Evaluating ICF

In response to a continuous onslaught of malicious Internet cracking, Microsoft has included the bare-bones Internet Connection Firewall (ICF) with Windows XP Home Edition and XP Professional Edition. This firewall lacks many of the frills of commercially available personal firewalls, but if you configure it correctly, ICF can provide basic, one-way security protection against mischievous probes and malicious software (malware). Let's discuss the ICF firewall and examine configuration settings that can maximize its effectiveness in your enterprise. ICF might not win any security-industry awards, but using it will make your PC and your network safer.

Getting Started
Like many of today's personal firewalls, ICF is a stateful packet-filtering firewall, which means that it automatically permits inbound network traffic that results from previously allowed outbound connections. This feature is important because many IP services dynamically generate port numbers to assign when negotiating return paths. So, although you might connect to an FTP server on TCP port 21, the server will return a random port number higher than 1024 for the subsequent two-way communication. Typically, ICF recognizes the incoming traffic as a response to the original outbound request and permits it. ICF maintains a connection flow table in memory to document established connections. As with most stateful firewalls, the algorithm that discerns the legitimacy of the traffic doesn't work perfectly in all situations. If you use Instant Messaging (IM) or other peer-to-peer services, you'll probably have to tweak ICF's default settings. . . .