Using a Group Policy Object, GPO, editor select:
Computer Configuration Windows Settings Security Settings IP Security Policies on Active DirectoryFrom this selection build Filters that describe the limitation you wish to impose on a collection of computers. Once the Filters are defined define a Security Policy:
"IPSec http://www.ietf.org/rfc/rfc1825.txt is the result of a long process of study, analysis, and argument by working groups in the Internet Engineering Task Force." [4]
From the Active Directory policy editor select IP Security Policy on Active Directory:
Right click, select Manage IP filter lists and filter actions select tab Manage IP Filter Lists
select Add Name: SNMP -- Blocked Description: 161/tcp/udp and 162/tcp/udp -- deny to all Check Use Add Wizard
select Add select Next select Any IP Address as the Source address. Select Next select My IP Address as the Destination address. Select Next select the protocol type of TCP. Select Next For Select the IP Protocol port select From any port and To this port enter 161. Select Next select the Edit Properties check box. select Finish select Description tab. Type Purpose: Block SNMP packets from any source to the computer's TCP port 161. select OK.
Right click, select Manage IP filter lists and filter actions select tab Manage IP Filter lists
select Add Name: SNMP -- Permitted Description: 161/tcp/udp and 162/tcp/udp -- restrict to campus Check Use Add Wizard
select Add select Next select A specific IP subnet as the Source address. Enter IP Address: 129 97 0 0 Enter Subnet Mask: 255 255 0 0. Select Next select My IP Address as the Destination address. Select Next select the protocol type of TCP. Select Next For Select the IP Protocol port select From any port and To this port enter 161. Select Next select the Edit Properties check box. select Finish select Description tab. Type Purpose: Allow on campus access to SNMP 161/tcp. select OK.
The end product should appear as:
| Name Description | Protocol | Source | Destination | Address | Mask | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SMB -- Permitted | TCP | Any | 445 | 129.97.0.0 | 255.255.0.0 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
select Manage Filter Actions select Add. Select Next. Name: Block Description: Block data select Next Filter Action: select Block select Finish
Right click, select Create IP Security Policy. Select Next. Name: Recommended Network Security Policy for UW Description: Policy and Filters as recommended by the IST Security personnel. Select Next. Clear the Activate the default response rule select Edit the properties Select Finish. select the Rules tab select Add. Select Next select This rule does not specify a tunnel. Select Next select All network connections. Select Next select Windows 2000 default (Kerberos v5 protocol) select SNMP Blocked select Next. select Block select Edit properties. Select Finish. select OK. select Add. Select Next select This rule does not specify a tunnel. Select Next select All network connections. Select Next select Windows 2000 default (Kerberos v5 protocol) select SNMP Permitted select Next. select Permit select Finish.Add the remaining twelve filters setting a Filter Action of Block or Permit as appropriate. Once created, the security policy appears in every GPO. Its Assign status is set on a per GPO basis.
Right click the policy name: Recommended Network Security Policy for UW select Assign
Audit Success and Failure of Audit Logon Events and Audit Object Access. Run gpresult.exe on the client workstation. If the Securityis in effect from a GPO you will see:
The computer received "IP Security" settings from these GPOs:
IP Security
In the Security log:
615 IPSec Services has started successfullyEvent 615 messages appear every n minutes where n is the interval specified when defining the policy, Check for policy changes every:. Default is 180 minutes.
Run the IP Security Monitor, ipsecmon, to monitor, in real time, network access to a workstation. This utility is likely found only on a domain controller.
Select Properties of Network and Dial-up Connections. Select TCP/IP Properties. Select Advanced. Select Options. The name of the Security policy is reported.
From the XP Support Tools run ipseccmd show all and all effective policies are reported by name.
Select the tab Group Policy Select New XP Upgrade (not to be confused with the Security Group of the same name) Properties Disable User Configuration Edit Windows Settings Security SettingsIP Security Policies on Active Directory
Select Manage IP filter lists and filter actions Add Name: Boss Machines Description: Full access by a specific list of servers. Use Add Wizard Add Next select A specific DNS Name as the Source address. Host Name: SYSLAB12 select My IP Address as the Destination address. Select Next select the protocol type of any. Select Next select the Edit Properties check box. select Finish select OK.Repeat the above for SYSLAB15, SYSLAB16, ROSEWOOD.
Right click, select Create IP Security Policy. Select Next. Name: XP Upgrade (not to be confused with the Security Group, or GPO, of the same name) Description: Limit access to the workstation by the DCs and required servers. Select Next. Clear the Activate the default response rule select Edit properties Select Finish. select the Rules tab Use Add Wizard select Add. Select Next select This rule does not specify a tunnel. Select Next select All network connections. Select Next select Windows 2000 default (Kerberos v5 protocol) Next select ALL IP Traffic select Next. select Block select Edit properties. Select Finish. select OK. select Add.Repeat for Boss Machines and Permit.
Right Click the IPSec policy XP Upgrade Select AssignExit the Group Policy Editor.
Select the GPO XP Upgrade Select Properties Select Security tab Add Type 'XP Upgrade' (the security group) Select Apply Group Policy, Allow Remove Authorized Users OK Close
Right Click OU Academic Support Select Properties Select Group Policy Add Seek XP Upgrade OK
COMPUTER SETTINGS Applied Group Policy Objects XP Upgradeexists on SYSLAB11 and not on SCOTER. Notice also that SYSLAB11 is a member of the XP Upgrade Security Group and SCOTER is not.
secpol.mscRun the console to create a Local policy in IP Security Policy on Local Computers.
Policy Recommended Security Policy for UW is enabled (Assign). The OU Test\Info Systems & Technology is assigned the GPO IP Security. Computers of several IST staff are moved into Test for purposes of testing the secirity policy.