---
title: '06 Planning & Deploying Security for Network Comms'
disqus: hackmd
---

:::info
ST2612 Secure Microsoft Windows
:::

06 Planning & Deploying Security for Network Comms
===

<style>
img{
/* border: 2px solid red; */
margin-left: auto;
margin-right: auto;
width: 80%;
display: block;
}
</style>

## Table of Contents

[TOC]

IPSec Concepts
---
- history
- published in 1995
- many extra exts added to enhance/replace earlier ver of protocol
- IKE defined in 1998
- IKE2 added to protocol in 2005
- abbrv of IP Security standardised to IPSec since then
- IPSec - set of protocols used to ensure private, secure comms over IP networks by using cryptographic security services based on
- protecting contents of IP packets
- packet filtering
- enforced trusting comms
- encryption of info travelling through network
- mosty used as option for IPv4 implementations
- NOTE
- starting from winserver 2008r2, IKE2 has been default built-in VPN protocols for their Remote Access Services

### IP Security Issues
- orig tcp/ip network protocols not designed with security in mind
- source spoofing
- replay packets
- no data integrity/confidentiality
- subject to
- DOS atks
- replay atks
- spying
- etc.
- NOTE
- IPSec is optional feature that network admins can use to protect tcp/ip network traffic
- protection mainly based on combination of various encryption & hashing schemes

### IPSec Control Elements
- uses 3 main security control elements
- __Internet Key Exchange (IKE)__
- protocol for exchanging encryption keys
- __Authentication Header (AH)__
- provides authenticity guarantee for packets
- __Encapsulating Security Payload (ESP)__
- provides confidentiality through encryption
- also uses __IP compression (IPComp)__ which is used to compress raw IP data
- NOTE
- ike is 1st used when 2 parties comm
- if IKE operation (host to host auth) fails, no further comm possible
- once IKE cleared, 2 parties may use AH &/or ESP to protect subsequent data traffic

#### IKE Module
- internet key exchange module
- responsible for
- initial security negotiation (phase 1)
- based on auth methods defined in ipsec rule
- need to establish 1st to support phase 2 operations
- determine secret keying material (phase 2)
- to secured network comm
- related to filter action setting of associate ipsec rule
- NOTE
- the 2 phases uses diff security & encryption schemes
- not elaborating for smw
- the 2 phases are using diffie hellman (key exchange method) asymmetric key encryptions to exchange data between the 2 parties

### IP Security Implementation
- winserver2016 supports implementation of ipsec
- when ipsec comm begins between 2 comps,
- comps 1st negotiate using IKE module & auth between receiver & sender using __Microsoft AuthIP extension__
- extra hasing scheme (optional) helps ensure data integrity at packet header
- data encrypted with integrity check (optional) at NIC of sending comp as its formatted into IP packet
- ipsec can provide security for all tcp/ip based apps & comm protocols
- ipsec security policies can be established through grp policy in active dir
- configed through ip security policies management MMC snap-in
- NOTE
- auth header (AH) ensures data integrity of packet
- encapsulating security payload (ESP) - provide encryption & integrity check to protect data packets
- packet sniffing tools (Eg. wireshark) shows diff of effect of these 2 protocols
- admins use ipsec security policies to define ipsec configs
- policies have to be deployed to take effect
- ipsec security policy is dependent to grp policy
- can define ipsec policy at indiv system locally

### IPSec Trade-Offs
- deploying ipsec can affect network perf & compatibility with other services/apps
- dont deploy ipsec if security it provides not required

#### Impacts
- time needed to establish ipsec conn
- IKE very complex
- time needed to filter & encrypt packets
- causes overhead (excess res used)
- extra packet header needed too
- increased packet size
- network inspection tech used in routers, firewalls, IDS may not work on ipsec packets
- app compatibility with other platforms
- effect on active dir & domain controller conns
- NOTE
- adding in ipsec might upset some existing security measures
- popular IKE auth scheme for active dir based env is Kerberos
- complicated if ipsec is involving DCs as kerberos is hosted by the DCs

Planning an IPSec Deployment
---
- config of ipsec based on
- the way you use it
- types of client OS in network
- diff OS/network devices have diff ways for ipsec implementation
- types of network devices in network
- not recommended for
- securing comms between domain members & dc
- reduce network perf
- config ofipsec policy complicated
- secure all traffic in network
- reduced network perf (again)
- ipsec cant support multicast & broadcast traffic
- network tools that need to inspect packet headers may not work
- NOTE
- if all traffic in network protected, may help adversaries (enemies) carry out data exfiltration operations undetected
- hence, ipsec might decrease degree of network security
- use cases of ipsec

- proper use of ipsec
- packet filtering like ipsec with routing & remote access service to permit/block inbound/outbound traffic
- secure host-to-host traffic on specific paths
- suitable for LAN
- secure traffic to servers
- suitable for LAN
- combining L2TP & ipsec (l2tp/ipsec) for securing vpn scenarios
- incorporating site-to-site or gateway-to-gateway tunnelling

### Implementing IPSec Policies
- in simple network structure, single ipsec policy can be designed to contain multiple rules
- 1 policy for all
- in large env, many diff ipsec policies can be designed
- factors that inc num of policies required
- computer roles
- sensitivity of data travelling
- comp OS
- domain r/s & memberships
- num of apps require ipsec
- NOTE
- ea system can only be deployed with at most 1 ipsec policy
- hence, system need to host/cater for diff apps with ipsec protections
- policy must have multiple rules
- ea rule cater to 1 type of app

### 5 Elements that make up a Rule
- ea policy can include many rules
- ea rule has 5 configurable elements
- connection type
- lan, remote, all
- mode
- transport or tunnel
- filter list
- host to host auth method
- used by IKE in phase 1
- filter action
- includes choice of AH/ESP
- negotiated in IKE phase 2 & carried out agreed scheme in actual traffic

#### Connection Type
- only applies for particular types of conns
- lan
- remote
- commonly seen if implemented remote access services in internet facing servers
- usually installed with at least 2 NICs
- Eg. 1 connects to LAN, other to internet via routing device
- all

#### Deciding which Mode to Use
- has 2 modes
- transport mode
- used to secure comms within network
- can be server to server or server to client
- provides end to end security
- tunnel mode
- secure comms between networks
- Eg. between 2 gateways
- primarily used for interoperability with gateways/end systems that dont support L2TP/IPSec or PPTP VPN site to site connns
- in simplest case, ipsec protection caters to system within lan
- hence use transport mode
- when conns involving wan, use tunnel
- NOTE
- in smw we focus on transport mode
- commonly, routers & firewall takes care of site to site traffic security
- many based on ipsec tunnel mode
- windows systems may use this security channel w/o ipsec configs
- tunnel mode only protects data traffic between 2 endpt devices
- traffic between host to corr endpt not protected by AH/ESP protocols

##### Example
- ipsec securing traffic between alice & hr server in remote office
- case A
- ipsec tunnel configed between router & firewall of company
- alice & hr server involved in ipsec config
- case B
- ipsec tunnel configed between alice & router
- both alice & hr involved in ipsec config
- diff between A
- all traffic from/to alice pc protected by ipsec
- case C
- router & server configed as tunnel endpt
- both alice & hr involved
- case D
- vpn channel on alice pc and office network
- hence, alice can use ipsec in transport mode to protect data between pc and hr
- however, since vpn alr securing conn, ipsec protection redundant

#### IPSec Filters
- ipsec filter is specification in ipsec rule used to match ip packets
- filters grped tgt in system wide filter list
- in ipsec properties setting
- system wide filter list avail for choice of filter
- packets which match filter applied with associated filter actions like
- permit
- block
- negotiate security
- limitations
- system configed with ipsec may not apply with expected security scheme if filter set wrongly
- when network traffic dont match ipsec, it wont be blocked but just pass through
- filter list identifies traffic based on its src, dest & protocol
- Eg. win2k3, win2k8
- all icmp/ip traffic
- filter action set for ea type of traffic as identified by filter list
- only triggered if traffic matches filter
- actions
- permit
- request security/negotiate security
- carried out at phase 2 of IKE
- require security/block
- admins may construct/customise specific actions
- can be managed in 1 of 2 ways
- create new policy & define set of rules for policy, adding filter lists & actions as needed
- 1st create set of filter lists & actions then create policies & add rules that combine with filter lists & actions
- basically create policy 1st or create filter list 1st
- NOTE
- unlike firewall filters, no action taken against unmatched traffic in ipsec filter
- in firewall filter unmatched traffic default blocked


#### Planning Auth Methods for IPSec
- ipsec auth
- specifies how comps will prove their identities to ea other when establishing SA (security association)
- if conn matches filter IKE phase 1 will be invoked for initial auth
- avail auth methods
- kerberos v5
- default auth method for win2000 server or later
- based on mutual auth
- use when all clients can auth using kerberosv5
- requires least administrative effort
- certificates
- requires PKI (pub key infrastructure)
- method for granting access to users based on unique identification
- used in situations when access to corporate res, external business partner comms or comps that dont run kerberosv5
- pre-shared key
- used when other methods not avail
- shared secret key
- auth process done using DH asymmetric key encryption for data exchange
- choosing ipsec auth method
- more than 1 can be selected with designated priority lvl
- IKE phase 1 will sort out if 2 parties share common auth method
- if dont match cannot establish ipsec channel
- NOTE
- IKE v2 released 2005 added EAP (extensible auth protocol) auth as extra choice
- windows systems adopted IKEv2 as built-in vpn protocol
- pre-shared key used for testing, short term ad-hoc solution
- cuz difficult to maintain & secure
- kerberos best for domain based systems
- certs ideal for non-domain based/mixed systems


### Encryption Levels
- 2 basic categories
- symmetric key encryption
- pub key encryption
- lifetime settings determine when new key generated
- NOTE
- in ike phase 2 both parties nego for commonly avail encryption scheme
- filter action bases on it to encrypt data packets

- this screenshot shows 4 possible encryption methods

#### Methods of Hashing
- secure hash algo (sha)
- use 160bit encryption key
- very high security method
- message digest 5 (md5)
- use 128bit key
- lower perf than sha
- hashing method used to support AH traffic

#### Methods of Encryption
- data encryption standard (des)
- use 56bit key
- not reco for high security
- triple des (3des)
- 168bit key
- medium & high security networks
- encryption method used to support ESP traffic
- NOTE
- hashing & enc methods here a bit old. new systems hash more choices

### IPSec Protocols

- AH transport mode

- ESP transport mode

- tunnel mode uses double encapsulation, suitable for protecting traffic between network systems (Eg. untrusted internet)
- ah tunnel mode - encapsulates ip packet by placing ah header between internal & external ip header
- esp tunnel mode - ip packet first encapsulated with esp header, then result encapsulated with extra ip header


How IPSec Works
---
- security association (sa)
- may include attributes like
- crypto algo & mode
- traffic encryption key
- params for network data to be passed over conn

Deploying IPSec Policies
---
- can be deployed using
- local policy objs
- a way to enable ipsec for comps that aint members of domain
- grp policy objs
- ipsec policy propagated to any comp accs that affected by gpo
- cli tools
- netsh ipsec cmd in winserver 2003/2008

### Using Local Policy Objects

### Using Group Policy Objects
- factors to consider when selecting gpos for ipsec policy assignment
- assignment precedence of ipsec policies
- lowest to highest
- local, site, domain and ou
- persistent ipsec policy has highest precedence of all even tho stored on local comp
- effective even other policies cannot be applied
- ipsec policies from diff OUs nvr merged
- for domain-based policy, limit num of rules to 10 or less
- create & apply ipsec policy at domain lvl to provide baseline of ipsec protection
- use export & import policies commands in ip security policy management console to backup & restore ipsec policy objs
- adequately test impact of new ipsec policies before assigning them in domain

### Understanding Default IPSec Policies
- client (respond only)
- secure comm only if other comp requests it
- server (request security)
- accepts initial incoming comm that's unsecured
- requests for comm to be secured
- carry on with unsecured conn if client dont support
- secure server (require security)
- accepts initial inbound comm that's unsecured
- requires all conn to be secured

### Understanding IPSec Policy Precedence
- possible to config ipsec for multiple containers that will affect comp
- only 1 ipsec policy can be assigned to comp at a time
- if there's multiple ipsec policies assigned at diff lvls, last one takes effect
- precedence sequence
- local gpo, site, domain, ou
- default order can be overriden using enforced, block policy inheritance
- when troubleshooting ipsec policies & precedence, rmb
- only single ipsec policy can be assigned at specific lvl in active dir
- ipsec policy assigned to OU takes precedence over domain-lvl for member in OU
- ipsec policies from diff OUs are nvr merged
- OU inherits policy of its parent OU unless policy inheritance explicitly blocked or separate policy explicitly assigned to OU
- before assigning ipsec policy to gpo, verify the grp policy settings that's required for the policy
- use enforced & blk policy inheritance features carefully
- procedure for deleting policy objs
- unassign ipsec policy in gpo
- wait 24h to ensure that change propagated
- delete gpo
- __persistent policy__ - provides max protection against atks during comp startup
- adds to/overrides local/active dir policy
- remains in effect regardless of whether other policies applied
- provides backup security in case ipsec policy gets corrupted or if errors occur
- can be set using cli tools
- netsh at local station
- NOTE
- persistent policy AKA static ipsec policy
- provides 1st line of def right after system powered up
- since gpo associated to ipsec takes time to be in effect after system reboot

Summary
---

###### tags: `SMW` `DISM` `School` `Notes`