Introduction to Labeled Networking on Linux
|
|
|
- Austin Pierce
- 10 years ago
- Views:
Transcription
1 Introduction to Labeled Networking on Linux Paul Moore 2008 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice
2 Agenda Labeled Networking Basics Types of Labeled Networking Secmark NetLabel Labeled IPsec Linux Security Modules and Labeled Networking SELinux Smack Labeled Networking Development 2 July 2008
3 Labeled Networking Basics 3 July 2008
4 Labeled Networking Introduction Labeled networking is a form of network access control based on security labels Security labels assigned to network traffic Labels represent both network and security attributes Network traffic identified by its security label Security policy applied to network traffic Defines access rights for network traffic and applications Integrates network access controls into the Linux Security Module (LSM) mechanism Requires a labeled security implementation SELinux Smack 4 July 2008
5 Labeled Networking on Linux Linux supports two different network label types Secmark labels represent network attributes Netfilter/iptables used to assign labels to packets based on Netfilter matching rules Peer labels represent sender's security attributes Labeling protocols convey the sender's security label across the network Labeled networking support varies by LSM SELinux Supports both secmark and peer network labels Smack Supports Peer network labels 5 July 2008
6 Secmark Network Labels Secmark labels are locally assigned based on network attributes Netfilter/iptable rule matching is used to assign secmark labels to network packets Flexible assignment of labels using existing Netfilter packet matching and connection tracking Single secmark packet labeling mechanism can be shared across multiple LSMs Does not require any external infrastructure Secmark labels are assigned locally, no labeling protocol needed Integrates traditional Linux firewall functionality with the LSM security model 6 July 2008
7 Peer Network Labels Peer labels are assigned based on the security attributes of the sender Labeling protocols convey security attributes Commercial IP Security Option (CIPSO) Labeled IPsec Protocol support is required for full functionality Fallback peer label support for unlabeled networks Two peer labeling mechanisms available NetLabel framework Labeled IPsec Extends the LSMs labeled security model across the network 7 July 2008
8 Secmark 8 July 2008
9 Secmark Labeling Labeling individual packets Command format iptables -t mangle -A <CHAIN> <RULES> -j SECMARK \ --selctx <SECMARK_LABEL> CHAIN : Netfilter/iptables chain RULES : Netfilter/iptables traffic matching rules SECMARK_LABEL : Secmark label Example iptables -t mangle -A INPUT -p tcp --dport 22 \ -j SECMARK --selctx system_u:object_r:ssh_packet_t:s0 Label an entire connection Traditional Netfilter connection marking using CONNSECMARK 9 July 2008
10 NetLabel 10 July 2008
11 NetLabel Framework NetLabel is a labeled networking framework Designed for multiple LSMs and protocols Provides interoperable labeled networking CIPSO protocol provides labeled networking interoperability with other Trusted OSs Trusted Solaris, HP-UX CMW, and others Limited to Multi-Level Security (MLS) attributes Provides fallback network peer labels Peer labels for systems without protocol support Allows peer labels to be assigned to both single hosts and entire networks Supports the full LSM security label 11 July 2008
12 CIPSO Configuration Define a CIPSO Domain of Interpretation (DOI) Command format netlabelctl cipsov4 add pass doi:<doi> tags:<tag_list> DOI : CIPSO DOI number TAG_LIST : Comma delimited list of CIPSO tag numbers Example netlabelctl cipsov4 add pass doi:8 tags:1,5,2 Map a CIPSO DOI configuration to a LSM domain Command format netlabelctl map domain:<domain> protocol:cipsov4,<doi> DOMAIN : LSM domain string DOI : CIPSO DOI number Example netlabelctl map domain:ping_t protocol:cipsov4,8 12 July 2008
13 Fallback Peer Label Configuration Define a CIPSO Domain of Interpretation (DOI) Command format netlabelctl unlbl add interface:<iface> address:<addr> \ label:<peer_label> IFACE : Network interface ADDR: Network address with optional mask PEER_LABEL: Fallback peer label Example netlabelctl unlbl add interface:eth0 \ address: /16 \ label:system_u:object_r:netlabel_peer_t:s0 13 July 2008
14 Labeled IPsec 14 July 2008
15 Labeled IPsec IPsec Security Associations (SA) assign peer labels to network traffic Peer labels transfered between systems during IKE exchange Network traffic is implicitly labeled by matching SAs Provides peer labeling with packet level encryption and authentication Interoperability limited to SELinux systems Requires SELinux specific IKE extensions Conflicts with Explicit Congestion Notification (ECN) Supports the full SELinux security label 15 July 2008
16 Labeled IPsec Configuration Create a Labeled IPsec policy Command format echo spdadd <SOURCE> <DEST> any -ctx 1 1 \ system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023 -P <POLICY> setkey -c SOURCE : Source IP address DEST : Destination IP address POLICY : IPsec policy Example echo spdadd any -ctx 1 1 \ system_u:object_r:ipsec_spd_t:s0-s15:c0.c1023 -P in esp/transport//require setkey -c Labeled SAs created on demand by the IKE daemon 16 July 2008
17 SELinux Labeled Networking 17 July 2008
18 Labeled Networking in SELinux SELinux supports all of the Linux labeled networking mechanisms Secmark NetLabel CIPSO support for IPv4 Fallback peer label support for IPv4 and IPv6 Labeled IPsec support for IPv4 and IPv6 Consolidated NetLabel and Labeled IPsec labels Peer labels must be equivalent to be allowed Dynamic labeled network access controls Access checks only enabled when needed by configuration 18 July 2008
19 Inbound Locally Destined Traffic Network labeling points NetLabel or Labeled IPsec provides peer label Netfilter configuration provides secmark label Network traffic access control points 1.Traffic with peer label allowed to enter the system via the inbound interface? 2.Traffic with peer label allowed to enter the system from the traffic's source address? 3.Socket allowed to receive traffic with peer label? 4.Socket allowed to receive traffic with secmark label? 19 July 2008
20 Outbound Locally Generated Traffic Network labeling points Peer label taken from the sending socket Netfilter configuration provides secmark label Network traffic access control points 1.Socket allowed to send traffic with secmark label? 2.Traffic with peer label allowed to exit the system via the outbound interface? 3.Traffic with peer label allowed to exit the system with the traffic's destination address? 20 July 2008
21 Inbound Forwarded Traffic Network labeling points NetLabel or Labeled IPsec provides peer label Netfilter configuration provides secmark label based on inbound packet Inbound traffic access control points 1.Traffic with peer label allowed to enter the system via the inbound interface? 2.Traffic with peer label allowed to enter the system from the traffic's source address? 3.Traffic with peer label allowed to be forwarded with (inbound) secmark label? 21 July 2008
22 Outbound Forwarded Traffic Network labeling points NetLabel or Labeled IPsec provides peer label Netfilter configuration provides secmark label based on outbound packet Outbound traffic access control points 1.Traffic with peer label allowed to be forwarded with (outbound) secmark label? 2.Traffic with peer label allowed to exit the system via the outbound interface? 3.Traffic with peer label allowed to exit the system with the traffic's destination address? 22 July 2008
23 Smack Labeled Networking 23 July 2008
24 Labeled Networking in Smack Smack currently provides limited labeled networking support NetLabel CIPSO support for IPv4 Fallback label support for IPv4 and IPv6 Not configurable using native Smack tools Smack network access control points limited to local network traffic Smack labeled networking functionality is expected to improve as Smack matures Smack first included in kernel July 2008
25 Traffic Control Points Local network traffic Inbound network traffic access checks Network labeling points NetLabel provides peer label Inbound traffic access control point Traffic with peer label allowed to write to the receiving socket? Outbound network traffic access checks Traffic is labeled based on originating socket No access control is applied to outbound traffic Forwarded network traffic No labeling or access control 25 July 2008
26 Labeled Networking Development 26 July 2008
27 Recent Labeled Networking Work NetLabel and Labeled IPsec consolidation Unified network peer label and access controls Easier SELinux policy development New network ingress and egress controls Access control for local and forwarded traffic Access control for physical network interfaces, subnetworks, and individual hosts New fallback peer labels for unlabeled traffic Peer labels when protocol support is missing Assign a single peer label to an entire network or a single host 27 July 2008
28 Planned Labeled Networking Work NetLabel traffic labeling based on sender's LSM domain and destination address Currently based only on sender's LSM domain Improved loopback peer labeling Extend NetLabel/CIPSO to support native LSM labels for loopback traffic Labeled IPsec is slow and problematic over loopback Standards body efforts IETF CALIPSO specification Multi-Level Security (MLS) labeling protocol for IPv6 Starting point for a generic peer labeling protocol IETF Labeled IPsec specification 28 July 2008
29 More Information NetLabel Website SELinux Wiki Smack Website Presenter's 29 July 2008
30 30 July 2008
Netfilter. GNU/Linux Kernel version 2.4+ Setting up firewall to allow NIS and NFS traffic. January 2008
Netfilter GNU/Linux Kernel version 2.4+ Setting up firewall to allow NIS and NFS traffic January 2008 Netfilter Features Address Translation S NAT, D NAT IP Accounting and Mangling IP Packet filtering
CSCI 454/554 Computer and Network Security. Topic 8.1 IPsec
CSCI 454/554 Computer and Network Security Topic 8.1 IPsec Outline IPsec Objectives IPsec architecture & concepts IPsec authentication header IPsec encapsulating security payload 2 IPsec Objectives Why
+ iptables. packet filtering && firewall
+ iptables packet filtering && firewall + what is iptables? iptables is the userspace command line program used to configure the linux packet filtering ruleset + a.k.a. firewall + iptable flow chart what?
Firewalls. Chien-Chung Shen [email protected]
Firewalls Chien-Chung Shen [email protected] The Need for Firewalls Internet connectivity is essential however it creates a threat vs. host-based security services (e.g., intrusion detection), not cost-effective
CS 5410 - Computer and Network Security: Firewalls
CS 5410 - Computer and Network Security: Firewalls Professor Kevin Butler Fall 2015 Firewalls A firewall... is a physical barrier inside a building or vehicle, designed to limit the spread of fire, heat
CSC574 - Computer and Network Security Module: Firewalls
CSC574 - Computer and Network Security Module: Firewalls Prof. William Enck Spring 2013 1 Firewalls A firewall... is a physical barrier inside a building or vehicle, designed to limit the spread of fire,
CSE543 - Computer and Network Security Module: Firewalls
CSE543 - Computer and Network Security Module: Firewalls Professor Trent Jaeger Fall 2010 1 Firewalls A firewall... is a physical barrier inside a building or vehicle, designed to limit the spread of fire,
Creating a Gateway to Gateway VPN between Sidewinder G2 and Linux
A PPLICATION N O T E Creating a Gateway to Gateway VPN between Sidewinder G2 and Linux This application note describes how to set up an IPsec VPN connection between a Linux host and a Sidewinder G2 Security
Intro to Linux Kernel Firewall
Intro to Linux Kernel Firewall Linux Kernel Firewall Kernel provides Xtables (implemeted as different Netfilter modules) which store chains and rules x_tables is the name of the kernel module carrying
How To Set Up An Ip Firewall On Linux With Iptables (For Ubuntu) And Iptable (For Windows)
Security principles Firewalls and NAT These materials are licensed under the Creative Commons Attribution-Noncommercial 3.0 Unported license (http://creativecommons.org/licenses/by-nc/3.0/) Host vs Network
Protocol Security Where?
IPsec: AH and ESP 1 Protocol Security Where? Application layer: (+) easy access to user credentials, extend without waiting for OS vendor, understand data; (-) design again and again; e.g., PGP, ssh, Kerberos
Linux MDS Firewall Supplement
Linux MDS Firewall Supplement Table of Contents Introduction... 1 Two Options for Building a Firewall... 2 Overview of the iptables Command-Line Utility... 2 Overview of the set_fwlevel Command... 2 File
Michal Ludvig, SUSE Labs, 01/30/2004, Secure networking, 1
Michal Ludvig, SUSE Labs, 01/30/2004, Secure networking, 1 Communication between User and Server: In the form of packets. Traverse several Routers. Can be intercepted by a BadBoy. Michal Ludvig, SUSE Labs,
CS 5410 - Computer and Network Security: Firewalls
CS 5410 - Computer and Network Security: Firewalls Professor Patrick Traynor Spring 2015 Firewalls A firewall... is a physical barrier inside a building or vehicle, designed to limit the spread of fire,
Track 2 Workshop PacNOG 7 American Samoa. Firewalling and NAT
Track 2 Workshop PacNOG 7 American Samoa Firewalling and NAT Core Concepts Host security vs Network security What is a firewall? What does it do? Where does one use it? At what level does it function?
1:1 NAT in ZeroShell. Requirements. Overview. Network Setup
1:1 NAT in ZeroShell Requirements The version of ZeroShell used for writing this document is Release 1.0.beta11. This document does not describe installing ZeroShell, it is assumed that the user already
Linux Firewall Wizardry. By Nemus
Linux Firewall Wizardry By Nemus The internet and your server So then what do you protect your server with if you don't have a firewall in place? NetFilter / Iptables http://www.netfilter.org Iptables
PowerLink Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions
Bandwidth Aggregation Redundant WAN Link and VPN Fail-Over Solutions Find your network example: 1. Basic network with and 2 WAN lines - click here 2. Add a web server to the LAN - click here 3. Add a web,
TECHNICAL NOTES. Security Firewall IP Tables
Introduction Prior to iptables, the predominant software packages for creating Linux firewalls were 'IPChains' in Linux 2.2 and ipfwadm in Linux 2.0, which in turn was based on BSD's ipfw. Both ipchains
APNIC elearning: IPSec Basics. Contact: [email protected]. esec03_v1.0
APNIC elearning: IPSec Basics Contact: [email protected] esec03_v1.0 Overview Virtual Private Networks What is IPsec? Benefits of IPsec Tunnel and Transport Mode IPsec Architecture Security Associations
Matthew Rossmiller 11/25/03
Firewall Configuration for L inux A d m inis trators Matthew Rossmiller 11/25/03 Firewall Configuration for L inux A d m inis trators Review of netfilter/iptables Preventing Common Attacks Auxiliary Security
Advanced routing scenarios POLICY BASED ROUTING: CONCEPTS AND LINUX IMPLEMENTATION
Advanced routing scenarios POLICY BASED ROUTING: CONCEPTS AND LINUX IMPLEMENTATION What is wrong with standard IP forwarding? The IP forwarding algorithm selects the route according to the destination
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Red Hat Docs > Manuals > Red Hat Enterprise Linux Manuals > Red Hat Enterprise Linux 4: Security Guide Chapter 7. Firewalls http://www.redhat.com/docs/manuals/enterprise/rhel-4-manual/security-guide/ch-fw.html
Networking in NSA Security-Enhanced Linux
Networking in NSA Security-Enhanced Linux James Morris Abstract Break through the complexity of SE Linux with a working example that shows how to add SE Linux protection to a simple network server. This
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance
Virtual Private Network VPN IPSec Testing: Functionality Interoperability and Performance Johnnie Chen Project Manager of Network Security Group Network Benchmarking Lab Network Benchmarking Laboratory
Main functions of Linux Netfilter
Main functions of Linux Netfilter Filter Nat Packet filtering (rejecting, dropping or accepting packets) Network Address Translation including DNAT, SNAT and Masquerading Mangle General packet header modification
Module: Firewalls. Professor Patrick McDaniel Spring 2009. CMPSC443 - Introduction to Computer and Network Security
CMPSC443 - Introduction to Computer and Network Security Module: Firewalls Professor Patrick McDaniel Spring 2009 1 Firewalls A firewall... is a physical barrier inside a building or vehicle, designed
Virtual Private Network (VPN)
Configuration Guide 5991-2120 April 2005 Virtual Private Network (VPN) VPN Using Preset Keys, Mode Config, and Manual Keys This Configuration Guide is designed to provide you with a basic understanding
Optimisacion del ancho de banda (Introduccion al Firewall de Linux)
Optimisacion del ancho de banda (Introduccion al Firewall de Linux) Christian Benvenuti [email protected] Managua, Nicaragua, 31/8/9-11/9/9 UNAN-Managua Before we start... Are you familiar
How To Industrial Networking
How To Industrial Networking Prepared by: Matt Crites Product: Date: April 2014 Any RAM or SN 6xxx series router Legacy firmware 3.14/4.14 or lower Subject: This document provides a step by step procedure
Firewall Troubleshooting
Firewall Troubleshooting (Checkpoint Specific) For typical connectivity issues where a firewall is in question follow these steps to eliminate any issues relating to the firewall. Firewall 1. From the
This section provides a summary of using network location profiles to identify network connection types. Details include:
Module 7 Network Access and Security In Module 7 students will learn several strategies for controlling network access and enhancing network security. These will include: controlling network location profiles,
Linux firewall. Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users
Linux firewall Need of firewall Single connection between network Allows restricted traffic between networks Denies un authorized users Linux firewall Linux is a open source operating system and any firewall
Managing Multiple Internet Connections with Shorewall
Managing Multiple Internet Connections with Shorewall Tom Eastep Linuxfest Northwest April 24-25, 2010 http://www.shorewall.net Agenda Introduction Routing Refresher Introduction to Policy Routing Policy
Configuring Personal Firewalls and Understanding IDS. Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA
Configuring Personal Firewalls and Understanding IDS Securing Networks Chapter 3 Part 2 of 4 CA M S Mehta, FCA 1 Configuring Personal Firewalls and IDS Learning Objectives Task Statements 1.4 Analyze baseline
Configuring an IPsec VPN to provide ios devices with secure, remote access to the network
Configuring an IPsec VPN to provide ios devices with secure, remote access to the network This recipe uses the IPsec VPN Wizard to provide a group of remote ios users with secure, encrypted access to the
Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance
CHAPTER 4 Configuring Switch Ports and VLAN Interfaces for the Cisco ASA 5505 Adaptive Security Appliance This chapter describes how to configure the switch ports and VLAN interfaces of the ASA 5505 adaptive
Network Security Management
Network Security Management TWNIC 2003 Objective Have an overview concept on network security management. Learn how to use NIDS and firewall technologies to secure our networks. 1 Outline Network Security
THE HONG KONG POLYTECHNIC UNIVERSITY Department of Electronic and Information Engineering
THE HONG KONG POLYTECHNIC UNIVERSITY Department of Electronic and Information Engineering ENG 224 Information Technology Laboratory 6: Internet Connection Sharing Objectives: Build a private network that
HP Load Balancing Module
HP Load Balancing Module Load Balancing Configuration Guide Part number: 5998-2685 Document version: 6PW101-20120217 Legal and notice information Copyright 2012 Hewlett-Packard Development Company, L.P.
Leveraging IPsec for Mandatory Per-Packet Access Control
Leveraging IPsec for Mandatory Per-Packet Access Control Trent Jaeger David H. King Kevin R. Butler Serge Hallyn Joy Latten Xiaolan Zhang Systems and Internet Infrastructure Lab, Pennsylvania State University
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS)
Firewalls, NAT and Intrusion Detection and Prevention Systems (IDS) Internet (In)Security Exposed Prof. Dr. Bernhard Plattner With some contributions by Stephan Neuhaus Thanks to Thomas Dübendorfer, Stefan
Definition of firewall
Internet Firewalls Definitions: firewall, policy, router, gateway, proxy NAT: Network Address Translation Source NAT, Destination NAT, Port forwarding NAT firewall compromise via UPnP/IGD Packet filtering
Chapter 4 Virtual Private Networking
Chapter 4 Virtual Private Networking This chapter describes how to use the virtual private networking (VPN) features of the FVL328 Firewall. VPN tunnels provide secure, encrypted communications between
CIS 433/533 - Computer and Network Security Firewalls
CIS 433/533 - Computer and Network Security Firewalls Professor Kevin Butler Winter 2011 Computer and Information Science Firewalls A firewall... is a physical barrier inside a building or vehicle, designed
IP Address: the per-network unique identifier used to find you on a network
Linux Networking What is a network? A collection of devices connected together Can use IPv4, IPv6, other schemes Different devices on a network can talk to each other May be walls to separate different
ipchains and iptables for Firewalling and Routing
ipchains and iptables for Firewalling and Routing Jeff Muday Instructional Technology Consultant Department of Biology, Wake Forest University The ipchains utility Used to filter packets at the Kernel
Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik
Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and
Virtual Private Networks
Virtual Private Networks ECE 4886 Internetwork Security Dr. Henry Owen Definition Virtual Private Network VPN! Virtual separation in protocol provides a virtual network using no new hardware! Private communication
Firewall. IPTables and its use in a realistic scenario. José Bateira ei10133 Pedro Cunha ei05064 Pedro Grilo ei09137 FEUP MIEIC SSIN
Firewall IPTables and its use in a realistic scenario FEUP MIEIC SSIN José Bateira ei10133 Pedro Cunha ei05064 Pedro Grilo ei09137 Topics 1- Firewall 1.1 - How they work? 1.2 - Why use them? 1.3 - NAT
Assignment 3 Firewalls
LEIC/MEIC - IST Alameda ONLY For ALAMEDA LAB equipment Network and Computer Security 2013/2014 Assignment 3 Firewalls Goal: Configure a firewall using iptables and fwbuilder. 1 Introduction This lab assignment
Open Source Bandwidth Management: Introduction to Linux Traffic Control
Open Source Bandwidth Management: Introduction to Linux Traffic Control Christian Benvenuti International Centre for Theoretical Physics (ICTP), Trieste [email protected] [http://benve.info]
Skywire TCP Socket Examples
Skywire TCP Socket Examples NimbeLink, LLC Published: April 2014 PN 30015 rev 1 NimbeLink, LLC All Rights Reserved. 1 1. TCP SOCKET OPERATIONS The following examples illustrate a few TCP socket operations
How To Understand A Firewall
Module II. Internet Security Chapter 6 Firewall Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 6.1 Introduction to Firewall What Is a Firewall Types of Firewall
Linux MPS Firewall Supplement
Linux MPS Firewall Supplement First Edition April 2007 Table of Contents Introduction...1 Two Options for Building a Firewall...2 Overview of the iptables Command-Line Utility...2 Overview of the set_fwlevel
Policy Based Network Management of a Differentiated Services domain using the Common Open Policy Service protocol
Policy Based Network Management of a Differentiated Services domain using the Common Open Policy Service protocol Adam Burke, Neco Ventura Department of Electrical Engineering, University of Cape Town,
Firewall Examples. Using a firewall to control traffic in networks
Using a firewall to control traffic in networks 1 1 Example Network 1 2 1.0/24 1.2.0/24.4 1.0.0/16 Rc 5.6 4.0/24 2 Consider this example internet which has: 6 subnets (blue ovals), each with unique network
PktFilter A Win32 service to control the IPv4 filtering driver of Windows 2000/XP/Server 2003 http://sourceforge.net/projects/pktfilter/
PktFilter A Win32 service to control the IPv4 filtering driver of Windows 2000/XP/Server 2003 http://sourceforge.net/projects/pktfilter/ Jean-Baptiste Marchand [email protected] Contents 1
Chapter 32 Internet Security
Chapter 32 Internet Security Copyright The McGraw-Hill Companies, Inc. Permission required for reproduction or display. Chapter 32: Outline 32.1 NETWORK-LAYER SECURITY 32.2 TRANSPORT-LAYER SECURITY 32.3
UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004
[CRT14] UNIVERSITY OF BOLTON CREATIVE TECHNOLOGIES COMPUTING AND NETWORK SECURITY SEMESTER TWO EXAMINATIONS 2014/2015 NETWORK SECURITY MODULE NO: CPU6004 Date: Wednesday 27 th May 2015 Time: 14:00 16:00
Manuale Turtle Firewall
Manuale Turtle Firewall Andrea Frigido Friweb snc Translator: Emanuele Tatti Manuale Turtle Firewall by Andrea Frigido Translator: Emanuele Tatti Published 2002 Copyright 2002, 2003 by Friweb snc, Andrea
Internet Protocol Security (IPSec)
CHAPTER 1 Internet Protocol Security (IPSec) Introduction Internet Protocol Security (IPSec) provides application-transparent encryption services for IP network traffic as well as other network access
Firewalls P+S Linux Router & Firewall 2013
Firewalls P+S Linux Router & Firewall 2013 Firewall Techniques What is a firewall? A firewall is a hardware or software device which is configured to permit, deny, or proxy data through a computer network
Load Balancing SIP Quick Reference Guide v1.3.1
Load Balancing SIP Quick Reference Guide v1.3.1 About this Guide This guide provides a quick reference for setting up SIP load balancing using Loadbalancer.org appliances. SIP Ports Port Protocol 5060
Stateful Firewalls. Hank and Foo
Stateful Firewalls Hank and Foo 1 Types of firewalls Packet filter (stateless) Proxy firewalls Stateful inspection Deep packet inspection 2 Packet filter (Access Control Lists) Treats each packet in isolation
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A
Firewalls N E T W O R K ( A N D D ATA ) S E C U R I T Y 2 01 5 / 2 01 6 P E D R O B R A N D Ã O M A N U E L E D U A R D O C O R R E I A Slides are based on slides by Dr Lawrie Brown (UNSW@ADFA) for Computer
Network Security Exercise 10 How to build a wall of fire
Network Security Exercise 10 How to build a wall of fire Tobias Limmer, Christoph Sommer, David Eckhoff Computer Networks and Communication Systems Dept. of Computer Sciences, University of Erlangen-Nuremberg,
Lab14.8.1 Configure a PIX Firewall VPN
Lab14.8.1 Configure a PIX Firewall VPN Complete the following lab exercise to practice what you learned in this chapter. Objectives In this lab exercise you will complete the following tasks: Visual Objective
Worksheet 9. Linux as a router, packet filtering, traffic shaping
Worksheet 9 Linux as a router, packet filtering, traffic shaping Linux as a router Capable of acting as a router, firewall, traffic shaper (so are most other modern operating systems) Tools: netfilter/iptables
Configuring IPsec VPN with a FortiGate and a Cisco ASA
Configuring IPsec VPN with a FortiGate and a Cisco ASA The following recipe describes how to configure a site-to-site IPsec VPN tunnel. In this example, one site is behind a FortiGate and another site
Access Control Lists: Overview and Guidelines
Access Control Lists: Overview and Guidelines Cisco provides basic traffic filtering capabilities with access control lists (also referred to as access lists). Access lists can be configured for all routed
ICS 351: Today's plan. IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration
ICS 351: Today's plan IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration IP address exhaustion IPv4 addresses are 32 bits long so there
Lecture Objectives. Lecture 6 Mobile Networks: Nomadic Services, DHCP, NAT, and VPNs. Agenda. Nomadic Services. Agenda. Nomadic Services Functions
Lecture Objectives Wireless Networks and Mobile Systems Lecture 6 Mobile Networks: Nomadic Services, DHCP, NAT, and VPNs Describe the role of nomadic services in mobile networking Describe the objectives
DEVICE DRIVERS AND TERRUPTS SERVICE MECHANISM Lesson-14: Device types, Physical and Virtual device functions
DEVICE DRIVERS AND TERRUPTS SERVICE MECHANISM Lesson-14: Device types, Physical and Virtual device functions 1 Device Types For each type of device, there is a set of the generic commands. For example,
OS/390 Firewall Technology Overview
OS/390 Firewall Technology Overview Washington System Center Mary Sweat E - Mail: [email protected] Agenda Basic Firewall strategies and design Hardware requirements Software requirements Components of
TLS and SRTP for Skype Connect. Technical Datasheet
TLS and SRTP for Skype Connect Technical Datasheet Copyright Skype Limited 2011 Introducing TLS and SRTP Protocols help protect enterprise communications Skype Connect now provides Transport Layer Security
Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1
Configure an IPSec Tunnel between a Firebox Vclass & a Check Point FireWall-1 This document describes how to configure an IPSec tunnel between a WatchGuard Firebox Vclass appliance (Vcontroller version
TECHNICAL NOTE. Technical Note P/N 300-999-649 REV 03. EMC NetWorker Simplifying firewall port requirements with NSR tunnel Release 8.
TECHNICAL NOTE EMC NetWorker Simplifying firewall port requirements with NSR tunnel Release 8.0 and later Technical Note P/N 300-999-649 REV 03 February 6, 2014 This technical note describes how to configure
Dr. Arjan Durresi. Baton Rouge, LA 70810 [email protected] These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601_07/
Set of Problems 2 Dr. Arjan Durresi Louisiana State University Baton Rouge, LA 70810 [email protected] These slides are available at: http://www.csc.lsu.edu/~durresi/csc4601_07/ Louisiana State University
Protecting and controlling Virtual LANs by Linux router-firewall
Protecting and controlling Virtual LANs by Linux router-firewall Tihomir Katić Mile Šikić Krešimir Šikić Faculty of Electrical Engineering and Computing University of Zagreb Unska 3, HR 10000 Zagreb, Croatia
Ulogd2, Advanced firewall logging
Ulogd2, Advanced firewall logging INL 172 rue de Charonne 75011 Paris, France RMLL 2009, July 8, Nantes Ulogd2, Netfilter logging reloaded 1/ 38 Some words about me NuFW main developper INL co-founder
Introduction to Firewalls
Introduction to Firewalls Today s Topics: Types of firewalls Packet Filtering Firewalls Application Level Firewalls Firewall Hardware/Software IPChains/IPFilter/Cisco Router ACLs Firewall Security Enumeration
Approaches to Multicast over Firewalls: an Analysis
Approaches to Multicast over Firewalls: an Analysis Loïc Oria [email protected] August 1999 1 Introduction Most commercial organisations, and increasingly even universities, use firewalls to constrain
BorderWare Firewall Server 7.1. Release Notes
BorderWare Firewall Server 7.1 Release Notes BorderWare Technologies is pleased to announce the release of version 7.1 of the BorderWare Firewall Server. This release includes following new features and
Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting
Catalyst 6500/6000 Switches NetFlow Configuration and Troubleshooting Document ID: 70974 Introduction Prerequisites Requirements Components Used Conventions Background Information Configure Network Diagram
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds [email protected] What is Firewall? A firewall
Case Study for Layer 3 Authentication and Encryption
CHAPTER 2 Case Study for Layer 3 Authentication and Encryption This chapter explains the basic tasks for configuring a multi-service, extranet Virtual Private Network (VPN) between a Cisco Secure VPN Client
Cisco Which VPN Solution is Right for You?
Table of Contents Which VPN Solution is Right for You?...1 Introduction...1 Before You Begin...1 Conventions...1 Prerequisites...1 Components Used...1 NAT...2 Generic Routing Encapsulation Tunneling...2
Secure use of iptables and connection tracking helpers
Secure use of iptables and connection tracking helpers Authors: Eric Leblond, Pablo Neira Ayuso, Patrick McHardy, Jan Engelhardt, Mr Dash Four Introduction Principle of helpers Some protocols use different
CIT 480: Securing Computer Systems. Firewalls
CIT 480: Securing Computer Systems Firewalls Topics 1. What is a firewall? 2. Types of Firewalls 1. Packet filters (stateless) 2. Stateful firewalls 3. Proxy servers 4. Application layer firewalls 3. Configuring
1 Attack Top Attackers Report, Top Targets Report, Top Protocol Used by Attack Report, Top Attacks Report, Top Internal Attackers Report, Top External Attackers Report, Top Internal Targets Report, Top
Network Security Part II: Standards
Network Security Part II: Standards Raj Jain Washington University Saint Louis, MO 63131 [email protected] These slides are available on-line at: http://www.cse.wustl.edu/~jain/cse473-05/ 18-1 Overview
Chapter 9. IP Secure
Chapter 9 IP Secure 1 Network architecture is usually explained as a stack of different layers. Figure 1 explains the OSI (Open System Interconnect) model stack and IP (Internet Protocol) model stack.