HP 635n Practical IPsec Deployment for Printing and Imaging Devices - Page 26

• Source IP: 192.168.0.1 • Destination IP: 192.168.0.25 • IP Protocol Type: TCP • Source Port: 11125 • Destination Port: 23 This packet doesn't match Rule 1, Rule 2, or Rule 3. Therefore it falls to the Default Rule which matches everything. Let's work through another example. Let's say the packet that IPsec intercepted has the following values: • Source IP: 192.168.0.1 • Destination IP: 192.168.0.25 • IP Protocol Type: TCP • Source Port: 11125 • Destination Port: 9100 This packet would match Rule 2. At this point, no more rules are processed by IPsec since we have a match on Rule 2. We'll we've covered a part of IPsec Policy - Packet Matching. Now, what happens when we have a match? IPsec performs the requested operation in the Action-on-Match column. IPsec Basics: IPsec Policy - Action-on-Match From Table 1, we can see that there are three primary actions: Drop, Allow without IPsec Protection, and Require IPsec Protection. Referring back to Figure 22, we can see that the Drop action essentially discards the packet. This packet never makes it to the Ethernet layer. This setting is useful to prevent unauthorized networking traffic from applications. The "Allow without IPsec Protection" allows a packet to proceed to the Ethernet layer as if it were never intercepted. In short, it is transmitted on the wire normally without the protections of IPsec. There are some situations where this behavior is required. For instance, there may be a service such as WINS that has many different clients, some supporting IPsec and some that do not. A network administrator may decide it is easier to not protect this protocol to prevent issues with devices that do not support IPsec. The IPsec policy gives them this flexibility. The most interesting action on match is the "Require IPsec Protection" action. The drivers for the parameters associated with IPsec would be an Information Protection Policy subset of the overall company's Security Policy. An extremely basic example of an Information Protection Policy: "When printing or digitally sending confidential or secret data documents on the company network (Intranet), a well regarded networking security protocol should be used that implements confidentiality, authentication, and integrity with cryptographic algorithms deemed highly secure as of Summer 2008. This policy will be forced through Active Directory policy distribution and the designation of sensitive data printing and imaging devices with reduced employee accessibility." We can see how the proper implementation of this policy would have protected the documents from Jane in our "case-study" example. Let's see how we would translate the general policy into something specific that IPsec can understand. Let's expand on Rule 2 from Table 1 and focus in on the appropriate columns in the IPsec Policy. 26