Home / Network Equipment

Set Up Access Policies and Rules


Figure 5.18: Network connection model


According to this model, for each Internet connection method, the Proxy server uses 02 interfaces as follows:

Maybe you are interested!

- Internet connection via voice line via PSTN network:

01 communicates with the internal network via network card.

01 communicates with the Internet via Modem.

- Internet connection via direct line (Leased Line)

01 communicates with the internal network via network card

01 communicates with the Internet through another network card. At this time, the local address table (LAT-Local Address Table) is built based on the list of internal network IP addresses.

Medium-sized network connection model

The characteristics of a medium-sized office network are as follows:

- Central office with several LANs

- Each branch office has a LAN.

- Use IP protocol.

- Telephone connection from branch office to central office.

- Internet connection from central office to ISP by telephone line or direct line (Leased Line).

- Less than 2000 workstations

The network model is shown in Figure 5.19. According to this model, the branch office uses a Proxy server to provide local caching, connection management, and access control to the central office. At the central office, a number of Proxy servers operate in an array architecture to provide general security for the entire network, provide distributed caching, and provide connectivity to the Internet.


Figure 5.19: Network connection model


Large corporate networking model

The networks of large corporations are characterized by the following:

- The central office has multiple LANs and a LAN backbone.

- There are several branch offices, each branch office has a LAN.

- Use IP network protocol.

- Telephone connection from branch offices to central office.

- Internet connection from central office to ISP via direct line (Leased Line).

- There are more than 2000 workstations.

The network model is shown in Figure 5.20. According to this model, the network at branch offices is configured similarly to the model of medium-sized offices. Internet connection requests that are not met by the internal cache at the branch office's Proxy server will be forwarded to a series of Proxy servers operating in an array architecture at the central office. At the central office, the Proxy servers use 02 network interfaces (network cards), in which 01 network card communicates with the LAN backbone and 01 network card communicates with the member LAN.


Figure 5.20: Network connection model


2.2. Set up access policies and rules

1..The rules.

You can configure a proxy server to meet security and operational requirements by setting rules that determine whether and how users, computers, or applications can access computers on the network or on the Internet. Typically, a proxy server defines the following types of rules: access policy rules, bandwidth rules, broadcast policy rules, packet filtering features, and routing and chaining rules.

When a client on the network requests an object, the proxy server processes the rules to determine whether the request is acceptable or not. Similarly, when an external client (Internet) requests an object from a server on the network, the proxy server also processes the rules to determine whether the request is allowed or not.

Access policy rules: We can use proxy servers to set up policies that include protocol rules and content rules. Protocol rules define which protocols can be used for information between the internal network and the Internet. Protocol rules are processed at the application level. For example, a protocol rule might allow clients to use the HTTP protocol. Content rules define what content on which sites clients can access. Content rules are also processed at the application level. For example, a content rule might allow clients to access any address on the Internet.

Bandwidth Rules: Bandwidth rules determine which connections receive priority. In bandwidth control, the proxy server does not typically limit bandwidth. Rather, it specifies how quality of service (QoS) is prioritized for network connections. Typically, any connection without a bandwidth rule attached will receive the default priority, and any connection with a bandwidth rule attached will be prioritized over the default priority.

Advertising policy rules: We can use proxy servers to set up advertising policies, including server advertising rules and web advertising rules. Server and web advertising rules filter all requests coming from external (internet) client requests to servers on the network. Server and web advertising rules will route requests to the appropriate servers behind the proxy server.

Packet filtering: The packet filtering feature of a proxy server allows you to control the flow of IP packets to and from the proxy server. When packet filtering is active, all packets on the external interface are dropped unless they are explicitly allowed either statically by IP packet filters or dynamically by access or broadcast policies. Even if you do not leave packet filtering active, communication between the Internet and your local network is allowed as long as you explicitly set the rules for allowing access. In most cases, dynamic port opening is preferred. Therefore, it is often recommended that you set up access rules that allow internal clients to access the Internet or broadcast rules that allow external clients to access internal servers. This is because IP packet filters open statically by access policies and broadcast rules open ports dynamically. Suppose you want to grant all users on your network access to HTTP sites. You should not set up an IP packet filter to open port 80. You should set up site, content and protocol rules to allow this access. In some cases we will have to use IP packet filters, for example we should set up IP packet filters if we want to advertise our Servers to the outside.

Routing rules and proxy chaining configuration: are typically the last rules applied to route client requests to a server designated to service those requests.

2. Process outgoing requests

One of the main functions of a proxy server is the ability to connect a private network to the Internet while protecting the network from malicious content. To facilitate control of this connection, we use a proxy server to create an access policy that allows clients to access specific Internet servers, the access policy along with routing rules determine how clients access the Internet.

When a proxy server processes an outgoing request, the proxy server checks the routing rules, content rules, and protocol rules to determine whether access is allowed. The request is only allowed if both the content and protocol rules agree.

format, content and site rules allow it and if none of the rules deny the request.

Several rules can be set up to apply to specific clients. In this case, clients can be specified either by IP address or by user name. The proxy server processes requests differently depending on the type of client request and the proxy server settings. For a request, the rules are processed in the following order: protocol rules, content rules, IP packet filters, routing rules, or proxy chain configuration.

The figure below shows the processing of an outgoing request (figure 5.21).


Figure 5.21: Processing for an outgoing request


First, the proxy server checks the protocol rules, the proxy server accepts the request only if a protocol rule specifically accepts the request and no protocol rule rejects the request.

The proxy server then checks the content rules. The proxy server only accepts the request if a content rule accepts the request and no content rule rejects it.

The proxy server then checks to see if there is an IP packet filter set to reject the request to decide whether the request should be rejected.

Finally, the proxy server checks the routing rules to decide whether the request

how to be served

Suppose we install a proxy server on a computer with two connections, one to the Internet and one to a private network. We will give instructions to allow all clients access to all sites. In this case, the access policy is just the following rules: a protocol rule

allows all clients to use all protocols at all times. A content rule allows everyone to access all content on all sites at all times. Note that this rule allows clients to access the Internet but does not allow outside clients to access your network.

3. Handle incoming requests

Proxy servers can be set up so that internal servers can be securely accessed from external clients. We can use proxy servers to set up a secure advertising policy for servers on the network. The advertising policy (including IP packet filters, Web advertising rules, or Server advertising rules, along with routing rules) will determine how servers are advertised.

When a proxy server processes a request originating from an external client, it examines IP packet filters, advertising rules, and routing rules to decide whether the request should be processed and which internal server should process the request.


Figure 5.22: Processing incoming requests

Suppose that a proxy server is set up with two interfaces, one to the Internet and one to the private network. If packet filtering is enabled and then the IP packet filter rejects the request, the request is rejected. If the web advertisement rules reject the request, the request is also dropped. If a routing rule is set up that requires the request to be routed to an upstream server or a session master site, then that specified server will process the request. If a routing rule indicates that the request is routed to a specific server, then the internal web server will return the object.

2.3. Proxy clients and authentication methods

Proxy server access policies and advertising rules can be set up to allow or deny access to a particular server to a group of computers or users. If the rules are applied to individual users, the Proxy server checks the requested properties to determine how the user is authenticated.

You can set parameters for incoming and outgoing requests so that the user must be authenticated by the proxy server before the rules are processed. This ensures that requests are only allowed if the user making the request is authenticated. You can also set the authentication methods used and can set different authentication methods for incoming and outgoing requests. A proxy server typically supports the following authentication methods: basic authentication, Digest authentication, Microsoft windows integrated authentication, client authentication and server authentication.

Make sure that proxy client programs support one of the authentication methods offered by the proxy server. IE 5 and above support most authentication methods, some other browsers may only support basic authentication methods. Make sure that client browsers can support at least one of the authentication methods offered by the proxy server.

1. Basic authentication method.

This authentication method sends and receives user information as readable text characters. Normally, user name and password information is encrypted, but in this method, no encryption is used. The authentication process is described as follows, the proxy client prompts the user for a username and password, and this information is then sent by the client to the proxy server. Finally, the username and password are checked as an account on the proxy server.

2. Digest authentication method.

This method is similar to the basic authentication method but differs in the way the authentication information is passed. The authentication information goes through a one-way process commonly known as "hashing". The result of this process is called a hash or message digest and cannot be decrypted. The original information cannot be recovered from the hash. Information is added to the password before it is hashed so that no one can intercept the password and use it to impersonate the real user. Values ​​are added to help identify the user. A time stamp is also added to prevent the user from using a password after it has been destroyed. This is a clear advantage over the basic authentication method because an unauthorized user cannot intercept the password.

3. Integrated authentication method.

This method is used in Microsoft products. It is also the standard method of authentication because the username and password are not sent over the network. This method uses or communicates with

V5 Kerberos authentication protocol or its challenge/response authentication protocol.

4. Client authentication and server authentication

We can use SSL features for authentication. Authentication is used in two ways when a client requests an object from a server: the server authenticates itself by sending a server certificate to the client. The server requests that the client authenticate itself (In this case the client must present a matching client certificate to the server).

SSL authenticates by examining the contents of an encrypted digital certificate submitted by the proxy client during the login process (Users may obtain digital certificates from a highly trusted external organization). Server certificates include identifying information about the server. Client certificates typically include identifying information about the user and the organization issuing the certificate.

Client authentication: If client authentication is selected as the authentication method, the proxy server requires the client to send an authentication certificate before requesting an object. The proxy server receives the request and sends an authentication certificate to the client. The client receives this authentication certificate and checks whether it really belongs to the proxy server. The client sends its request to the proxy server, but the proxy server requests an authentication certificate from the client that was previously provided. The proxy server checks whether the authentication certificate really belongs to the client that is authorized to access it.

Server authentication: When a client requests an SSL object from a server, the client asks the server to authenticate itself. If a proxy server terminates an SSL connection, the proxy server must then authenticate itself to the client. We must set up and specify server-side certificates to use when authenticating the server to the client.

5. Pass-through authentication

Pass-though authentication refers to the ability of a proxy server to pass client authentication information to the destination server. A proxy server supports authentication for both outgoing and incoming requests. The following figure illustrates the pass-though authentication scenario.




Figure 5.23: Pass-through authentication

The client sends a request to retrieve an object on a web server to the proxy server. The proxy server forwards this request to the web server, from here the authentication begins through the following steps:

Comment


Agree Privacy Policy *