So, just like the title of my blog, I’ll try to post things I can’t find Googling. Not only will I spell out the solution, I will explain what each of the step does so that you are not just clicking through dialog boxes. Bold <\/strong>fonts in a sentence indicate action you need to perform. Italic <\/em>fonts indicate label.<\/p>\n Goal:<\/strong><\/p>\n <\/strong><\/p>\n You have a central server(web server, file server, database, etc) in your company, and you have a small number of workstation accessing the server(as pictured on the right). Let’s say you have 3 workstations, and you’d like to accomplish the following:<\/p>\n If you are planning to deploy this solutions to hundreds of computers, of course Group Policy will make your life easier.<\/p>\n Short Solution and its shortcoming: If it’s a web server, slap an SSL certificate on it and restrict the web port to allow only certain IP. That will secure traffic between all the workstations and the server. Shortcomings:<\/p>\n Long, complicated Solution, and its benefit<\/strong><\/p>\n It’s long and complicated, but I’ll try to spell it out here with screen shot and explanation. Basically, you need to implement IPSec in Windows Firewall. Benefits are:<\/p>\n Requirements\/assumptions<\/strong><\/p>\n There are a lot of variables in this setup. I definitely can not list and explain every possible OS scenario. So, I’m going to pick the simplest one. This is what you need:<\/p>\n Enough explanation. Let’s get down to it.<\/p>\n 1. launch Local Security Policy MMC by typing secpol.msc<\/strong> from start menu. Make sure your server is joined to your company’s domain. A security policy contains packet filter(s) that specify one or more network traffic going in or out of the server.<\/p>\n 2. Right Click on IP Security Policies on Local Computer<\/em><\/strong>, <\/strong>and click Create IP Security Policy<\/em><\/strong>, and click next <\/strong>on the initial wizard screen<\/p>\n 3. Name and describe<\/strong> your Policy. I usually name mine based on what project I’m securing. Let’s say the super secret I’m protecting is called: Salary History Data Policy. <\/em>Description: To secure salary data only to person 1, person 2 and person 3, using computer 1, computer 2 and computer 3. <\/em>Next. <\/strong>Please Note that I’m not actually storing anyone’s salary. This is merely an example. <\/span><\/p>\n 4. On Request for secure communication <\/em>window, I will leave the checkbox(Activate the default response rule)<\/em> unchecked. Next<\/strong><\/p>\n 5. Leave Edit properties <\/em>checked. Finish<\/strong><\/p>\n 6. You’ll be prompted with a property window of a policy you just created. Click Add <\/strong>to add a new security Rule and click Next <\/strong> on the welcome screen<\/p>\n 7. We won’t be using a Tunnel Endpoint because the sever and workstations are in the same network. Choose This rule does not specify a tunnel<\/strong><\/em>.\u00a0Next<\/strong><\/p>\n 8. On Network Type <\/em>Window, you can choose to apply this policy to several network type. In this scenario, All network connections<\/em> and Local area network(LAN)<\/em> will yield the same result. I’ll go ahead and pick All Network Connections<\/strong>. <\/em>Next<\/strong><\/p>\n 9. You are now on\u00a0IP Filter List<\/em> window. \u00a0This specify the source and destination IPs you’d like to be included in your protected environment(List of IPs that this rule will be enforced on). Click Add<\/strong> to add a new filter list. Give it a name. I’ll name mine Super Secret Employees Salary IP Filter List. <\/em>Click Add<\/strong> again<\/p>\n 10. Getting tired of all those dialog box?? Don’t worry, we still have a long way to go(well, in that case, DO worry then).<\/p>\n 11. Click Next. <\/strong>You’ll be prompted for the description. You can skip this. Be kind to your brain, and provide some description. I’m sure you are not going to remember any of this a year from now :). Leave the Mirrored <\/em>option\u00a0Checked. <\/strong><\/p>\n 12. Leave the Source Address <\/em>to Any IP Address <\/em> and click Next<\/strong>. <\/em>You might ask “Are you crazy?? I thought we are restricting access to only specific sets of workstations to be able to access this server??” We’ll cover that part later using Kerberos authentication. \u00a0I promise. You won’t have to worry about workstations IPs.<\/p>\n 13. Change the destination address to My IP Address<\/strong>. <\/em>Click Next.<\/strong><\/p>\n 14. On protocol type<\/em>, select the protocol you’d like this rule to be enforced on. If you are protecting a web, file or database server, they are mostly using TCP <\/strong>protocol. Click Next.<\/strong><\/p>\n 15. In this example, I will be protecting a web server. So, I will choose to enforce this rule for TCP traffic coming from ANY\u00a0port<\/strong>, going to port<\/strong> 80<\/strong> on this server. Click Next, <\/strong>and\u00a0Finish<\/strong><\/p>\n 16. You are back to IP Filter list window on step 9 above. Click OK.<\/strong><\/p>\n 17. Select <\/strong>the filter list you just created and click Next<\/strong><\/p>\n <\/strong><\/p>\n 18. Now that you have specified a filter(IP, protocol and port), what are you going to do with it when a traffic that match the filter criteria arrive on your server(permit, deny, or negotiate with it)? This is where Filter Action <\/em>comes along. You can also think of this as “In order for other computers to access this server, their IP traffic has to be….(requirements you will specify later)”. On Filter Action <\/em> window, click on Add. <\/strong>Make sure the Use Add Wizard<\/em> is selected<\/strong>. Click Next <\/strong>on the Filter Action Wizard <\/em>welcome screen.<\/p>\n 19. I’ll name my action Super Secret Employee Salary Filter <\/strong>Action<\/strong>. <\/em>I’m getting tired of typing description. I’m leaving it blank. Click Next.<\/strong><\/p>\n 20. On Filter Action General Options <\/em>window, pick Negotiate security<\/strong>. Next.<\/strong><\/p>\n 21. Click Do not allow unsecured communication. Next<\/strong><\/p>\n 22. Click Integrity, and encryption <\/strong>to support encryption and authentication. Next, Finish<\/strong><\/p>\n 23. Select the filter action you just created and click Next<\/strong><\/p>\n 24. Pick Active Directory default(Kerveros V5 protocol). <\/strong>In order for this to work, your server needs to be joined to the domain. You can use certificate or shared key(not recommended) too, but I will cover only using AD for authentication. You don’t need to be domain admin. Next, Finish<\/strong><\/p>\n 25. Click\u00a0Ok <\/strong>to close the dialog box. At this point you have created a security policy, BUT you haven’t enabled it yet.<\/p>\n 26. To enable\/use this policy, you need to\u00a0Assign<\/strong> it. Right Click on the policy and click Assign<\/strong><\/p>\n At this point you have created and enabled this policy. It’s time to do some testing!!<\/p>\n I’m enforcing this policy on a web traffic(TCP port 80). Assuming that my server is called protectedserver, <\/em>with an IP of 192.168.1.200<\/em> and my company domain is called mycompany.com, <\/em>with this policy applied, I should NOT be able to access my server using http:\/\/protectedserver.mycompany.com<\/em> or http:\/\/192.168.1.200<\/em> from other location. However, I can still launch an internal browser on protectedserver<\/em> and navigate to http:\/\/protectedserver.mycompany.com<\/em> or\u00a0http:\/\/192.168.1.200. <\/em> This is okay. Traffic within protectedserver <\/em>is not included in the filter.\u00a0\u00a0If you Un-assign <\/em>the policy by right clicking and click on Un-assign, <\/em>now the http traffic should work again.<\/p>\n This means you have successfully restrict connection to the server. You need to test it accordingly of course. If you are restricting file share, then test if file shares work correctly after you assign the policy.<\/p>\n You are half way there. IPSec works together with Windows Firewall. So, the next step is to configure Windows Firewall.<\/p>\n You need to create a connection security rule in your firewall. “What does it do? clean my car? It’s been too many steps”, one might ask(or complain). This is where you can request IPSec authentication based on criterias such as: users, computers or both. This governs when to request authentication and how it’s done(it’ll be clearer below). It doesn’t restrict users. You would need to configure that separately, which I will also explain.<\/p>\n 1. Launch Windows Firewall with Advanced Security<\/strong><\/p>\n 2. Right click on Connection Security Rules<\/strong> and click New Rule<\/strong><\/p>\n 3. Select Custom, Next<\/strong><\/p>\n 4. Add <\/strong>the IP address of the server you are protecting to\u00a0Enpoint 2<\/em>. In my case, I’m adding 192.168.1.200 <\/em>to Endpoint 2. <\/em>Next<\/strong><\/p>\n 5. <\/em>Pick<\/strong> Require authentication for inbound and outbound connections. <\/strong>This is the WHEN part I explained above. The verb\u00a0Request <\/em>means it’s not required. It will be requested, but not required. Click Next<\/strong>.<\/p>\n 6. This is the HOW part I explained above. You can choose to authenticate based on Computers<\/em>(any user can access my web server as long as they use computers I specified in my policy), Users<\/em>(only a specific users can access my server regardless of which computers they use. It’s not displayed on this screen. I will explain more below), Computer and User<\/em>(only specific sets of computers used by users I specify are allowed to access my server). I’ll go ahead and Pick <\/strong>Computer and user (kerberos v5). <\/span><\/strong>Any users you specify can use any computer you specify to access your servers<\/span>. Click Next<\/strong><\/p>\n 7. Specify <\/strong>a protocol type and port. In my case, I’m using TCP <\/strong>protocol because I’m using http over port 80. Select All ports <\/strong>for Endpoint 1<\/em>, and Port 80 <\/strong>for Endpoint 2. <\/em>Click Next<\/strong><\/p>\n 8. You’ll have the option to apply it only to a specific network Profile. Obviously we need to enable this rule on at least one the Domain profile. You can apply them to all profiles(domain, private and public<\/strong>). Click Next<\/strong><\/p>\n 9. Name it again. I name mine Super Secret Employees Salary Firewall Connection Rule<\/strong>. Click Finish<\/strong><\/p>\n You are almost done. Remember how I told you that you can choose to only allow certain users only, regardless of what computer they use?? You can do this by changing the properties of this Connection Security Rule. <\/em>Now, your screen should look like the screenshot below. Make sure the Enabled <\/em>column says Yes<\/em>. :<\/p>\n The red-dotted column indicates that you are authenticating your users using BOTH their username and Computer. If you want to change this, right click <\/strong>on the connection rule you just created, click Properties, <\/strong>and click on the Authentication <\/strong>tab. You can change the authentication method to authenticate by User<\/strong> only. The User<\/strong> option is not available on the Wizard screen in step II.6 above. For the rest of this article, I’ll be using Computer and User<\/strong> authentication method.<\/p>\n At this point you did all the HOW and WHEN parts of authentication. Now you need to configure WHO or WHAT are you allowing to access this server. You will be using Windows Firewall with Advanced Security<\/em>. <\/strong>It’s so much easier now that IPSec is integrated with Firewall.<\/p>\n 1. Launch Windows Firewall with Advanced Security <\/strong>on the server you are protecting<\/p>\n 2. Click Inbound Rules<\/strong><\/p>\n 3. If the port you are securing is not listed under Local Port <\/em>column, do the following. If it is, skip this step, and continue to step 4.<\/p>\n![\"IPSec](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/06\/IPSec-without-Group-Policy1-297x300.png\" "\\"IPSec")
<\/a>\n
\n<\/strong><\/p>\n\n
\n
\n
I. \u00a0Configure your Server Security Policy<\/strong><\/h1>\n
![\"New](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/ipsec11-300x193.png\" "\\"New")
<\/a>![\"Adding](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/Adding-IP-Filter-List-300x191.png\" "\\"Adding")
<\/a>![\"IPSec](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/IPSec-Ports-300x191.png\" "\\"IPSec")
<\/a>![\"IPSec](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/IPSec-Filter-List-300x174.png\" "\\"IPSec")
<\/a><\/strong>![\"Filter](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/FilterAction-300x191.png\" "\\"Filter")
<\/a><\/strong>![\"Assign](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/Assign-IPSec-Policy-300x71.png\" "\\"Assign")
<\/a><\/strong>II. Configure your Server Advance Firewall Rules<\/strong><\/h1>\n
![\"Firewall](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/Firewall-Security-Rule.png\" "\\"Firewall")
<\/a><\/strong>![\"Connection](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/Connection-Security-Rule-300x30.png\" "\\"Connection")
<\/a>III. Restricting server access using Windows Firewall <\/strong><\/h1>\n
![\"New](\"http:\/\/digitallibraryworld.com\/wp-content\/uploads\/2011\/05\/New-Firewall-Rule.png\" "\\"New")
<\/a>