ISA Server 2000 Best Practices from the Field

Transcription

ISA Server 2000
Best Practices from the Field
Presenters:
Tom Shinder - www.tacteam.net www.isaserver.org
Jim Harrison - Microsoft Corp www.isatools.org
Jim Edwards - Microsoft Corp www.microsoft.com/isaserver
Agenda
Introduction (Tom Shinder)
Security (Jim Harrison)
Reliability (Tom Shinder)
Performance (Jim Edwards)
Q&A
Security
Windows Configuration
Domain Association
Perimeter Network Scenarios
ISA Configuration
ISA Policies
ISA Logs
References
Patches, Patches, PATCHES!
Security checklists on
– Technet
– ISAServer.org
– NSA
ISA Service Dependencies
– ISA Server Packet Filter Extension (mspfltex)
– Remote Access Connection Manager
(rasman)
– WMI Driver Extensions (wmi)
DCOM is required for ISA
Service Dependencies created by ISA
– ICS (sharedaccess) depends on Microsoft
Firewall (fwsrv)
– Routing and Remote Access (remoteaccess)
depends on ISA Control (isactrl)
Non-Domain
ISA Server(s)
LAN Domain
Separate Domains (Forests)
One Way
Trust from
ISA to LAN
ISA Domain
LAN Domain
Same Forest, Separate Domains
Domain (Forest) root
Implicit
Two Way
Trust
ISA Domain
LAN Domain
Single Domain
ISA / LAN Domain
Two–Tier Perimeter Network
2nd-Tier
Perimeter
Network
LAT Segment
123.123.123/24
192.168.0/24
192.168.1/24
Third-leg Perimeter Network
123.123.123/25
123.123.123/24
192.168.0/24
LAT Segment
External
Subnet
LAT Perimeter Network
192.168.1/24
192.168.0/24
LAT Segment
IPSec / RRAS IP Filters
LAT
Segment
Cache mode
IP packet filtering NOT Available
LAT / LDT NOT Available
Outgoing and Incoming Web Requests
listener configurations
Best behind another (ISA) firewall
Firewall & Integrated modes
IP Filtering makes this the most secure
User- / group-based non-web traffic rules
Single-NIC installation is NOT supported
without dialup as external
LAT configuration
LAT Configuration
Right
Wrong
IP Packet Filtering
Right
Wrong
IP Packet Filtering
Right
Wrong
Admin Rights
Right
Right?
Protocol Rules
Right
Protocol Rules
Wrong
Site & Content Rules
Anonymous
Site & Content Rules
Unfiltered
Server Publishing
Incoming Web Listeners
Right
Right ?
Web Publishing
Right
Wrong
Web Publishing
Web Publishing
ISA Logs
Other Server Logs
– SMTP, DNS, etc.
Forensic Analysis
– Securityfocus.com article
Legal Evidence
– Computer Forensics
– Trail of Evidence
IP Packet Filter Logs
External scans,
attacks, spoofs
Log field selections
– Payload is limited to
the first 256 bytes
IP PF Log Examples
source-ip
destination-ip proto param#1 param#2
flags
68.124.157.106
193.179.148.234
123.123.123.10 Tcp
123.123.123.12 Tcp
1646
4738
17300
22
SYN
SYN
209.221.223.108
209.221.223.108
209.221.223.108
209.221.223.108
123.123.123.10
123.123.123.11
123.123.123.12
123.123.123.13
ICMP
ICMP
ICMP
ICMP
8
8
8
8
0
0
0
0
62.111.208.195
62.111.208.195
62.111.208.195
62.111.208.195
123.123.123.10
123.123.123.11
123.123.123.12
123.123.123.13
Tcp
Tcp
Tcp
Tcp
2736
2737
2738
2739
135
135
135
135
SYN
SYN
SYN
SYN
Firewall Logs
Internal virus / worms
detection
– WP and FW share
many logging options
Firewall Log Examples
c-ip
r-ip
r-port
cs-prot s-oper
sc-status
192.168.0.1 123.123.123.123
192.168.0.1 207.46.245.214
135
135
TCP
TCP
Connect
Connect
13301
0
192.168.0.1 207.46.245.214
192.168.0.1 207.46.245.214
17300
17300
TCP
TCP
Connect
Connect
13301
0
192.168.0.1 207.46.245.214
192.168.0.1 207.46.245.214
80
80
TCP
TCP
Connect
Connect
13301
0
Web Proxy Logs
Internal, external virus
/ worms detection
Web Proxy Log Examples
CodeRed
<SourceIP>
<SourceIP>
GET
GET
www
www
12202
200
Nimda
<SourceIP>
<SourceIP>
GET
GET
<ISAExtIP>
<ISAExtIP>
12202
200
Auth Failure
<SourceIP>
GET
http://www.thatsite.tld
12209
Romper-Room No-No ’s
IP Packet Filtering off & IP Routing on
Enable IP Routing via RRAS or TCP/IP
LAT includes external (or DMZ) subnets
Same-subnet on internal / external NICs
FW Client installed on the ISA
“All destinations” web publishing rule
Security and Critical Hotfixes
Service Pack 1
– KB 283213 ICMP blocking (Nachi defense)
Post SP1
– KB 319374 & 321846 Web Proxy crash
– MS02-027 BO in Gopher protocol handler
– MS03-009 DoS in DNS IDS filter
– MS03-012 DoS in Firewall Service
– MS03-028 XSS in ISA Error pages
Security References
Microsoft checklists and guides:
http://www.microsoft.com/technet/security/chklist/Default.
asp
http://www.microsoft.com/technet/security/tools/default.a
sp
CC configuration
https://s.microsoft.com/isaserver/code/commoncriteria/
Security References
NSA configuration
http://www.nsa.gov/snac/win2k/guides/w2k11.pdf
http://www.nsa.gov/snac/win2k/guides/inf/isa.inf
Log Forensics
http://securityfocus.com/infocus/1712
Reliability
Windows Considerations
ISA Server 2000 Firewall Considerations
Reliability Windows Settings
NIC binding order
Routing table
Patch Patch Patch!
Redundancy
System Services
Extraneous Services
Reliability Windows Settings:
NIC Binding Order
Internal
–
–
–
Top of list
NO Default gateway
DNS/WINS
External
– Default gateway
– Dial up issues
RAS
– Dial up issues
DMZ
– Doesn’t matter
Routing Table
Static Routes
– Windows
routing table
– RRAS routing
table
Dynamic Routes
– VPN issues
VPN Clients
– Mystery of the Windows VPN client gateway
Patches!
Service Packs
–
–
Install them now
Latest OS and ISA SP and FP
Hotfixes
– Do you need them?
– What about Windows Update?
Security Updates
– What’s going to break?
Testing lab
– Mirror config in lab
– Don’t let the production network be your regression
testing lab
Redundancy
What are you
trying to accomplish?
Web v. Server
Publishing Rules
NLB v. Rainwall
– Bidirectional
what?
Hardware Load
Balancers
– Pay to play
RainConnect
– Redundant Internet
connectivity
– Outbound and inbound
NextLAND Proturbo 800
System Services
Disable Junk Services
– (list several of these)
Determining Required
Services
– Disable and test
Remote Registry
Service
Extraneous Software
Server Services
– It’s a firewall, not a firesale
Not a workstation
– No Kaaza
– No VPN client connections
Plug In’s
– Test test test
– (examples of issues from KB)
Reliability ISA Settings
Test All Policies
Separate Inbound and Outbound Duties
Backing Up
Caching Arrays
Reliability ISA Settings:
Field Test All Policies
Protocol Rules
– The dreaded “all open” rule
Site and Content Rules
– Kill anonymous access Site and
Content Rules
– Server client address set for
anonymous access
Kill the HTTP (Re)Director
– Can’t block via Site/Content rules
Packet Filters
– This ain’t no pix(en)
Web and Server Publishing Rules
– FQDN in Destination Sets
– The mystery of the ephemeral
outbound IP address
VMware
– Buy now or pay later
Separate Inbound and Outbound
Separate Inbound and Outbound Servers
Inbound Servers
– Web Publishing and
Memory
– Server publishing
performance
Outbound Servers
– Authentication traffic and
performance
– Active caching and traffic
Bandwidth
– Kill bandwidth rules
Backing Up
Integrated Backup Tool
– Who need’s ‘em?
Import/Export Script
– Different IP address publishing/filters (IP specific)
ISAinfo script (better know everything before you
need to restore)
Disk Imaging
– Careful of different hardware
Using VMware Images
– Works great – performance
issues
Caching Array
Caching Array
– Not fault tolerance scheme
– Load balancing v. load sharing
– The miracle of wpad and autodiscovery
– Wpad caching
Autoconfiguration and Autodetection
Wpad
– DHCP
– DNS
Group Policy
IEAK
Registry file
Firewall client
installation
Reliability Hotfixes
ISA Server Service Pack 1
– http://www.microsoft.com/isaserver/downloads/sp1.asp
ISA Server 2000 Hotfix for Rules Engine and
Potential Web Proxy Service Crash
– http://www.microsoft.com/downloads/details.aspx?displaylang=e
n&FamilyID=235B14FB-CDB4-4FCE-BE10-E25F869DD40E
Flaw In ISA Server DNS Intrusion Detection Filter
Can Cause Denial Of Service
– http://www.microsoft.com/technet/treeview/default.asp?url=/tech
net/security/bulletin/MS03-009.asp
Flaw In Winsock Proxy Service And ISA Firewall
Service Can Cause Denial Of Service
– http://www.microsoft.com/technet/treeview/default.asp?url=/tech
net/security/bulletin/MS03-012.asp
Update Rollup for ISA Server Services
– http://support.microsoft.com/default.aspx?scid=kb;ENUS;810493
Key References
Shinder ISA Server 2000 Section
– www.isaserver.org/shinder
Jim Harrison’s ISAtools Site
– www.isatools.org
ISA Server Performance Best Practices
– http://www.microsoft.com/technet/security/pro
dtech/ISA/ISAPrfBP.asp?frame=true
Performance
ISA Configuration
Performance; Windows Settings
IP Stack configuration
– TcpTimedWaitDelay & StrictTimeWaitSeqCheck
– Remove QOS when not using ISA Bandwidth Control
Page File
– Separate physical drive
– Not compressed/encrypted volume
Physical memory
–
–
–
1024 Meg Minimum
3072 Meg Maximum
/3GB switch – Reverse Web Cache only
Disk subsystem – Only for Web Cache
– RAID 0 if using RAID
NIC
– Server class, 64-bit PCI-X
– Multiprocessor - HW Interrupt Partitioning
SSL/IPSec Accelerators
– Good only for large number of HTTPS connections
Processors (class / quantity)
– Do not use the ISA server as a workstation
Domain Topology
– Large number of NTLM authentication
requests
– DNS
Logical Network
– Single Default Gateway on ISA Server
Performance; ISA Settings
Rule elements – Less granular
–
–
–
Rule processing increases linearly
Small number of Rules with large Destination Sets
Destination Sets containing 20,000 destinations per
set were tested
Enable Kernel Mode Data Pump – IP Routing
– Significant increase to most capacity intensive Protocols
– Disable HTTP Redirector Application Filter
– Disable filtering of IP fragments
Firewall & Web Proxy service DNS Cache
– By default, services hold last 3000 DNS records
for 6 hours, regardless of TTL
Server Publishing
– Non RPC
– RPC
Web Publishing
– Fewer Rules with large Destination Sets. Faster, less
secure.
– More Rules with small Destination Sets. Slower,
more secure.
– Skip name resolution
Memory Usage
– Firewall Service
– Web Service
Split purpose
– Web Proxy
– Web Publishing
– Firewall
Logging
–
–
–
–
Ideal is Off. Not going to happen
Logging Fails, ISA stops serving content
File
Database
Reporting
– Disable
Performance; ISA Clients
Outbound
– Use Remote WinSock (RWS) client where possible
Significant gains made when using in conjunction to Kernel
Mode Data Pump.
– Set web browsers to use ISA server as Web Proxy
Forward caching significantly faster than transparent caching
Higher connection keep-alive rate
Decreases total number of simultaneous connections
– Streaming media clients
Enable Streaming Media Application filter
RWS clients should configure players to stream over HTTP
SecureNat clients should configure players to use UDP
Performance; Registry Re-Cap
Disk
– Disable short name creation.
HKLM\SYSTEM\CurrentControlSet\Control\Filesystem
“NtfsDiable8dot3NameCreation” 0x1
– Disable last access update.
HKLM\SYSTEM\CurrentControlSet\Control\Filesystem
“NtfsDsiableLastAccessUpdate” 0x1
– Multiprocessor only - Bypassing I/O Counters.
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\I/O
System “CounterOperations” 0x0
NTLM Authentication
HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
DWord “MaxConcurrentApi” 0x3 through 0x6
Performance; Registry Re-Cap
ISA
– Internal DNS Cache
Web Proxy: HKLM\SOFTWARE\Microsoft\Fpc
\Arrays\{Array
HKLM\SOFTWARE\Microsoft\Fpc\Arrays\{Array
GUID}\ArrayPolicy\WebProxy
GUID}\ArrayPolicy\WebProxy "msFPCDnsCacheSize
"msFPCDnsCacheSize““ &
"msFPCDnsCacheTtl"
msFPCDnsCacheTtl"
Firewall: HKLM\SOFTWARE\Microsoft\Fpc
\Arrays\{Array
HKLM\SOFTWARE\Microsoft\Fpc\Arrays\{Array
GUID}\ArrayPolicy
\Proxy-WSP "msFPCDnsCacheSize
GUID}\ArrayPolicy\Proxy-WSP
"msFPCDnsCacheSize““ &
"msFPCDnsCacheTtl“
– Maximum backlog for incoming TCP connections
Non RPC – HKLM\System\CurrentControlSet
\Services\FWSRV\Parameters
HKLM\System\CurrentControlSet\Services\FWSRV\Parameters
“ServerMappingBlacklog”
ServerMappingBlacklog” DWord key. For Exchange server 0x50, Web
server 0xA0.
RPC – HKLM\Software\Microsoft\FPC\ PluginRPC “ServerMappingBlacklog”
ServerMappingBlacklog”
and ”InterfacesBacklog”
”
.
For
Exchange
RPC
“
ServerMappingBlacklog”
InterfacesBacklog
ServerMappingBlacklog” =
0xA0 and ”InterfacesBacklog”
InterfacesBacklog” = 0x50.
– Bypass Name Resolution
HKLM\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNam
eResolutionForPublishingRules “SkipNameResolutionForPublishingRules”
SkipNameResolutionForPublishingRules”
HKLM\SYSTEM\CurrentControlSet\Services\W3Proxy\Parameters\SkipNam
eResolutionForAccessAndRoutingRules
“SkipNameResolutionForAccessAndRoutingRules”
SkipNameResolutionForAccessAndRoutingRules” 0x1
Performance; References
Windows
Disk
http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/ser
verop/part2/sopch08.asp
System
http://support.microsoft.com/default.aspx?scid=kb;en-us;171793
verop/part2/sopch10.asp
ISA
http://www.microsoft.com/technet/security/prodtech/ISA/ISAPrfBP.asp
http://www.microsoft.com/technet/security/prodtech/ISA/ISAPrfBP.asp
http://www.isaserver.org/tutorials/ISA_Clients__Part_1__General_ISA_Server_
Configuration.html
http://support.microsoft.com/default.aspx?scid
http://support.microsoft.com/default.aspx?scid =kb;en-us;292018
Q&A

ISA Server 2000 Best Practices from the Field

Transcription

Similar documents