Windows firewalls, how do you configure them?
How do you get them up and running?
And most importantly, what do you not know how to do?
I’m going to show you all the stuff you should be doing
and tell you where to go to do it easily and simply,
and oh, by the way, ever so securely.
All that and more, coming up now.
Hello everybody, my name is Adam Gordon,
an edutainer here at ITProTV,
coming at you back with another fun and exciting episode
about how do I get that stuff done
in Windows Server I always wondered about,
probably scratched my head about,
maybe even banged it against the wall once or twice,
but couldn’t really figure out on my own.
Remember, you can check out our YouTube channel
and subscribe for this and all other exciting
and hopefully informative conversations we offer you there.
And if you need more in depth training,
you can check us out right over at ITProTV as well,
where myself and all the edutainers hang out
and spend time figuring out how to show you
how to make life simple, but also keep it secure along the way.
In this episode we’re going to talk about
how to set up and configure
the Microsoft Windows Defender Advanced Firewall on Server 2022.
A common question I get asked a lot
by my students and my customers,
“We’ve got this firewall built right into the operating system?”
Is it enough for us to use that, do we need to use
one of those fancy and expensive firewalls
that’s either racked and stacked in our own data center,
as you see a lot of stuff racked and stacked behind me
here in our studios,
and/or do I need to use a Cloud based firewall
for maybe one of the Cloud providers that I work with?
Well, the answer is yes to all of those,
because while one firewall is good,
as I often tell my customers, two is better than one,
and three is better than two.
What I mean by that is that it’s important
to have a firewall in place at different levels of interaction
and the firewall in the local system,
joining me here while we’re talking,
the firewall on the local system
is going to be really important
because it’s going to help us to understand
how we can protect information right at the source,
but also as we’re talking about
potentially out in the Cloud and within the network
inside of our organizations, as well.
So, different firewalls for different capabilities,
but all of them equally important,
we’re going to focus on how to configure that firewall
at the point of connection on that server
where people are often going to get information directly
and use the built in capabilities
of the Windows Server operating system itself.
What we’re taking a look at is the ability
to be able to go in and use the Server Manager
to be able to drive access to a working with
and configuration of the Windows Defender Advanced Firewall.
It’s built right into the operating system
and believe it or not, it’s turned on and configured by default,
which makes it so much simpler,
because we don’t even need to worry about
how to install and configure it,
we just really have to focus on managing it
and perhaps tweaking it here and there
to adjust the rules, the monitoring, the settings,
the logging, to ensure that the traffic
that we want to allow is able to reach the server,
and of course, by extension,
the traffic that we don’t want reaching that server is blocked.
So, we’re going to open the Server Manager.
If you’re not familiar with how to do that,
it normally opens by default.
But, if you’re one of those people
that closes the Server Manager,
really doesn’t want to have it bothering you
when you’re on your desktop and it looks like this,
you have to open it up.
Simply do that by going down the Start menu,
lower left, we can then navigate up right over here,
to our Quick Select area under the Windows server tiles
on the right hand side.
As we open the Start menu,
Server Manager should normally be pinned there.
First tile upper left, we click on that,
we’ll open up just like this,
and then once it sets itself up,
we have our Quick Navigation bar on the left
and then over here on the right
we have the ability to work with,
going left to right, Manage, Tools, View, and Help.
We’re going to go into Tools, because as I suggested,
Windows Defender Firewall is already installed
and configured as part of the basic operating system load.
When you download and install Windows Server,
the firewall is already turned on and configured.
If it wasn’t, we’d have to go to Manage,
and add that in as a service, a role, a feature.
But it’s already there for us.
So, we’re going to go to Tools
and we’re going to go down alphabetically,
and almost down towards the bottom of that list,
you can see it right over here,
Windows Defender Firewall with Advanced Security
will be available, simply highlighting and clicking on that
will bring up the Microsoft Management Console, the MMC.
Let’s go ahead and open that up.
I’m going to minimize the Server Manager,
just put it down on the task bar so it’s out of our way.
What we’re looking at is the Windows Defender
with Advanced Security Management console.
It’s got our ability to navigate laid out pretty succinctly here.
We see Inbound and Outbound Rules,
inbound means ingress,
inbound flow coming in from the outside,
so traffic outside of the machine
that’s looking to connect will be governed by those rules.
Outbound Rules, egress, flow out from this machine
to anywhere local or remote on our network
through our network connections in our data center
or perhaps externally beyond the boundary
of our organization,
whatever that traffic ultimately is designed to go do,
it’s governed by outbound rules.
So, we see our ability to manage rule sets,
and by the way, a subset of rules already available
for selected turned on
to provide basic configuration protection and security
while the firewall was operating out of the box, if you will.
Connection Security Rules are ability
to create additional rules as needed
for a variety of different connection types.
And then Monitoring, Monitoring allows us to,
well, do just that, monitor the various functions,
not just of the firewall itself, but of the connection rules,
as well as what are called the SAs,
Security Associations
designed to allow us to communicate securely
through the firewall with other systems.
And so at a high level,
firewalls interface looks pretty straightforward,
let’s move this over just a smidge so you can see that.
Notice, we can right click
right up at the top of the Management area
on the firewall instance itself,
we can import/export policies,
reconfiguring and applying them to the firewall
to essentially at scale reconfigure very minute, small,
or perhaps global elements of the firewall’s configuration.
We can restore the default policy, if we’ve made a change
and want to essentially hit the reset button,
and put it back to what it would be normally out of the box.
We could diagnose and repair
if there is a network connection issue,
some sort of problem that’s preventing the firewall
from operating properly,
perhaps the service needs to be stopped and restarted,
we could do that right from here
with the built in troubleshooters Microsoft provides.
We can also look at Properties associated
with the configuration of the firewall.
Now, all of those are available
as a right click shortcut menu right from over here,
but we see them off on the right hand side,
as well, right in this area,
and you’ll notice they are the same identical,
as a matter of fact, and in the same order,
Properties is right above Help,
and you can see Properties is right above Help,
and right below Refresh.
So, these two menu elements are going to mirror one another,
and they are going to be the same.
And when we come over here
we can see those elements are available to us
under the Actions area on the right hand side.
If we click on Properties, what we will find is that
we have a tabbed interface, we have a Domain Profile tab,
these are going to become important in just a moment,
we have a Private Profile tab,
we have a Public Profile,
and we have IPsec Settings,
all of those are available from the Properties area.
The first three, Domain, Private, and Public Profile
are kind of sitting right behind the dialogue box
we just opened up to see Properties,
and they’re available for us to see
in read only fashion right here,
in other words, we see the current configuration
of how those profiles are set on those tabs,
but we don’t have an ability to edit them right from here.
We can just roll that up,
you could see it disappears and comes back.
But, I can get to Properties in more than one way.
I can click right down there
and the Windows Defender Firewall Properties are available,
and I bring up the same exact interface,
allowing me to be able to work with any one of these profiles,
the Domain Profile configuration can be changed,
this is the read only overview of the current configuration,
the ability to administer
that is on the right hand side on that tab
inside the Properties window as it comes up.
And you’ll notice right now it is on,
green shield, white check, set to On.
If I want to change that I pull that down
and notice I can change that, set that to Off,
and if I do that, no change is made here
until I apply that change, and when I apply that change,
notice all of a sudden the changes are represented here.
So, I can easily configure and control different elements
of the firewall by working with Properties.
I also have the ability to be able to go in
and to look at connection security rules right from here.
This middle navigation area is a collection of shortcuts
and likely activities that we want to engage in,
are documented, defined, discussed here,
and we have an ability to click directly through to get to them.
But if I know my way around,
I can simply come right up here, as we’ve talked about,
we go to Connection Security Rules
and create a rule right from here.
So, I could do this in either place.
Let’s look at the existing rule set
that governs our interactions first,
our Inbound and Outbound rules, as I mentioned,
there’s a series of rules that are configured,
and you’ll notice the ones that are turned on
are going to have that same green circle
with the white check,
and we can see as we look across on the column view,
all the way over, row by row,
we see Enabled at the far right between Profile and Action,
we see it says Yes, and if we track that,
we’ll see the green circles white checks
are going to indicate Yes,
and where there is no icon of any kind to the left of the name,
we look under Enable, it says No,
that means those rules are currently not active.
So, I can work with any one of these rules,
highlight that rule if I choose to,
and I can go ahead and right click
and enable the rule from that shortcut option.
I also have an Enable Rule option right over here
on the right hand side, as you can see, the lower area,
where it says Enable Rule
under the name of the rule that I’ve highlighted.
So, I could do that right from here, as well.
If I enable that rule, notice it is turned on automatically,
no big deal, if I want to go ahead and disable that,
I can right click and simply disable it,
turning it back off again, very easy to work with.
I can look at properties of the individual rule,
I can right click and do this right from here.
I can delete the rule, I can copy it and modify it,
I can work with it from the Action menu
on the right hand side, as well.
I can filter using a variety of mechanisms,
and I can create brand new rules here
if I want to for a specific traffic direction.
In this case, this will be a brand new inbound rule,
and this can be created for either programs, ports,
a predefined solution that’s already in there,
like one of the rule sets
that may already be there for a vendor,
let’s say, and/or I can create a custom rule,
essentially starting from scratch and doing this on my own.
I have a series of steps I have to engage in,
in order to do that, and once I’m done,
assuming I’m successful and make good choices,
and everything is going to work and there is no issues
that would prevent the rule from being created,
I’ll be able to enable that rule, turn it on,
or enable it after it is created, it’s up to me,
and that will govern inbound flow.
I could do the same thing for outbound flow, as you can see.
I can work with rules,
normally when they’re turned on inbound,
they’re turned on outbound,
because you have to have a bidirectional capability
to manage traffic coming and going back out again.
So, we give the traffic inbound
an automatic outbound path
so that way it can be governed by the same set of rules,
but I can create a rule here if I need to.
I also have the ability
to create connection security rules separately,
these can be clicked right over there,
a new rule can then be created through the Wizard.
But notice, these are different types of rules
than inbound/outbound rules.
They focus on outcomes, things like isolation,
things like authentication exemption,
server to server authentication
and connection between two defined endpoints,
or a tunnel that authenticates connects
between two computers to communicate securely,
and/or again, a custom rule.
I would create one of more of these rules as needed,
choosing the appropriate type, changes,
the options that I have to provide here, as you can see.
And when I’ve done that, walked through the Wizard,
successful configuring everything,
the rule will show up here in the list,
it will be available for me to manage.
The firewall is a multifaceted solution,
there’s a lot going on, we can monitor the coming
and going of rule sets and traffic through the firewall
by looking at firewall monitoring,
we see information about any or all of the rules listed here.
We can look at what’s going on with them
and see the status of the rule.
We can look at the status of the connection security rules,
we can look at the status of the IPsec,
the IP security associations.
One other thing I just want to show you quickly,
we can do this by going into Start menu, going to Settings,
and under Settings, what we’re going to do is the following,
let’s just do a search right here,
or you know what, we’re not going to do it this way,
I was going to show you how to do it that way,
but we’ll do it this way instead.
Let’s go to Run, I’m just going to bring up the services MMC,
and we’ll do Services, and when we do that,
we should get in just a second
our Services Microsoft Management console,
if our system is going to cooperate.
If not, we’ll try that one more time,
because I might have mistyped that.
And we’ve done that, we got our Services area to manage,
and I just want to show you the service
that drives the firewall before we wrap up.
We’re going to come all the way down
and we’re going to go to here, Windows,
where is my service, there it is, right below it,
Defender Firewall, that’s the one.
If you have to restart the firewall for any reason,
I’ll zoom in so you can see this, there we are, right there,
you have to restart the firewall for any reason,
you’re having an issue with it,
that troubleshooting option I showed you
where things may not be working, you can come in here,
notice the status is running, it’s automatic,
let me just close the console before we do this
so we don’t have any issues,
and you’ll notice I can right click and go to Properties,
and you’ll notice here I’m not able
to change the setting on this firewall,
I’m not able to mess around with this service,
it’s controlled by the system.
What I can do is I can use the troubleshooter
to cycle the firewall in case there is a problem.
A lot of these services we can control on our own,
we’re able to go in and make changes,
we’re able to go in and modify the startup properties,
we’re able to even restart the system service, if necessary.
The core security functions like the firewall,
we don’t control, the operating system does.
We’re barred from being able to do that.
But, what we can do
is we can rely on the troubleshooting element
to maybe stop and start that firewall, if necessary.
So, I just want to point that out to you,
make sure you’re aware of that, you see that,
and you understand that we have that capability
if we choose to, up to you, of course.
But if there is a problem,
instead of restarting the whole server,
maybe you’ll simply restart the firewalls
through troubleshooting, and hopefully
that will allow you to get the firewall back up and running.
Alright, so this is how we can work with,
configure, and a little bit of the under the hood
capabilities associated with Windows Advanced Firewall.
Remember, we don’t install it, we simply manage it
because it’s already there by default.
I’m going to go get ready
for additional exciting conversations
we’re planning to have with you
about other features and capabilities
on how do I do that in Windows Server, but until I do,
and until you come back and subscribe,
watch another one of our cool episodes,
I’m going to wish you happy servering, and I’ll see you soon.