Evaluating ICF

In response to a continuous onslaught of malicious Internet cracking, Microsoft has included the bare-bones Internet Connection Firewall (ICF) with Windows XP Home Edition and XP Professional Edition. This firewall lacks many of the frills of commercially available personal firewalls, but if you configure it correctly, ICF can provide basic, one-way security protection against mischievous probes and malicious software (malware). Let's discuss the ICF firewall and examine configuration settings that can maximize its effectiveness in your enterprise. ICF might not win any security-industry awards, but using it will make your PC and your network safer.

Getting Started
Like many of today's personal firewalls, ICF is a stateful packet-filtering firewall, which means that it automatically permits inbound network traffic that results from previously allowed outbound connections. This feature is important because many IP services dynamically generate port numbers to assign when negotiating return paths. So, although you might connect to an FTP server on TCP port 21, the server will return a random port number higher than 1024 for the subsequent two-way communication. Typically, ICF recognizes the incoming traffic as a response to the original outbound request and permits it. ICF maintains a connection flow table in memory to document established connections. As with most stateful firewalls, the algorithm that discerns the legitimacy of the traffic doesn't work perfectly in all situations. If you use Instant Messaging (IM) or other peer-to-peer services, you'll probably have to tweak ICF's default settings.

Despite its name, ICF can prove useful for protecting a wide range of non-Internet LAN connections and nonbridged wireless pathways, as long as those connections use IP for their transport layer. The exceptions are bridged connections, private Internet Connection Sharing (ICS) connections, Infrared Data Association (IrDA) connections, and Direct Cable Connect (DCC) connections. Microsoft intended ICF to work in conjunction with its ICS service (the two services share the same API), but the two mechanisms don't have to work together. In a network with ICS, only PCs directly connected to the Internet need ICF, which is ideal for home and small-business networks.

A question I often hear from XP users is how to determine whether ICF is working. The software provides no outward sign that it's functioning and displays no Taskbar icon. Microsoft includes ICF with all XP systems, but by default, the software is enabled only on PCs that connect directly to the Internet and that you configure by using a network configuration wizard. To turn on ICF, perform the following steps:

1. Run the Control Panel Networking and Internet Connections applet.
2. Click Network Connections.
3. Right-click the network connection for which you want to enable ICF (e.g., Local Area Connection), then click Properties.
4. Select the Advanced tab, then select the Protect my computer and network by limiting or preventing access to this computer from the Internet check box.

If you have a Windows 2000 Active Directory (AD) domain, you can use a Group Policy Object (GPO) to enable or disable ICF on all machines in the domain. This GPO would govern laptops when connected to the domain, and you can continue to use ICF on those machines when you're traveling. I only wish that Microsoft had expanded group functionality and made ICF easier to configure and manage at the enterprise level.