Configuring Access Rule Elements

What Are Access Rule Elements?

Access rule elements are configuration objects in ISA Server that you use to create access rules. For example, you may want to create an access rule that allows only HTTP traffic. To do this, ISA Server provides an HTTP protocol access rule element that you can use when creating the access rule. Or you may want to limit access to the Internet to certain users or computers. To enable this, you can create a subnet or user set access rule element, and then use this element in an access rule to limit access to the Internet to only computers on the specified subnet, or to only the specified users.

How to Configure Access Rule Elements :

ISA Server includes several default access rule elements. For example, ISA Server includes a large number of protocol elements that you can use when creating an access rule. However, in some cases, you must create new access rule elements or modify existing elements.

How to Configure Protocol Elements
In some cases, you may want to create an access rule that allows or denies access to the Internet, depending on which protocol the client uses. To do this, you can use one of the protocol elements provided with ISA Server or create your own protocol definition.

In almost all cases, the preconfigured protocols defined by the ISA Server configuration provide all the flexibility you need when configuring access rules. The protocols included with ISA Server cannot be deleted. You can modify which application filters are applied to the preconfigured protocols, but you cannot modify any other settings.

You can also create new protocols by using the ISA Server Management Console. For example, you may be using a custom application that requires a specific port. You can create a protocol element that uses this port number and then use the protocol in an access rule. User-defined protocols can be edited or deleted.

To create a protocol object, use the following procedure.
1. In the Microsoft ISA Server Management Console tree, click Firewall Policy.
2. On the Toolbox tab, click Protocols.
3. Click New, and then click Protocol or RPC Protocol.
To modify an existing protocol definition, click the protocol in the Protocols box, and then click Edit.

How to Configure User Set Elements
The second criterion that you may want to apply to an access rule specifies which users will be allowed or denied access by the access rule. To limit access to Internet resources based on users or groups, you must create a user set element. When you limit an access rule to specific users, users must authenticate before they are granted access. For each group of users, you can define the type of authentication required. You can mix different types of authentication within a user set. For example, a user set might include a Windows user or group based on domain membership, a user from a RADIUS namespace, and another user from the SecurID namespace.

ISA Server is preconfigured with the following user sets:
1- All Authenticated Users This set includes all users who have authenticated using any type of authentication. SecureNAT clients are not authenticated unless they connect through a virtual private network (VPN). This means that this group does not include non-VPN SecureNAT clients.

2- All Users This set includes all users, both authenticated and unauthenticated. If you want to allow access for SecureNAT clients, you should use this user set.

3- System and Network Service This user set includes the Local System service and the Network service on the computer running ISA Server. This user set is used in some system policy rules.

Enabling Secure Internet Access with ISA Server 2004

Lesson 1: Enabling Secure Access to Internet Resources

What Is Secure Access to Internet Resources?
Almost all organizations provide some level of Internet access for their users. The use of the Internet as a source of information and e-mail as a communication tool means that most organizations cannot afford to be without access to the Internet. At the same time, ensuring that the connection to the Internet is secure is critical.

So what is secure access to the Internet? At a minimum, providing secure Internet access for users in an organization means the following:
1- Users can access the resources that they need. To do their jobs, users in many organizations must be able to use a Web browser or other application to access Internet resources.
2- The connection to the Internet is secure. Users must be reasonably sure that they will not be attacked through the Internet connection. Ideally, the connection to the Internet should not reveal any information about the internal system that can be used to launch an attack against the client computer. Information about the computer, such as the computer name, user logon name, and shared folders, as well as details about the network configuration for the client computer, such as the client Internet Protocol (IP) address, should be hidden.
3- The data that users transfer to and from the Internet is secure. In some cases, users might send confidential personal information such as credit card information to the Internet or they might send private or confidential organizational information such as client data to the Internet. This data must be secured when it leaves the organization. If the data cannot be protected, you must prevent users from sending the information to the Internet.
4- Users cannot download malicious programs from the Internet. One of the ways attackers gain access to your network is by getting users to download malicious content. You must prevent users from inadvertently or deliberately causing damage to the network by downloading viruses or Trojan horse applications to their client computers.

Secure access to the Internet also means that the user’s actions comply with the organization’s
security or Internet usage policy. This means the following:
1- Only users who have permission to access the Internet can access the Internet.
2- These users can use only approved protocols and applications to access Internet resources.
3- These users can gain access only to approved Internet resources, or these users cannot gain access to denied Internet resources.
4- These users can gain access to the Internet only in accordance with any other restrictions the organization may establish, such as when and from which computers access is permitted.

MCP 70-299 : Module 12 Securing Remote Access

Lesson 3: Configuring Remote Access Clients

You can configure clients to connect to a remote access server in one of two ways: by using the network connection properties or by using the Connection Manager Administration Kit (CMAK). Manually configuring a connection by using network connection properties is convenient when you are using the default security settings or when you need to configure fewer than ten clients. However, it would not be possible to configure and maintain VPN or dial-up network connection configurations on hundreds or thousands of client computers.

The CMAK allows you to easily configure large numbers of clients by creating an executable file that you can distribute to your users. When your users run the file, it creates a dial-up or VPN connection with your customized security settings. If you later change authentication or encryption methods, you can re-run the CMAK and distribute a new executable file to overwrite the previous configuration. You can even automate the distribution of the CMAK executable file by distributing it with a Group Policy object.

Configuring Client-Side Authentication Protocols :

You create a remote access connection by using the New Connection Wizard, as described in Lesson 2, Exercise 2. However, the New Connection Wizard does not allow you to configure the acceptable authentication or encryption settings for the connection. To view or modify the authentication protocols enabled for a remote access connection on the client, open the properties dialog box of the dial-up or VPN connection on the client, and then click the Security tab.

The Typical option is selected, and a secured password and data encryption are required. Automatically Use My Windows Logon Name And Password is not selected. This default setting is the
more secure choice. If you choose to automatically use the current credentials, an intruder who takes over the active desktop of the client can successfully authenticate and connect to your internal network, potentially compromising far more than a single computer. When the option is cleared, the user must provide credentials each time a connection is made.

CMAK Wizard :

Manually configuring remote access connections on clients is straightforward, but configuring
hundreds or thousands of clients would be impossible. Unfortunately, you cannot use Group Policy objects to directly control a user’s available network connections. However, you can use the CMAK to create an executable file that you can deploy to users. When users run this file, the CMAK adds a connection by using the settings you specified with the CMAK wizard.

Though most of the pages of the wizard do not involve security settings, there are several important pages that you can use to control the security settings on the resulting network connection. Specifically, the VPN Entries and Dial-Up Networking Entries pages allow you to restrict authentication and encryption on the client. The VPN Entries and Dial-Up Networking Entries pages are identical, except that the VPN settings allow you to choose between PPTP and L2TP.

70-299 : Module 12 : Securing Remote Access

Lesson 1: Remote Access Fundamentals

Windows Server 2003 provides two main types of remote access methods: dial-up and VPN. For each remote access type, there are several authentication and encryption protocols to choose from. You will have to choose the remote access type and security protocols based on the clients that will be connecting to your internal network and based on your existing infrastructure. This lesson will describe the two remote access methods and the various encryption and authentication protocols to allow you to make educated recommendations.

Remote Access Methods :

There are two primary methods for connecting remote users to a private network: dialup networking and virtual private networking. Dial-up networking enables a remote access client to establish a temporary dial-up connection to a physical port on a remote access server by using the service of a telecommunications provider, such as analog phone lines, Integrated Services Digital Network (ISDN), or X.25. The most common use of dial-up networking is that of a dial-up networking client that dials the phone number of a modem attached to the remote access server. This establishes a circuit
between the two devices.

Virtual private networking is the creation of an encrypted, authenticated point-to-point connection across a public network such as the Internet. A VPN client uses special network protocols called tunneling protocols to make a virtual call to a virtual port on a VPN server.

VPN Protocols :

Windows Server 2003 supports two VPN protocols: PPTP and L2TP. In most circumstances,either protocol will work equally well. They both provide similar levels of privacy and data integrity because they support the same authentication and encryption standards. They primarily differ in stability and compatibility. PPTP is more mature, but it is not an Internet standard. L2TP is relatively new, but it might be supported by a wider variety of non-Microsoft clients because it is an Internet standard.

70-299 : 10 Planning and Implementing Security for Wireless Networks

Lesson 2: Configuring Wireless Security

Although almost anyone can set up a wireless network in a few minutes, configuring a wireless network with security features is significantly more complex. Fortunately, Windows Server 2003 provides all of the software you need to deploy a wireless infrastructure with authentication, encryption, message integrity, and dynamically changing WEP shared secrets. At a high level, you will follow these steps to configure a wireless network infrastructure:

1. Plan wireless access policies.
2. Create a structure for authorizing users and computers to access the wireless network.
3. Plan the certificate infrastructure, and optionally deploy a PKI.
4. Configure IAS servers, including assigning a certificate and creating remote access policies (RAPs).
5. Update and configure wireless clients with the SSID and security settings.
6. Configure WAPs with security settings and the IP addresses of the IAS servers.

Planning Wireless Access Policies :
There are several aspects to planning wireless access policies. First, it is important to plan wireless access policies to help prevent WAPs from being installed in your organization with insufficient security. You should draft a policy that, at a minimum, defines the following requirements for new WAPs:
■ Authentication requirements. Generally, you should require that all wireless users are authenticated and specify whether PEAP or EAP-TLS will be used. If you plan to allow guests to access your wireless network, you should make provisions for creating WAPs providing limited access to your internal network that will be used only by guests.
■ Encryption. Some level of encryption should always be required. Unless you have wireless devices that do not support it, your policy should mandate the highest level of encryption available.
■ Physical security. Just like any other piece of network equipment, WAPs should be protected by lock and key to prevent attackers from tampering with the hardware.
■ SSID broadcast and naming conventions. Your policy should specify whether WAPs are configured to broadcast the SSID, and it should detail naming conventions for SSIDs.
■ Actively maintained list of WAPs. You must maintain a list of all WAPs on your network that at a minimum includes the SSID, the security settings, the administrator’s name, and patching equirements.
■ Auditing requirements. You should specify how usage information is gathered and how logs are archived.