On the left side, click the Firewall Settings link. This should display the Firewall

174 | Lesson 8 5. Take note of the first setting: Enable SPI. This is stateful packet inspection. It should be selected by default, but if not, select it and move on to the next step.

6. View the NAT Endpoint Filtering section directly under the Firewall Settings. Increase

the security of UDP Endpoint Filtering by clicking the radio button Port and Address Restricted.

7. Next, enable anti-spoofing by clicking the Enable anti-spoofing checking check box.

8. Finally, scroll down and view the Application Level Gateway ALG Configuration.

PPTP, IPSec VPN, RTSP, and SIP should all be selected. SCAN HOSTS WITH Nmap GET READY. In this exercise, we will scan a computer with Nmap. This vulnerability scanner is best known for its port scanning abilities. We will use this tool to scan for open ports on a computer.

1. Download and install the command-line version of the Nmap program. You will also be

prompted to install the WinPCap program.

2. Extract the contents to a folder of your choice.

3. Write down the IP address of a Windows host on your network. For this example, we

will use a host with the IP address 10.254.254.208.

4. Scan the ports of that host with the –sS parameter for example,

nmap –sS 10.254.254.208. 5. If there are non-essential ports open, turn off their corresponding unnecessary services, such as FTP or HTTP. This can be done in a variety of places, including Computer Management. If there are no services that you wish to turn off, enable one and then rescan the ports with Nmap to show that the service is running, turn off the ser- vice, and move on to the next step.

6. Scan the ports of that host a second time, once again with the –sS parameter. This

time, you are verifying that the services are turned off by identifying that the corre- sponding ports are closed.

7. If possible, scan the ports of a four-port SOHO routerfirewall or a computer with a

firewall running. Use the –P0 parameter for example, nmap –P0 10.254.254.208. This may take up to five minutes. Doing this will verify whether the firewall is run- ning properly by displaying that all of the ports are filtered. The –sS option we used previously will not work on a fully firewalled device because the initial ICMP packets from the ping will not be accepted. –P0 does not use ICMP packets, but it takes longer to complete. SCAN THE INTERNET CONNECTION WITH ShieldsUP GET READY. There are several online port scanners available. This exercise requires an Internet connection in order to access one of them. This exercise will scan the ports of whatever device is facing the Internet. This could be the local computer if it connects directly to the Internet or a four-port router, or perhaps a more advanced firewalling device. It all depends on your network scenario.

1. With a web browser, connect to www.grc.com.

2. Click on the ShieldsUP picture.

3. Scroll down and click the ShieldsUP link.

4. Click the Proceed button.

5. Select the Common Ports scan. This will initiate a scan of the computer or device

that is being displayed to the Internet. If you access the Internet through a router Defining Network Infrastructures and Network Security | 175 CERTIFICATION READY How would you define a DMZ? 1.1 firewall, then this will be the device that is scanned. If your computer connects directly to the Internet, then the computer will be scanned.

6. Make note of the results. It should show the public IP that was scanned. Then it will

list the ports that were scanned and their status. The desired result for all ports listed is “Stealth,” all the way down the line for each of the listed ports. If there are Open or Closed ports, you should check to make sure that the firewall is enabled and oper- ating properly.

7. Try a few other scans, such as All Service Ports or File Sharing.

A proxy server acts as an intermediary between a LAN and the Internet. By definition, proxy means “go-between,” acting as such a mediator between a private and a public network. The proxy server evaluates requests from clients, and if they meet certain criteria, forwards them to the appropriate server. There are several types of proxies, including the following: • Caching proxy attempts to serve client requests without actually contacting the remote server. Although there are FTP and SMTP proxies among others, the most common caching proxy is the HTTP proxy, also known as a web proxy, which caches web pages from servers on the Internet for a set amount of time. This is done to save bandwidth on the company’s Internet connection and to increase the speed at which client requests are carried out. • IP proxy secures a network by keeping machines behind it anonymous; it does this through the use of NAT. For example, a basic four-port router will act as an IP proxy for the clients on the LAN it protects. Another example of a proxy in action is Internet content filtering. An Internet content filter, or simply a content filter, is usually applied as software at the application layer and it can filter out various types of Internet activities, such as access to certain Web sites, email, instant messaging, and so on. Although firewalls are often the device closest to the Internet, sometimes another device could be in front of the firewall, making it the closest to the Internet—a network intrusion detec- tion system, or perhaps a more advanced network intrusion prevention system. A network intrusion detection system NIDS is a type of IDS that attempts to detect mali- cious network activities e.g., port scans and DoS attacks by constantly monitoring network traffic. The NIDS will then report any issues that it finds to a network administrator as long as it is configured properly. A network intrusion prevention system NIPS is designed to inspect traffic, and, based on its configuration or security policy, it can remove, detain, or redirect malicious traffic in addi- tion to simply detecting it. Redefining the DMZ A perimeter network or demilitarized zone DMZ is a small network that is set up separately from a company’s private local area network and the Internet. It is called a perimeter network because it is usually on the edge of a LAN, but DMZ has become a much more popular term. A DMZ allows users outside a company LAN to access specific services located on the DMZ. However, when the DMZ set up properly, those users are blocked from gaining access to the company LAN. Users on the LAN quite often connect to the DMZ as well, but with- out having to worry about outside attackers gaining access to their private LAN. The DMZ might house a switch with servers connected to it that offer web, email, and other services. Two common DMZ configurations are as follows: • Back-to-back configuration: This configuration has a DMZ situated between two firewall devices, which could be black box appliances or Microsoft Internet Security and Acceleration ISA Servers.