Using the Windows Server 2003 Security Configuration Wizard to Harden the ISA Firewall

[LEFT][CODE]http://www.isaserver.org/tutorials/Windows-Server-2003-Security-Configuration-Wizard-Harden-ISA-Firewall.html[/CODE]


The pain was felt on both ends of the aisle – ISA firewall admins felt the pain, and the Microsoft ISA firewall product group felt it too. Microsoft was determined to correct this situation and they worked diligently to come up with comprehensive ISA firewall hardening guides for the 2004 ISA firewall. If you haven’t a chance to read them yet, check them out at [URL]http://www.microsoft.com/isaserver/techinfo/guidance/2004/planning.mspx[/URL]
As good as those guides are, you still have to read them a few times to figure out the consequences of your actions, and then if something goes haywire, you need to figure out a way to back out of your configuration without making the fix an avocation.
The solution for ISA firewall admins running their ISA firewalls on Windows Server 2003 Service Pack 1 is the Security Configuration Wizard (SCW). The SCW automates the process of hardening the ISA firewall by using security templates specially designed to lock down tight as a drum the ISA firewall and its base operating system.
The SCW isn’t installed by default. After installing Windows Server 2003 SP1, open the [B]Control Panel [/B]and open the [B]Add/Remove Programs[/B] applet. Click the [B]Add/Remove Windows Components[/B] button and select the [B]Security Configuration Wizard[/B] from the list. After the SCW is installed, you can access the application from the [B]Administrative Tools[/B] menu.
[INDENT] [B]NOTE: [/B]
Make sure that ISA Server 2004 Service Pack 1 is installed on the ISA firewall before installing Windows Server 2003 SP1.[/INDENT]The example provided in this article shows how the SCW works using a best practices configuration, where the ISA firewall has multiple network interfaces and is a member of the domain. The SCW may detect different roles and present you with different options if you run it on an ISA firewall that doesn’t meet these requirements for a secure ISA firewall deployment.
The first page of the wizard explains what the SCW does. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig11123839971641.jpg[/IMG]
[B]Figure 1[/B][/INDENT]The second page of the wizard enables you to create a new policy, edit an existing policy, apply an existing policy, and best of all, rollback the last applied security policy. The rollback feature is a great feature that help you save yourself in the event that you make the wrong decisions and the ISA firewall blows up. Since this is the first time we’re running the SCW on the ISA firewall, select the [B]Create a new security policy [/B]option.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig21123839971657.jpg[/IMG]
[B]Figure 2[/B][/INDENT]On the [B]Select Server[/B] page you enter the name of the ISA firewall in the [B]Server[/B] [B](use DNS name, NetBIOS name, or IP address[/B] text box). Since you never want to allow connections to the ISA firewall itself (except for those absolutely necessary), we always run the SCW on the firewall and not from another host on the network. While the SCW does allow you to do remote profiling and configuration of servers, this should be avoided when using the SCW to harden the ISA firewall. In this example, the FQDN of the ISA is [B]isalocal.msfirewall.org[/B] so we enter that into the text box. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig31123839971672.jpg[/IMG]
[B]Figure 3[/B][/INDENT]After clicking [B]Next[/B], the SCW will take a minute or two to check the ISA firewall’s current configuration against the SCW’s security configuration database.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig41123839971704.jpg[/IMG]
[B]Figure 4[/B][/INDENT]When the SCW is done doing its work, you’ll see the [B]View Configuration Database[/B] button appear. Click the [B]View Configuration Database [/B]button.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig51123840292063.jpg[/IMG]
[B]Figure 5[/B][/INDENT]This brings up the [B]SCW Viewer[/B], which shows you information about the different client and server roles, admin options, services, ports and other settings that the SCW has information on and can configure. You can get more information about each setting by clicking the arrow next to the setting or role. This is a comprehensive list and includes roles and settings that fall outside just the ISA firewall settings. If you click on a role or setting that does apply to the ISA firewall, you’ll see that the SCW has detected that role or feature. Close the [B]SCW Viewer[/B] and click [B]Next[/B] on the [B]Processing Security Configuration Database[/B] page.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig61123840292063.jpg[/IMG]
[B]Figure 6[/B][/INDENT]The [B]Role-Based Service Configuration[/B] page explains that the SCW can configure the device based on the role that device plays on the network. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig71123840292079.jpg[/IMG]
[B]Figure 7[/B][/INDENT]On the [B]Select Server Roles[/B] page you see the roles that were detected for the ISA firewall device. In this example, the SCW had actually detected that the ISA firewall was configured as both a [B]File server[/B] and [B]Microsoft Internet Security and Acceleration Server 2004[/B]. The ISA firewall would need to be configured as a file server [I]if[/I] you have the Firewall client installation share installed on the ISA firewall, but if you are not hosting the Firewall client installation share on the ISA firewall, then you should remove that role by removing the checkmark. You can get more information about the role by clicking the arrow next to the role. In this example the only role played by the ISA firewall is the [B]Microsoft Internet Security and Acceleration Server 2004[/B] role. This machine does not host the Firewall client share, so I removed the checkmark that the SCW had put there.
Note that if you are using the ISA firewall as a VPN server or gateway, then you should [I]not[/I] select the [B]Remote access/VPN server[/B] option. We want the ISA firewall to take control of the RRAS configuration, not the SCW. So, make sure that the [B]Remote access/VPN server[/B] option is [B]not[/B] selected. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig81123840292079.jpg[/IMG]
[B]Figure 8[/B][/INDENT]On the [B]Select Client Features[/B] page, the client features required by the ISA firewall are selected by default. However, you may want to support additional client features. For example, if you want your VPN clients to browse the network after they connect, you should configure the ISA firewall’s internal interface of the ISA firewall with a WINS server address. If you do, then make sure the [B]WINS Client[/B] role is selected. Most of the options are valid and the WINS entry is the only one that I would change. You might want to consider removing the [B]DNS registration client[/B] if you’re not using DDNS. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig91123840514876.jpg[/IMG]
[B]Figure 9[/B][/INDENT]The [B]Select Administration and Other Options[/B] page shows you the admin and other options that the ISA firewall team determined were important for an ISA firewall in our current configuration. Most of them are legit, although I removed the [B]Application installation from Group Policy[/B] option since I’m not interested in having any applications other than the ISA firewall software installed on the ISA firewall device. Review the client roles careful and click the arrows next to each of the options to learn more about the options. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig101123840514876.jpg[/IMG]
[B]Figure 10[/B][/INDENT]On the [B]Handling Unspecified Services[/B] page, you tell the Wizard how to handle services that aren’t installed on the selected server and not listed in the security configuration database. While its unlikely that you’ll have additional services installed on the ISA firewall that aren’t included in the security database, it could be possible that third party product would install services that need to start in order to work correctly. For this reason, I recommend selecting the [B]Do not change the startup mode of the service[/B] option. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig111123840514891.jpg[/IMG]
[B]Figure 11[/B][/INDENT]The [B]Confirm Service Changes[/B] page shows you the changes the SCW will make to services running on the ISA firewall. Carefully review these changes before proceeding. In my runs with the SCW, I didn’t find anything changed that I didn’t want to change. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig121123840514907.jpg[/IMG]
[B]Figure 12[/B][/INDENT]The [B]Network Security[/B] page introduces changes the SCW can make to Windows Firewall and IPSec settings. Since we’re running a stateful packet and application layer inspection firewall, we don’t need to configure the Windows Firewall or IPSec settings. Leave the checkmark in the [B]Skip this section[/B] checkbox and click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig131123840759766.jpg[/IMG]
[B]Figure 13[/B][/INDENT]The [B]Registry Settings[/B] page introduces you to the changes you can make to protocols supported by the ISA firewall device. Most of what you’ll be configuring in the following pages is related to RPC and other intradomain communications. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig141123840759766.jpg[/IMG]
[B]Figure 14[/B][/INDENT]On the [B]Require SMB Security Signatures[/B] page you configure whether or not want SMB signatures enabled and required. I recommend that you select both the [B]All computer that connect to it satisfy the following minimum operating system requirements [/B]and the [B]It has surplus processor capacity that can be used to sign file and print traffic[/B] if you are hosting the Firewall client share on the ISA firewall device. If you are not hosting the Firewall client share on the ISA firewall device, then do not select the [B]It has surplus processor capacity that can be used to sign file and print traffic[/B]. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig151123840759782.jpg[/IMG]
[B]Figure 15[/B][/INDENT]On the [B]Outbound Authentication Methods[/B] page you configure the LAN Manager authenticated supported for when the ISA firewall device itself must authenticate to another computer. In this example, the ISA firewall is a member of the user domain (for enhanced security) and will also be used as a VPN gateway for site to site VPN connections. For this reason I selected the [B]Domain Accounts[/B] and [B]Local Accounts on the remote computers[/B] (since the remote VPN gateways might not be members of the domain). However, this is [B][I]no reason at all[/I][/B] that I can imagine supporting connections requiring [B]File sharing passwords on Windows 95, Windows 98, or Windows Millennium Edition[/B]. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig161123840759782.jpg[/IMG]
[B]Figure 16[/B][/INDENT]On the [B]Outbound Authentication using Domain Accounts[/B] page you configure the LAN Manager authentication level used when making outbound connections. The default enabled option is [B]Windows NT 4.0 Service Pack 6a or later operating systems[/B]. However, you do have the option to select [B]Clocks that are synchronized with the selected server’s clock[/B]. You can check both if your network security requirements dictate that you do so, but I typically select the first one since I’m connecting to Windows Server 2003 servers/firewalls. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig171123840984985.jpg[/IMG]
[B]Figure 17[/B][/INDENT]The [B]Registry Settings Summary[/B] page shows you the changes that will be made to the Registry to enforce the authentication requirements. Review these settings closely and then click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig181123840985001.jpg[/IMG]
[B]Figure 18[/B][/INDENT]The [B]Audit Policy[/B] page explains the purposes and goals of the audit policy configuration options that show up on subsequent pages. Click [B]Next[/B] after reading this information.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig191123840985016.jpg[/IMG]
[B]Figure 19[/B][/INDENT]The options on the [B]System Audit Policy[/B] page allow you to set the audit policy on the ISA firewall device. The default option is [B]Audit successful activities[/B]. However, I want to know who’s been successful and unsuccessful, so I will typically choose the [B]Audit successful and unsuccessful activities [/B]option.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig201123840985063.jpg[/IMG]
[B]Figure 20[/B][/INDENT]The [B]Audit Policy Summary[/B] page shows the changes the SCW will make to the current audit configuration on the ISA firewall device. Review these closely before continuing. You also have the option include the [B]SCWAUdit.inf[/B] security template, which will set system access controls (SACLs) which will enable auditing of the file system. Note that once the template sets the SACLs on the file system, you won’t be able to use the rollback feature to reset them. Click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig211123841269954.jpg[/IMG]
[B]Figure 21[/B][/INDENT]Click [B]Next[/B] on the [B]Save Security Policy[/B] page to save the changes to a security policy template. Note that no changes will be made to the ISA firewall device at this time.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig221123841269954.jpg[/IMG]
[B]Figure 22[/B][/INDENT]On the [B]Security Policy File Name[/B] page, enter the name for the file at the end of the path provided for you in the [B]Security policy file name[/B] text box. In this example, we’ll name the file [B]isafirewallsecpol[/B]. Click the [B]View Security Policy[/B] button to view the details of the security policy you’ve configured with the SCW.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig231123841269954.jpg[/IMG]
[B]Figure 23[/B][/INDENT]The [B]SCW Viewer [/B]appears and shows you the details of the security policy you’ve configured with the SCW. Review these settings closely to confirm that you want to make the changes listed in here. Close the [B]SCW Viewer[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig241123841269969.jpg[/IMG]
[B]Figure 24[/B][/INDENT]Now for the moment of Truth. You have the option to save the file and apply it later, or you can apply the policy you’ve configured in the SCW now. If you’re not sure you want to make the changes, choose the [B]Apply later[/B] option and copy the file to a lab ISA firewall and test it there. If you want immediate gratification, then select the [B]Apply now[/B] option. Except for the changes made to the file system ACLs, you can always undo the changes made by the SCW policy but running the SCW again. In this example I’ll select the [B]Apply now[/B] option and click [B]Next[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig251123841297376.jpg[/IMG]
[B]Figure 25[/B][/INDENT]Click [B]Next[/B] on the [B]Applying Security Policy[/B] page after you see it say [B]Application complete[/B].
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig261123841297376.jpg[/IMG]
[B]Figure 26[/B][/INDENT]Click [B]Finish[/B] on the [B]Completing the Security Configuration Wizard[/B] page.
[INDENT] [IMG]http://www.isaserver.org/img/upl/Fig271123841297391.jpg[/IMG]
[B]Figure 27[/B]
[CENTER]

[URL="http://www.amazon.com/exec/obidos/ASIN/1931836191/ref%3Dnosim/searchbyisbn/wwwshindernet-20"]
[/URL][/CENTER][/INDENT][B]Conclusion[/B]

I recommend restarting the ISA firewall device after you apply the policy changes to the ISA firewall.
While the changes made to the ISA firewall do not seem to have disabled any core functionality and have not created an access control issues that I’ve been able to identify, I have to recommend that you [B]always[/B] test your policies in a lab environment before deploying them to your production ISA firewall. Your deployment may significantly differ from the best practices configuration that I recommend for ISA firewalls, or you may have networking or stateful packet inspection or application layer inspection enhancements installed on your ISA firewall. You should test your SCW security polices in the lab, with your production software environment, before deploying them on the actual ISA firewall device. You’re asking for trouble if you do otherwise.


[/LEFT]