Improving Web Application Security: Threats and - CGISecurity

778 Improving Web Application Security: Threats and CountermeasuresWhat You Must KnowBefore you start to configure IPSec, you should be aware of the following.Identify Your Protocol and Port RequirementsBefore you create and apply IPSec policies to block ports and protocols, make sureyou know which communication you need to secure including the ports andprotocols used by day-to-day operations. Consider the protocol and portrequirements for remote administration, application communication, andauthentication.IPSec Does Not Secure All CommunicationSeveral types of IP traffic are exempt from filtering. For more information, seeMicrosoft Knowledge Base article 253169, “Traffic That Can and Cannot Be Securedby IPSec.”Firewalls and IPSecIf a firewall separates two hosts that use IPSec to secure the communication channel,the firewall must open the following ports:● TCP port 50 for IPSec Encapsulating Security Protocol (ESP) traffic●●TCP port 51 for IPSec Authentication Header (AH) trafficUDP port 500 for Internet Key Exchange (IKE) negotiation trafficFilters, Filter Actions, and RulesAn IPSec policy consists of a set of filters, filter actions, and rules.●FiltersA filter is used to match traffic. It consists of:●●●●A source IP address or range of addressesA destination IP address or range of addressesAn IP protocol, such as TCP, UDP, or “any”Source and destination ports (for TCP or UDP only)Note An IP filter list is used to group multiple filters together so that multiple IP addresses andprotocols can be combined into a single filter.