By default, the pfsense firewall __________ outbound access from the lan interface.

CIS 534 - Advanced Network Security Design 1

CIS 534

Advanced Network Security Design

CIS 534 - Advanced Network Security Design 2

Table of Contents Toolwire Lab 1:Analyzing IP Protocols with Wireshark ........................................................................ 6

Introduction ............................................................................................................................................. 6

Learning Objectives ................................................................................................................................ 6

Tools and Software ................................................................................................................................. 7

Deliverables ............................................................................................................................................. 7

Evaluation Criteria and Rubrics ........................................................................................................... 7

Hands-On Steps ....................................................................................................................................... 8

Part 1: Exploring Wireshark ............................................................................................................... 8

Part 2: Analyzing Wireshark Capture Information .......................................................................... 12

Lab #1 - Assessment Worksheet .............................................................................................................. 19

Analyzing IP Protocols with Wireshark ............................................................................................. 19

Overview ................................................................................................................................................ 20

Lab Assessment Questions & Answers ............................................................................................... 20

Toolwire Lab 2: Using Wireshark and Netwitness Investigator to Analyze Wireless Traffic ........... 22

Introduction ........................................................................................................................................... 22

Learning Objectives .............................................................................................................................. 23

Tools and Software ............................................................................................................................... 23

Deliverables ........................................................................................................................................... 23

Evaluation Criteria and Rubrics ......................................................................................................... 23

Hands-On Steps ..................................................................................................................................... 24

Part 1: Analyzing Wireless Traffic with Wireshark .......................................................................... 24

Part 2: NetWitness Investigator ......................................................................................................... 31

Lab #2 - Assessment Worksheet .............................................................................................................. 34

Using Wireshark and NetWitness Investigator to Analyze Wireless Traffic .................................. 34

Overview ................................................................................................................................................ 34

Lab Assessment Questions & Answers ............................................................................................... 35

Toolwire Lab 3: Configuring a pfSense Firewall on the Client ............................................................ 36

Introduction ........................................................................................................................................... 36

Learning Objectives .............................................................................................................................. 37

Tools and Software ............................................................................................................................... 37

Deliverables ........................................................................................................................................... 37

Evaluation Criteria and Rubrics ......................................................................................................... 37

CIS 534 - Advanced Network Security Design 3

Hands-On Steps ..................................................................................................................................... 38

Part 1: Planning the Configuration .................................................................................................. 38

Part 2: Configuring the Firewall ....................................................................................................... 46

Lab #3 - Assessment Worksheet .............................................................................................................. 48

Configuring a pfSense Firewall on the Client ..................................................................................... 48

Overview ................................................................................................................................................ 48

Lab Assessment Questions ................................................................................................................... 49

Toolwire Lab 4: Configuring a pfSense Firewall on the Server ........................................................... 50

Introduction ........................................................................................................................................... 50

Learning Objectives .............................................................................................................................. 51

Tools and Software ............................................................................................................................... 51

Deliverables ........................................................................................................................................... 51

Evaluation Criteria and Rubrics ......................................................................................................... 51

Hands-On Steps ..................................................................................................................................... 52

Part 1: Planning the Configuration .................................................................................................. 52

Part 2: Configuring the Firewall ....................................................................................................... 59

Lab #4 - Assessment Worksheet .............................................................................................................. 63

Configuring a pfSense Firewall on the Server .................................................................................... 63

Overview ................................................................................................................................................ 63

Lab Assessment Questions & Answers ............................................................................................... 63

Toolwire Lab 5: Penetration Testing a pfSense Firewall ...................................................................... 65

Introduction ........................................................................................................................................... 65

Learning Objectives .............................................................................................................................. 66

Tools and Software ............................................................................................................................... 66

Deliverables ........................................................................................................................................... 66

Evaluation Criteria and Rubrics ......................................................................................................... 66

Hands-On Steps ..................................................................................................................................... 67

Part 1: Configuring a pfSense Server Firewall ................................................................................ 67

Part 2: Penetration Testing ................................................................................................................ 68

Lab #5 - Assessment Worksheet .............................................................................................................. 72

Penetration Testing a pfSense Firewall ............................................................................................... 72

Overview ................................................................................................................................................ 72

Lab Assessment Questions & Answers ............................................................................................... 72

CIS 534 - Advanced Network Security Design 4

Toolwire Lab 6: Using Social Engineering Techniques to Plan an Attack .......................................... 74

Introduction ........................................................................................................................................... 74

Learning Objectives .............................................................................................................................. 75

Tools and Software ............................................................................................................................... 75

Deliverables ........................................................................................................................................... 75

Evaluation Criteria and Rubrics ......................................................................................................... 76

Hands-On Steps ..................................................................................................................................... 76

Part 1: Targeted Social Engineering Attack ..................................................................................... 76

Part 2: Targeted Reverse Social Engineering Attack ....................................................................... 82

Lab #6 - Assessment Worksheet .............................................................................................................. 84

Using Social Engineering Techniques to Plan an Attack .................................................................. 84

Overview ................................................................................................................................................ 84

Lab Assessment Questions ................................................................................................................... 84

Toolwire Lab 7: Configuring a Virtual Private Network Server ......................................................... 87

Introduction ........................................................................................................................................... 87

Learning Objectives .............................................................................................................................. 88

Tools and Software ............................................................................................................................... 88

Deliverables ........................................................................................................................................... 88

Evaluation Criteria and Rubrics ......................................................................................................... 89

Hands-On Steps ..................................................................................................................................... 89

Part 1: Configuring the VPN: Server Side ........................................................................................ 89

Lab #7 - Assessment Worksheet .............................................................................................................. 98

Configuring a Virtual Private Network Server .................................................................................. 98

Overview ................................................................................................................................................ 98

Lab Assessment Questions & Answers ............................................................................................... 98

Host-to-Host Configuration Worksheet .............................................................................................. 99

IPsec.conf file ......................................................................................................................................... 99

Toolwire Lab 8: Configuring a VPN Client for Secure File Transfers .............................................. 100

Introduction ......................................................................................................................................... 100

Learning Objectives ............................................................................................................................ 101

Tools and Software ............................................................................................................................. 101

Deliverables ......................................................................................................................................... 101

Evaluation Criteria and Rubrics ....................................................................................................... 102

CIS 534 - Advanced Network Security Design 5

Hands-On Steps ................................................................................................................................... 102

Part 1: Configuring a Windows VPN Client to work with a Linux VPN Server ........................... 102

Part 2: Comparing Secure and Non-secure File Transfers in Wireshark ..................................... 107

Lab #8 - Assessment Worksheet ............................................................................................................ 116

Configuring a VPN Client for Secure File Transfers ...................................................................... 116

Overview .............................................................................................................................................. 117

Lab Assessment Questions & Answers ............................................................................................. 117

Toolwire Lab 9: Attacking a Virtual Private Network ........................................................................ 118

Introduction ......................................................................................................................................... 118

Learning Objectives ............................................................................................................................ 119

Tools and Software ............................................................................................................................. 119

Deliverables ......................................................................................................................................... 119

Evaluation Criteria and Rubrics ....................................................................................................... 120

Hands-On Steps ................................................................................................................................... 120

Part 1: Social Engineering / Reverse Social Engineering Attack .................................................. 120

Part 2: Creating Spam Emails ......................................................................................................... 126

Lab #9 - Assessment Worksheet ............................................................................................................ 129

Attacking a Virtual Private Network ................................................................................................ 129

Overview .............................................................................................................................................. 129

Lab Assessment Questions & Answers ............................................................................................. 129

Toolwire Lab 10: Investigating and Responding to Security Incidents ............................................. 131

Introduction ......................................................................................................................................... 131

Learning Objectives ............................................................................................................................ 132

Tools and Software ............................................................................................................................. 132

Deliverables ......................................................................................................................................... 132

Evaluation Criteria and Rubrics ....................................................................................................... 133

Hands-On Steps ................................................................................................................................... 133

Part 1: Gather System Performance Information .......................................................................... 133

Part 2: Scan a Windows 2008 Server for Vulnerabilities ............................................................... 136

Lab #10 - Assessment Worksheet .......................................................................................................... 138

Investigating and Responding to Security Incidents........................................................................ 138

Overview .............................................................................................................................................. 138

Lab Assessment Questions & Answers ............................................................................................. 138

CIS 534 - Advanced Network Security Design 6

Toolwire Lab 1:Analyzing IP Protocols with Wireshark

Introduction

Click the link below to view the network topology for this lab:

Topology

Wireshark is probably the most widely used packet capture and analysis software in the world. It is available free of charge and while it lacks some of the more sophisticated diagnostic tools of similar commercial products, the use of Wireshark saves many organizations thousands of dollars and thousands of hours. And, Wireshark allows capture of network packet traffic and the ability to save frame detail in multiple formats that make them usable by the more sophisticated, more expensive software tools.

This lab has three parts which you should complete in order.

1. In the first part of the lab, you will either learn the basics of Wireshark, if you have not already used it, or you will improve and fine tune your Wireshark skills. In either case, you will learn about probe placement, clocking/timing issues, Wireshark traffic capture and the use of filters.

2. In the second part of the lab, you will utilize a capture file to answer basic questions about key IP protocols and the basic configuration of the IP hosts from which traffic is captured.

3. Finally, if assigned by your instructor, you will explore the virtual environment on your own in the third part of the lab to answer a set of challenge questions that allow you to use the skills you learned in the lab to conduct independent, unguided work, similar to what you will encounter in a real-world situation.

Learning Objectives

Upon completing this lab, you will be able to:

• Use basic features of the Wireshark packet capture and analysis software> • Apply appropriate filters to view only the traffic subset of interest • Be able to reliably and consistently place probes to capture packet traffic> • Determine if timing and clocking is synchronized for better reliability and repeatability

javascript:popUp;

CIS 534 - Advanced Network Security Design 7

• Guarantee that all traffic is being captured and that the interface rate and capture rate are compatible

• Capture and analyze basic Internet Protocol transactions and determine basic configuration information about the IP hosts from which traffic is captured

Tools and Software

The following software and/or utilities are required to complete this lab. Students are encouraged to explore the Internet to learn more about the products and tools used in this lab.

• Wireshark

Deliverables

Upon completion of this lab, you are required to provide the following deliverables to your instructor:

1. Lab Assessments file; 2. Optional: Challenge Questions file, if assigned by your instructor.

Evaluation Criteria and Rubrics

The following are the evaluation criteria for this lab that students must perform:

1. Use basic features of the Wireshark packet capture and analysis software. - [10%] 2. Apply appropriate filters to view only the traffic subset of interest. - [20%] 3. Be able to reliably and consistently place probes to capture packet traffic. - [20%] 4. Determine if timing and clocking is synchronized for better reliability and repeatability. -

[20%] 5. Guarantee that all traffic is being captured and that the interface rate and capture rate are

compatible. - [20%] 6. Capture and analyze basic Internet Protocol transactions and determine basic

configuration information about the IP hosts from which traffic is captured. - [10%]

CIS 534 - Advanced Network Security Design 8

Hands-On Steps

Note: This lab contains detailed lab procedures which you should follow as written. Frequently performed tasks are explained in the Common Lab Tasks document on the vWorkstation desktop. You should review these tasks before starting the lab.

1. From the vWorkstation desktop, double-click the Common Lab Tasks file to open the file in Adobe Reader.

If desired, use the File Transfer button to transfer the file to your local computer and print a copy for your reference. Instructions for transferring the file can be found in the file itself.

Figure 1 “Student Landing” workstation

2. On your local computer, create the lab deliverable files. 3. Review the Lab Assessment Worksheet at the end of this lab. You will find

answers to these questions as you proceed through the lab steps.

Part 1: Exploring Wireshark

Note: Wireshark is already loaded on the vWorkstation, as indicated by the Wireshark shortcut on the desktop. Wireshark can be downloaded, free of charge, from http://www.wireshark.org if you would like to have your own personal copy, though doing so is not a requirement for this lab.

1. Double-click the Wireshark icon on the desktop to start the Wireshark application.

Figure 2 Wireshark splash screen

The main screen of Wireshark includes several shortcuts to make your job easier. There are four categories of shortcuts.

Wireshark Screen Sections SECTION TITLE DESCRIPTION

javascript:popUp();

javascript:popUp();

CIS 534 - Advanced Network Security Design 9

Capture This section displays a list of the network interfaces, or machines, that Wireshark has identified, and from which packets can be captured and analyzed.

Files This section displays the most recent list of files that you were analyzing in Wireshark. The default status for this section is blank because no files have been opened yet.

Online This section displays shortcuts to the Wireshark website. Capture Help This section displays shortcuts to the Wireshark website for help in

using the tool.

2. Click Interface List to bring up a list of active interfaces.

Figure 3 Wireshark Capture Interfaces

Notice that only one interface, the student workstation, is available for capturing packets in the virtual lab. This Capture Interface is a virtual interface described as “Citrix” with an IP address of 172.30.0.2.

Note: If you were running Wireshark on your local computer, it is possible that would see many interfaces. It is also possible that some interfaces you were expecting to see may not appear on the list at all. If you know that a logical or physical interface exists but it does not show up on the list, check the installation of winpcap and troubleshoot accordingly. Very often it is necessary to reinstall or update the Network Interface Card (NIC) drivers.

3. Click the checkbox to the left of the Student device to select it, and click Details to display additional information about the interface.

The Interface Details dialog box displays a great deal of information about the interface that may be useful in troubleshooting and resolving packet capture problems, for instance if you are not capturing all of the packets you may be exceeding the transmit and/or receive buffers. Take a moment to review the information in this dialog box before proceeding with the lab.

Figure 4 Wireshark Capture Interface Details

4. Click Close to close the Interface Details dialog box. 5. With the Student checkbox still checked, click Start to open Wireshark and

begin capturing data packets affecting the Student’s virtual workstation.

Note: Because Wireshark is capturing traffic live, your default content will be different from the screen captures in this part of the lab. However, in Part 2, you will load a static file and your results should match the examples almost

javascript:popUp();

javascript:popUp();

CIS 534 - Advanced Network Security Design 10

exactly once. All of these steps are not needed for every packet analysis, but it is a good way of familiarizing yourself with the various capabilities of Wireshark.

6. Maximize the Wireshark window.

The Wireshark window opens with the detailed information about the first packet captured, Frame 1, displayed in the middle pane. Use your mouse to drag the borders of any pane up or down to change its size.

o The top pane of the Wireshark window contains all of the packets that Wireshark has captured, in time order and provides a summary of the contents of the packet in a format close to English. Keep in mind that the content will be different depending upon where you capture packets in the network. Also remember that the “source” and “destination” is relative to where a packet is captured. This area of the Wireshark window will be referred to as the frame summary.

o The middle pane of the Wireshark window is used to display the packet structure and contents of fields within the packet. This area of the Wireshark window will be referred to as the frame detail.

o The bottom pane of the Wireshark window displays the byte data. All of the information in the packet is displayed in hexadecimal on the left and in decimal, in characters when possible, on the left. This can be a very useful feature, especially if passwords for which you are looking are unencrypted. This area of the Wireshark window will be referred to as the byte data.

Figure 5 Wireshark application window

How Does Wireshark Work?

Wireshark can be used in a variety of ways. The following figures illustrate the Wireshark Capture Environment. In the simplest terms, Wireshark is used to capture all packets to and from the IP Host on the left (a computer workstation) and the IP Host on the right (a server).

Figure 6 Wireshark capture environment

The most common configuration for Wireshark, and the configuration that we are running in this lab, has the software running on a local host.

Figure 7 Wireshark running on local host

javascript:popUp();

javascript:popUp();

javascript:popUp();