Re: IPSec Filter

Ipsec was primarily designed to secure network traffic via encryption and
insure integrity. It can certainly be used only with filter actions for
block and allow to use as a basic non stateful firewall which means that the
response ports also need to be defined usually via mirroring a filter entry.
So it really can not be like hardware firewall / iptables on linux because
it is not stateful meaning it can not recognize an established session.
Ipsec also has very limited logging abilities. Having said that it is a lot
better than no firewall if for some reason there are no other options and
part of ipsec strength is that it is free, built into the OS, uses limited
resources, and can be configured via Group Policy. Also by default ipsec has
some standard exemptions that can be managed via the registry and they vary
depending on the operating system. The links below may be helpful.

Steve

http://support.microsoft.com/default.aspx?scid=kb;en-us;811832
http://www.securityfocus.com/infocus/1559 -- example of creating an ipsec
filtering policy


"beachboy" <jpsteambun@xxxxxxxxxxxx> wrote in message
news:OQUI1ZXzGHA.4844@xxxxxxxxxxxxxxxxxxxxxxx
Can we use IPsec filter as Windows firewall to block the untrust access as
similar as hardware firewall / iptables on linux??

Thanks.




.

Relevant Pages

  • Re: IPSec Filter
    ... I also forgot to add that creating ipsec filters can be problematic. ... not for instance specify port ranges or IP ranges in a single filter entry.. ... So it really can not be like hardware firewall / iptables on linux ...
    (microsoft.public.windows.server.security)
  • Re: Problem with IPSEC
    ... It is not unusual not to be able to access a website by entering the IP ... troubleshooting ipsec rules. ... protocol:TCP, and filter action permit. ... I have tried other web sites too and couldn't connect with the IPSEC ...
    (microsoft.public.windows.server.security)
  • Re: Problem with IPSEC
    ... Group Policy of course makes it easy to deploy ipsec to domain ... Consequently it cannot filter the external traffic. ... rules like this work on an internal subnet. ... addresses or even a subnet on the internet it doesn't work. ...
    (microsoft.public.windows.server.security)
  • Re: Problem with IPSEC
    ... I have not used that many filter lists for subnets in an ipsec rule to see ... rules like this work on an internal subnet. ... addresses or even a subnet on the internet it doesn't work. ...
    (microsoft.public.windows.server.security)
  • Re: IPSEC not blocking specific IP address per Ethereal
    ... > However, when I try to block a specific IP address by using IPSEC, the ... I have added a very specific filter ... > against those IPs but ethereal still shows their packets getting in past ... I am blocking specific ports rather than ...
    (microsoft.public.win2000.security)
Quantcast