Windows Defender Firewall with Advanced Security

Applies to

• WindowsВ 10
• Windows Server 2016
• Windows Server 2019

This is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features.

Overview of Windows Defender Firewall with Advanced Security

Windows Defender Firewall in Windows 8, WindowsВ 7, WindowsВ Vista, Windows Server 2012, Windows ServerВ 2008, and Windows ServerВ 2008В R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user.

The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Both interfaces interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment.

Feature description

Windows Defender Firewall with Advanced Security is an important part of a layered security model. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy.

Practical applications

To help address your organizational network security challenges, Windows Defender Firewall offers the following benefits:

Reduces the risk of network security threats.В В Windows Defender Firewall reduces the attack surface of a device, providing an additional layer to the defense-in-depth model. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

Safeguards sensitive data and intellectual property.В В With its integration with IPsec, Windows Defender Firewall provides a simple way to enforce authenticated, end-to-end network communications. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data.

Extends the value of existing investments.В В Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API).

Защитник Windows брандмауэра с расширенными мерами безопасности Windows Defender Firewall with Advanced Security

Область применения Applies to

• Windows 10 Windows 10
• Windows Server2016 Windows Server 2016
• Windows Server 2019 Windows Server 2019

Это обзор функций брандмауэра Защитник Windows advanced Security (WFAS) и IPsec. This is an overview of the Windows Defender Firewall with Advanced Security (WFAS) and Internet Protocol security (IPsec) features.

Обзор Защитник Windows брандмауэра с расширенными мерами безопасности Overview of Windows Defender Firewall with Advanced Security

Защитник Windows брандмауэра в Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008 и Windows Server 2008 R2 — это брандмауэр хоста с состоянием, который помогает защитить устройство, позволяя создавать правила, определяющие, какой сетевой трафик разрешено вводить на устройство из сети и какой сетевой трафик устройство может отправлять в сеть. Windows Defender Firewall in Windows 8, Windows 7, Windows Vista, Windows Server 2012, Windows Server 2008, and Windows Server 2008 R2 is a stateful host firewall that helps secure the device by allowing you to create rules that determine which network traffic is permitted to enter the device from the network and which network traffic the device is allowed to send to the network. Защитник Windows брандмауэр также поддерживает протокол IPsec, который можно использовать для обязательной проверки подлинности с любого устройства, которое пытается связаться с устройством. Windows Defender Firewall also supports Internet Protocol security (IPsec), which you can use to require authentication from any device that is attempting to communicate with your device. Если требуется проверка подлинности, устройства, которые не могут быть аутентификацией как доверенные устройства, не могут взаимодействовать с вашим устройством. When authentication is required, devices that cannot be authenticated as a trusted device cannot communicate with your device. С помощью IPsec можно также требовать шифрования определенного сетевого трафика, чтобы предотвратить его чтение анализаторами сетевых пакетов, которые могут быть подключены к сети злоумышленником. You can also use IPsec to require that certain network traffic is encrypted to prevent it from being read by network packet analyzers that could be attached to the network by a malicious user.

Брандмауэр Защитник Windows с оснасткой MMC «Advanced Security» является более гибким и предоставляет гораздо больше функциональных возможностей, чем пользовательский интерфейс Защитник Windows брандмауэра на панели управления. The Windows Defender Firewall with Advanced Security MMC snap-in is more flexible and provides much more functionality than the consumer-friendly Windows Defender Firewall interface found in the Control Panel. Оба интерфейса взаимодействуют с одними и теми же службами, но обеспечивают разные уровни контроля над этими службами. Both interfaces interact with the same underlying services, but provide different levels of control over those services. Хотя программа Защитник Windows панели управления брандмауэром может защитить одно устройство в домашней среде, она не предоставляет достаточно возможностей централизованного управления или безопасности для защиты более сложного сетевого трафика в типичной корпоративной среде. While the Windows Defender Firewall Control Panel program can protect a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment.

Описание компонента Feature description

Защитник Windows брандмауэра с расширенными уровнями безопасности является важной частью многоуровневой модели безопасности. Windows Defender Firewall with Advanced Security is an important part of a layered security model. Обеспечивая двунаправную фильтрацию сетевого трафика на основе хост-трафика для устройства, Защитник Windows брандмауэр блокирует несанкционированный сетевой трафик, который проходит в локальное устройство или из него. By providing host-based, two-way network traffic filtering for a device, Windows Defender Firewall blocks unauthorized network traffic flowing into or out of the local device. Защитник Windows брандмауэр также работает с информированием о сети, чтобы применить параметры безопасности, соответствующие типам сетей, к которым подключено устройство. Windows Defender Firewall also works with Network Awareness so that it can apply security settings appropriate to the types of networks to which the device is connected. Защитник Windows брандмауэра и IPsec интегрированы в единую консоль управления (MMC) с именем Защитник Windows Firewall, поэтому брандмауэр Защитник Windows также является важной частью стратегии изоляции сети. Windows Defender Firewall and Internet Protocol Security (IPsec) configuration settings are integrated into a single Microsoft Management Console (MMC) named Windows Defender Firewall, so Windows Defender Firewall is also an important part of your network’s isolation strategy.

Практическое применение Practical applications

Чтобы решить проблемы безопасности сети организации, Защитник Windows брандмауэр предоставляет следующие преимущества: To help address your organizational network security challenges, Windows Defender Firewall offers the following benefits:

Снижает риск угроз сетевой безопасности. Reduces the risk of network security threats. Защитник Windows брандмауэра уменьшает поверхность атаки устройства, обеспечивая дополнительный уровень для модели глубокой защиты. Windows Defender Firewall reduces the attack surface of a device, providing an additional layer to the defense-in-depth model. Уменьшение числа атак на устройстве повышает управляемость и снижает вероятность успешной атаки. Reducing the attack surface of a device increases manageability and decreases the likelihood of a successful attack.

Защищает конфиденциальные данные и интеллектуальную собственность. Safeguards sensitive data and intellectual property. Благодаря интеграции с IPsec Защитник Windows брандмауэра предоставляет простой способ применения межсетевых коммуникаций с проверкой подлинности. With its integration with IPsec, Windows Defender Firewall provides a simple way to enforce authenticated, end-to-end network communications. Это обеспечивает масштабируемый многоуровневый доступ к надежным сетевым ресурсам, помогая обеспечивать целостность данных и при желании помогая защищать конфиденциальность данных. It provides scalable, tiered access to trusted network resources, helping to enforce integrity of the data, and optionally helping to protect the confidentiality of the data.

Расширяет ценность существующих инвестиций. Extends the value of existing investments. Поскольку Защитник Windows брандмауэр — это брандмауэр на основе хост-компьютера, включаемой в операционную систему, не требуется дополнительное оборудование или программное обеспечение. Because Windows Defender Firewall is a host-based firewall that is included with the operating system, there is no additional hardware or software required. Защитник Windows брандмауэр также разработан для дополнения существующих решений по обеспечению безопасности сети от корпорации Майкрософт с помощью задокументированных программных интерфейсов (API). Windows Defender Firewall is also designed to complement existing non-Microsoft network security solutions through a documented application programming interface (API).

Open Защитник Windows firewall with Advanced Security Open Windows Defender Firewall with Advanced Security

Область применения Applies to

• Windows 10 Windows 10
• Windows Server 2016 Windows Server 2016

В этой процедуре показано, как открыть брандмауэр Защитник Windows с помощью консоли «Advanced Security». This procedure shows you how to open the Windows Defender Firewall with Advanced Security console.

Учетные данные администратора Administrative credentials

Для выполнения этой процедуры необходимо быть членом группы администраторов. To complete this procedure, you must be a member of the Administrators group. Дополнительные сведения см. в дополнительных сведениях. For more information, see Additional considerations.

Открытие брандмауэра Защитник Windows с помощью пользовательского интерфейса To open Windows Defender Firewall using the UI

Нажмите кнопку «Начните», Защитник Windows брандмауэре, а затем нажмите ввод. Click Start, type Windows Defender Firewall, and then press ENTER.

Открытие брандмауэра Защитник Windows брандмауэра из командной подсказки To open Windows Defender Firewall from a command prompt

Откройте окно командной подсказки. Open a command prompt window.

В командной подсказке введите: At the command prompt, type:

Дополнительные рекомендации Additional considerations

Хотя стандартные пользователи могут запускать оснастку Защитник Windows MMC брандмауэра, для изменения большинства параметров пользователь должен быть членом группы с разрешениями на изменение этих параметров, например администраторами. Although standard users can start the Windows Defender Firewall MMC snap-in, to change most settings the user must be a member of a group with the permissions to modify those settings, such as Administrators.

Windows Defender Firewall with Advanced Security design guide

Applies to

• WindowsВ 10
• Windows Server 2016

Windows Defender Firewall with Advanced Security is a host firewall that helps secure the device in two ways. First, it can filter the network traffic permitted to enter the device from the network, and also control what network traffic the device is allowed to send to the network. Second, Windows Defender Firewall supports IPsec, which enables you to require authentication from any device that is attempting to communicate with your device. When authentication is required, devices that cannot authenticate cannot communicate with your device. By using IPsec, you can also require that specific network traffic be encrypted to prevent it from being read or intercepted while in transit between devices.

The interface for Windows Defender Firewall is much more capable and flexible than the consumer-friendly interface found in the Windows Defender Firewall Control Panel. They both interact with the same underlying services, but provide different levels of control over those services. While the Windows Defender Firewall Control Panel meets the needs for protecting a single device in a home environment, it does not provide enough centralized management or security features to help secure more complex network traffic found in a typical business enterprise environment.

About this guide

This guide provides recommendations to help you to choose or create a design for deploying Windows Defender Firewall in your enterprise environment. The guide describes some of the common goals for using Windows Defender Firewall, and then helps you map the goals that apply to your scenario to the designs that are presented in this guide.

This guide is intended for the IT professional who has been assigned the task of deploying firewall and IPsec technologies on an organization’s network to help meet the organization’s security goals.

Windows Defender Firewall should be part of a comprehensive security solution that implements a variety of security technologies, such as perimeter firewalls, intrusion detection systems, virtual private networking (VPN), IEEE 802.1X authentication for wireless and wired connections, and IPsec connection security rules.

To successfully use this guide, you need a good understanding of both the capabilities provided by Windows Defender Firewall, and how to deliver configuration settings to your managed devices by using Group Policy in Active Directory.

You can use the implementation goals to form one of these Windows Defender Firewall with Advanced Security designs, or a custom design that combines elements from those presented here:

Basic firewall policy design. Restricts network traffic in and out of your devices to only that which is needed and authorized.

Domain isolation policy design. Prevents devices that are domain members from receiving unsolicited network traffic from devices that are not domain members. Additional «zones» can be established to support the special requirements of some devices, such as:

A «boundary zone» for devices that must be able to receive requests from non-isolated devices.

An «encryption zone» for devices that store sensitive data that must be protected during network transmission.

Server isolation policy design. Restricts access to a server to only a limited group of authorized users and devices. Commonly configured as a zone in a domain isolation design, but can also be configured as a stand-alone design, providing many of the benefits of domain isolation to a small set of devices.

Certificate-based isolation policy design. This design is a complement to either of the previous two designs, and supports any of their capabilities. It uses cryptographic certificates that are deployed to clients and servers for authentication, instead of the KerberosВ V5 authentication used by default in Active Directory. This enables devices that are not part of an Active Directory domain, such as devices running operating systems other than Windows, to participate in your isolation solution.

In addition to descriptions and example for each design, you will find guidelines for gathering required data about your environment. You can then use these guidelines to plan and design your Windows Defender Firewall with Advanced Security deployment. After you read this guide, and finish gathering, documenting, and mapping your organization’s requirements, you have the information that you need to begin deploying Windows Defender Firewall using the guidance in the Windows Defender Firewall with Advanced Security Deployment Guide.

You can find the Windows Defender Firewall with Advanced Security Deployment Guide at these locations:

(Downloadable Word document)

In this section

Topic	Description
Understanding the Windows Defender Firewall with Advanced Security Design Process	Learn how to get started with the Windows Defender Firewall with Advanced Security design process.
Identifying Your Windows Defender Firewall with Advanced Security Deployment Goals	Learn how to identify your Windows Defender Firewall with Advanced Security implementation goals.
Mapping Your Deployment Goals to a Windows Defender Firewall with Advanced Security Design	After you finish reviewing the existing Windows Defender Firewall with Advanced Security implementation goals and you determine which goals are important to your specific deployment, you can map those goals to a specific Windows Defender Firewall with Advanced Security design.
Designing a Windows Defender Firewall with Advanced Security Strategy	To select the most effective design for helping to protect the network, you must spend time collecting key information about your current computer environment.
Planning Your Windows Defender Firewall with Advanced Security Design	After you have gathered the relevant information in the previous sections, and understand the basics of the designs as described earlier in this guide, you can select the design (or combination of designs) that meet your needs.
Appendix A: Sample GPO Template Files for Settings Used in this Guide	You can import an XML file containing customized registry preferences into a Group Policy Object (GPO) by using the Preferences feature of the Group Policy Management Console (GPMC).

Terminology used in this guide

The following table identifies and defines terms used throughout this guide.