Windows Server 2003 : Monitoring Network Protocol Security (part 2) - Negotiation Process

Negotiation Process

When an IPSec policy is Assigned (made active) and the IPSec service is running each network communication, both incoming and outgoing policies are evaluated to see whether they meet the conditions specified in the IPSec policy. If a condition match is made—for example, an outgoing Simple Mail Transfer Protocol (SMTP) communication that matches a filter—the filter is triggered and the filter action occurs. If the filter action is Block or Allow, that is what occurs, but if it is Negotiate, a number of processing steps must follow.

Processing can be divided into Phase I, or Main Mode negotiation, and Phase II, or Quick Mode negotiation. For purposes of this discussion, we’ll use the computer names Red and Blue. Figure 1 illustrates a simplification of the process. A more detailed explanation follows.

The following steps explain the Main Mode process in detail:

The following steps explain the Quick Mode process in detail:

Creating an IPSec Policy

Creating an IPSec Policy is easy. Creating one that does exactly what you want it to is not always so easy. This far, you have learned how policy works. Now you will use that knowledge to create a simple policy that you can use to block access to port 80 and another to ensure encryption of data between two computers. The two major tools used to create policy are IP Security and Netsh. The next section describes how to create a policy from the command line. The exercises at the end of this section teach you how to use the GUI tool and Netsh.

Using Netsh to Manage IPSec

Netsh is a native Windows Server 2003 command-line scripting tool that you can use to display or modify the local or remote network configuration of a computer running Windows Server 2003. You can run Netsh from a batch file or from the command prompt. The Netsh IPSec commands cannot be used on any other Windows computer.

To set the Netsh IPSec context, type the word static or dynamic while in the Netsh IPSec context. Our discussion is concerned only with Netsh commands that are useful to establish and monitor IPSec.

Once you have a context, you can use the Netsh commands to produce a policy or monitor IPSec activity. Two modes are possible. Static mode allows you to create, modify, and assign policies without affecting the active IPSec policy. Dynamic mode allows you to display the active state and immediately implement changes to the active IPSec policy. Dynamic Netsh commands affect the service only when it is running. If it is stopped, dynamic policy settings are discarded.

Using Netsh to Monitor IPSec You can use Netsh to monitor the current IPSec session. Monitoring consists of either displaying policy information, getting diagnostics and logging IPSec information, or both. Any information you can find by running the IP Security Monitor snap-in, you can find by running Netsh.

Displaying IPSec Policy Information First, of course, you might want to know what the current IPSec Policy is. To find out, you can use the Show command. If you choose to use the Show All command, a lot of information will be returned.

Netsh ipsec static show all

Sometimes it is useful to look at only a portion of the IPSec configuration information. A wide range of Show commands is available. Some are defined in Table 1. You can enter all commands from the Netsh IPSec Dynamic or the Netsh IPSec Static context, or, with modification, from the command line.

Obtaining Diagnostic IPSec Information One of the steps in diagnosing IPSec problems—or just establishing that the policy is working like you think it should—is to obtain information about the current policy. The Show commands described later in Table 2 provide that information. The information that each command reveals identifies the settings in the policy. For example, the Show Filterlist command lists the information in the policies filter list. Filter list options were listed in Table 11-6.

Some examples of the Show command syntax are illustrated next. In the commands, the equal sign is part of the command and the italicized words are replaced by some value as indicated below the command.

• Show All Resolvedns=value Resolves the DNS or NetBIOS computer name associated with an IP address. This command might assist you in determining whether the policy is affecting the right computer.

• Show Mmsas Displays information on the IPSec Main Mode SA. You can see the source and destination addresses. When used with the Resolvedns=yes switch, the names of the computers are also displayed.

• Show Qmsas Displays information about the IPSec Quick Mode SAs.

• Show Stats Displays the IKE Main Mode statistics, IPSec Quick Mode statistics, or both.
  

In addition to Show commands, you can use several Dynamic mode Netsh IPSec diagnostic commands to obtain diagnostic information, such as the following:

• Set Config Property=Ipsecdiagnostics value=value Can be set with a value of 0 through 7, indicating the level of IPSec diagnostic logging. The default is 0, which means logging is disabled. The level 7 causes all logging to be performed. The computer must be restarted for logging to begin.

• Set Config Property=Ipsecloginterval value=value Indicates how frequently in seconds the IPSec events are sent to the system event log. The range is 60 to 86,400 with a default of 3600.

• Set Config Property=Ikelogging value=value Can be set with a value of 0 or 1, determining whether IKE (Oakley) logging will occur. This command produces a log with a copious amount of information. You must be familiar with the RFCs at the expert level to completely understand the Oakley logs.

• Set Config Property=Strongcrlcheck value=value Determines whether certificate revocation list (CRL) checking is used. If 0, CRL checking is disabled. If 1 is the value, certificate validation fails only if the certificate is revoked. Level 2 fails if any CRL check error occurs. A CRL check fails if the CRL cannot be located on the network.

You can make other diagnostic efforts by modifying the current policy to reduce security. For example, if you change authentication to Shared Secret on both computers instead of Kerberos or Certificates, you eliminate the possibility that the problem is related to authentication. Netdiag.exe is a command-line tool that you can use to display IPSec information as well as to test and view network configuration. Netdiag is available for Windows Server 2003, Windows 2000, and Windows XP. However, it must be installed in a different way for each operating system. For Windows Server 2003, Netdiag is installed with the Windows Server 2003 Support Tools. For Windows 2000, Netdiag is included with the Windows 2000 Resource Kit tools that you can also download from the Internet. It is also available on the Windows XP Installation CD-ROM, and is installed by running Setup.exe from the Support\Tools folder.

You can obtain general network diagnostic information (not IPSec-specific) by using the Netdiag command. For example, the Netdiag /v /l command provides the IP configuration and routing configuration for a computer, tests WINS and DSN name resolution, reports the build version of the computer and the hotfixes that are installed, tests the validity of domain membership, verifies contacts by member computers with their domain controllers, and checks trust relationships. All of this information can be useful in eliminating general networking problems before attempting to diagnose IPSec issues.

However, although the Netdiag.exe tool is available for Windows Server 2003, the Netdiag /test:ipsec option is removed. Use the Netsh command instead. Because Netsh IPSec context commands will not work with downlevel Windows computers, use Netdiag for them. You might want to remotely examine the IPSec policy of a computer running Windows XP or Windows 2000 that is communicating, or attempting to communicate, with Windows Server 2003. In this case, use a remote desktop session and the Netdiag tool.

Using IP Security Monitor to Monitor IPSec Traffic

IP Security Monitor is a Windows XP and Windows Server 2003 snap-in used to monitor and troubleshoot IPSec. If an IPSec policy is active, you can use this console to examine the policy and its operations. You can use the IP Security Monitor console to monitor computers of only the same version as the one running the monitor. Information that you can obtain includes the following:

• Name of the active IPSec policy

• Details about the active IPSec policy

• Quick Mode statistics

• Main Mode statistics

• Information about active SAs

Understanding Main Mode and Quick Mode Statistics in IP Security Monitor Viewing IPSec statistics is simply a matter of expanding the server node, expanding the Main Mode node or the Quick Mode node, and then selecting the Statistics node. Understanding what each statistic means is more difficult. Table 2 describes the most common Main Mode statistics, and Table  describes the most common Quick Mode statistics. Within Table 2, several statistics appear to be related to Quick Mode. They are, but they are initialized by IKE during Main Mode, hence their inclusion as part of the Main Mode statistics table.

Using Netcap to Capture Network Traffic

Netcap.exe is a command-line utility that you can use to capture network traffic to a capture file. You can then load the file in Network Monitor to view the captured traffic. The Network Monitor tool does not have to be installed on the computer running Windows Server 2003 to use Netcap. You can also use Netcap on computers running Windows XP, which makes it an extremely attractive way to capture traffic for later review. The tool is available after the Windows Server 2003 Support Tools have been installed. When you first run the command, the Network Monitor driver is automatically installed.

Table 4 describes the syntax used to obtain a capture.

The following are two example commands:

Capture the packets received on NIC 2 using a 20-MB buffer:

Netcap /n:2 /b:20

Capture for one hour:

Netcap /L:01:00:00