Improving Web Application Security: Threats and - CGISecurity

How To: Use IPSec for Filtering Ports and Authentication 779●●Filter ActionsA filter action specifies which actions to take when a given filter is invoked. It canbe one of the following:● Permit. The traffic is not secured; it is allowed to be sent and received withoutintervention.● Block. The traffic is not permitted.● Negotiate security. The endpoints must agree on and then use a secure methodto communicate. If they cannot agree on a method, the communication does nottake place. If negotiation fails, you can specify whether to allow unsecuredcommunication or to whether all communication should be blocked.RulesA rule associates a filter with a filter action and is defined by the IPSec policy.Restricting Web Server CommunicationThe following example shows you how to use IPSec to limit communicationwith a Web server to port 80 (for HTTP traffic) and port 443 (for HTTPS trafficthat uses SSL.) This is a common requirement for Internet-facing Web servers.Note After applying the steps below, communication will be limited to port 80 and 443. In a realworld environment, you will require additional communication such as that required for remoteadministration, database access and authentication. A complete IPSec policy, in a productionenvironment, will include all authorized communication. Create filter actions1. Start the Local Security Policy Microsoft Management Console (MMC) snap-in.2. Right-click IPSec Security Policies on Local Machine, and then click Manage IPfilter lists and filter actions.3. Click the Manage Filter Actions tab.4. Click Add to create a new filter action, and then click Next to move past theintroductory Wizard dialog box.5. Type MyPermit as the name for the new filter action. This filter action is used topermit traffic.6. Click Next.7. Select Permit, click Next, and then click Finish.8. Create a second filter action called “MyBlock” by repeating steps 4 to 8. This time,select Block when you are prompted by the Filter Action dialog box.9. Click Close to close the Manage IP filter lists and filter actions dialog box.