Monitoring IPSec

Using the IP Security Monitor Snap-In to Monitor IPSec

The IP Security Monitor snap-in, a new feature in Windows Server 2003, can be used to monitor and troubleshoot IPSec activity. The IP Security Monitor snap-in provides enhanced IPSec security monitoring. As long as the IPSec policy is active, you can monitor how the IPSec policy is functioning within your networking environment through the IP Security Monitor.

The main administrative activities which you can perform through the IP Security Monitor snap-in are listed here:

By default, the computer which is listed in the IP Security Monitor snap-in is the local computer. You can though add another computer(s) which you want to monitor to the IP Security Monitor snap-in.

To add other computers to the IP Security Monitor snap-in,

  1. Open the IP Security Monitor.
  2. In the left pane, right-click the IP Security Monitor node and then click Add Computer on the shortcut menu.

The information which is displayed in the IP Security Monitor snap-in is categorized into the following three nodes:

IPSec information, on which IPSec policy is assigned, is displayed under the Active Policy node within the IP Security Monitor tool. This includes the following IPSec policy information:

For the Main Mode and Quick Mode nodes, you can view IP Security statistics by clicking the Statistics node contained within the Main Mode node and Quick Mode node. It is this Statistics node which should be used to monitor IPSec activity:

The various Main mode statistics, together with a brief description on what each statistic tracks are listed here:

The various Quick mode statistics, together with a brief description on what each statistic tracks are listed here:

How to monitor IPSec with the Security Monitor

  1. Click Start, click Run, type mmc in the Run dialog box, and then click OK.
  2. Click the File Menu item and select Add/Remove Snap-in.
  3. The Add/Remove Snap-in dialog box opens. Click Add.
  4. The Add Standalone Snap-In dialog box opens.
  5. In the Available Standalone Snap-ins list, select IP Security Monitor, and then click Add.
  6. The Select Computer Or Domain dialog box opens.
  7. Click the Local Computer option.
  8. Click Finish.
  9. Click Close to close the Add Standalone Snap-in dialog box.
  10. Click OK to close the Add/Remove Snap-in dialog box.
    11. 1
  11. To add another computer to the IP Security Monitor console, right-click IP Security Monitor and then select Add Computer from the shortcut menu.
    12. 1
  12. To view active policy information, double-click the Active Policy node.
    13. 1
  13. To view IP Security statistics for Main mode, expand the Main Mode node in the left pane and then click Statistics.
    14. 1
  14. To view IP Security statistics for Quick mode, expand the Quick Mode node in the left pane and then click Statistics.

Using the Netsh command command-line utility to Monitor IPSec

The Netsh command-line utility can be used to view information on IPSec policies and to monitor IPSec on computers running Windows Server 2003. If you use the Netsh command-line utility to monitor IPSec, you can find and view exactly the same the information which is available for IPSec in the IP Security Monitor snap-in.

The netsh diag command with the additional diagnostics switches which you can use at the command prompt to monitor IPSec are listed here:

Using Event Viewer to Monitor IPSec

If you configure IPSec to add events to the event logs, you can use the Event Viewer tool, located in the Administrative Tools folder, to monitor IPSec activity. Event Viewer stores events that are logged in the system log, application log, and security log.

IPSec can add events for the following:

If you want to log an event whenever a change is made to an IPSec policy, you can enable the Audit Policy Change policy.

A few IPSec event log messages are listed here:

Using Network Monitor to Monitor IPSec Activity

You can use Network Monitor to monitor network traffic, and to troubleshoot network issues or problems. Network Monitor shipped with Windows Server 2003 allow you to monitor network activity and use the gathered information to manage and optimize traffic, identify unnecessary protocols, and to detect problems with network applications and services.

In order to capture frames, you have to install the Network Monitor application and the Network Monitor driver on the server where you are going to run Network Monitor. The Network Monitor driver makes it possible for Network Monitor to receive frames from the network adapter.

The two versions of Network Monitor are:

Because of these features, you can use Network Monitor to monitor and troubleshoot IPSec traffic.

To install Network Monitor

  1. Click Start, and then click Control Panel.
  2. Click Add Or Remove Programs to open the Add Or Remove programs dialog box.
  3. Click Add/Remove Windows Components.
  4. Select Management and Monitoring Tools and click the Details button.
  5. On the Management and Monitoring Tools dialog box, select the Network Monitor Tools checkbox and click OK.
  6. Click Next when you are returned to the Windows Components Wizard.
  7. If prompted during the installation process for additional files, place the Windows Server 2003 CD-ROM into the CD-ROM drive.
  8. Click Finish on the Completing the Windows Components Wizard page.

To start a Network Monitor capture

  1. Click Start, click Administrative Tools, and then click Network Monitor.
  2. If you need to specify a network connection, expand Local Computer and then select Local Area Connection. Click OK.
  3. Click the Start command on the Action menu.
  4. If you want to examine captured data during the capture, select Stop And View from the Capture menu.

How to monitor IPSec logon activity

  1. Click Start, click Run, type mmc in the Run dialog box, and then click OK.
  2. Click the File Menu item and select Add/Remove Snap-in.
  3. The Add/Remove Snap-in dialog box opens. Click Add.
  4. The Add Standalone Snap-In dialog box opens.
  5. In the Available Standalone Snap-ins list, select Group Policy Object Editor, and then click Add.
  6. The Select Computer Or Domain dialog box opens.
  7. Click the Local Computer option.
  8. Click Finish.
  9. Click Close to close the Add Standalone Snap-in dialog box.
  10. Click OK to close the Add/Remove Snap-in dialog box.
  11. Navigate to the Audit Policy node.
  12. Double-click Audit Logon Events.
  13. The Local Security Policy Setting dialog box opens.
  14. Enable the Success checkbox and the Failure checkbox and then click OK.
  15. Double-click Audit Object Access.
  16. Enable the Success checkbox and the Failure checkbox.
  17. Click OK.
  18. You can now view the event log to determine whether IPSec negotiations were successful or not.


Top 5 Free Networking Tools

Bookmark Monitoring IPSec

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.