Improving Web Application Security: Threats and - CGISecurity

How To: Use IPSec for Filtering Ports and Authentication 781Figure 5IP Filter List dialog boxAfter creating the filter actions and filter lists, you need to create a policy and tworules to associate the filters with the filter actions. Create and apply IPSec policy1. In the main window of the Local Security Policy snap-in, right-click IPSecSecurity policies on Local Machine, and then click Create IPSecurity Policy.2. Click Next to move past the initial Wizard dialog box.3. Type MyPolicy for the IPSec policy name and IPSec policy for a Web server thataccepts traffic to TCP/80 and TCP/443 from anyone for the description, and thenclick Next.4. Clear the Activate the default response rule check box, click Next, and then clickFinish.The MyPolicy Properties dialog box is displayed so that you can edit the policyproperties.5. Click Add to start the Security Rule Wizard, and then click Next to move past theintroductory dialog box.6. Select This rule does not specify a tunnel, and then click Next.7. Select All network connections, and then click Next.8. Select Windows 2000 default (Kerberos V5 protocol), and then click Next.9. Select the MatchHTTPAndHTTPS filter list, and then click Next.10. Select the MyPermit filter action, click Next, and then click Finish.11. Create a second rule by repeating steps 5 to 10. Instead of selectingMatchHTTPAndHTTPS and MyPermit, select MatchAllTraffic and MyBlock.