利用IPSec建立內部防火牆以提升資料庫安全2

        上一篇介紹IPSECCMD的使用範例，本篇介紹可以用在Windows Server 2008上的Netsh IPsec命令吧，詳細使用方法請參見Netsh Commands for Internet Protocol Security (IPsec)
 
        Netsh IPsec比起IPSECCMD更好的優點有以下兩點（缺點是指令比較多行）：

1. IPSECCMD對篩選器清單的篩選器只會整個取代，而Netsh IPsec對篩選器清單的篩選器是可以一筆一筆附加的
2. IPSECCMD對原則的每次變更都要先停用再啟用，變更的部分才會生效，而Netsh IPsec只要是對已經指派的原則所作的變更都是立刻生效 

       對了，忘了提使用IPsec不僅可當內部防火牆，還可順便對網路連線作加密！像你如果用Wireshark這類的封包分析軟體來擷取網路封包，未加密前是可以從封包中查出使用的T-SQL指令，但如果用IPsec加密後是看不出來的喔！

         以下命令請存成bat檔後在SQL Server端執行，效果同前一篇IPSECCMD的差不多

echo off
echo 建立安全原則
Netsh IPsec static add policy name = SQLSecurity
echo 建立篩選器動作是阻止
Netsh IPsec static add filteraction name = Prohibit action = block
echo 建立篩選器動作是交涉，並指定加密的方法
Netsh IPsec static add filteraction name = Allow action = negotiate qmsecmethods = "ESP[3DES,SHA1]:100000k/3600s"
echo 建立一個篩選器清單是可以訪問的篩選器
Netsh IPsec static add filterlist name = AllowList
Netsh IPsec static add filter filterlist = AllowList srcaddr = 10.192.168.1 dstaddr = me dstport = 1433 description = test01 protocol = TCP mirrored = yes
Netsh IPsec static add filter filterlist = AllowList srcaddr = 10.192.168.2 dstaddr = me dstport = 1433 description = test02 protocol = TCP mirrored = yes
echo 建立一個篩選器不可以訪問的篩選器
Netsh ipsec static add filter filterlist = ProhibitList Srcaddr = any  dstaddr = me dstport = 1433 description = Stop protocol =TCP mirrored = yes
echo 建立允許規則，與安全原則、篩選器清單及篩選器動作作鏈結
Netsh ipsec static add rule name = AllowRule Policy = SQLSecurity filterlist = AllowList filteraction= Allow  psk = "key123"
echo echo 建立阻止規則，與安全原則、篩選器清單及篩選器動作作鏈結
Netsh ipsec static add rule name = ProhibitRule Policy = SQLSecurity filterlist = ProhibitList filteraction= Prohibit 
echo 啟動安全原則
netsh ipsec static set policy name = SQLSecurity assign = y
pause

        以下則是Netsh IPsec的顯示命令

::1.顯示所有篩選器清單

netsh ipsec static show filterlist all

::2.顯示某個篩選器清單

netsh ipsec static show filterlist name = AllowList

::3.顯示某個篩選器清單等相關內容

netsh ipsec static show filterlist name = AllowList format= table level = verbose

::4.顯示所有安全政策，以table且符合螢幕寬度的格式顯示

netsh ipsec static show policy all wide = no format = table

        以下則是Netsh IPsec的匯出匯入命令

::5.匯出所有的規則到檔案裡

netsh ipsec static exportpolicy c:\ip.ipsec

::6.從指定檔案匯入原則

netsh ipsec static importpolicy c:\ip.ipsec

:: 匯入後再將規則啟用

netsh ipsec static set policy name=SQLSecurity assign=y

        以下則是Netsh IPsec的刪除命令 

::7.刪除所有安全策略

Netsh ipsec static delete all