Syngress - Eleventh Hour Network+ Exam N10-004 Study Guide (11 ...

Network Ports, Services, and Threats 129
Datalink
Header
IP Header
IPsec
ESP
Header
UDP
Header
L2TP
Header
PPP
Header
Encrypted portion
PPP Payload
(IP
datagram)
IPsec
ESP
Trailer
IPsec
ESP Auth
Trailer
Datalink
Trailer
Authenticated portion
FIGURE 8.3
L2TP/IPSec packet showing multiple levels of encapsulation
■ L2TP is most often used as a VPN by combining it with IPSec Encapsulating Security
Payload (ESP) so that VPN traffic is encapsulated in five layers (see Figure 8.3) from
the outermost layer to the innermost layer:
1. IP
2. IPSec ESP
3. UDP
4. L2TP
5. PPP
NETWORK PORTS, SERVICES, AND THREATS
Unnecessary network ports and protocols in your environment should be eliminated
whenever possible. By identifying the ports that are open but may not
be in use, you will be able to monitor required services and remove all others
thereby reducing the opportunity for attack. Many of our internal networks today
use TPC/IP as the primary protocol. So, for most that means eliminating the
following protocols:
■ Internetwork Packet Exchange (IPX)
■ Sequenced Packet Exchange (SPX)
■ Network Basic Input/Output System (NetBIOS) Extended User Interface
(NetBEUI)
It is also important to look at the specific operational protocols used in a network,
such as
■
■
■
■
■
Internet Control Messaging Protocol (ICMP)
Internet Group Management Protocol (IGMP)
Service Advertising Protocol (SAP)
Network Basic Input/Output System (NetBIOS)
Server Message Block (SMB)
Once the network has been secured according to policy, scans should be conducted
on a periodic basis to ensure that the network is in compliance with