The next scenario that I want to talk about is managing Windows Firewall.
So let's dive into that.
Group policy provides Windows Firewall with advanced security.
Under the security settings path within computer configuration, the old way of configuring Windows
Firewall was actually within admin templates.
So if you had a Windows XP or Server 23 client, there was a section under admin templates for the computer
that lets you configure this that has been superseded by Windows Firewall with advanced security that
lets you configure the domain private and public profile states for the Windows firewall, whether it's
on or off.
It also lets you configure inbound rules, in other words, to what traffic is allowed inbound to machines
that process this firewall policy and outbound rules now.
So you can set rules on what traffic can go outbound from a machine which has interesting security implications
and also challenges as well as IP SEQ rules.
IP SEQ is a sort of tunneling protocol that allows you to securely traverse networks and provide tunnels
for encrypted traffic and windows.
Firewall with Advanced Security is your tool for configuring both Firewall and IPsec.
In this particular policy area.
Those IPsec rules are called connection rules.
Windows Firewall Profiles, which I talked about in the previous slide, are what you can use to have
different firewall behaviors depending on what kind of network you're on.
So the three firewall profiles that are represented in the policy are domain, private and public domain
being when you're on the corporate network.
In other words, you have a domain controller that's accessible to the client.
Private, meaning you're on your home network, which means it's a trusted network, but it's not your
work network.
And then public is pretty much everything else.
It's when you're in a cafe or on an airplane or in an airport and you're on essentially what is it,
the Wild West for wireless networks.
You can configure firewall on or off for each of those profiles as well as other postures based on each
of those different locations that you can be in.
This is really a good idea, especially for public networks.
If you do no other configuration of Windows Firewall, do one for public profile so that when your domain
join machines, go off network laptops and such are connecting at Starbucks, that you are controlling
what inbound traffic is able to get to those machines.
Let's talk a little bit more about inbound and outbound rules.
Inbound rules are definitely the most common.
This is what we had before Windows Firewall with advanced security in the XP days.
It's basically saying who can talk to the system, who can initiate traffic from externally to this
to this particular system that's processing policy?
Outbound rules are more interesting and more challenging because it it kind of assumes that, you know,
all of the outbound traffic going from a workstation to other sources on your network.
This is definitely easier to do if you're on a server with a predetermined workload instead of applications,
and you can more easily characterize the traffic of those applications to from the server to external
sources.
But it's a lot harder to do in a workstation world where you've got users running different applications
all the time that may have different protocol and port needs.
So I think, you know, outbound rolls are one of those thing where if you're going to go down the road
of host based firewall configuration, outbound rolls are sort of the next level of sophistication in
terms of doing that.
That rules can be set to be either allow or deny.
Once the firewall is turned on for a given profile.
In other words, let's say on the domain profile that the firewall is on, then all traffic is implicitly
denied inbound, but not outbound unless exceptions are defined.
That's important to understand that the default state when the firewall is on, is to deny all.
And you can create exception rules that allow specific traffic in.
But by large, everything else is denied.
This is just a kind of a UI that talks about how you create a rule.
And I'm going to show you this in a demo in the next session.
You define the thing that you want to block, and it could be a program, a port predefined or custom
rule.
You say whether it's allowed.
In other words, the action decides whether it's allow or deny.
And you tell it which profile the rule applies to.
Let's go ahead and dive in and do a demo of this Windows firewall capability so you can see sort of
how it works.