ServeranddomainisolationusingIPsecandgroupPolicy-ByRashmiS.ThakurCS772IntroductionEarlydays,companieshadtoworkwithmainframes---networkaccesssecuritywasnotmuchanissuesincetheonlywaytoaccessthenetworkwastoenteralarge,datacenterandsitdowninfrontofaterminaltodoanything.Notmorepronetoattacksanduntrustedaccess…..PresentScenario…Nomoremainframes.AnyonecanaccessthenetworkfromanywhereLargeorganizationsneededsecuritytoprotecttheirinternalnetworkfromexternalattacksandaccessTheyalsoneededsegmentsofinternalnetworksi.erestrictedaccessfromonepartofthenetworktotheother...Solution!Useoffirewalls!Firewallscouldprotectinternalnetworksfromoutsideattacks.Theycouldalsobeusedtoseparatesegmentsofinternalnetworksbysettingrulesforthefirewall.

Thenwhystudyserveranddomainisolation?Ithasbeenfoundoutthatusingfirewallsforinternalnetworksegmentationdoesn'talwaysworksmoothly.Alsointernalattacksi.eattacksmightcomefrommaliciousemployeeswhocancansubvertotherprotectivemeasures--includingfirewalls--togettothecenterofthenetwork.compromisedPCsmighthavespywareormalware.GoalofLogicalIsolationThegoaloflogicalisolationistoallowtheinternalnetworktobesegmentedandisolatedtosupportahigherlevelofsecuritywithoutrequiringhardphysicalboundariesShouldnotbetootightsuchthatitishardtodoevendailybusinesstasks.Shouldbemanageableandscalable.People,Policies,andProcessPhysicalsecurityPerimeterInternalnetworkHostApplicationDataIsolationServerandDomainIsolationComponents

TrustedHosts–Thehostswithminimumsecurityrequirements.runningasecureandmanagedoperatingsystem,antivirussoftwarecurrentapplicationandoperatingsystemupdatesHostAuthenticationIPsecThe802.1XProtocolHostAuthorization–UsingGrouppoliciestoallow/denyaccesstoservers.StepsindetailSTEP1:Userloginstoaclientontheinternalnetwork(whichiswithinthelogicalisolation)Clientcomputerattemptstoconnecttothetrustedhostusingthefilesharingprotocol.TheclienthasIPsecpolicyassignedaspartofthesolution.TheoutboundTCPconnectionrequesttriggersanIKEnegotiationtotheserver.TheclientIKEobtainsaKerberostickettoauthenticatetotheserver.STEPS2to4:IKEmainmodenegotiation.AftertheserverreceivestheinitialIKEcommunicationrequestfromtheclientcomputer,theserverauthenticatestheKerberosticket.Step4contd…Iftheuseraccounthastherequireduserrightassignment,theprocesscompletes,andtheuserlogontokeniscreated.Afterthisprocessiscomplete,thelogicalisolationsolutionhasfinishedconductingitssecuritychecks.Whatremainsnowistheaccessrightsofthefile,theuseristryingtoaccess.Step5Shareandfileaccesspermissionschecked.Finally,thestandardWindowsshareandfileaccesspermissionsarecheckedbytheservertoensurethattheuserisamemberofagroupthathastherequiredpermissionstoaccessthedatathattheuserrequested.Grouping…Tillnowwedealtwithisolationachievedonahost-by-hostbasisIfanorganizationcontainsalotofhosts,thendoingahost-by-hostmightbetoocostly!Solution:Grouphostsintoagroupsandgiveacessgroup-by-groupThisismuchcheaper.ImplimentingIsolationIdentifyFoundational(basic)IsolationGroups.Eg:IsolationDomain: ThehostsinthisgrouparetrustedanduseIPsecpolicytocontrolthecommunicationsthatareallowedtoandfromthemselves.Eg:BoundaryIsolationGroup Thisgroupcontainstrustedhoststhatwillbeallowedtocommunicatewithuntrustedsystems.Thesehostswillbeexposedtoahigherlevelofriskbecausetheyareabletoreceiveincomingcommunicationsdirectlyfromuntrustedcomputers.WhydoweneedBoundaryIsolationGroupSinceinalmostallorganizations,therewillbeanumberofworkstations,orservers,thatareunabletocommunicateusingIPsecalthoughtheyaregenuinehosts.ExemptionsLists

Keyinfrastructureserverssuchasdomaincontrollers,DNSservers,andDynamicHostConfigurationProtocol(DHCP)serversorotherswhichareusuallyavailabletoallsystemsontheinternalnetworkdonotuseIPSecbutarewidelyused.AllowingthemonlythroughBoundaryIsolationGroupmightresultindecreasingperformanceoftheorganizationduetoheavyrequests.Sol:Createspecialliststoidentifysuchservers.AndallowdirectaccesstothemthroughanyisolationgroupAdditonalIsolationGroupsCouldcreatemoreIsolationGroupsapartfromthefoundationalifwehavedifferentrequirementsforeachgroup.Eg:EncryptionrequirementsLimitedhostoruseraccess requiredatthenetworklevelOutgoingorincomingnetwork trafficfloworprotection requirementsthat fromtheisolationdomain

PlanningTrafficMapping-foundationalIDFromToBidirectionalIPsecFallbackEncrypt1IDExYesNoNoNo2IDBOYesYesNoNo3IDUNNoYesYesNo4BOEXYesYesYesNo5BOUNNoYesYesNo6UNBONoNoNoNo7UNEXYesNoNoNoPlanningTrafficMapping-additionalIDFromToBidirectionalIPsecFallbackEncrypt8ENEXYesNoNoNo9ENIDYesYesNoYes10ENNFYesYesNoYes11ENBONoYesNoYes12NFIDYesYesNoNo13NFEXYesNoNoNo14NFBOYesYesNoNoNetworkaccessgroupsConsidergroup1isrestrictedaccesstgroup2.OnlyExceptionisifahostinGroup1istheManagerthenheisnotrestrictedtoGroup2.Howdowestatethisexplicitrule?NAGsareusedtoexplicitlyallowordenyaccesstoasystemthroughthenetworkNamesreflectfunction—ANAG:allownetworkaccessgroupDNAG:denynetworkaccessgroupCancontainusers,computersorgroupsDefinedindomainlocalgroupsExampleScenariosUn-trustedServerIsolationUnmanagedDevicesActiveDirectoryDomainController(exempted)DomainIsolationOptionaloutboundauthenticationRequiredauthenticationXAuthenticatingHostFirewallsXDomainIsolationDomain

controllerServer:domainisolation

IPsecpolicyActive(requiresIPsecforalltrafficexceptforICMP)Client:

Untrustedor

non-IPseccapablePingsucceedsothersfailUser:

anytypeDomain

controllerServer:domainisolation

IPsecpolicyActive(requiresIPsecforalltrafficexceptforICMP)Pingsucceeds,otherssucceedoverIPsecClient:

WindowsXPSP2TrustedmachineUser:

domainmemberServerIsolationDomain

controllerServer:serverisolation

IPsecpolicyActive(requiresIPsecforalltrafficexceptforICMP)PingsucceedsothersfailbecauseIKEfailsAuthorizationonlyfor

CLIENT1ingrouppolicyvia“Accessthiscomputer

fromnetwork〞r(shí)ightUser:

domainmemberClient:

WindowsXPSP2

“CLIENT2〞TrustedmachineDomain

controllerServer:serverisolation

IPsecpolicyActive(requiresIPsecforalltrafficexceptforICMP)Client:

WindowsXPSP2

“CLIENT1〞TrustedmachineUser:

domainmemberPingsucceeds,othersucceedoverIPsecAuthorizationonlyfor

CLIENT1andthisuser

ingrouppolicyvia“Accessthisc