Hardening Communications - Protect IPSec-Protected Computers During Startup
(Page 5 of 11 )
When IPSec is used to protect communications, there is a brief period of time during computer startup when network connections are possible and yet IPSec is not enforced. This is the point after which the TCP/IP driver and the IPSec driver have started, but the IPSec Policy Agent service has not yet started and applied the local- or domain-configured IPSec policy. To protect computers during this critical time, you can set the computer startup mode to block and set a persistent IPSec policy. Persistent policies are in effect whether or not IPSec policies managed by the IPSec Policy Agent are.
Set Computer Startup State: To set the computer startup state to block, use the following netsh command:
netsh ipsec dynamic set config bootexemptions value=tcp:0:3389:inbound
In some cases, you may want to be able to manage the computer (for recovery, for example) by using the Remote Desktop for Administration. You can set this capability by using this command. You must then create a persistent policy that will negotiate the connection between the computer and the administration station.
Set Persistent Policy: To set a persistent policy, you must use the netsh command. It is not possible to do so using the GUI. A persistent policy is in effect as soon as the IPSec driver starts. You can use such a policy to block all communications, then, in your IPSec policy, Allow the communications required for the specific computer. Creating a persistent policy consists of two steps. First, create an IPSec policy using netsh and assign it. Next, set the policy to be persistent.
A full discussion and tutorial on using netsh to create IPSec policies is beyond the scope of this book. Commands for assigning and making the policy persistent follow.
NOTE Information on using the
netsh ipsec command can be found in “Netsh Commands for Internet Protocol Security” at
www.microsoft.com/resources/documentation/WindowsServ/2003/standard
/proddocs/en-us/Default.asp?url=/resources/documentation/
WindowsServ/2003/standard/proddocs/en-us/netsh_ipsec.asp.
To assign a policy named blockall:
set policy name=blockall assign=yes
Make the policy persistent:
set store location=persistent
 This is from Hardening Windows Systems, by Roberta Bragg, (McGraw-Hill/Osborne, ISBN: 0072253541). Check it out at your favorite bookstore today. Buy this book now. |
Next: Protect WAN Communications >>
More Windows Security Articles
More By McGraw-Hill/Osborne
