Log in no password is required.

174 | Lesson 8 5. Take note of the first setting: Enable SPI. This is stateful packet inspection. It should be selected by default, but if not, select it and move on to the next step.

6. View the NAT Endpoint Filtering section directly under the Firewall Settings. Increase

the security of UDP Endpoint Filtering by clicking the radio button Port and Address Restricted.

7. Next, enable anti-spoofing by clicking the Enable anti-spoofing checking check box.

8. Finally, scroll down and view the Application Level Gateway ALG Configuration.

PPTP, IPSec VPN, RTSP, and SIP should all be selected. SCAN HOSTS WITH Nmap GET READY. In this exercise, we will scan a computer with Nmap. This vulnerability scanner is best known for its port scanning abilities. We will use this tool to scan for open ports on a computer.

1. Download and install the command-line version of the Nmap program. You will also be

prompted to install the WinPCap program.

2. Extract the contents to a folder of your choice.

3. Write down the IP address of a Windows host on your network. For this example, we

will use a host with the IP address 10.254.254.208.

4. Scan the ports of that host with the –sS parameter for example,

nmap –sS 10.254.254.208. 5. If there are non-essential ports open, turn off their corresponding unnecessary services, such as FTP or HTTP. This can be done in a variety of places, including Computer Management. If there are no services that you wish to turn off, enable one and then rescan the ports with Nmap to show that the service is running, turn off the ser- vice, and move on to the next step.

6. Scan the ports of that host a second time, once again with the –sS parameter. This

time, you are verifying that the services are turned off by identifying that the corre- sponding ports are closed.

7. If possible, scan the ports of a four-port SOHO routerfirewall or a computer with a

firewall running. Use the –P0 parameter for example, nmap –P0 10.254.254.208. This may take up to five minutes. Doing this will verify whether the firewall is run- ning properly by displaying that all of the ports are filtered. The –sS option we used previously will not work on a fully firewalled device because the initial ICMP packets from the ping will not be accepted. –P0 does not use ICMP packets, but it takes longer to complete. SCAN THE INTERNET CONNECTION WITH ShieldsUP GET READY. There are several online port scanners available. This exercise requires an Internet connection in order to access one of them. This exercise will scan the ports of whatever device is facing the Internet. This could be the local computer if it connects directly to the Internet or a four-port router, or perhaps a more advanced firewalling device. It all depends on your network scenario.

1. With a web browser, connect to www.grc.com.

2. Click on the ShieldsUP picture.

3. Scroll down and click the ShieldsUP link.

4. Click the Proceed button.

5. Select the Common Ports scan. This will initiate a scan of the computer or device

that is being displayed to the Internet. If you access the Internet through a router