book

The Best Damn Firewall Book Period, 2nd Edition

Name: The Best Damn Firewall Book Period, 2nd Edition
Author: Thomas W Shinder
ISBN: 9780080556871

by Thomas W Shinder

April 2011

Intermediate to advanced

1168 pages

28h 9m

English

Syngress

Read now

Unlock full access

Copyright
Contributing Authors
1. Installing Check Point NGX
IntroductionPreparing the GatewayInstallationSecurePlatformFireWall-1/VPN-1 InstallationSmartCenter Server InstallationSmartConsole InstallationPutting It All TogetherSmartDashboardSummary
2. SmartDashboard and SmartPortal
IntroductionA Tour of the DashboardLogging InThe Rulebase PaneSecurity TabAddress Translation TabSmartDefense TabWeb Intelligence TabVPN Manager TabQoS TabDesktop Security TabWeb Access TabConsolidation Rules TabThe Objects Tree PaneNetwork ObjectsServicesResourcesServers and OPSEC ApplicationsUsers and AdministratorsVPN CommunitiesThe Objects List PaneThe SmartMap PaneMenus and ToolbarsWorking with Policy PackagesInstalling the PolicyGlobal PropertiesFireWall PageNAT—Network Address Translation PageVPN PageVPN-1 Edge/Embedded PageRemote Access PageSmartDirectory (LDAP) PageStateful Inspection PageNew in SmartDashboard NGXSecurity Policy Rule Names and Unique IDsGroup Object ConventionGroup HierarchyClone ObjectSession DescriptionTooltipsYour First Security PolicyCreating Your Administrator AccountHooking Up to the GatewayReviewing the Gateway ObjectDefining Your Security PolicyPolicy DesignCreating RulesNetwork Address TranslationInstalling the PolicyOther Useful Controls on the DashboardWorking with Security Policy RulesSection TitlesHiding RulesRule QueriesSearching RulesWorking with ObjectsObject ReferencesWho Broke That Object?Object QueriesWorking with PoliciesWhat Would Be Installed?What’s Really Installed?No Security PleaseFor the AnoraksChange ManagementManaging Connectra and Interspect GatewaysConfiguring Interspect or Connectra IntegrationSmartDefense UpdatesSmartPortalSmartPortal FunctionalityInstalling SmartPortalTour of SmartPortalSummary
3. Smart View Tracker
IntroductionTrackerLog ViewActiveAuditPredefined QueriesUse for Predefined QueriesAdding Custom QueriesApplying FiltersCustom QueriesMatching Rule FilterViewing the Matching RuleViewing Log Records from SmartDashboardActive ViewLive ConnectionsCustom CommandsFollowing a Source or DestinationBlock IntruderAudit ViewLog MaintenanceDaily MaintenanceLog SwitchSummary
4. SmartDefense and Web Intelligence
IntroductionNetwork SecurityThreatsStructured ThreatsDenial of ServiceExternal ThreatsWelchia Internet Control Message ProtocolNetwork QuotaInternal ThreatsReconnaissance (Port Scans and Sweeps)The OSI ModelLayer 3: The Network LayerLayer 4: The Transport LayerLayer 7: The Application LayerThe Need for Granular InspectionApplication IntelligenceConfiguring Hosts and Nodes for AISmartDefense TechnologyCentral Configuration and the SmartDefense Web SiteUpdating SmartDefenseDefense Against AttacksPeer-to-PeerPreventing Information DisclosureFingerprint ScramblingAbnormal Behavior AnalysisWeb Intelligence TechnologyMalicious Code ProtectorActive StreamingApplication IntelligenceWeb Application LayerSQL InjectionCustom Web BlockingPreventing Information DisclosureHeader SpoofingDirectory ListingMalicious CodeDefinitionDifferent Types of Malicious CodeGeneral HTTP Worm CatcherProtocol InspectionConformityDNS EnforcementHTTP InspectionDefault ConfigurationDShield Storm CenterRetrieving BlocklistSubmitting LogsSummary
5. Network Address Translation
IntroductionGlobal PropertiesNetwork Address TranslationConfiguring Dynamic Hide Mode NATDynamic NAT DefinedAdvanced Understanding of NATWhen to Use ItRouting and ARPAdding ARP EntriesSecure PlatformSolarisWindowsIPSOConfiguring Static Mode NATStatic NAT DefinedWhen to Use ItInbound ConnectionsConfiguring Automatic NATWhen to Use ItNAT Rule BaseAccess Control SettingsConfiguring Port TranslationWhen to Use ItNAT Rule BaseSecurity Policy ImplicationsSummary
6. Authentication
IntroductionAuthentication OverviewUsing Authentication in Your EnvironmentUsers and AdministratorsManaging Users and AdministratorsPermission ProfilesAdministratorsGeneral TabPersonal TabGroupsAdmin AuthAdmin CertificatesAdministrator GroupsUser TemplatesGeneralPersonalGroupsAuthenticationLocationTimeEncryptionUser GroupsUsersGeneralPersonalGroupsAuthenticationLocationTimeCertificatesEncryptionExternal User ProfilesMatch by DomainMatch All UsersLDAP GroupUnderstanding Authentication SchemesUndefinedSecurIDCheck Point PasswordRADIUSTACACSUser AuthenticationConfiguring User Authentication in the RulebaseUserAuth | Edit Properties | General | SourceUserAuth | Edit Properties | General | DestinationUserAuth | Edit Properties | General | HTTPInteracting with User AuthenticationTelnet and RLOGINFTPHTTPPlacing Authentication RulesAdvanced TopicsEliminating the Default Authentication BannerChanging the BannerUse Host Header as DestinationSession AuthenticationConfiguring Session Authentication in the RulebaseSessionAuth | Edit Properties | General | SourceSessionAuth | Edit Properties | General | DestinationSessionAuth | Edit Properties | General | Contact Agent AtSessionAuth | Edit Properties | General | Accept only SecuRemote/SecureClient Encrypted ConnectionsSessionAuth | Edit Properties | General | Single Sign-OnConfiguring Session Authentication EncryptionThe Session Authentication AgentConfiguration | Passwords | Ask for PasswordConfiguration | Allowed Firewall-1 | Allow authentication request fromConfiguration | Allowed Firewall-1 | OptionsInteracting with Session AuthenticationClient AuthenticationConfiguring Client Authentication in the RulebaseClientAuth | Edit Properties | General | SourceClientAuth | Edit Properties | General | DestinationClientAuth | Edit Properties | General | Apply Rule Only if Desktop Configuration Options Are VerifiedClientAuth | Edit Properties | General | Required Sign-InClientAuth | Edit Properties | General | Sign-On MethodManual Sign-OnPartially Automatic Sign-OnFully Automatic Sign-OnAgent Automatic Sign-OnSingle Sign-OnGeneral | Successful Authentication TrackingLimits | Authorization TimeoutLimits | Number of Sessions AllowedAdvanced TopicsCheck Point Gateway | AuthenticationEnabled Authentication SchemesAuthentication SettingsHTTP Security ServerGlobal Properties | AuthenticationFailed Authentication AttemptsAuthentication of Users with CertificatesBrute-Force Password Guessing ProtectionEarly Version CompatibilityRegistry SettingsNew InterfaceUse Host Header as DestinationOpening All Client Authentication RulesConfiguration FilesEnabling Encrypted AuthenticationCustom PagesInstalling the User DatabaseSummary
7. Content Security and OPSEC
IntroductionOPSECPartnershipAnti-virusWeb FilteringOPSEC ApplicationsSecurity ServersURISMTPFTPTCPCIFSCVPResource CreationUFPResource CreationMDQHow to DebugSecure Internal CommunicationSummary
8. VPN
IntroductionEncryption OverviewSymmetric and Asymmetric EncryptionCertificate AuthoritiesExchanging KeysTunnel Mode vs. Transport ModeEncryption AlgorithmsHashing AlgorithmsPublic Key InfrastructureSimplified vs. TraditionalUsing the Simplified Configuration MethodVPN CommunitiesMeshed VPN CommunitiesStar VPN CommunitiesMultiple Entry Point (MEP)Installing the PolicyConfiguring a VPN with a Cisco PIXUsing the Traditional VPN Configuration MethodVPN Directional MatchingRoute-Based VPNRouting ProtocolsConfiguring VTIsConfiguring VTI ExampleTunnel Management and DebuggingUsing SmartView TrackerUsing cpstatSummary

9. SecuRemote, SecureClient, and Integrity
IntroductionSecuRemoteWhat’s New with SecuRemote in NGX?Standard ClientBasic Remote AccessDefining the Connection PolicySecuRemote Installation and Configuration on Microsoft WindowsConnecting to the VPN-1 GatewaySecureClientWhat’s New in SC NGX?Installing SecureClient on Microsoft WindowsPolicy ServerDesktop Security PoliciesConfiguring Desktop Security PoliciesDisabling the Security PolicySecure Configuration VerificationOffice ModeWhy Office Mode?Client IP PoolConfiguring Office Mode with IP PoolsConfiguring the VPN-1 Gateway for Office ModeConfiguring SecureClient for Office ModeSecure Configuration Verification (SCV)What’s New with Secure Configuration Verification (SCV) in NGX?Configuring the Policy Server to Enable Secure Configuration Verification (SCV)Secure Configuration Verification (SCV) Checks AvailableCheck Point OPSEC Vendor SCV ChecksOther Third-Party ChecksCreate Your Own ChecksIntegrityHistory of IntegrityIntegrity Client InstallationIntegrity Client ConfigurationIntegrity Clientless SecuritySummary
10. Adaptive Security Device Manager
IntroductionFeatures, Limitations, and RequirementsSupported PIX Firewall Hardware and Software VersionsPIX Device RequirementsHost Requirements for Running ASDMAdaptive Security Device Manager LimitationsUnsupported CommandsUnsupported CharactersASDM CLI Does Not Support Interactive CommandsPrinting from ASDMInstalling, Configuring, and Launching ASDMPreparing for InstallationInstalling or Upgrading ASDMObtaining a DES Activation KeyConfiguring the PIX Firewall for Network ConnectivityInstalling a TFTP ServerUpgrading the PIX Firewall and Configuring the DES Activation KeyInstalling or Upgrading ASDM on the PIX DeviceEnabling and Disabling ASDMLaunching ASDMConfiguring the PIX Firewall Using ASDMUsing the Startup WizardConfiguring System PropertiesThe AAA MenuThe Advanced MenuThe ARP Static Table MenuThe Auto Update MenuThe DHCP Services MenuThe DNS Client MenuThe Failover MenuThe History Metrics CategoryThe IP Audit MenuThe Logging MenuThe Priority Queue CategoryThe SSL CategoryThe SunRPC Server CategoryThe URL Filtering CategoryConfiguring VPNs Using ASDMConfiguring a Site-to-Site VPN Using ASDMConfiguring a Remote Access VPN Using ASDMSummary
11. Application Inspection
New Features in PIX 7.0Supporting and Securing ProtocolsTCP, UDP, ICMP, and the PIX FirewallApplication Layer Protocol InspectionDefining a Traffic ClassAssociating a Traffic Class with an ActionCustomizing Application Inspection ParametersApplying Inspection to an InterfaceDomain Name ServiceRemote Procedure CallSQL*NetInternet Locator Service and Lightweight Directory Access ProtocolHTTP InspectionFTP InspectionActive versus Passive ModeESMTP InspectionICMP InspectionH.323Simple Network Management Protocol (SNMP)Voice and Video ProtocolsSIPCTIQBESCCPReal-Time Streaming Protocol (RTSP), NetShow, and VDO LiveSummary
12. Filtering, Intrusion Detection, and Attack Management
New Features in PIX 7.0Enhanced TCP Security EngineImproved Websense URL Filtering PerformanceIntroductionFiltering Web and FTP TrafficFiltering URLsWebsense and Sentian by N2H2Fine-Tuning and Monitoring the Filtering ProcessConfiguring HTTP URL FilteringConfiguring HTTPS FilteringSetting Up FTP FilteringActive Code FilteringFiltering Java AppletsFiltering ActiveX ObjectsVirus Filtering; Spam, Adware, Malware, and Other-Ware FilteringTCP Attack Detection and ResponsePIX Intrusion DetectionSupported SignaturesConfiguring Intrusion Detection/AuditingDisabling SignaturesConfiguring ShunningAttack Containment and ManagementPlacing Limits on FragmentationSYN FloodGuardThe TCP Intercept FeaturePreventing IP SpoofingOther Ways the PIX Can Prevent, Contain, or Manage AttacksConfiguring Connection Limits and TimeoutsPreventing MAC Address SpoofingSummary
13. Services
IntroductionDHCP FunctionalityDHCP ServersCisco IP Phone-Related OptionsDHCP RelayDHCP ClientsPPPoEEasyVPNEasyVPN ServerRouting and the PIX FirewallUnicast RoutingStatic RoutesRIPOSPFNetwork Address Translation as a Routing MechanismMulticast RoutingStub Multicast RoutingPIM Multicast RoutingBGP through PIX FirewallQueuing and PolicingSummary
14. Configuring Authentication, Authorization, and Accounting
IntroductionNew and Changed Commands in 7.0Introducing AAA ConceptsAuthenticationAuthorizationAccountingAAA Security ProtocolsRADIUSAuthentication Methods Used by RADIUSRADIUS Functions Available on the Cisco PIXHow RADIUS WorksTACACS+Authentication Methods Used by TACACS+TACACS+ Functions Available to the Cisco PIXHow TACACS+ WorksOptional Security Protocols and MethodsAAA ServersConfiguring Console AuthenticationConfiguring Local AuthenticationConfiguring Local AAA Using the ASDMConfiguring Command AuthorizationConfiguring Local Command AuthorizationConfiguring TACACS+ and RADIUS Console AuthenticationConfiguring TACACS+ Command AuthorizationConfiguring Authentication for Traffic through the FirewallConfiguring Cut-through ProxyVirtual HTTPVirtual TelnetConfiguring Authorization for Traffic through the FirewallConfiguring Accounting for Traffic through the FirewallSummary
15. PIX Firewall Management
IntroductionConfiguring LoggingLogging LevelsDropped and Changed Syslog Messages from 6.xLogging FacilityLocal LoggingBuffered LoggingConsole LoggingTerminal LoggingRemote Logging via SyslogDisabling Specific Syslog MessagesConfiguring Remote AccessSecure ShellEnabling SSH AccessTroubleshooting SSHTelnetRestrictionsConfiguring Simple Network Management ProtocolConfiguring System IdentificationConfiguring PollingConfiguring TrapsManaging SNMP on the PIXConfiguring System Date and TimeSetting and Verifying the Clock and Time ZoneConfiguring and Verifying the Network Time ProtocolNTP AuthenticationManagement Using the Cisco PIX Adaptive Security Device Manager (ASDM)Summary
16. Configuring Virtual Private Networking
IntroductionWhat’s New in PIX 7.0IPsec ConceptsIPsecIPsec Core Layer 3 Protocols: ESP and AHAuthentication HeaderEncapsulating Security PayloadIPsec Communication Modes: Tunnel and TransportInternet Key ExchangeSecurity AssociationsCertificate Authority SupportConfiguring a Site-to-Site VPNPlanningAllowing IPsec TrafficEnabling IKECreating an ISAKMP Protection SuiteDefining an ISAKMP Preshared KeyConfiguring Certificate Authority SupportPreparing the PIX to Use CertificatesGenerating a Key PairConfigure a CA as a TrustpointAuthenticating and Enrolling with the CAConfiguring Crypto Access-ListsDefining a Transform SetBypassing Network Address TranslationConfiguring a Crypto MapTroubleshootingRemote Access—Configuring Support for the Cisco Software VPN ClientEnabling IKE and Creating an ISAKMP Protection SuiteDefining a Transform SetCrypto MapsTunnel Groups and Group PoliciesAddress Pool ConfigurationSplit TunnelingNAT IssuesAuthentication against Radius, TACACS+, SecurID, or Active DirectoryAutomatic Client UpdateConfiguring Client Firewall RequirementsSample Configurations of PIX and VPN ClientsSummary
17. ISA Server 2006 Client Types and Automating Client Provisioning
IntroductionUnderstanding ISA Server 2006 Client TypesUnderstanding the ISA Server 2006 SecureNAT ClientSecureNAT Client LimitationsSecureNAT Client AdvantagesName Resolution for SecureNAT ClientsName Resolution and “Looping Back” Through the ISA Server 2006 FirewallUnderstanding the ISA Server 2006 Firewall ClientAllows Strong User/Group-Based Authentication for All Winsock Applications Using TCP and UDP ProtocolsAllows User and Application Information to be Recorded in the ISA Server 2006 Firewall’s Log FilesProvides Enhanced Support for Network Applications, Including Complex Protocols That Require Secondary ConnectionsProvides “Proxy” DNS Support for Firewall Client MachinesThe Network Routing Infrastructure Is Transparent to the Firewall ClientHow the Firewall Client WorksInstalling the Firewall Client ShareInstalling the Firewall ClientFirewall Client ConfigurationCentralized Configuration Options at the ISA Server 2006 Firewall ComputerEnabling Support for Legacy Firewall Client/Winsock Proxy ClientsClient Side Firewall Client SettingsFirewall Client Configuration Files.ini FilesAdvanced Firewall Client SettingsFirewall Client Configuration at the ISA Server 2006 FirewallISA Server 2006 Web Proxy ClientImproved Performance for the Firewall Client and SecureNAT Client Configuration for Web AccessAbility to Use the Autoconfiguration Script to Bypass Sites Using Direct AccessAllows You to Provide Web Access (HTTP/HTTPS/FTP Download) without Enabling Users Access to Other ProtocolsAllows You to Enforce User/Group-based Access Controls Over Web AccessAllows you to Limit the Number of Outbound Web Proxy Client ConnectionsSupports Web Proxy Chaining, Which Can Further Speed Up Internet AccessISA Server 2006 Multiple Client Type ConfigurationDeciding on an ISA Server 2006 Client TypeAutomating ISA Server 2006 Client ProvisioningConfiguring DHCP Servers to Support Web Proxy and Firewall Client AutodiscoveryInstall the DHCP ServerCreate the DHCP scopeCreate the DHCP 252 Scope Option and Add It to the ScopeConfigure the Client as a DHCP ClientConfigure the Client Browser to Use DCHP for AutodiscoveryConfigure the ISA Server 2006 Firewall to Publish Autodiscovery InformationMaking the ConnectionConfiguring DNS Servers to Support Web Proxy and Firewall Client AutodiscoveryCreating the wpad Entry in DNSConfigure the Client to Use the Fully-Qualified wpad AliasConfigure the client browser to use autodiscoveryConfigure the ISA Server 2006 Firewall to Publish Autodiscovery InformationMaking the Connection Using DNS for AutodiscoveryAutomating Installation of the Firewall ClientConfiguring Firewall Client and Web Proxy Client Configuration in the ISA Management ConsoleGroup Policy Software InstallationSilent Installation ScriptSystems Management Server (SMS)Summary
18. Installing and Configuring the ISA Firewall Software
Pre-installation Tasks and ConsiderationsSystem RequirementsConfiguring the Routing TableDNS Server PlacementConfiguring the ISA Firewall’s Network InterfacesInstallation via a Terminal Services Administration Mode SessionPerforming a Clean Installation on a Multihomed MachineDefault Post-installation ISA Firewall ConfigurationThe Post-installation System PolicyPerforming a Single NIC Installation (Unihomed ISA Firewall)Quick Start Configuration for ISA FirewallsConfiguring the ISA Firewall’s Network InterfacesIP Address and DNS Server AssignmentConfiguring the Internal Network InterfaceConfiguring the External Network InterfaceNetwork Interface OrderInstalling and Configuring a DNS Server on the ISA Server FirewallInstalling the DNS ServiceInstalling the DNS Server Service on Windows Server 2003Configuring the DNS Service on the ISA FirewallConfiguring the DNS Service in Windows Server 2003Configuring the DNS Service on the Internal Network DNS ServerInstalling and Configuring a DHCP Server on the ISA Server FirewallInstalling the DHCP ServiceInstalling the DHCP Server Service on a Windows Server 2003 ComputerConfiguring the DHCP ServiceInstalling and Configuring the ISA Server 2006 SoftwareConfiguring the ISA FirewallDHCP Request to Server RuleDHCP Reply from Server RuleInternal DNS Server to DNS Forwarder RuleInternal Network to DNS ServerThe All Open RuleConfiguring the Internal Network ComputersConfiguring Internal Clients as DHCP ClientsHardening the Base ISA Firewall Configuration and Operating SystemISA Firewall Service DependenciesService Requirements for Common Tasks Performed on the ISA FirewallClient Roles for the ISA FirewallISA Firewall Administrative Roles and PermissionsLockdown ModeLockdown Mode FunctionalityConnection LimitsDHCP Spoof Attack PreventionSummary
19. Creating and Using ISA 2006 Firewall Access Policy
ISA Firewall Access Rule ElementsProtocolsUser SetsContent TypesSchedulesNetwork ObjectsConfiguring Access Rules for Outbound Access through the ISA FirewallThe Rule Action PageThe Protocols PageThe Access Rule Sources PageThe Access Rule Destinations PageThe User Sets PageAccess Rule PropertiesThe General TabThe Action TabThe Protocols TabThe From TabThe To TabThe Users TabThe Schedule TabThe Content Types TabThe Access Rule Context Menu OptionsConfiguring RPC PolicyConfiguring FTP PolicyConfiguring HTTP PolicyOrdering and Organizing Access RulesHow to Block Logging for Selected ProtocolsDisabling Automatic Web Proxy Connections for SecureNAT ClientsUsing Scripts to Populate Domain Name SetsUsing the Import ScriptsExtending the SSL Tunnel Port Range for Web Access to Alternate SSL PortsAvoiding Looping Back through the ISA Firewall for Internal ResourcesAnonymous Requests Appear in Log File Even When Authentication is Enforced For Web (HTTP Connections)Blocking MSN Messenger using an Access RuleAllowing Outbound Access to MSN Messenger via Web ProxyChanges to ISA Firewall Policy Only Affects New ConnectionsAllowing Intradomain Communications through the ISA FirewallSummary
20. Creating Remote Access and Site-to-Site VPNs with ISA Firewalls
Overview of ISA Firewall VPN NetworkingFirewall Policy Applied to VPN Client ConnectionsFirewall Policy Applied to VPN Site-to-Site ConnectionsVPN QuarantineUser Mapping of VPN ClientsSecureNAT Client Support for VPN ConnectionsSite-to-Site VPN Using Tunnel Mode IPSecPublishing PPTP VPN ServersPre-shared Key Support for IPSec VPN ConnectionsAdvanced Name Server Assignment for VPN ClientsMonitoring of VPN Client ConnectionsAn Improved Site-to-Site Wizard (New ISA 2006 feature)The Create Answer File Wizard (New ISA 2006 feature)The Branch Office Connectivity Wizard (New ISA 2006 feature)The Site-to-Site Summary (New ISA 2006 feature)Creating a Remote Access PPTP VPN ServerEnable the VPN ServerCreate an Access Rule Allowing VPN Clients Access to Allowed ResourcesEnable Dial-in AccessTest the PPTP VPN ConnectionCreating a Remote Access L2TP/IPSec ServerIssue Certificates to the ISA Firewall and VPN ClientsTest the L2TP/IPSec VPN ConnectionMonitor VPN ClientsUsing a Pre-shared Key for VPN Client Remote Access ConnectionsCreating a PPTP Site-to-Site VPNCreate the Remote Site Network at the Main OfficeThe Network Rule at the Main OfficeThe Access Rules at the Main OfficeCreate the VPN Gateway Dial-in Account at the Main OfficeCreate the Remote Site Network at the Branch OfficeThe Network Rule at the Branch OfficeThe Access Rules at the Branch OfficeCreate the VPN Gateway Dial-in Account at the Branch OfficeActivate the Site-to-Site LinksCreating an L2TP/IPSec Site-to-Site VPNEnable the System Policy Rule on the Main Office Firewall to Access the Enterprise CARequest and Install a Certificate for the Main Office FirewallConfigure the Main Office ISA Firewall to use L2TP/IPSec for the Site-to-Site LinkEnable the System Policy Rule on the Branch Office Firewall to Access the Enterprise CARequest and Install a Certificate for the Branch Office FirewallConfigure the Branch Office ISA Firewall to use L2TP/IPSec for the Site-to-Site LinkActivate the L2TP/IPSec Site-to-Site VPN ConnectionConfiguring Pre-shared Keys for Site-to-Site L2TP/IPSec VPN LinksIPSec Tunnel Mode Site-to-Site VPNs with Downlevel VPN GatewaysUsing RADIUS for VPN Authentication and Remote Access PolicyConfigure the Internet Authentication Services (RADIUS) ServerCreate a VPN Clients Remote Access PolicyRemote Access Permissions and Domain Functional LevelChanging the User Account Dial-in PermissionsChanging the Domain Functional LevelControlling Remote Access Permission via Remote Access PolicyEnable the VPN Server on the ISA Firewall and Configure RADIUS SupportCreate an Access Rule Allowing VPN Clients Access to Approved ResourcesMake the Connection from a PPTP VPN ClientUsing EAP User Certificate Authentication for Remote Access VPNsConfiguring the ISA Firewall Software to Support EAP AuthenticationEnabling User Mapping for EAP Authenticated UsersIssuing a User Certificate to the Remote Access VPN Client MachineSupporting Outbound VPN Connections through the ISA FirewallInstalling and Configuring the DHCP Server and DHCP Relay Agent on the ISA FirewallSummary
21. ISA 2006 Stateful Inspection and Application Layer Filtering
IntroductionApplication FiltersThe SMTP FilterThe DNS FilterThe POP Intrusion Detection FilterThe SOCKS V4 FilterThe FTP Access FilterThe H.323 FilterThe MMS FilterThe PNM FilterThe PPTP FilterThe RPC FilterThe RTSP FilterWeb FiltersThe HTTP Security Filter (HTTP Filter)Overview of HTTP Security Filter SettingsThe General TabThe Methods TabThe Extensions TabThe Headers TabThe Signatures TabHTTP Security Filter LoggingExporting and Importing HTTP Security Filter SettingsExporting an HTTP Policy from a Web Publishing RuleImporting an HTTP Policy into a Web Publishing RuleInvestigating HTTP Headers for Potentially Dangerous ApplicationsExample HTTP Security Filter PoliciesCommonly Blocked Headers and Application SignaturesThe ISA Server Link TranslatorDetermining Custom Dictionary EntriesConfiguring Custom Link Translation Dictionary EntriesThe Web Proxy FilterThe OWA Forms-Based Authentication FilterThe RADIUS Authentication FilterIP Filtering and Intrusion Detection/Intrusion PreventionCommon Attacks Detection and PreventionDNS Attacks Detection and PreventionIP Options and IP Fragment FilteringSource Routing AttackSummary
22. Deploying NetScreen Firewalls
IntroductionManaging the NetScreen FirewallNetScreen Management OptionsSerial ConsoleTelnetSecure ShellWebUIThe NetScreen-Security ManagerAdministrative UsersThe Local File System and the Configuration FileUsing the Command Line InterfaceUsing the Web User InterfaceSecuring the Management InterfaceUpdating ScreenOSSystem RecoveryConfiguring NetScreenTypes of ZonesSecurity ZonesTunnel ZonesFunction ZonesVirtual RoutersTypes of InterfacesSecurity Zone InterfacesPhysical InterfacesSubinterfacesAggregate InterfacesRedundant InterfacesVLAN1 InterfaceVirtual Security InterfacesFunction Zone InterfacesManagement InterfacesHA InterfacesTunnel InterfacesLoopback InterfacesConfiguring Security ZonesConfiguring Your NetScreen for the NetworkBinding an Interface to a ZoneSetting up IP AddressingConfiguring the DHCP ClientUsing PPPoEInterface Speed ModesPort Mode ConfigurationConfiguring Basic Network RoutingConfiguring System ServicesSetting The TimeDHCP ServerDNSSNMPSyslogWebTrendsResourcesSummary
23. Policy Configuration
IntroductionNetScreen PoliciesTheory Of Access ControlTypes of NetScreen PoliciesIntrazone PoliciesInterzone PoliciesGlobal PoliciesDefault PolicyPolicy CheckingGetting Ready to Make a PolicyPolicy ComponentsZonesAddress Book EntriesCreating Address Book EntriesModifying and Deleting Address Book EntriesAddress GroupsServicesCreating Custom ServicesModifying and Deleting ServicesService GroupsCreating PoliciesCreating a PolicyCreating a Policy via the WebUIReordering Policies in the WebUIOther Policy Options in the WebUICreating a Policy via the CLIOther Policy Options Available in the CLISummary
24. User Authentication
IntroductionTypes of UsersUses of Each TypeAuth UsersIKE UsersL2TP UsersXAuth UsersAdmin UsersUser DatabasesLocal DatabaseTypes of UsersFeaturesExternal Auth ServersObject PropertiesAuth Server TypesRADIUSTypes of UsersFeaturesHow to ConfigureSecurIDTypes of UsersFeaturesHow to ConfigureLDAPTypes of UsersFeaturesHow to ConfigureDefault Auth ServersHow to ChangeWhen to UseAuthentication TypesAuth Users and User GroupsIKE Users and User GroupsXAuth Users and User GroupsL2TP Users and User GroupsAdmin Users and User GroupsMulti-type UsersUser Groups and Group expressions
25. Routing
IntroductionVirtual RoutersUsing Virtual RoutersCreating Virtual RoutersRoute SelectionSet Route PreferenceSet Route MetricRoute RedistributionConfiguring a Route Access ListConfiguring A Route MapRouting Information ProtocolRIP ConceptsBasic RIP ConfigurationConfiguring RIPOpen Shortest Path First (OSPF)OSPF ConceptsBasic OSPF ConfigurationBorder Gateway ProtocolBasic BGP ConfigurationSummary
26. Address Translation
IntroductionPurpose of Address TranslationAdvantages of Address TranslationDisadvantages of Address TranslationNetScreen NAT OverviewNetScreen Packet FlowSource NATInterface-based Source TranslationMIPMIP LimitationsMIP ScenariosScenario 1Scenario 2Scenario 3Policy-based Source NATDIPSticky DIPDIP ShiftDestination NATVIPPolicy-based Destination NATDestination NAT ScenariosOne-to-One MappingMany-to-one MappingMany-to-Many MappingDestination PAT ScenarioSource and Destination NAT CombinedSummary

Content preview from The Best Damn Firewall Book Period, 2nd Edition

Chapter 12. Filtering, Intrusion Detection, and Attack Management

New Features in PIX 7.0

PIX 7.0 offers several enhancements for filtering, intrusion detection, and attack management that earlier versions did not.

Enhanced TCP Security Engine

The enhanced TCP security engine:

Introduces new capabilities for detecting protocol and application layer attacks.
Provides TCP stream reassembly and analysis services to detect attacks that are spread across a series of packets. ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Ethernet Networking for the Small Office and Professional Home Office

Publisher Resources

ISBN: 9781597492188

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design