured to all transport layer protocols (TCP/UDP protocol). Based on the end-to-end security model, a trust and secure connection is established between the source IP and the destination IP address. The IPSEC protocol is not an orphaned protocol, it includes the Network authentication Protocol (AH), Encapsulating Security Payload Protocol (ESP), Internet Key Management Protocol (IKE) and some algorithms for network authentication and encryption, which stipulate how to select the security protocol, determine the security algorithm in the IP layer of the peer network model, Secret key exchange, data encryption, security authentication and other services.

The role of IPSEC:

Protecting the contents of IP packets

Protect against cyber attacks through packet filtering and implementation of trusted communications

2 Configuration Example: Restricting connections (shutting down port 3389)

Configure a policy that disables the login system's own Telnet service

Cmd-mmc

To add an IPSEC control node

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/12/wKiom1XchcnRVL5tAADmo36JvKg371.jpg "style=" float: none; "title=" 1.png "alt=" Wkiom1xchcnrvl5taadmo36jvkg371.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/0E/wKioL1Xch9_hM4rMAAEm_w-9LXE338.jpg "style=" float: none; "title=" 2.png "alt=" Wkiol1xch9_hm4rmaaem_w-9lxe338.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/12/wKiom1XchcrTqHxoAAKV8CoYrFI040.jpg "style=" float: none; "title=" 3.png "alt=" Wkiom1xchcrtqhxoaakv8coyrfi040.jpg "/>

Create a policy

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/0E/wKioL1Xch-CSa6LaAAFrvX_2HF4411.jpg "style=" float: none; "title=" 4.png "alt=" Wkiol1xch-csa6laaafrvx_2hf4411.jpg "/>

Establish a filter for a policy

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/12/wKiom1XchcujALAvAAGgkFNZL5w002.jpg "style=" float: none; "title=" 5.png "alt=" Wkiom1xchcujalavaaggkfnzl5w002.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/0E/wKioL1Xch-GyJGHRAAFOFzhawA8906.jpg "style=" float: none; "title=" 6.png "alt=" Wkiol1xch-gyjghraafofzhawa8906.jpg "/>

Start setting filters

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/12/wKiom1XchcuTEET8AAEjwcDTYmo405.jpg "style=" float: none; "title=" 7.png "alt=" Wkiom1xchcuteet8aaejwcdtymo405.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/0E/wKioL1Xch-LxtvkXAAFWVBuRQw8621.jpg "style=" float: none; "title=" 8.png "alt=" Wkiol1xch-lxtvkxaafwvburqw8621.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/0E/wKioL1Xch-LSn1kcAAEBHihenPw947.jpg "style=" float: none; "title=" 9.png "alt=" Wkiol1xch-lsn1kcaaebhihenpw947.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/12/wKiom1XchczjlLpMAAEBJcFnXd8200.jpg "style=" float: none; "title=" 10.png "alt=" Wkiom1xchczjllpmaaebjcfnxd8200.jpg "/>

Add an action to a filter

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/0E/wKioL1Xch-Pzu1xXAAFFRDekvP8080.jpg "style=" float: none; "title=" 11.png "alt=" Wkiol1xch-pzu1xxaaffrdekvp8080.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/12/wKiom1Xchc2BG4TsAAFG9DZEFIg896.jpg "style=" float: none; "title=" 12.png "alt=" Wkiom1xchc2bg4tsaafg9dzefig896.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/12/wKiom1Xchc7Di3qNAAFFe6im3vw615.jpg "style=" float: none; "title=" 13.png "alt=" Wkiom1xchc7di3qnaaffe6im3vw615.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/0E/wKioL1Xch-Szpx2cAAFdzDGgWMY701.jpg "style=" float: none; "title=" 14.png "alt=" Wkiol1xch-szpx2caafdzdggwmy701.jpg "/>

Generate last-needed filter options

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/12/wKiom1Xchc7xuesSAAFSJyPtfp4365.jpg "style=" float: none; "title=" 15.png "alt=" Wkiom1xchc7xuessaafsjyptfp4365.jpg "/>

Enable the security policy so that the filter takes effect (immediate effect).

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/0F/wKioL1Xch-Tgq7HdAAGPS6l1hj0024.jpg "style=" float: none; "title=" 16.png "alt=" Wkiol1xch-tgq7hdaagps6l1hj0024.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/12/wKiom1Xch9ux4V0CAAE8_Wl8Smo386.jpg "title=" 17.png "alt=" Wkiom1xch9ux4v0caae8_wl8smo386.jpg "/>

3 Configuration Example: Disable port 139

Similarly, create a policy, set a filter.

650) this.width=650; "Src=" http://s3.51cto.com/wyfs02/M01/72/0F/wKioL1Xcj_KjzJrcAAEr4G5dayI517.jpg " Style= "Float:none;" title= "1.png" alt= "Wkiol1xcj_kjzjrcaaer4g5dayi517.jpg"/>

Filter action allows multiplexing

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/13/wKiom1XcjdyAdT3LAAEuGGOu8r8931.jpg "style=" float: none; "title=" 2.png "alt=" Wkiom1xcjdyadt3laaeuggou8r8931.jpg "/>

The final effect, assigned a 139 strategy

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/0F/wKioL1Xcj_KiaFe-AAEp--u8omA279.jpg "style=" float: none; "title=" 3.png "alt=" Wkiol1xcj_kiafe-aaep--u8oma279.jpg "/>

4 Configuration Example: Encrypt the connection

Setting up encrypted transfer data between two machines requires two machines to be configured at the same time.

① start configuration on the first machine

Add a policy, set a filter

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/13/wKiom1XcmBiD_RthAAEIxsD4hBI817.jpg "title=" 1.png " alt= "Wkiom1xcmbid_rthaaeixsd4hbi817.jpg"/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/13/wKiom1Xckxyjl6qHAADHtHU16Vw318.jpg "style=" float: none; "title=" 2.png "alt=" Wkiom1xckxyjl6qhaadhthu16vw318.jpg "/>

Setting up connection encryption

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/0F/wKioL1XclTOBaRQBAAFKgtXMDR8552.jpg "style=" float: none; "title=" 3.png "alt=" Wkiol1xcltobarqbaafkgtxmdr8552.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/13/wKiom1Xckx2DouwZAAGLYQ-gIzc452.jpg "style=" float: none; "title=" 4.png "alt=" Wkiom1xckx2douwzaaglyq-gizc452.jpg "/>

You can see that data encryption is enabled, data integrity verification is enabled

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M01/72/0F/wKioL1XclTOT7Br3AAFsOdHcQI0905.jpg "style=" float: none; "title=" 5.png "alt=" Wkiol1xcltot7br3aafsodhcqi0905.jpg "/>

Click the OK button.

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/0F/wKioL1XcmA7x0-sRAAFOFjpmc6w232.jpg "style=" float: none; "title=" 6.png "alt=" Wkiol1xcma7x0-sraafofjpmc6w232.jpg "/>

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M00/72/13/wKiom1XclfjTbJ-JAAHCZ2FBi_Q424.jpg "style=" float: none; "title=" 7.png "alt=" Wkiom1xclfjtbj-jaahcz2fbi_q424.jpg "/>

② make the same configuration on the second machine

650) this.width=650; "src=" http://s3.51cto.com/wyfs02/M02/72/0F/wKioL1XcmVChomr8AAFXMkSVakA834.jpg "title=" 8.png " alt= "Wkiol1xcmvchomr8aafxmksvaka834.jpg"/>

This article from "Little Cui's experimental notes" blog, declined to reprint!

IPSec under Windows