Windows Server2008 Firewall Recommendations 3

[zoeythecat]

Hi All,

We have a Windows2003 native domain. I recently installed Windows2008 server as a member server in the domain. I had issues pinging (I realize I could make this a firewall exception)from other servers to this server. I turned off the firewall and all is well. We of course our behind a firewall already so do I really need this turned on?

I look forward to any opinions on this.

Thanks

 

[58sniper]

Yes. Security in layers.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[kmcferrin]

Absolutely. You have a firewall on your network that separates your network from the Internet. That's good, because there are a lot of threats that can come in from the Internet. However, every modern Windows-based PC and server also has a software firewall built into the OS (and many security/antivirus suites include them as well). Why? Because the Internet isn't your only attack vector. What happens if someone comes into your business with a laptop that is infected with something? Once they plug into your network (or log on via wireless) you're essentially wide open to whatever they have on their laptop. All it takes is for a malicious worm or virus to get onto one system on your network and it can quickly spread to everything in your network. However, if you are using the software firewall that is built into Windows then you can block a significant portion of the traffic that can be used to attack your systems.

For example, at a former employer we kept all of the servers on a different subnet from all of the desktops/laptops/wireless LANs. We configured software firewalls on all of the client devices to block all traffic from the client device subnets. There wasn't any need in our case for our end-users' PCs to be communicating directly with each other anyway, and after they were locked down we could prevent a virus from spreading if a single machine was compromised. Then we configured the servers to only allow connections on ports that were required for services that they offered. In other words, the ports used for CIFS file shares were only open on file servers, not DCs, Exchange servers, etc. Ports used for FTP were only open on servers than ran FTP services, and so on. We went even further by restricting inter-server communication. For example, while all of the client PCs needed to talk to the Exchange server and the file/print server, the Exchange server and the file/print server didn't need to talk to each other, so that traffic would be blocked.

It takes a fair amount of effort to identify the ports and services that are required for every application, but once you know what you need you can configure a group policy to apply that config to all of your PCs and servers automatically, and it is well worth it. While I worked for that company we would occasionally have single, isolated malware infections (like most businesses) but we never once had an outbreak where the malware spread to a second machine from the first.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCSE:Security 2003
MCITP:Enterprise Administrator

 

[zoeythecat]

Kmcferrin,

Great post. I do have it turned off for now. This will be our exhange2007 server eventually, so I will have to figure out what services I need to set as exceptions.

Thx

 

[58sniper]

Use the Security Configuration Wizard (SCW). I wrote a multipart series on SCW on Exchange 2007 that starts here:

http://www.petri.co.il/scw-for-exchange-server-2007-part-1.htm

And recently wrote a follow up at

http://www.ucblogs.net/blogs/exchan...07-SCW-files-and-Windows-Server-2008-SP2.aspx

that covers some issues with 2008 and the SCW for Exchange 2007.

The SCW can really help tighten up a servers attack surface.

And a star for kmcferrin for the great answer.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[zoeythecat]

Pat,

Thanks for the links on SCW.

Regards

 

[58sniper]

Not a problem. A note that if you're going to use SCW on a CCR cluster, read Nik's comments at the bottom of

http://msexchangeteam.com/archive/2009/03/05/450816.aspx.

They may come in handy.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[baddos]

In other words, the ports used for CIFS file shares were only open on file servers, not DCs, Exchange servers, etc.

What? Did you guys not use Group Policy or login scripts? Clients need read access to sysvol shares for those features.