From 47418abb63ee1aaa61e23c80d7e689cc1656a185 Mon Sep 17 00:00:00 2001 From: Benny Shilpa Date: Thu, 3 Dec 2020 11:50:21 +0530 Subject: [PATCH] Update quarantine.md --- .../windows-firewall/quarantine.md | 50 +++++++++---------- 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index 7ebe7fac5b..6e13094d17 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -1,5 +1,5 @@ --- -title: Quarantine Behavior +title: Quarantine behavior description: Quarantine behavior is explained in detail. ms.author: v-bshilpa author: Benny-54 @@ -17,27 +17,27 @@ ms.topic: conceptual ms.date: 11/17/2020 --- -# Quarantine Behavior +# Quarantine behavior One of the security challenges that network admins face is configuring a machine properly after a network change. Network changes can happen frequently. Additionally, the operations required to re-categorize the network after a change and apply the correct security policies on a machine are non-trivial and may require considerable CPU time. This is especially true for machines that are part of the domain. In the past, the delay in applying security policies during network re-categorization has been successfully exploited for vulnerabilities. -To counter this potential exploitation, Windows Firewall will "quarantine" an interface until the system has successfully re-categorized the network and Windows Filtering Platform (WFP) has the correct filters applied for the updated interface configuration. During quarantine, all new inbound connections without exceptions are blocked to the machine. +To counter this potential exploitation, Windows Firewall will quarantine an interface until the system has successfully re-categorized the network and Windows Filtering Platform (WFP) has the correct filters applied for the updated interface configuration. During quarantine, all new inbound connections without exceptions are blocked to the machine. While the quarantine feature has long been a part of Windows Firewall, the feature’s behavior has often caused confusion for customers unaware of quarantine and its motivations. Ultimately, the goal of this document is to describe the quarantine feature at a high level and help network admins understand why the application traffic is sometimes blocked by quarantine. -## Quarantine Filters +## Quarantine filters The quarantine feature creates filters which can be split into three categories: -1. Quarantine Default Inbound Block Filter +1. Quarantine default inbound block filter -2. Quarantine Default Exception Filters +2. Quarantine default exception filters -3. Interface Un-quarantine Filters +3. Interface un-quarantine filters These filters are added in the FWPM_SUBLAYER_MPSSVC_QUARANTINE sublayer and these layers are: @@ -54,37 +54,37 @@ These filters are added in the FWPM_SUBLAYER_MPSSVC_QUARANTINE sublayer and thes For more information about WFP layers and sublayers, see [WFP Operation](https://docs.microsoft.com/windows/win32/fwp/basic-operation). -### Quarantine Default Inbound Block Filter +### Quarantine default inbound block filter -The Quarantine Default Inbound Block filter effectively blocks any new non-loopback inbound connections if the packet is not explicitly permitted by another filter in the quarantine sublayer. +The quarantine default inbound block filter effectively blocks any new non-loopback inbound connections if the packet is not explicitly permitted by another filter in the quarantine sublayer. -### Quarantine Default Exception Filters +### Quarantine default exception filters -When the interface is in quarantine state, the Quarantine Default Exception filters will permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the Quarantine Default Inbound Loopback Exception filter. This exception filter allows all loopback packets when the interface is in quarantine state. +When the interface is in quarantine state, the quarantine default exception filters will permit new inbound connections given that they meet the conditions of an exception filter. One example of the exception filters is the quarantine default inbound loopback exception filter. This exception filter allows all loopback packets when the interface is in quarantine state. -### Interface Un-quarantine filter +### Interface un-quarantine filter -The Interface Un-quarantine filters allows all non-loopback packets if the interface is successfully categorized. +The interface un-quarantine filters allows all non-loopback packets if the interface is successfully categorized. -## Quarantine Flow +## Quarantine flow The following describes the general flow of quarantine: 1. There is some change on the current network interface. -2. The Interface Un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state. +2. The interface un-quarantine filters will no longer permit new inbound connections. The interface is now in quarantine state. -3. All non-loopback inbound connections are either permitted by Quarantine Default Exception Filters or dropped by the Quarantine Default Inbound Block filter. +3. All non-loopback inbound connections are either permitted by quarantine default exception filters or dropped by the quarantine default inbound block filter. 4. The WFP filters applicable to the old interface state are removed. 5. The WFP filters applicable to the new interface state are added, which include the un-quarantine filters for this interface. These filters are updated to match the interface's current state. -6. The interface has now exited quarantine state as the Interface Un-quarantine filters permit any new non-loopback packets. +6. The interface has now exited quarantine state as the interface un-quarantine filters permit any new non-loopback packets. -## Quarantine Diagnostics +## Quarantine diagnostics -There are two methods of identifying packet drops from the Quarantine Default Inbound Block Filter. +There are two methods of identifying packet drops from the quarantine default inbound block filter. Given that the network connectivity issue is reproducible, diagnostic traces can be collected by running the following in an administrative command prompt: @@ -106,7 +106,7 @@ The characters in the application ID name will be separated by periods: The `netEvent` will have more information about the packet that was dropped including information about its capabilities, the filter that dropped the packet, and much more. -If the filter that dropped that packet was by the Quarantine Default Inbound Block filter, then the drop `netEvent` will have `filterOrigin` as `Quarantine Default`. +If the filter that dropped that packet was by the quarantine default inbound block filter, then the drop `netEvent` will have `filterOrigin` as `Quarantine Default`. The following is a sample `netEvent` with `filterOrigin` as `Quarantine Default`. @@ -195,11 +195,11 @@ To enable Filtering Platform Connection audits, run the following command in an Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /success:enable /failure:enable ``` -Sample Drop Audit with `filterOrigin` as `Quarantine Default`. +Sample drop audit with `filterOrigin` as `Quarantine Default`. -![Quarantine Default](images/quarantine-default1.png) +![Quarantine default](images/quarantine-default1.png) -Once the drop’s filter origin has been identified as the Quarantine Default Inbound Block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: +Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: ```Powershell Get-NetIPInterface –InterfaceIndex @@ -208,8 +208,8 @@ Get-NetIPInterface –InterfaceIndex 5 ![Quarantine Interfaceindex](images/quarantine-interfaceindex1.png) -Using the interface name, Event Viewer can be searched for any interface related changes. +Using the interface name, event viewer can be searched for any interface related changes. To enable more networking audit events, see [Enable IPsec and Windows Firewall Audit Events](https://docs.microsoft.com/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/cc754714(v=ws.10)?redirectedfrom=MSDN). -Packet drops from the Quarantine Default Inbound Block filter are often transient and do not signify anything more than a network change on the interface. +Packet drops from the quarantine default inbound block filter are often transient and do not signify anything more than a network change on the interface.