Course 2824B: Implementing Microsoft internet security and acceleration server 2004 - Module 7

Chia sẻ: Nothing Nothing | Ngày: | Loại File: PPT | Số trang:23

Thêm vào BST

Báo xấu

51
lượt xem 3
download

Download Vui lòng tải xuống để xem tài liệu đầy đủ

Module 7: Advanced application and web filtering. This module explains how application and Web filtering can be used for very specific filtering of traffic that flows through the ISA Server. The module shows how to configure application and Web filtering to provide advanced protection for the internal network.

Chủ đề:

Bình luận(0) Đăng nhập để gửi bình luận!

Lưu

Nội dung Text: Course 2824B: Implementing Microsoft internet security and acceleration server 2004 - Module 7

Module 7: Advanced Application and Web Filtering
Overview Advanced Application and Web Filtering Overview Configuring HTTP Web Filters Additional Application and Web Filters
Lesson: Advanced Application and Web Filtering Overview What Is an Application Filter? What Is a Web Filter? Why Use Application and Web Filters? Application and Web Filter Architecture
What Is an Application Filter? Application filters can: Enable firewall traversal for complex protocols Enable protocol-level Application intrusion detection Server Enable protocol-level content filtering Generate alerts and log events ISA Server
What Is a Web Filter? Web filters can: Scan and modify HTTP requests Scan and modify HTTP responses Web Block specified Server responses Log and analyze traffic Encrypt and compress data Implement custom authentication schemes ISA Server
Why Use Application and Web Filters? Protectionand Application against Webmalicious code by filters provide: blocking packets that have worm or virus characteristics Protection against user actions by blocking the download of harmful programs or ensuring that some types of data do not leave the network Protection against specific network connections by blocking connection attempts by specific applications Integration with third-party or custom filters that have been developed using the application filter API or the Web filter API
Application and Web Filter Architecture Web Filter 3 s Web Filter API Web Applicati Proxy 2 on Filter Filters Application Filter API Firew all 4 1 Servic Rules Engine e Firewa ll Engin e
Lesson: Configuring HTTP Web Filters HTTP Web Filtering Overview How to Configure HTTP Web Filter General Properties How to Configure HTTP Web Filter Methods How to Configure HTTP Web Filter Extensions How to Configure HTTP Web Filter Headers How to Configure HTTP Web Filter Signatures How to Identify an HTTP Application Signature Best Practice: HTTP Filter Configuration for Web Publishing
HTTP Web Filtering Overview Use HTTP filtering to: Filter traffic from internal clients to other networks Filter traffic from Internet clients to internal Web servers HTTP filtering is rule specific so you can configure different filters for each access or publishing rule HTTP filters enable filtering of HTTP packets based on several criteria
How to Configure HTTP Web Filter General Properties Configure maximum header length Configure maximum payload length Configure maximum URL and query length
How to Configure HTTP Web Filter Methods Configure allowed or blocked methods
How to Configure HTTP Web Filter Extensions Configure allowed or blocked extensions
How to Configure HTTP Web Filter Headers Configure headers that will be blocked Configure server header settings Configure Via header settings
How to Configure HTTP Web Filter Signatures Configure blocked signatures
How to Identify an HTTP Application Signature HTTP Reque st Reques GET.http://www.contoso.com/.HTTP/1.0. t .Accept:.image/gif,.image/xxbitmap, Header .image/jpeg,.image/pjpeg, .application/vnd.msexcel, .application/vnd.mspowerpoint, .application/msword,.*/*. .AcceptLanguage:.enus. .IfModifiedSince:.Fri,.11.Oct.2002.20:30:04.GMT. .IfNoneMatch:."06ee8fa6471c21:428". .UserAgent:.Mozilla/4.0.(compatible;.MSIE.6.0; .Windows.NT.5.1). .Host:.www.contoso.com. .ProxyConnection:.KeepAlive... HTTP Signatu Header re
Best Practice: HTTP Filter Configuration for Web Publishing To configure a baseline HTTP filter: Configure maximum header, payload, URL and query lengths Verify normalization and do not block high-bit characters Allow only GET, HEAD, and POST Block executable and server side includes extensions Block potentially malicious signatures Use the httpfilterconfig.vbs script from the ISA Server CD to import and export HTTP filter configurations
Practice: Configuring HTTP Filtering Testing HTTP Connections with Default HTTP Filter Importing and Testing Sample HTTP Filter Settings Modifying HTTP Filter Settings Den-Web-01 Gen-Web-01 Den-ISA-01 Internet Den-DC-01
Lesson: Additional Application and Web Filters About the FTP Application Filter About the SOCKS V4 Application Filter Other Application and Web Filters How to Develop Application and Web Filters
About the FTP Application Filter Contoso Ltd FTP Site Connect on Port 21 Reply to port Connect on Port 2456 20 ISA Reply to port Serv 2457 er ftp://ftp.contoso. com
About the SOCKS Version 4 Application Filter Application Server ISA Serv er SOCKS Application