Cisco Secure VPN Exam Certification Guide - Cisco press

268Chapter 6: Configuring the Cisco VPN Client Firewall Feature

•DHCP requests—Dynamic Host Configuration Protocol (DHCP) requests are sent from the client on one port to the DHCP server and received on a different port.

•ESP—Encapsulating Security Payload (ESP) is VPN data that are allowed from the secure gateway because ESP rules are always packet filters, as opposed to session-based filters.

Turning off the Always On option allows the user to have a secure VPN connection to the headend network while still having nonsecured connections to other networks, such as the Internet. This merging of secured and nonsecured traffic on the same wire is called split tunneling. The Stateful Firewall (Always On) feature provides protection for nonsecured traffic when split tunneling is in use.

Cisco Integrated Client

The VPN Client used on the Windows platforms includes a stateful firewall that is transparent to the user. Designed by Zone Labs, this firewall is called the Cisco Integrated Client (CIC). Although the Always On option of the VPN Client allows the user to choose whether to have basic firewall protection in place, the CIC can still be controlled by the concentrator using the Central Protection Policy (CPP). CPP allows the VPN concentrator to define rules for use during split-tunnel operation. Because the Tunnel Everything option already blocks all nontunneled traffic, CPP is not used in this mode.

The Zone Labs Integrity Server, commonly refereed to as IS, is a stand-alone server that communicates with the VPN concentrator to maintain policies for the remote PCs. The IS also ensures policy enforcement by communicating with the concentrator to allow or drop connections, exchange session and user information, and report the status of connections.

Centralized Protection Policy

CPP, which is also known as a push policy because it is pushed from the concentrator down to the client, allows you to define additional rules to allow or deny Internet traffic while the client is connected to the concentrator.

During the VPN connection negotiation, the concentrator sends a predefined policy to the VPN Client. The client then passes this policy to the CIC, which in turn enforces the policy. If the Always On option has been chosen on the client, more restrictive rules can be used regarding Internet traffic while the tunnel is established.

CPP can use a number of firewalls to enforce these rules, including CIC, Zone Alarm, and Zone AlarmPro. CPP allows finer tuning of the firewall than the Stateful Firewall feature because you can allow or deny specific ports and protocols.

Configuring Firewall Filter Rules 269

The Are You There Feature

An alternative to using the CPP method of defining policies on the personal firewall is where the VPN Client polls a firewall installed on the client PC every 30 seconds. This process is called Are You There (AYT). If the firewall does not answer these polls, the VPN Client drops the tunnel. Using this method, the VPN Client does not enforce a policy but rather ensures that a software firewall on the PC is running.

AYT is usable with BlackICE, Zone Alarm, or Zone AlarmPro. The only messages passed between the concentrator and the firewall are these AYT polls.

Configuring Firewall Filter Rules

24 Customizing firewall policy

Before you can use filter rules from the concentrator, you must configure those rules. Although the concentrator’s default configuration comes with some rules, these are not meant for production networks. The default rules are too open for a truly secure environment because they were designed merely to facilitate the building of rules for your individual network. Rules, which are specifications that allow or deny specific types of traffic, can be applied to either an interface or a VPN group. This section discusses how to build rules and filters for use with the VPN concentrator.

Rules are configured from the Configuration | Policy Management | Traffic Management | Rules screen, as shown in Figure 6-2.

Figure 6-2 The Configuration | Policy Management | Traffic Management | Rules Screen

270 Chapter 6: Configuring the Cisco VPN Client Firewall Feature

On this screen, you can add, modify, copy, or delete rules. The list shown consists of the default rules and those rules that the administrator has added, minus the deleted rules. Notice that each of these rules has text inside parentheses. The text within the parentheses describes the action and direction. The meaning of this action and direction text is discussed in the section describing the creation of a rule, “Name, Direction, and Action.”

The default rules are listed in Table 6-3. For the default rules, the action is almost always forward and the source address is always Use IP Address/Wildcard mask, which is set to any address (0.0.0.0 255.255.255.255). The destination IP address is always Use IP Address/Wildcard mask, which is set to any address (0.0.0.0/255.255.255.255). The exceptions to these rules are with Virtual Router Redundancy Protocol (VRRP) In and VRRP Out, which use the Internet Assigned Numbers Authority (IANA)–assigned multicast IP address of 224.0.0.18/0.0.0.0.

Table 6-3 Default Rules

272 Chapter 6: Configuring the Cisco VPN Client Firewall Feature

Table 6-3 Default Rules (Continued)

To configure a new rule, click the Add button, which takes you to the Configuration | Policy Management | Traffic Management | Rules | Add screen, as shown in Figure 6-3. While configuring rules, remember that the rule is based on the viewpoint of the VPN concentrator. This means that if the rule is to be used on a VPN Client, you must verify that the rule is set for the client, not the head-end concentrator.

Figure 6-3 The Configuration | Policy Management | Traffic Management | Rules | Add Screen

The TCP Connection field is ignored for client firewall rules.

Source Address and Destination Address

The source address and destination address sections work in the same manner. The pull-down menu lists all the network lists that are configured on the concentrator. Leaving the default of Use IP Address/Wildcard mask allows you to enter an IP address and wildcard mask combination to define the range of IP addresses to which this list applies.

TCP/UDP Source and Destination Ports

The TCP/UDP source and destination ports sections work in a similar manner. You can choose to leave Range as the setting, in which case you enter two port numbers. If the port numbers are different, a range is used. If both port numbers are the same, that single port is used. The port numbers entered are the IANA-assigned port numbers. Otherwise, you can click the pull-down menu that brings up a list of the predefined ports with their associated IANA numbers, as shown in Table 6-5.

276 Chapter 6: Configuring the Cisco VPN Client Firewall Feature

Table 6-5 TCP and UDP Ports (Continued)

ICMP Packet Type

Finally, you configure the ICMP Packet Type if you are not using the client firewall. Make sure that you save the configuration, or you run the risk of losing your configuration due to loss of power. The VPN Client ignores any configurations that you make in this field.

Configuring the Stateful Firewall

21 Software client’s Stateful Firewall feature

The Stateful Firewall feature is easily configured on the Cisco VPN Client. Open the client, as shown in Figure 6-4.

Figure 6-4 VPN Dialer

Configuring the VPN Concentrator for Firewall Usage 277

Choose the Options pull-down menu, as shown in Figure 6-5. If the Stateful Firewall (Always On) option does not have a check mark in front of it, click it once. Because the Options pulldown menu disappears, choose it again, and make sure that there is a check mark in front of the Stateful Firewall (Always On) option, as shown in Figure 6-5.

Figure 6-5 VPN Client Options Menu

Configuring the VPN Concentrator for Firewall Usage

24 Customizing firewall policy

Configuration of the firewall for the VPN Client is done on the Configuration | User Management | Groups | Modify screen under the Client FW tab (see Figure 6-6). This screen is used for configuring all firewall options other than the Stateful (Always On) option, which is configured on the VPN Client itself. The following sections describe each of the options that are shown in the Client FW tab.