FIREWALL TECHNOLOGIES AND NETWORK SECURITY
CONTENTS CHAPTER 1 INSTALLING CHECK POINT NGX INTRODUCTION PREPARING THE GATEWAY INSTALLATION SECUREPLATFORM FIREWALL-1/VPN-1 INSTALLATION SMARTCENTER SERVER INSTALLATION SMARTCONSOLE INSTALLATION PUTTING IT ALL TOGETHER SMARTDASHBOARD SUMMARY CHAPTER 2 SMARTDASHBOARD AND SMARTPORTAL A TOUR OF THE DASHBOARD LOGGING IN THE RULEBASE PANE SECURITY TAB ADDRESS TRANSLATION TAB SMARTDEFENSE TAB WEB INTELLIGENCE TAB VPN MANAGER TAB QOS TAB DESKTOP SECURITY TAB WEB ACCESS TAB CONSOLIDATION RULES TAB THE OBJECTS TREE PANE NETWORK OBJECTS SERVICES RESOURCES SERVERS AND OPSEC APPLICATIONS USERS AND ADMINISTRATORS VPN COMMUNITIES THE OBJECTS LIST PANE THE SMARTMAP PANE MENUS AND TOOLBARS WORKING WITH POLICY PACKAGES INSTALLING THE POLICY GLOBAL PROPERTIES FIREWALL PAGE NAT—NETWORK ADDRESS TRANSLATION PAGE VPN PAGE VPN-1 EDGE/EMBEDDED PAGE REMOTE ACCESS PAGE SMARTDIRECTORY (LDAP) PAGE STATEFUL INSPECTION PAGE NEW IN SMARTDASHBOARD NGX SECURITY POLICY RULE NAMES AND UNIQUE IDS GROUP OBJECT CONVENTION GROUP HIERARCHY CLONE OBJECT SESSION DESCRIPTION TOOLTIPS YOUR FIRST SECURITY POLICY CREATING YOUR ADMINISTRATOR ACCOUNT HOOKING UP TO THE GATEWAY REVIEWING THE GATEWAY OBJECT DE? NING YOUR SECURITY POLICY POLICY DESIGN CREATING RULES NETWORK ADDRESS TRANSLATION OTHER USEFUL CONTROLS ON THE DASHBOARD WORKING WITH SECURITY POLICY RULES SECTION TITLES HIDING RULES RULE QUERIES SEARCHING RULES WORKING WITH OBJECTS OBJECT REFERENCES WHO BROKE THAT OBJECT? OBJECT QUERIES WORKING WITH POLICIES WHAT WOULD BE INSTALLED? WHAT’S REALLY INSTALLED? NO SECURITY PLEASE FOR THE ANORAKS CHANGE MANAGEMENT MANAGING CONNECTRA AND INTERSPECT GATEWAYS CON? GURING INTERSPECT OR CONNECTRA INTEGRATION SMARTDEFENSE UPDATES SMARTPORTAL SMARTPORTAL FUNCTIONALITY INSTALLING SMARTPORTAL TOUR OF SMARTPORTAL CHAPTER 3 SMART VIEW TRACKER TRACKER LOG VIEW ACTIVE AUDIT PREDE? NED QUERIES USE FOR PREDE? NED QUERIES ADDING CUSTOM QUERIES APPLYING FILTERS CUSTOM QUERIES MATCHING RULE FILTER VIEWING THE MATCHING RULE VIEWING LOG RECORDS FROM SMARTDASHBOARD ACTIVE VIEW LIVE CONNECTIONS CUSTOM COMMANDS FOLLOWING A SOURCE OR DESTINATION BLOCK INTRUDER AUDIT VIEW LOG MAINTENANCE DAILY MAINTENANCE LOG SWITCH CHAPTER 4 SMARTDEFENSE AND WEB INTELLIGENCE NETWORK SECURITY THREATS STRUCTURED THREATS DENIAL OF SERVICE EXTERNAL THREATS WELCHIA INTERNET CONTROL MESSAGE PROTOCOL NETWORK QUOTA INTERNAL THREATS RECONNAISSANCE (PORT SCANS AND SWEEPS) THE OSI MODEL LAYER 3: THE NETWORK LAYER LAYER 4: THE TRANSPORT LAYER LAYER 7: THE APPLICATION LAYER THE NEED FOR GRANULAR INSPECTION APPLICATION INTELLIGENCE CON? GURING HOSTS AND NODES FOR AI SMARTDEFENSE TECHNOLOGY CENTRAL CON? GURATION AND THE SMARTDEFENSE WEB SITE UPDATING SMARTDEFENSE DEFENSE AGAINST ATTACKS PEER-TO-PEER PREVENTING INFORMATION DISCLOSURE FINGERPRINT SCRAMBLING ABNORMAL BEHAVIOR ANALYSIS WEB INTELLIGENCE TECHNOLOGY MALICIOUS CODE PROTECTOR ACTIVE STREAMING WEB APPLICATION LAYER SQL INJECTION CUSTOM WEB BLOCKING HEADER SPOO? NG DIRECTORY LISTING MALICIOUS CODE DE? NITION DIFFERENT TYPES OF MALICIOUS CODE GENERAL HTTP WORM CATCHER PROTOCOL INSPECTION CONFORMITY DNS ENFORCEMENT HTTP INSPECTION DEFAULT CON? GURATION DSHIELD STORM CENTER RETRIEVING BLOCKLIST SUBMITTING LOGS CHAPTER 5 NETWORK ADDRESS TRANSLATION CON? GURING DYNAMIC HIDE MODE NAT DYNAMIC NAT DE? NED ADVANCED UNDERSTANDING OF NAT WHEN TO USE IT ROUTING AND ARP ADDING ARP ENTRIES SECURE PLATFORM SOLARIS WINDOWS IPSO CON? GURING STATIC MODE NAT STATIC NAT DE? NED INBOUND CONNECTIONS CON? GURING AUTOMATIC NAT NAT RULE BASE ACCESS CONTROL SETTINGS CON? GURING PORT TRANSLATION SECURITY POLICY IMPLICATIONS CHAPTER 6 AUTHENTICATION AUTHENTICATION OVERVIEW USING AUTHENTICATION IN YOUR ENVIRONMENT MANAGING USERS AND ADMINISTRATORS PERMISSION PRO? LES ADMINISTRATORS GENERAL TAB PERSONAL TAB GROUPS ADMIN AUTH ADMIN CERTI? CATES ADMINISTRATOR GROUPS USER TEMPLATES GENERAL PERSONAL AUTHENTICATION LOCATION TIME ENCRYPTION USER GROUPS USERS CERTI? CATES EXTERNAL USER PRO? LES MATCH BY DOMAIN MATCH ALL USERS LDAP GROUP UNDERSTANDING AUTHENTICATION SCHEMES UNDE? NED SECURID CHECK POINT PASSWORD RADIUS TACACS USER AUTHENTICATION CON? GURING USER AUTHENTICATION IN THE RULEBASE USERAUTH | EDIT PROPERTIES | GENERAL | SOURCE USERAUTH | EDIT PROPERTIES | GENERAL | DESTINATION USERAUTH | EDIT PROPERTIES | GENERAL | HTTP INTERACTING WITH USER AUTHENTICATION TELNET AND RLOGIN FTP HTTP PLACING AUTHENTICATION RULES ADVANCED TOPICS ELIMINATING THE DEFAULT AUTHENTICATION BANNER CHANGING THE BANNER USE HOST HEADER AS DESTINATION SESSION AUTHENTICATION CON? GURING SESSION AUTHENTICATION IN THE RULEBASE SESSIONAUTH | EDIT PROPERTIES | GENERAL | SOURCE SESSIONAUTH | EDIT PROPERTIES | GENERAL | DESTINATION SESSIONAUTH | EDIT PROPERTIES | GENERAL | CONTACT AGENT AT SESSIONAUTH | EDIT PROPERTIES | GENERAL | ACCEPT ONLY SECUREMOTE/SECURECLIENT ENCRYPTED CONNECTIONS SESSIONAUTH | EDIT PROPERTIES | GENERAL | SINGLE SIGN-ON CON? GURING SESSION AUTHENTICATION ENCRYPTION THE SESSION AUTHENTICATION AGENT CON? GURATION | PASSWORDS | ASK FOR PASSWORD CON? GURATION | ALLOWED FIREWALL-1 | ALLOW AUTHENTICATION REQUEST FROM CON? GURATION | ALLOWED FIREWALL-1 | OPTIONS INTERACTING WITH SESSION AUTHENTICATION CLIENT AUTHENTICATION CON? GURING CLIENT AUTHENTICATION IN THE RULEBASE CLIENTAUTH | EDIT PROPERTIES | GENERAL | SOURCE CLIENTAUTH | EDIT PROPERTIES | GENERAL | DESTINATION CLIENTAUTH | EDIT PROPERTIES | GENERAL | APPLY RULE ONLY IF DESKTOP CON? GURATION OPTIONS ARE VERI? ED CLIENTAUTH | EDIT PROPERTIES | GENERAL | REQUIRED SIGN-IN CLIENTAUTH | EDIT PROPERTIES | GENERAL |SIGN-ON METHOD MANUAL SIGN-ON PARTIALLY AUTOMATIC SIGN-ON FULLY AUTOMATIC SIGN-ON AGENT AUTOMATIC SIGN-ON SINGLE SIGN-ON GENERAL | SUCCESSFUL AUTHENTICATION TRACKING LIMITS | AUTHORIZATION TIMEOUT LIMITS | NUMBER OF SESSIONS ALLOWED CHECK POINT GATEWAY | AUTHENTICATION ENABLED AUTHENTICATION SCHEMES AUTHENTICATION SETTINGS HTTP SECURITY SERVER GLOBAL PROPERTIES | AUTHENTICATION FAILED AUTHENTICATION ATTEMPTS AUTHENTICATION OF USERS WITH CERTI? CATES BRUTE-FORCE PASSWORD GUESSING PROTECTION EARLY VERSION COMPATIBILITY REGISTRY SETTINGS NEW INTERFACE OPENING ALL CLIENT AUTHENTICATION RULES CON? GURATION FILES ENABLING ENCRYPTED AUTHENTICATION CUSTOM PAGES INSTALLING THE USER DATABASE CHAPTER 7 CONTENT SECURITY AND OPSEC OPSEC PARTNERSHIP ANTI-VIRUS WEB FILTERING OPSEC APPLICATIONS SECURITY SERVERS URI SMTP TCP CIFS CVP RESOURCE CREATION UFP MDQ HOW TO DEBUG SECURE INTERNAL COMMUNICATION CHAPTER 8 VPN ENCRYPTION OVERVIEW SYMMETRIC AND ASYMMETRIC ENCRYPTION CERTI? CATE AUTHORITIES EXCHANGING KEYS TUNNEL MODE VS TRANSPORT MODE ENCRYPTION ALGORITHMS HASHING ALGORITHMS PUBLIC KEY INFRASTRUCTURE SIMPLI? ED VS TRADITIONAL USING THE SIMPLI? ED CON? GURATION METHOD MESHED VPN COMMUNITIES STAR VPN COMMUNITIES MULTIPLE ENTRY POINT (MEP) CON? GURING A VPN WITH A CISCO PIX USING THE TRADITIONAL VPN CON? GURATION METHOD VPN DIRECTIONAL MATCHING ROUTE-BASED VPN ROUTING PROTOCOLS CON? GURING VTIS CON? GURING VTI EXAMPLE TUNNEL MANAGEMENT AND DEBUGGING USING SMARTVIEW TRACKER USING CPSTAT CHAPTER 9 SECUREMOTE, SECURECLIENT, AND INTEGRITY SECUREMOTE WHAT’S NEW WITH SECUREMOTE IN NGX? STANDARD CLIENT BASIC REMOTE ACCESS DE? NING THE CONNECTION POLICY SECUREMOTE INSTALLATION AND CON? GURATION ON MICROSOFT WINDOWS CONNECTING TO THE VPN-1 GATEWAY SECURECLIENT WHAT’S NEW IN SC NGX? INSTALLING SECURECLIENT ON MICROSOFT WINDOWS POLICY SERVER DESKTOP SECURITY POLICIES CON? GURING DESKTOP SECURITY POLICIES DISABLING THE SECURITY POLICY SECURE CON? GURATION VERI? CATION OF? CE MODE WHY OF? CE MODE? CLIENT IP POOL CON? GURING OF? CE MODE WITH IP POOLS CON? GURING THE VPN-1 GATEWAY FOR OF? CE MODE CON? GURING SECURECLIENT FOR OF? CE MODE SECURE CON? GURATION VERI? CATION (SCV) WHAT’S NEW WITH SECURE CON? GURATION VERI? CATION (SCV) IN NGX? CON? GURING THE POLICY SERVER TO ENABLE SECURE CON? GURATION VERI? CATION (SCV) SECURE CON? GURATION VERI? CATION (SCV) CHECKS AVAILABLE CHECK POINT OPSEC VENDOR SCV CHECKS OTHER THIRD-PARTY CHECKS CREATE YOUR OWN CHECKS INTEGRITY HISTORY OF INTEGRITY INTEGRITY CLIENT INSTALLATION INTEGRITY CLIENT CON? GURATION INTEGRITY CLIENTLESS SECURITY CHAPTER 10 ADAPTIVE SECURITY DEVICE MANAGER FEATURES, LIMITATIONS, AND REQUIREMENTS SUPPORTED PIX FIREWALL HARDWARE AND SOFTWARE VERSIONS PIX DEVICE REQUIREMENTS HOST REQUIREMENTS FOR RUNNING ASDM ADAPTIVE SECURITY DEVICE MANAGER LIMITATIONS UNSUPPORTED COMMANDS UNSUPPORTED CHARACTERS ASDM CLI DOES NOT SUPPORT INTERACTIVE COMMANDS PRINTING FROM ASDM INSTALLING, CON? GURING, AND LAUNCHING ASDM PREPARING FOR INSTALLATION INSTALLING OR UPGRADING ASDM OBTAINING A DES ACTIVATION KEY CON? GURING THE PIX FIREWALL FOR NETWORK CONNECTIVITY INSTALLING A TFTP SERVER UPGRADING THE PIX FIREWALL AND CON? GURING THE DES ACTIVATION KEY INSTALLING OR UPGRADING ASDM ON THE PIX DEVICE ENABLING AND DISABLING ASDM LAUNCHING ASDM CON? GURING THE PIX FIREWALL USING ASDM USING THE STARTUP WIZARD CON? GURING SYSTEM PROPERTIES THE AAA MENU THE ADVANCED MENU THE ARP STATIC TABLE MENU THE AUTO UPDATE MENU THE DHCP SERVICES MENU THE DNS CLIENT MENU THE FAILOVER MENU THE HISTORY METRICS CATEGORY THE IP AUDIT MENU THE LOGGING MENU THE PRIORITY QUEUE CATEGORY THE SSL CATEGORY THE SUNRPC SERVER CATEGORY THE URL FILTERING CATEGORY CON? GURING VPNS USING ASDM CON? GURING A SITE-TO-SITE VPN USING ASDM CON? GURING A REMOTE ACCESS VPN USING ASDM CHAPTER 11 APPLICATION INSPECTION NEW FEATURES IN PIX 7 0 SUPPORTING AND SECURING PROTOCOLS TCP, UDP, ICMP, AND THE PIX FIREWALL APPLICATION LAYER PROTOCOL INSPECTION DE? NING A TRAF? C CLASS ASSOCIATING A TRAF? C CLASS WITH AN ACTION CUSTOMIZING APPLICATION INSPECTION PARAMETERS APPLYING INSPECTION TO AN INTERFACE DOMAIN NAME SERVICE REMOTE PROCEDURE CALL SQL NET INTERNET LOCATOR SERVICE AND LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL FTP INSPECTION ACTIVE VERSUS PASSIVE MODE ESMTP INSPECTION ICMP INSPECTION H 323 SIMPLE NETWORK MANAGEMENT PROTOCOL (SNMP) VOICE AND VIDEO PROTOCOLS SIP CTIQBE SCCP REAL-TIME STREAMING PROTOCOL (RTSP), NETSHOW, AND VDO LIVE CHAPTER 12 FILTERING, INTRUSION DETECTION, AND ATTACK MANAGEMENT ENHANCED TCP SECURITY ENGINE IMPROVED WEBSENSE URL FILTERING PERFORMANCE FILTERING WEB AND FTP TRAF? C FILTERING URLS WEBSENSE AND SENTIAN BY N2H2 FINE-TUNING AND MONITORING THE FILTERING PROCESS CON? GURING HTTP URL FILTERING CON? GURING HTTPS FILTERING SETTING UP FTP FILTERING ACTIVE CODE FILTERING FILTERING JAVA APPLETS FILTERING ACTIVEX OBJECTS VIRUS FILTERING; SPAM, ADWARE, MALWARE, AND OTHER-WARE FILTERING TCP ATTACK DETECTION AND RESPONSE PIX INTRUSION DETECTION SUPPORTED SIGNATURES CON? GURING INTRUSION DETECTION/AUDITING DISABLING SIGNATURES CON? GURING SHUNNING ATTACK CONTAINMENT AND MANAGEMENT PLACING LIMITS ON FRAGMENTATION SYN FLOODGUARD THE TCP INTERCEPT FEATURE PREVENTING IP SPOO? NG OTHER WAYS THE PIX CAN PREVENT, CONTAIN, OR MANAGE ATTACKS CON? GURING CONNECTION LIMITS AND TIMEOUTS PREVENTING MAC ADDRESS SPOO? NG CHAPTER 13 SERVICES DHCP FUNCTIONALITY DHCP SERVERS CISCO IP PHONE-RELATED OPTIONS DHCP RELAY DHCP CLIENTS PPPOE EASYVPN EASYVPN SERVER ROUTING AND THE PIX FIREWALL UNICAST ROUTING STATIC ROUTES RIP OSPF NETWORK ADDRESS TRANSLATION AS A ROUTING MECHANISM MULTICAST ROUTING STUB MULTICAST ROUTING PIM MULTICAST ROUTING BGP THROUGH PIX FIREWALL QUEUING AND POLICING CHAPTER 14 CON? GURING AUTHENTICATION, AUTHORIZATION, AND ACCOUNTING NEW AND CHANGED COMMANDS IN 7 0 INTRODUCING AAA CONCEPTS AUTHORIZATION ACCOUNTING AAA SECURITY PROTOCOLS AUTHENTICATION METHODS USED BY RADIUS RADIUS FUNCTIONS AVAILABLE ON THE CISCO PIX HOW RADIUS WORKS TACACS+ AUTHENTICATION METHODS USED BY TACACS+ TACACS+ FUNCTIONS AVAILABLE TO THE CISCO PIX HOW TACACS+ WORKS OPTIONAL SECURITY PROTOCOLS AND METHODS AAA SERVERS CON? GURING CONSOLE AUTHENTICATION CON? GURING LOCAL AUTHENTICATION CON? GURING LOCAL AAA USING THE ASDM CON? GURING COMMAND AUTHORIZATION CON? GURING LOCAL COMMAND AUTHORIZATION CON? GURING TACACS+ AND RADIUS CONSOLE AUTHENTICATION CON? GURING TACACS+ COMMAND AUTHORIZATION CON? GURING AUTHENTICATION FOR TRAF? C THROUGH THE FIREWALL CON? GURING CUT-THROUGH PROXY VIRTUAL HTTP VIRTUAL TELNET CON? GURING AUTHORIZATION FOR TRAF? C THROUGH THE FIREWALL CON? GURING ACCOUNTING FOR TRAF? C THROUGH THE FIREWALL CHAPTER 15 PIX FIREWALL MANAGEMENT CON? GURING LOGGING LOGGING LEVELS DROPPED AND CHANGED SYSLOG MESSAGES FROM 6 X LOGGING FACILITY LOCAL LOGGING BUFFERED LOGGING CONSOLE LOGGING TERMINAL LOGGING REMOTE LOGGING VIA SYSLOG DISABLING SPECI? C SYSLOG MESSAGES CON? GURING REMOTE ACCESS SECURE SHELL ENABLING SSH ACCESS TROUBLESHOOTING SSH TELNET RESTRICTIONS CON? GURING SIMPLE NETWORK MANAGEMENT PROTOCOL CON? GURING SYSTEM IDENTI? CATION CON? GURING POLLING CON? GURING TRAPS MANAGING SNMP ON THE PIX CON? GURING SYSTEM DATE AND TIME SETTING AND VERIFYING THE CLOCK AND TIME ZONE CON? GURING AND VERIFYING THE NETWORK TIME PROTOCOL NTP AUTHENTICATION MANAGEMENT USING THE CISCO PIX ADAPTIVE SECURITY DEVICE MANAGER (ASDM) CHAPTER 16 CON? GURING VIRTUAL PRIVATE NETWORKING WHAT’S NEW IN PIX 7 0 IPSEC CONCEPTS IPSEC IPSEC CORE LAYER 3 PROTOCOLS: ESP AND AH AUTHENTICATION HEADER ENCAPSULATING SECURITY PAYLOAD IPSEC COMMUNICATION MODES: TUNNEL AND TRANSPORT INTERNET KEY EXCHANGE SECURITY ASSOCIATIONS CERTI? CATE AUTHORITY SUPPORT CON? GURING A SITE-TO-SITE VPN PLANNING ALLOWING IPSEC TRAF? C ENABLING IKE CREATING AN ISAKMP PROTECTION SUITE DE? NING AN ISAKMP PRESHARED KEY CON? GURING CERTI? CATE AUTHORITY SUPPORT PREPARING THE PIX TO USE CERTI? CATES GENERATING A KEY PAIR CON? GURE A CA AS A TRUSTPOINT AUTHENTICATING AND ENROLLING WITH THE CA CON? GURING CRYPTO ACCESS-LISTS DE? NING A TRANSFORM SET BYPASSING NETWORK ADDRESS TRANSLATION CON? GURING A CRYPTO MAP TROUBLESHOOTING REMOTE ACCESS—CON? GURING SUPPORT FOR THE CISCO SOFTWARE VPN CLIENT ENABLING IKE AND CREATING AN ISAKMP PROTECTION SUITE CRYPTO MAPS TUNNEL GROUPS AND GROUP POLICIES ADDRESS POOL CON? GURATION SPLIT TUNNELING NAT ISSUES AUTHENTICATION AGAINST RADIUS, TACACS+, SECURID, OR ACTIVE DIRECTORY AUTOMATIC CLIENT UPDATE CON? GURING CLIENT FIREWALL REQUIREMENTS SAMPLE CON? GURATIONS OF PIX AND VPN CLIENTS CHAPTER 17 ISA SERVER 2006 CLIENT TYPES AND AUTOMATING CLIENT PROVISIONING UNDERSTANDING ISA SERVER 2006 CLIENT TYPES UNDERSTANDING THE ISA SERVER 2006 SECURENAT CLIENT SECURENAT CLIENT LIMITATIONS SECURENAT CLIENT ADVANTAGES NAME RESOLUTION FOR SECURENAT CLIENTS NAME RESOLUTION AND “LOOPING BACK” THROUGH THE ISA SERVER 2006 FIREWALL UNDERSTANDING THE ISA SERVER 2006 FIREWALL CLIENT ALLOWS STRONG USER/GROUP-BASED AUTHENTICATION FOR ALL WINSOCK APPLICATIONS USING TCP AND UDP PROTOCOLS ALLOWS USER AND APPLICATION INFORMATION TO BE RECORDED IN THE ISA SERVER 2006 FIREWALL’S LOG FILES PROVIDES ENHANCED SUPPORT FOR NETWORK APPLICATIONS, INCLUDING COMPLEX PROTOCOLS THAT REQUIRE SECONDARY CONNECTIONS PROVIDES “PROXY” DNS SUPPORT FOR FIREWALL CLIENT MACHINES THE NETWORK ROUTING INFRASTRUCTURE IS TRANSPARENT TO THE FIREWALL CLIENT HOW THE FIREWALL CLIENT WORKS INSTALLING THE FIREWALL CLIENT SHARE INSTALLING THE FIREWALL CLIENT FIREWALL CLIENT CON? GURATION CENTRALIZED CON? GURATION OPTIONS AT THE ISA SERVER FIREWALL COMPUTER ENABLING SUPPORT FOR LEGACY FIREWALL CLIENT/WINSOCK PROXY CLIENTS CLIENT SIDE FIREWALL CLIENT SETTINGS FIREWALL CLIENT CON? GURATION FILES INI FILES ADVANCED FIREWALL CLIENT SETTINGS FIREWALL CLIENT CON? GURATION AT THE ISA SERVER 2006 FIREWALL ISA SERVER 2006 WEB PROXY CLIENT IMPROVED PERFORMANCE FOR THE FIREWALL CLIENT AND SECURENAT CLIENT CON? GURATION FOR WEB ACCESS ABILITY TO USE THE AUTOCON? GURATION SCRIPT TO BYPASS SITES USING DIRECT ACCESS ALLOWS YOU TO PROVIDE WEB ACCESS (HTTP/HTTPS/FTP DOWNLOAD) WITHOUT ENABLING USERS ACCESS TO OTHER PROTOCOLS ALLOWS YOU TO ENFORCE USER/GROUP-BASED ACCESS CONTROLS OVER WEB ACCESS ALLOWS YOU TO LIMIT THE NUMBER OF OUTBOUND WEB PROXY CLIENT CONNECTIONS SUPPORTS WEB PROXY CHAINING, WHICH CAN FURTHER SPEED UP INTERNET ACCESS ISA SERVER 2006 MULTIPLE CLIENT TYPE CON? GURATION DECIDING ON AN ISA SERVER 2006 CLIENT TYPE AUTOMATING ISA SERVER 2006 CLIENT PROVISIONING CON? GURING DHCP SERVERS TO SUPPORT WEB PROXY AND FIREWALL CLIENT AUTODISCOVERY INSTALL THE DHCP SERVER CREATE THE DHCP SCOPE CREATE THE DHCP 252 SCOPE OPTION AND ADD IT TO THE SCOPE CON? GURE THE CLIENT AS A DHCP CLIENT CON? GURE THE CLIENT BROWSER TO USE DCHP FOR AUTODISCOVERY CON? GURE THE ISA SERVER 2006 FIREWALL TO PUBLISH AUTODISCOVERY INFORMATION MAKING THE CONNECTION CON? GURING DNS SERVERS TO SUPPORT WEB PROXY AND FIREWALL CLIENT AUTODISCOVERY CREATING THE WPAD ENTRY IN DNS CON? GURE THE CLIENT TO USE THE FULLY-QUALI? ED WPAD ALIAS CON? GURE THE CLIENT BROWSER TO USE AUTODISCOVERY MAKING THE CONNECTION USING DNS FOR AUTODISCOVERY AUTOMATING INSTALLATION OF THE FIREWALL CLIENT CON? GURING FIREWALL CLIENT AND WEB PROXY CLIENT CON? GURATION IN THE ISA MANAGEMENT CONSOLE GROUP POLICY SOFTWARE INSTALLATION SILENT INSTALLATION SCRIPT SYSTEMS MANAGEMENT SERVER (SMS) CHAPTER 18 INSTALLING AND CON? GURING THE ISA FIREWALL SOFTWARE PRE-INSTALLATION TASKS AND CONSIDERATIONS SYSTEM REQUIREMENTS CON? GURING THE ROUTING TABLE DNS SERVER PLACEMENT CON? GURING THE ISA FIREWALL’S NETWORK INTERFACES INSTALLATION VIA A TERMINAL SERVICES ADMINISTRATION MODE SESSION PERFORMING A CLEAN INSTALLATION ON A MULTIHOMED MACHINE DEFAULT POST-INSTALLATION ISA FIREWALL CON? GURATION THE POST-INSTALLATION SYSTEM POLICY PERFORMING A SINGLE NIC INSTALLATION (UNIHOMED ISA FIREWALL) QUICK START CON? GURATION FOR ISA FIREWALLS IP ADDRESS AND DNS SERVER ASSIGNMENT CON? GURING THE INTERNAL NETWORK INTERFACE CON? GURING THE EXTERNAL NETWORK INTERFACE NETWORK INTERFACE ORDER INSTALLING AND CON? GURING A DNS SERVER ON THE ISA SERVER FIREWALL INSTALLING THE DNS SERVICE INSTALLING THE DNS SERVER SERVICE ON WINDOWS SERVER 2003 CON? GURING THE DNS SERVICE ON THE ISA FIREWALL CON? GURING THE DNS SERVICE IN WINDOWS SERVER 2003 CON? GURING THE DNS SERVICE ON THE INTERNAL NETWORK DNS SERVER INSTALLING AND CON? GURING A DHCP SERVER ON THE ISA SERVER FIREWALL INSTALLING THE DHCP SERVICE INSTALLING THE DHCP SERVER SERVICE ON A WINDOWS SERVER 2003 COMPUTER CON? GURING THE DHCP SERVICE INSTALLING AND CON? GURING THE ISA SERVER 2006 SOFTWARE CON? GURING THE ISA FIREWALL DHCP REQUEST TO SERVER RULE DHCP REPLY FROM SERVER RULE INTERNAL DNS SERVER TO DNS FORWARDER RULE INTERNAL NETWORK TO DNS SERVER THE ALL OPEN RULE CON? GURING THE INTERNAL NETWORK COMPUTERS CON? GURING INTERNAL CLIENTS AS DHCP CLIENTS HARDENING THE BASE ISA FIREWALL CON? GURATION AND OPERATING SYSTEM ISA FIREWALL SERVICE DEPENDENCIES SERVICE REQUIREMENTS FOR COMMON TASKS PERFORMED ON THE ISA FIREWALL CLIENT ROLES FOR THE ISA FIREWALL ISA FIREWALL ADMINISTRATIVE ROLES AND PERMISSIONS LOCKDOWN MODE LOCKDOWN MODE FUNCTIONALITY CONNECTION LIMITS DHCP SPOOF ATTACK PREVENTION CHAPTER 19 CREATING AND USING ISA 2006 FIREWALL ACCESS POLICY ISA FIREWALL ACCESS RULE ELEMENTS PROTOCOLS USER SETS CONTENT TYPES SCHEDULES CON? GURING ACCESS RULES FOR OUTBOUND ACCESS THROUGH THE ISA FIREWALL THE RULE ACTION PAGE THE PROTOCOLS PAGE THE ACCESS RULE SOURCES PAGE THE ACCESS RULE DESTINATIONS PAGE THE USER SETS PAGE ACCESS RULE PROPERTIES THE GENERAL TAB THE ACTION TAB THE PROTOCOLS TAB THE FROM TAB THE TO TAB THE USERS TAB THE SCHEDULE TAB THE CONTENT TYPES TAB THE ACCESS RULE CONTEXT MENU OPTIONS CON? GURING RPC POLICY CON? GURING FTP POLICY CON? GURING HTTP POLICY ORDERING AND ORGANIZING ACCESS RULES HOW TO BLOCK LOGGING FOR SELECTED PROTOCOLS DISABLING AUTOMATIC WEB PROXY CONNECTIONS FOR SECURENAT CLIENTS USING SCRIPTS TO POPULATE DOMAIN NAME SETS USING THE IMPORT SCRIPTS EXTENDING THE SSL TUNNEL PORT RANGE FOR WEB ACCESS TO ALTERNATE SSL PORTS AVOIDING LOOPING BACK THROUGH THE ISAFIREWALL FOR INTERNAL RESOURCES ANONYMOUS REQUESTS APPEAR IN LOG FILE EVEN WHEN AUTHENTICATION IS ENFORCED FOR WEB (HTTP CONNECTIONS) BLOCKING MSN MESSENGER USING AN ACCESS RULE ALLOWING OUTBOUND ACCESS TO MSN MESSENGER VIA WEB PROXY CHANGES TO ISA FIREWALL POLICY ONLY AFFECTS NEW CONNECTIONS ALLOWING INTRADOMAIN COMMUNICATIONS THROUGH THE ISA FIREWALL CHAPTER 20 CREATING REMOTE ACCESS AND SITE-TO-SITE VPNS WITH ISA FIREWALLS OVERVIEW OF ISA FIREWALL VPN NETWORKING FIREWALL POLICY APPLIED TO VPN CLIENT CONNECTIONS FIREWALL POLICY APPLIED TO VPN SITE-TO-SITE CONNECTIONS VPN QUARANTINE USER MAPPING OF VPN CLIENTS SECURENAT CLIENT SUPPORT FOR VPN CONNECTIONS SITE-TO-SITE VPN USING TUNNEL MODE IPSEC PUBLISHING PPTP VPN SERVERS PRE-SHARED KEY SUPPORT FOR IPSEC VPN CONNECTIONS ADVANCED NAME SERVER ASSIGNMENT FOR VPN CLIENTS MONITORING OF VPN CLIENT CONNECTIONS AN IMPROVED SITE-TO-SITE WIZARD (NEW ISA 2006 FEATURE) THE CREATE ANSWER FILE WIZARD (NEW ISA 2006 FEATURE) THE BRANCH OF? CE CONNECTIVITY WIZARD (NEW ISA 2006 FEATURE) THE SITE-TO-SITE SUMMARY (NEW ISA 2006 FEATURE) CREATING A REMOTE ACCESS PPTP VPN SERVER ENABLE THE VPN SERVER CREATE AN ACCESS RULE ALLOWING VPN CLIENTS ACCESS TO ALLOWED RESOURCES ENABLE DIAL-IN ACCESS TEST THE PPTP VPN CONNECTION CREATING A REMOTE ACCESS L2TP/IPSEC SERVER ISSUE CERTI? CATES TO THE ISA FIREWALL AND VPN CLIENTS TEST THE L2TP/IPSEC VPN CONNECTION MONITOR VPN CLIENTS USING A PRE-SHARED KEY FOR VPN CLIENT REMOTE ACCESS CONNECTIONS CREATING A PPTP SITE-TO-SITE VPN CREATE THE REMOTE SITE NETWORK AT THE MAIN OF? CE THE NETWORK RULE AT THE MAIN OF? CE THE ACCESS RULES AT THE MAIN OF? CE CREATE THE VPN GATEWAY DIAL-IN ACCOUNT AT THE MAIN OF? CE CREATE THE REMOTE SITE NETWORK AT THE BRANCH OF? CE THE NETWORK RULE AT THE BRANCH OF? CE THE ACCESS RULES AT THE BRANCH OF? CE CREATE THE VPN GATEWAY DIAL-IN ACCOUNT AT THE BRANCH OF? CE ACTIVATE THE SITE-TO-SITE LINKS CREATING AN L2TP/IPSEC SITE-TO-SITE VPN ENABLE THE SYSTEM POLICY RULE ON THE MAIN OF? CE FIREWALL TO ACCESS THE ENTERPRISE CA REQUEST AND INSTALL A CERTI? CATE FOR THE MAIN OF? CE FIREWALL CON? GURE THE MAIN OF? CE ISA FIREWALL TO USE L2TP/IPSEC FOR THE SITE-TO-SITE LINK ENABLE THE SYSTEM POLICY RULE ON THE BRANCH OF? CE FIREWALL TO ACCESS THE ENTERPRISE CA REQUEST AND INSTALL A CERTI? CATE FOR THE BRANCH OF? CE FIREWALL CON? GURE THE BRANCH OF? CE ISA FIREWALL TO USE L2TP/IPSEC FOR THE SITE-TO-SITE LINK ACTIVATE THE L2TP/IPSEC SITE-TO-SITE VPN CONNECTION CON? GURING PRE-SHARED KEYS FOR SITE-TO-SITE L2TP/IPSEC VPN LINKS IPSEC TUNNEL MODE SITE-TO-SITE VPNS WITH DOWNLEVEL VPN GATEWAYS USING RADIUS FOR VPN AUTHENTICATION AND REMOTE ACCESS POLICY CON? GURE THE INTERNET AUTHENTICATION SERVICES (RADIUS) SERVER CREATE A VPN CLIENTS REMOTE ACCESS POLICY REMOTE ACCESS PERMISSIONS AND DOMAIN FUNCTIONAL LEVEL CHANGING THE USER ACCOUNT DIAL-IN PERMISSIONS CHANGING THE DOMAIN FUNCTIONAL LEVEL CONTROLLING REMOTE ACCESS PERMISSION VIA REMOTE ACCESS POLICY ENABLE THE VPN SERVER ON THE ISA FIREWALL AND CON? GURE RADIUS SUPPORT CREATE AN ACCESS RULE ALLOWING VPN CLIENTS ACCESS TO APPROVED RESOURCES MAKE THE CONNECTION FROM A PPTP VPN CLIENT USING EAP USER CERTI? CATE AUTHENTICATION FOR REMOTE ACCESS VPNS CON? GURING THE ISA FIREWALL SOFTWARE TO SUPPORT EAP AUTHENTICATION ENABLING USER MAPPING FOR EAP AUTHENTICATED USERS ISSUING A USER CERTI? CATE TO THE REMOTE ACCESS VPN CLIENT MACHINE SUPPORTING OUTBOUND VPN CONNECTIONS THROUGH THE ISA FIREWALL INSTALLING AND CON? GURING THE DHCP SERVER AND DHCP RELAY AGENT ON THE ISA FIREWALL CHAPTER 21 ISA 2006 STATEFUL INSPECTION AND APPLICATION LAYER FILTERING APPLICATION FILTERS THE SMTP FILTER THE DNS FILTER THE POP INTRUSION DETECTION FILTER THE SOCKS V4 FILTER THE FTP ACCESS FILTER THE H 323 FILTER THE MMS FILTER THE PNM FILTER THE PPTP FILTER THE RPC FILTER THE RTSP FILTER WEB FILTERS THE HTTP SECURITY FILTER (HTTP FILTER) OVERVIEW OF HTTP SECURITY FILTER SETTINGS THE METHODS TAB THE EXTENSIONS TAB THE HEADERS TAB THE SIGNATURES TAB HTTP SECURITY FILTER LOGGING EXPORTING AND IMPORTING HTTP SECURITY FILTER SETTINGS EXPORTING AN HTTP POLICY FROM A WEB PUBLISHING RULE IMPORTING AN HTTP POLICY INTO A WEB PUBLISHING RULE INVESTIGATING HTTP HEADERS FOR POTENTIALLY DANGEROUS APPLICATIONS EXAMPLE HTTP SECURITY FILTER POLICIES COMMONLY BLOCKED HEADERS AND APPLICATION SIGNATURES THE ISA SERVER LINK TRANSLATOR DETERMINING CUSTOM DICTIONARY ENTRIES CON? GURING CUSTOM LINK TRANSLATION DICTIONARY ENTRIES THE WEB PROXY FILTER THE OWA FORMS-BASED AUTHENTICATION FILTER THE RADIUS AUTHENTICATION FILTER IP FILTERING AND INTRUSION DETECTION/INTRUSION PREVENTION COMMON ATTACKS DETECTION AND PREVENTION DNS ATTACKS DETECTION AND PREVENTION IP OPTIONS AND IP FRAGMENT FILTERING SOURCE ROUTING ATTACK CHAPTER 22 DEPLOYING NETSCREEN FIREWALLS MANAGING THE NETSCREEN FIREWALL NETSCREEN MANAGEMENT OPTIONS SERIAL CONSOLE WEBUI THE NETSCREEN-SECURITY MANAGER ADMINISTRATIVE USERS THE LOCAL FILE SYSTEM AND THE CON? GURATION FILE USING THE COMMAND LINE INTERFACE USING THE WEB USER INTERFACE SECURING THE MANAGEMENT INTERFACE UPDATING SCREENOS SYSTEM RECOVERY CON? GURING NETSCREEN TYPES OF ZONES SECURITY ZONES TUNNEL ZONES FUNCTION ZONES VIRTUAL ROUTERS TYPES OF INTERFACES SECURITY ZONE INTERFACES PHYSICAL INTERFACES SUBINTERFACES AGGREGATE INTERFACES REDUNDANT INTERFACES VLAN1 INTERFACE VIRTUAL SECURITY INTERFACES FUNCTION ZONE INTERFACES MANAGEMENT INTERFACES HA INTERFACES TUNNEL INTERFACES LOOPBACK INTERFACES CON? GURING SECURITY ZONES CON? GURING YOUR NETSCREEN FOR THE NETWORK BINDING AN INTERFACE TO A ZONE SETTING UP IP ADDRESSING CON? GURING THE DHCP CLIENT USING PPPOE INTERFACE SPEED MODES PORT MODE CON? GURATION CON? GURING BASIC NETWORK ROUTING CON? GURING SYSTEM SERVICES SETTING THE TIME DHCP SERVER DNS SNMP SYSLOG WEBTRENDS CHAPTER 23 POLI