IPSec Policies

IPSec Policies Overview

IPSec encrypts data information contained in IP datagrams through encapsulation to provide data integrity, data confidentiality, data origin authentication, and replay protection. The two main IPSec components that are installed when you install IPSec are the IPSec Policy Agent and the IPSec driver. The IPSec Policy Agent is a service running on a Windows Server 2003 computer that accesses IPSec policy information. The IPSec Policy Agent accesses the IPSec policy information in the local Windows registry or in Active Directory. The IPSec Policy Agent then passes this information to the IPSec driver. The IPSec driver performs a number of operations to enable secure network communications such as initiating IKE communication, creating IPSec packets, encrypts data, and calculates hashes.

IPSec policies are used to apply security in your network. The IPSec policies define when and how data should be secured. The IPSec policies also determine which security methods to use when securing data at the different levels in your network. You can configure IPSec policies so that different types of traffic are affected by each individual policy.

The different components of an IPSec policy are listed here:

IPSec policies can be applied at the following levels within a network:

When you configure and manage IPSec, you would basically be configuring the following aspects of IPSec policies:

To configure IPSec policies, you can use either of the following methods:

The IP Security Policy Management snap-in is used to manage IPSec with respect to:

When you install the IPSec IP Security Policy Management snap-in, you need to select which IPSec policy you want to manage, and on what network level you want to manage IPSec. You can select either of the following options:

Understanding Default IPSec Policies

Windows Server 2003 IPSec deployments include predefined IPSec rules, filter lists, filter actions, and three default IPSec policies. Each default IPSec policy contains a set of predefined rules, filter lists and filter actions.

Each IPSec policy is based on number of rules. An IPSec policy can contain a single rule, or a set of rules. It is these rules that enable secure connections, based on the following factors:

An IPSec rule contains the following components:

The three default IPSec policies and their predefined configuration are described below:

You can also create customized IPSec policies that include customized rules and filters that suit specific security requirements of the organization. You can also create your own IPSec policy by using the IP Security Wizard which you can initiate from within the IP Security Policy Management MMC.

For filter actions, you can select between the filter actions listed below. Remember that the filter action which is defined determines how IPSec responds to computers matching a filter list, and it determines which security methods is used:

How to view default IPSec policies

  1. Click Start, click Run, type mmc in the Run dialog box, and then click OK.
  2. Click the File Menu item, and select Add/Remove Snap-in.
  3. The Add/Remove Snap-in dialog box opens. Click Add.
  4. The Add Standalone Snap-In dialog box opens.
  5. Select Group Policy Object Editor, and then click Add.
  6. Select the Local Computer default option.
  7. Click Finish.
  8. Click Close to close the Add Standalone Snap-in dialog box.
  9. Click OK to close the Add/Remove Snap-in dialog box.
  10. Expand Local Computer Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand IP Security Policies on Active Directory.
  11. The details pane displays the default IPSec policies.
  12. Right-click the initial default IPSec policy displayed, which should be the Server (Request Security) policy, and then click Properties to open the Server (Request Security) default policy's Properties dialog box.
  13. Click the General tab. The configuration settings on the General tab are listed here:
    • The name of the policy is listed in the Name text box.
    • A description of the policy appears in the Description text box.
    • The Check For Policy Changes Every box contains the interval for which clients using this specific policy checks for policy updates.
  14. Clicking the Settings button on the General tab opens the Key Exchange Settings dialog box. On the Exchange Settings dialog box you can specify when new keys are generated for the policy.
  15. Clicking the Methods button opens the Key Exchange Security Methods dialog box. You change the IKE settings and security preference methods on this dialog box. This is where is you can change encryption, integrity, and Diffie-Hellman Group settings.
  16. To close the Key Exchange Security Methods dialog box, click Cancel.
  17. To close the Key Exchange Settings dialog box, click Cancel.
  18. The Server (Request Security) default IPSec policy's Properties dialog box should be displayed once more.
  19. Click the Rules tab.
  20. The three IPSec rules described in this Article earlier are defined on the Rules tab.
  21. Each IPSec rule has IP filter list, Filter Action, Authentication, Tunnel Endpoint, and Connection Type settings.
  22. To view the settings of a rule, click the Edit button.
  23. The Edit Rule Properties dialog box opens.
  24. The Edit Rule Properties dialog box contains the following tabs which you can use to set configuration settings for the IPSec rule:
    • IP Filter List tab; used to add, remove, and configure the filter lists for the rule. All currently configured filter lists are displayed in the IP Filter Lists list.
    • Filter Action tab; used to configure filter actions for the rule. The current filter actions defined for the rule are listed in the Filter Actions list. The Edit, Add, and Remove buttons can be used to change, add and remove filter actions for the rule. You can also specify whether the IP Security Filter Action Wizard should be initiated when a new filter action is added by enabling the Use Add Wizard checkbox.
    • Authentication Methods tab; used to set the authentication method(s) which should be used for the rule. Options include Kerberos, digital certificates, or preshared keys. If you define more than one authentication method, you can set the order of precedence for the authentication methods.
    • Tunnel Setting tab; used to configure whether the rule should establish an IPSec tunnel with another end system.
    • Connection Type tab; used to set the connection type for the rule:
      • All Network Connections option
      • Local Area Network option.
      • Remote Access option.
  25. To close the Edit Rule Properties dialog box dialog box, click Cancel.
  26. To close the Server (Request Security) Properties dialog box of the Default IPSec policy, click Cancel.

Understanding How IPSec Policy is Applied

Whenever a computer starts, the IPSec Policy Agent service starts automatically too. The IPSec Policy Agent service running on the computer accesses IPSec policy information in either the Windows registry or in Active Directory.

The main functions which the IPSec Policy Agent provides are listed below:

IPSec policies are accessed when the computer starts, and at the specific interval defined in the particular IPSec policy. For computers that belong to a domain in Active Directory but are however disconnected from the domain, then cached IPSec policy information is used.

As mentioned previously, the IPSec Policy Agent passes information to the IPSec driver. The IPSec driver performs a number of operations to enable secure network communication. The IPSec driver checks inbound and outbound packets to determine whether a packet matches criteria for secured communication. The IPSec driver checks the IP Filter List of the IPSec policy to determine this information. If a match is found, the IPSec driver uses the filter list and filter actions to determine how security should be applied.

A few functions performed by the IPSec driver are listed here:

The IKE protocol is used by computers to create a security association (SA) and to exchange information to generate Diffie-Hellman keys. IKE manages and exchanges cryptographic keys so that computers can have a common set of security settings. Negotiation occurs on which authentication method, and encryption algorithm and hashing algorithm the computers will use. The computers negotiate and agree on a number of factors, including the following:

Understanding How the IPSec driver operates

The IPSec driver operates in the following three modes:

Configuring and Assigning IPSec Policy

You can use the IP Security Policy Management snap-in to manage IPSec policy, create IPSec policies edit existing IPSec policies, and assign IPSec policies. You can use the tool to add and remove filters which are applied to IPSec policies. If you are planning a Windows Server 2003 IPSec implementation, then you have to use the Windows Server 2003 IPSec Policy Management MMC snap-in if you want to use the latest IPSec features.

You can also configure IPSec using the Netsh command-line utility. The netsh command-line utility replaces the previously used Ipsecpol.exe command-line utility. The netsh command-line utility can be used to view information on IPSec policies, configure startup security for computers, and enable IPSec driver event logging and to troubleshoot IPSec configuration.

You can assign IPSec policy at the following levels within Active Directory. You can though only apply a single IPSec policy at a specific level in Active Directory:

An IPSec policy that is assigned for a domain in Active Directory has precedence over a locally applied IPSec policy. With Active Directory, organizational units (OUs) automatically inherit the IPSec policy of their associated parent OU in Active Directory. IPSec policy assigned for an organizational unit (OU) has precedence over domain level policies for members of the specific OU. An IPSec policy that is assigned to the lowest level organizational unit has precedence over an IPSec policy which is assigned to the higher level organizational units.

How to create an MMC console for the IP Security IP Security Policy Management snap-in

  1. Click Start, click Run, type mmc in the Run dialog box, and then click OK.
  2. Click the File Menu item, and select Add/Remove Snap-in.
  3. The Add/Remove Snap-in dialog box opens. Click Add.
  4. The Add Standalone Snap-In dialog box opens.
  5. In the Available Standalone Snap-ins list, select IP Security Policy Management, and then click the Add button.
  6. The Select Computer Or Domain dialog box opens.
  7. Click the Local Computer option.
  8. Click Finish.
  9. Click Close to close the Add Standalone Snap-in dialog box.
  10. Click OK to close the Add/Remove Snap-in dialog box.

How to create a new IPSec policy

  1. Open the IP Security Policy Management console.
  2. Right-click IP Security Policies and then select Create IP Security Policy from the shortcut menu.
  3. The IP Security Policy Wizard initiates.
  4. Click Next on the IP Security Policy Wizard Welcome page.
  5. On the IP Security Policy Name page, provide a name and a description for the new IPSec policy, and then click Next.
  6. On the Requests for Secure Communication page, you can leave the Activate the default response rule option selected, or you can deselect the option. Click Next.
  7. On the Default Rule Authentication Method page, set the authentication method for the security rule, and then click Next.
  8. On the Completing the IP Security Policy Wizard page, select the Edit properties option, and then click Finish.
  9. The IP Security Policy Properties dialog box for the new policy opens so that you can change the properties of the policy, and change any security rules.
  10. Click Edit on the IP Security Policy Properties dialog box.
    11. 1
  11. When the Edit Rule Properties dialog box opens, you can add and remove security methods, modify existing security methods, set the order of precedence for security methods, and specify the utilization of session key perfect forward secrecy (PFS).
    12. 1
  12. Click the Authentication tab. This is where you add and remove authentication methods, and set the order of precedence for authentication methods.
    13. 1
  13. Click OK to close the Edit Rule Properties dialog box.
    14. 1
  14. Before you assign the IPSec policy, first ensure that the IPSec service is running.
    15. 1
  15. In the IP Security Policy Management console, right-click the new policy name that you want to assign, and then click Assign from the shortcut menu.

How to assign IPSec policy for an Active Directory domain

  1. Click Start, click Run, type mmc in the Run dialog box, and then click OK.
  2. Click the File Menu item, and select Add/Remove Snap-in.
  3. The Add/Remove Snap-in dialog box opens. Click Add.
  4. The Add Standalone Snap-In dialog box opens.
  5. Select Group Policy Object Editor, and then click Add.
  6. The Select Group Policy Object dialog box opens. Click Browse
  7. The Browse For A Group Policy Object dialog box opens.
  8. Select Default Domain Policy, and then click OK.
  9. Click Finish.
  10. Click Close to close the Add Standalone Snap-in dialog box.
    11. 1
  11. Click OK to close the Add/Remove Snap-in dialog box.
    12. 1
  12. Expand Domain Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand IP Security Policies on Active Directory.
    13. 1
  13. Select IP Security Policies On Active Directory.
    14. 1
  14. The details pane displays all available IPSec policies.
    15. 1
  15. Right-click the IPSec policy which you want to assign, and then click Assign from the shortcut menu.

How to configure a policy for IPSec tunnel mode

IPSec tunnel mode can be used to provide security for WAN and VPN connections that use the Internet as the connection medium. With tunneling, the data contained in a packet is encapsulated inside an additional packet. The new packet is then sent over the network. In tunnel mode, IPSec encrypts the IP header and the IP payload. Tunnel mode is typically used for server to server, server to gateway, and gateway to gateway configurations.

To configure an IPSec policy for IPSec tunnel mode

  1. Open the IP Security Policy Management console.
  2. Right-click the IP Security Policies On Local Computer node and select Create IP Security Policy from the shortcut menu.
  3. When the IP Security Policy Wizard initiates. click Next on the IP Security Policy Wizard Welcome page.
  4. Provide a name and a description for the new IPSec policy, and then click Next.
  5. On the Requests for Secure Communication page, disable the Activate the default response rule option, and then click Next.
  6. On the Completing the IP Security Policy Wizard page, select the Edit properties option, and then click Finish
  7. The Tunnel To Properties dialog box opens.
  8. Click Add on the Rules tab.
  9. The Create IP Security Rule Wizard starts.
  10. Click Next on the Create IP Security Rule Wizard Welcome page.
  11. On the Tunnel Endpoint page, select The Tunnel Endpoint Is Specified By The Following IP Address option, and then enter the IP address of the other machine. Click Next.
  12. On the Network Type page, select the Local Area Network (LAN) option and then click Next.
  13. Specify the All IP Traffic option and then click Next.
  14. On the Filter Action page, specify the Request Security (Optional) option and then click Next.
  15. On the Authentication Method page, specify the Active Directory Default (Kerberos V5 protocol) option and then click Next.
  16. Click Finish and then click OK.
  17. Repeat the process on the other machine.


Top 5 Free Networking Tools

Bookmark IPSec Policies

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.