Now we will see a demonstration of how phase one may proceed.
First we need to decide on a way in which the identity of the remote host is confirmed.
The IPCA allows us to confirm the identity of a remote computer by checking its account with the Active
Directory domain using the Kerberos protocol.
We can also verify the certificate issued for a given computer.
The solution is used most often the third option should be used only for testing and demonstrations.
It's the shared secret verification the shared secret is a string of characters recognized by every
computer that is to take part in IP communication
establishing a secure channel consist of the exchange of challenge response messages
challenge response protocols are widely used for remote authentication of both computers and users.
This is also how the L-M and TLM protocols the two protocols which we'll discuss later on work the underlying
principle is the same difference is concerned only technical details one party must generate a pseudo
random challenge message and send it to the computer it wants to exchange data with the receiver should
be able to use the challenge to calculate a response and send it back the response when decrypted should
verify or authenticate the identity of the remote host.
For this the shared secret is used.
It can be the short secret certificate and a public key or a password that would start up a computer
in the Active Directory
an important feature of the IP is that it allows mutual authentication.
It requires both parties to authenticate or prove their identities both parties must be sure who they
exchange data with
phase two is relatively simple.
It consists of confirming or changing and then goshi had a Security Association and generating new session
keys.
Let's see how in the simplest case the configuration of IP could look will learn how to do it in Windows
7 in Windows 7.
You should use that and then see a console to perform all administrative operations.
Then this operating system the IP was integrated with the network connection firewall.
Therefore you need to find the local computer tools that allow you to configure the security policies
of the network firewall.
In practice this type of operation will affect all the computers in the group what's defined the settings
will apply to all the computers that are members of the group.
In this version of Windows the IP policies are set as part of the firewall configuration in earlier
Windows systems.
The IP policies could be configured independently of the firewall policies but resulted in many people
accidentally blocking communications between computers.
Users often created conflicting rules.
The first question of the wizard concerns the type of rule you're creating as you can see the IP set
can be successfully used to block certain hosts with the IP sic.
You can completely block data from sudden that X or some that y.
In our demonstration we will try to create a rule allowing secure exchange of data
now you need to specify which computers this rule will apply to in the simplest case.
Both fields can be left blank which means that the rule will be universal.
The customize option allows us to choose a type of interface.
The next question is critical when it comes to the security of our rule.
The default option request means that an attempt to negotiate the IP security associations will be made.
However if the other party does not agree to the negotiated Security Association the data will be sent
as a clear text in all wizards.
The request option makes it possible we're not required to negotiate security associations
The require option on the other hand means that if the other party does not agree to negotiate as security
mechanisms the communication will not take place.
The next step is to select the remote host authentication method.
This can be a certificate issued for the computer or after selecting the advanced option.
A computer account in the domain each computer and each user as well has an account in the Active Directory
domain this account is password protected and the passwords are regularly changed
and method is authentication with a pre-shared key.
It's not recommended to use this option everything you type in this box will be visible to anyone who
will create a similar solution in the future.
You can define more than one authentication method.
This is connected to the security associations negotiation we mentioned earlier.
If an attempt to negotiate one of the mechanisms fails the next one will be tried out
the next step is to determine whether the rule being created is to apply to private public or corporate
networks.
At the end you type the name of the rule
we've created a rule which is by default enabled.
It protects both inbound and outbound connections.
This is a very general rule.
In practice such rules are hardly ever created.
It applies to all kinds of protocols.
The rule enforces the authentication of the remote host by checking whether it recognizes the information
we've provided in the wizard.
It affects networks of all types theoretically the principles behind the IP stack may seem uncomplicated
the implementation of this protocol is very simplified in the domain environment where we can use kerberos
the wizard We have just gone through also greatly simplifies the implementation of the rules.
However the fact remains that the implementation of a set of rules that effectively protects the communication
with various servers requires thorough planning of the whole mechanism.