Connection Security Rules.
When we're talking about Windows Defender Firewall connection security rules,
we're talking about a principle that Microsoft calls domain isolation. So if
you look on the topology diagram, I have it right. Now admittedly, that is an
Azure virtual network infrastructure, but it just as well could be on‑premises
VLANs, you see. The point I want to make is what if you had need to restrict
traffic say to that sv08 virtual machine, that any traffic to that machine
either had to be only from certain hosts, or if you'd made a connection to
that machine,
you would have to apply additional security to the network packet
level? That's what we're talking about. Basically, a connection
security rule brings in the Internet Protocol Security extensions
to the IP, Internet Protocol.
IPsec is the name of the technology. And it's simple
as that. It allows us to use IPsec.
Now IPsec operates in two different modes.
There's tunnel mode that's used for virtual private network, or VPN,
connections, but what we're talking about really for our exam success
here in AZ‑801 today is transport mode. And this is where on a local area
network or potentially frankly in a hybrid cloud if you're going from
on‑prem into Azure over a site‑to‑site VPN or ExpressRoute tunnel, this
enforces IPsec on the packet‑level basis between particular hosts. Going
further,
there are two components of Internet Protocol Security that do
different things, but you can enable them together.
One is Authentication Header. Another is Encapsulating Security
Payload. ESP might be easier for a newcomer to understand.
That's simply where you're encrypting the payload portion of the frame.
Now, again, it gets more complex on how much of the frame is being
encrypted and so on depending upon whether you're doing tunnel or
transport mode, but for our purposes, we're just dealing with
understanding that ESP provides your data confidentiality,
that the payload or the data portion of those IP packets traveling
between machines that are having connection security rules enforced will
be encrypted and only the designated receiver system will be able to
decrypt those ESP encrypted packets.
Now Authentication Header is a different purpose. Authentication Header
is about validation; it's about mutual authentication.
AH is about preventing and mitigating man‑in‑the‑middle type attacks.
In other words, you want to verify using checksums,
you could use digital certificates, you can use Kerberos tickets.
I'll show you more about this in our upcoming demo. But you can
make sure that that connection security traffic between two hosts,
that they're validating that the packets are in fact coming from
that source and not from, again, a man‑in‑the‑middle attacker.
So you can enable AH or ESP separately, or for maximum
security, you can configure them together.
So long story short, connection security rules provides line or media‑level
encryption. You can do this in a VPN situation or just in a LAN Layer 2/Layer
3 situation. And depending upon how you configure those policies, which we
use Group Policy Object for typically,
you can really granularly control that security to help support, for instance, your security compliance requirements.