Windows Firewall with Advanced Security

This topic provides an overview of Windows Firewall with Advanced Security. It includes conceptual information about what it is, how it works, and the tools you can use to configure Windows Firewall with Advanced Security and Internet Protocol security (IPsec) settings.

What is Windows Firewall with Advanced Security?

Windows Firewall with Advanced Security combines a host firewall and IPsec. Unlike a perimeter firewall, Windows Firewall with Advanced Security runs on each computer running this version of Windows and provides local protection from network attacks that might pass through your perimeter network or originate inside your organization. It also provides computer-to-computer connection security that allows you to require authentication and data protection for communications.

Windows Firewall with Advanced Security is a stateful firewall and inspects and filters all packets for IP version 4 (IPv4) and IP version 6 (IPv6) traffic. By default, incoming traffic is blocked unless it is a response to a request by the host (solicited traffic) or it is specifically allowed (that is, a firewall rule has been created to allow the traffic). You can explicitly allow traffic by specifying a port number, application name, service name, or other criteria by configuring Windows Firewall with Advanced Security settings.

Windows Firewall with Advanced Security also allows you to request or require that computers authenticate each other before communicating and use data integrity or data encryption when communicating.

How does Windows Firewall with Advanced Security work?

Windows Firewall with Advanced Security uses two sets of rules to configure how it responds to incoming and outgoing traffic. Firewall rules determine which traffic is allowed or blocked. Connection Security rules determine how traffic between this computer and other computers is secured. These rules, along with other settings, can be applied by using a firewall profile, which is applied depending on where the computer is connected. You can also monitor the firewall activities and rules.

Firewall rules

You configure firewall rules to determine whether traffic is blocked or allowed through Windows Firewall with Advanced Security. When an incoming packet reaches your computer, Windows Firewall with Advanced Security inspects the packet and determines whether it meets criteria specified in a firewall rule. If the packet matches the criteria in a rule, Windows Firewall with Advanced Security performs the action specified in the rule, either block the connection or allow the connection. If the packet does not match the criteria in a rule, Windows Firewall with Advanced Security discards the packet and creates an entry in the firewall log file (if logging is enabled). You can select from a variety of criteria when configuring a rule: for example, application names, system service names, TCP ports, UDP ports, local IP addresses, remote IP addresses, profile, interface type (for example, network adapter), users, user groups, computers, computer groups, protocols, ICMP types, and more. The criteria within a rule are added together; the more criteria you add, the more narrowly Windows Firewall with Advanced Security matches incoming traffic. For more information, see Firewall Rules.

Connection Security rules

You can use Connection Security rules to configure IPsec settings for specific connections between this computer and other computers. Windows Firewall with Advanced Security uses the rule to evaluate network traffic and then blocks or allows messages based on the criteria you establish in the rule. Under some circumstances Windows Firewall with Advanced Security will block the communication. If you have configured a setting that requires security for a connection (in either direction), and the two computers cannot authenticate each other, the connection will be blocked. For more information, see Connection Security Rules.

Firewall profiles

Firewall rules and Connection Security rules, as well as other settings, can be applied to one or more firewall profiles. These profiles are then applied to the computer, depending on where the computer is connected. You can configure a profile for when the computer is connected to a domain, a private network, such as a home network, or a public network, such as an Internet kiosk. For more information, see Firewall Profiles.

Monitoring

The Monitoring node shows information about the computer to which you are currently connected, either the local computer or a remote computer. This node is not present if you are using the snap-in to manage a Group Policy object rather than the local computer. For more information, see Monitoring Windows Firewall with Advanced Security.

Firewall and IPsec configuration tools

There are several ways to configure Windows Firewall and IPsec settings and options, including the following:

Using the Windows Firewall with Advanced Security MMC snap-in

The Windows Firewall with Advanced Security snap-in enables you to configure both firewall settings and security (IPsec) settings in one interface. You can also view the currently applied policy, rules, and other information in the Monitor node.

Note

The snap-in can be used to configure all settings for policies that are to be applied to computers running this version of Windows. To create IPsec policies for computers running an earlier version of Windows, use the IP Security Policies snap-in.

Using the Windows Firewall Control Panel

The Windows Firewall Control Panel, which is available for the local computer, also configures a limited set of the settings available through the Windows Firewall with Advanced Security MMC snap-in. For more information, see the Windows Firewall Control Panel Help.

Using the IP Security Policy MMC snap-in

This MMC snap-in can be used for configuring IPsec policies that apply to computers running earlier version of Windows and to computers running this version of Windows. This MMC snap-in is useful for environments where computers running these versions of Windows co-exist. You cannot use this snap-in to configure Windows Firewall with Advanced Security settings. For more information, see the IP Security Policy snap-in Help.

Using the IP Security Monitor MMC snap-in

This MMC snap-in can be used for monitoring IPsec security associations on earlier versions of Windows and on computers running this version of Windows. The snap-in includes a Statistics node that displays various statistics for the combined activities of both policies created with the IP Security Policy snap-in and with the Windows Firewall with Advanced Security snap-in.

Netsh commands

Netsh is a command-line tool that you can use to configure settings for network components. Windows Firewall with Advanced Security provides the netsh advfirewall context, which you can use to configure Windows Firewall with Advanced Security settings. Using netsh advfirewall, you can create scripts to automatically configure a set of Windows Firewall with Advanced Security settings for both IPv4 and IPv6 traffic. You can also use netsh advfirewall commands to display the configuration and status of Windows Firewall with Advanced Security. For more information, see the Netsh advfirewall Help.

You can also configure connection security rules by using the netsh ipsec commands and configure a more limited set of firewall settings by using netsh firewall commands. For more information, see the Netsh IPsec Help and the Netsh Firewall Help.

Group Policy settings

Windows Firewall with Advanced Security provides Group Policy settings that you can use to centrally configure and manage large numbers of computers in an organization that uses the Active Directory® Domain Service. These Group Policy settings allow you to configure Windows Firewall with Advanced Security rules, and other settings. You can find the snap-in by navigating to Computer Configuration/Windows Settings/Security Settings/Windows Firewall with Advanced Security. You can also use the Windows Firewall Administrative Template to apply settings available in earlier versions of Windows.

You can also use Group Policy to configure and distribute IPsec policies created in the IP Security Policies snap-in. For more information, see the IP Security Policy snap-in Help or the Group Policy Help.

Additional references

Firewall Rules

Connection Security Rules

Firewall Profiles

Monitoring Windows Firewall with Advanced Security


Firewall Profiles

Understanding Windows Firewall with Advanced Security profiles

A firewall profile is a way of grouping settings, such as firewall rules and connection security rules, that are applied to the computer depending on where the computer is connected. On computers running this version of Windows , there are three profiles for Windows Firewall with Advanced Security. Only one profile is applied at a time.

The following profiles are available:

Profile | Description
Domain | Applied when a computer is connected to a network in which the computer's domain account resides.
Private | Applied when a computer is connected to a network in which the computer's domain account does not reside, such as a home network. The private profile settings should be more restrictive than the domain profile settings.
Public | Applied when a computer is connected to a domain through a public network such as those available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as within an IT environment.

If you do not alter profile settings, their default values are applied whenever Windows Firewall with Advanced Security uses the profile. It is recommended that you enable Windows Firewall with Advanced Security for all three profiles.

You can configure these profiles by right-clicking the Windows Firewall with Advanced Security folder and clicking Properties. You can also access the properties from the Action menu, the Action pane, or the center pane, when the folder is highlighted.

Policies

All of the Windows Firewall with Advanced Security settings, including all three profiles, are combined into a policy. Policy files have the .wfw extension and can be imported and exported. When you import a policy, you will overwrite the current policy and the imported policy will be applied. You can import or export a policy by right-clicking the Windows Firewall with Advanced Security folder and clicking Import Policy or Export Policy. You can also select these actions from the Action menu or the Action pane.

These policies can be distributed on other computers manually or by importing the policy into a Group Policy object.

Additional references

Firewall Properties - Profiles

Windows Firewall with Advanced Security


Firewall Rules

Understanding Windows Firewall with Advanced Security rules

You create firewall rules to allow this computer to send traffic to, or receive traffic receive from, programs, system services, computers, or users. Firewall rules can be created to take one of three actions for all connections that match the rule's criteria: allow the connection, only allow a connection that is secured through the use of Internet Protocol security (IPsec), or explicitly block the connection.

Rules can be created for either inbound traffic or outbound traffic. The rule can be configured to specify the computers or users, program, service, or port and protocol. You can specify which type of network adapter the rule will be applied to: local area network (LAN), wireless, remote access, such as a virtual private network (VPN) connection, or all types. You can also configure the rule to be applied when a specific profile is in use, or when any profile is being used.

As your IT environment changes, you might have to change, create, disable, or delete rules.

Firewall rules are applied with the following precedence:

  • Authenticated bypass (in other words, rules that override block rules)

  • Block connection

  • Allow connection

  • Default profile behavior (allow connection or block connection, as specified on the Profile tab of the Windows Firewall with Advanced Security Properties dialog)

Inbound rules

Inbound rules explicitly allow, or explicitly block, traffic that matches the criteria in the rule. For example, you can configure a rule to explicitly allow traffic secured by IPsec for Remote Desktop through the firewall, but block the same traffic if it is not secured by IPsec. When Windows is first installed, inbound traffic is blocked; to allow traffic, you must create an inbound rule. You can also configure the action that Windows Firewall with Advanced Security takes, whether connections are allowed or blocked, when no inbound rule applies.

Outbound rules

Outbound rules are rules that explicitly allow, or explicitly deny, traffic originating from the computer that matches the criteria in the rule. For example, you can configure a rule to explicitly block outbound traffic to a computer through the firewall, but allow the same traffic for other computers. Outbound traffic is allowed by default, so you must create an outbound rule to block traffic.

The default action, whether connections are allowed or blocked by default, can be configured.

How firewall rules and connection security rules are related

Firewall rules allow traffic through the firewall, but do not secure that traffic. To secure traffic with IPsec, you can create connection security rules. However, the creation of a connection security rule does not allow the traffic through the firewall. You must create a firewall rule to do this, if the traffic is not allowed by the default behavior of the firewall. Connection security rules are not applied to programs or services; they are applied between the computers that make up the two endpoints.

Note

As a best practice, give the firewall rules a unique name. Unique names makes management using the netsh commands much easier.

Configuring rules

Because Windows Firewall with Advanced Security blocks all incoming unsolicited TCP/IP traffic by default, you might need to configure program, port, and system service rules for programs or services that are acting as servers, listeners, or peers. Program, port, and system service rules must be managed on an ongoing basis as your server roles or configurations change.

Important

The settings for a firewall rule add increasing levels of restriction to the criteria for which connection requests will match the rule. For example, if you do not specify a program or service on the Program and Services tab, all programs and services will be allowed to connect, if they match other criteria. Therefore, adding more detailed criteria makes the rule progressively more restrictive and less likely to be matched.

Configuring program or service settings

To add a program to the rules list, you must specify the full path to the executable (.exe) file used by the program. A system service that runs within its own unique .exe file and is not hosted by a service container is considered to be a program and can be added to the rules list. In the same way, a program that behaves like a system service and runs whether or not a user is logged on to the computer is also considered a program, as long as it runs within its own unique .exe file.

Caution

Adding service containers or programs that host services, such as Svchost.exe, Dllhost.exe, and Inetinfo.exe, to the rules list without further restrictions in the rule might expose the computer to security threats. Also, adding these containers might conflict with other service hardening policies on computers running this version of Windows.

When you add a program to the rules list, Windows Firewall with Advanced Security dynamically opens (unblocks) and closes (blocks) the ports required by the program. When the program is running and listening for incoming traffic, Windows Firewall with Advanced Security opens the required ports; when the program is not running or is not listening for incoming traffic, Windows Firewall with Advanced Security closes the ports. Because of this dynamic behavior, adding programs to the rules list is the recommended method for allowing unsolicited incoming traffic through Windows Firewall with Advanced Security.

Note

You can use program rules to allow unsolicited incoming traffic through Windows Firewall with Advanced Security only if the program uses Windows Sockets (Winsock) to create port assignments. If a program does not use Winsock to assign ports, you must determine which ports the program uses and add those ports to the rules list.

To add a system service with a service security identifier (SID) associated with it to the rules list, you use the Programs and Services tab in the Firewall Rule Properties dialog box. This provides more precise control of services because a lot of services are hosted in processes like Svchost.exe. This is a more secure method than adding the Svchost.exe process to the rules list.

Note

A system service that runs within its own unique executable (.exe) file and is not hosted by a service container is considered to be a program. Such a system service can be added to the rules list. In the same way, a program that behaves like a system service and runs whether or not a user is logged on to the computer is also considered a program as long as it runs within its own unique .exe file. Do not add service containers or programs that host services, such as Svchost.exe, Dllhost.exe, and Inetinfo.exe, to the rules list.

Configuring port and protocol settings

In some cases, if you cannot add a program or system service to the rules list, you must determine which port or ports the program or system service uses, and then add the port or ports to the Windows Firewall with Advanced Security rules list.

When you add a port to the rules list, you must specify the protocol and port number (you can specify ports with only the TCP and UDP protocols). When you add a TCP or UDP port to the rules list, the port is open (unblocked) whenever Windows Firewall with Advanced Security is running and whether or not there is a program or system service listening for incoming traffic on the port. For this reason, if you need to allow unsolicited incoming traffic through Windows Firewall with Advanced Security, you should create a program rule instead of a port rule. When you add a program to the rules list, Windows Firewall with Advanced Security dynamically opens and closes the ports required by the program. When the program is running and listening for incoming traffic, Windows Firewall opens the required ports; when the program is not running or is not listening for incoming traffic, Windows Firewall with Advanced Security closes the ports.

Configuring user or computer settings

You can configure the firewall rule to be applied only if specified users or groups request a connection or if a specified computer or group of computers request a connection. These settings will be added to any other restrictions you have specified for the rule.

Configuring scope settings

You can configure the firewall rule to be applied only if a specified computer is the local computer and a specified computer is the remote computer. You can also specify groups of computers by individual IP address, subnet, IP address range, or keyword (WINS computers, for example); however, you cannot specify an Active Directory group.

Configuring advanced settings

You usually configure Windows Firewall with Advanced Security on a global basis. For example, when you turn on Windows Firewall with Advanced Security, it is enabled on all of the network connections that already exist on your computer and all network connections that you create on your computer. Likewise, when you create a rule, the rule applies to all network connections that already exist on the computer and all network connections that you create on the computer.

You can also configure Windows Firewall with Advanced Security on an interface-type-specific basis. You can create a rule for each interface type on your computer, such as your LAN card or a wireless connection. This is useful if your computer has multiple interface types and you do not want Windows Firewall with Advanced Security enabled on all connections or you want to open different ports for each network connection.

Additional references

Firewall Profiles

Connection Security Rules


Connection Security Rules

About connection security

Connection security involves authenticating two computers before they begin communications and securing information being sent between two computers. Windows Firewall with Advanced Security incorporates the Internet Protocol security (IPsec) technology to achieve this by using key exchange, authentication, data integrity, and, optionally, data encryption.

Note

Unlike firewall rules, which operate unilaterally, connection security rules require that both computers communicating have a policy with connection security rules or another compatible IPsec policy.

How firewall rules and connection security rules are related

Firewall rules allow traffic through the firewall, but do not secure that traffic. To secure traffic with IPsec, you can create Computer Connection Security rules. However, the creation of a connection security rule does not allow the traffic through the firewall. You must create a firewall rule to do this, if the traffic is not allowed by the default behavior of the firewall. Connection security rules are not applied to programs or services; they are applied between the computers that make up the two endpoints.

Note

As a best practice, give the firewall rules unique names. Unique names make management using the netsh commands much easier.

Authentication

Authentication methods define the requirements for the way in which identities are verified before communications begin. The methods are attempted by each peer in the order they are listed. The two peers must have at least one common authentication method or communication will fail. Creating multiple authentication methods increases the chance that a common method between two computers can be found.

Key exchange

To enable secure communication, two computers must be able to gain the same shared key (session key), without sending the key across a network and compromising the secret.

The Diffie-Hellman algorithm (DH) is one of the oldest and most secure algorithms used for key exchange. The two parties publicly exchange keying information, which this version of Windows additionally protects with a hash function signature. Neither party ever exchanges the actual key; however, after their exchange of keying material, each can generate the identical shared key.

DH keying material exchanged by the two parties can be based on keying material, known as DH groups. The strength of the DH group is proportional to the strength of the key computed from the DH exchange. Strong DH groups combined with longer key lengths increase the degree of computational difficulty of determining the key.

Windows Firewall with Advanced Security uses the DH algorithm to provide the keying material for all other encryption keys. DH does not provide authentication. In the IPsec implementation of this version of Windows, identities are authenticated after the DH exchange takes place, providing protection against man-in-the-middle attacks.

You can configure key exchange settings on the IPsec Settings tab of the Windows Firewall with Advanced Security Properties dialog box.

Data protection

Data protection includes both data integrity and data encryption. Data integrity uses message hashes to ensure that information is not being changed while in transit. Hash message authentication codes (HMAC) sign packets to verify that the information received is exactly the same as the information sent. This is called integrity and it is critical when data is exchanged over unsecured media.

The hash is a cryptographic checksum or message integrity code (MIC) that each peer must compute to verify the message. For example, the sending computer uses a hash function and shared key to compute the checksum for the message, including it with the packet. The receiving computer must perform the same hash function on the received message and shared key and compare it to the original (included in the packet from the sender). If the message has changed in transit, the hash values are different and the packet is rejected.

Data encryption uses algorithms to conceal the information being transmitted. In this version of Windows, IPsec uses the United States Data Encryption Standard (DES) to provide confidentiality (data encryption). The DES algorithm was published in 1977 by the United States National Bureau of Standards. Because IPsec provides the ability to frequently regenerate keys during a communication, the entire data set will not be compromised if one DES key is broken.


Monitoring Windows Firewall with Advanced Security

Monitoring Windows Firewall with Advanced Security

Use this folder to monitor both firewall rules and connection security rules created using the Windows Firewall with Advanced Security snap-in. Policies created using the IP Security Policy snap-in cannot be viewed using this folder.

The Monitoring Overview page shows which profile is active (either domain, private, or public) and the settings for that profile.

Firewall

Use this folder to monitor all of the enabled firewall rules, including firewall rules for the active profile and firewall rules distributed by using Group Policy objects (GPOs). Only active (applied) firewall rules are monitored.

Connection security rules

This folder lists all of the enabled connection security rules with detailed information about their settings. Connection security rules use Internet Protocol security (IPsec) to secure communication between this computer and other computers. Connection security rules define which authentication, key exchange, data integrity, or encryption can be used to form a security association (SA). An SA defines the security used to protect the communication from sender to receiver.

Security associations

This folder lists all of the Main Mode and Quick Mode SAs with detailed information about their settings and endpoints.

Main Mode

This folder lists all of the Main Mode SAs with detailed information about their settings and endpoints. You can use this folder to view the IP addresses of the endpoints.

Quick Mode

This folder lists all of the Quick Mode SAs with detailed information about their settings and endpoints. You can use this folder to view the IP addresses of the endpoints.


Users and Computers

Users and computers

Use these settings to specify which remote users or user groups or remote computers or computer groups can connect with the local computer.

Important

To use these options, the firewall rule action must be set to Allow the connection if it is secure and there must be a corresponding connection security rule for the computers or users specified by this firewall rule.

The computer and user information is derived from the authentication method used by the connection security rule. The authentication method must be either a Kerberos version 5 authentication protocol authentication method or a certificate with account mapping enabled.

Only allow connections from these computers

Select the Only allow connections from these computers check box and specify which computers can connect to this computer. These computer accounts must be available in Active Directory Domain Services.

Only allow connections from/to these users

Select this check box to specify, for inbound rules, which users this computer will accept connections from, and for outbound rules, which users this computer is allowed to connect to. These user accounts must be available in Active Directory Domain Services.

Additional references

Firewall Rules

Firewall Rule Properties - Users and Computers


Monitor Connection Security Rules - General

Connection Security Rule - General Properties

Endpoint 1 IP Address This is the IP address or range of IP addresses of the first endpoint as configured on the Computers tab of the Connection Security Rule Properties page. If no endpoint is specified, Any appears.

Endpoint 1 port This is the port of the first endpoint computer or group of computers. If no port is specified, Any appears.

Endpoint 2 IP Address This is the IP address or range of IP addresses of the second endpoint as configured on the Computers tab of the Connection Security Rule Properties page. If no endpoint is specified, Any appears.

Endpoint 2 port This is the port of the second endpoint computer or group of computers. If no port is specified, Any appears.

See Also

  • Connection Security Properties - Computers


Firewall Properties - Profiles

Firewall profiles

A firewall profile is a way of grouping settings, such as firewall rules and connection security rules, that are applied to the computer depending on where the computer is connected. On computers running this version of Windows, there are three profiles for Windows Firewall with Advanced Security. Only one profile is applied at a time.

The following profiles are available:

Profile | Description
Domain | Applied when a computer is connected to a network in which the computer's domain account resides.
Private | Applied when a computer is connected to a network in which the computer's domain account does not reside, such as a home network. The private profile settings should be more restrictive than the domain profile settings.
Public | Applied when a computer is connected to a domain through a public network, such as those available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as within an IT environment.

You can configure any profile, even one that is not currently being applied. If you do not alter profile settings, their default values are applied whenever Windows Firewall with Advanced Security uses the profile. It is recommended that you enable Windows Firewall with Advanced Security for all three profiles.

A profile must be configured for both firewall rules and connection security rules.

State

State selections determine whether Windows Firewall with Advanced Security uses the profile settings and how the profile handles inbound and outbound network messages.

Firewall state

Select On (recommended) to have Windows Firewall with Advanced Security use the settings for this profile to filter network traffic. If you select Off, Windows Firewall with Advanced Security will not use any of the firewall rules or connection security rules for this profile.

Inbound connections

This setting determines the behavior for inbound connections that do not match an inbound firewall rule. The installed behavior is to block connections unless there are firewall rules to allow the connection. You can choose the following behavior for inbound connections:

Selection | Description
Block (default) | Blocks all connections that do not have firewall rules that explicitly allow the connection.
Block all connections | Blocks all connections, regardless of any firewall rules that explicitly allow the connection.
Allow | Allows the connection unless there is a firewall rule that explicitly blocks the connection.

Outbound connections

This setting determines the behavior for outbound connections that do not match an outbound firewall rule. The installed behavior is to allow connections unless there are firewall rules to block the connection. You can choose the following behavior for outbound connections:

Selection | Description
Block | Blocks all connections that do not have firewall rules that explicitly allow the connection.
Allow (default) | Allows the connection unless there is a firewall rule that explicitly blocks the connection.
Caution

If you set Outbound connections to Block and then deploy the firewall policy by using a Group Policy object, computers that receive it cannot receive subsequent Group Policy updates unless you create and deploy an outbound rule that enables Group Policy to work. Predefined rules for Core Networking include outbound rules that enable Group Policy to work. Ensure that these outbound rules are active, and thoroughly test firewall profiles before deploying.

Settings

Use these settings to configure several Windows Firewall with Advanced Security behaviors, such as who can change Windows Firewall with Advanced Security settings.

Logging

Use these settings to configure how Windows Firewall with Advanced Security logs various events, how big the log file can grow, and where the log file is located.

Additional references

Firewall Profiles

Customize Settings for a Firewall Profile

Customize Logging Settings for a Firewall Profile

Firewall Properties - IPsec


Authentication Requirements

Authentication requirements

Use this wizard page to specify how authentication is applied to inbound and outbound connections. Requesting authentication allows the communications when authentication fails; requiring authentication causes the connection to be dropped if authentication fails.

Use the Authentication Method page of the wizard to configure the credential used for authentication.

Request authentication for inbound and outbound connections

Use this option to ask that all inbound and outbound traffic be authenticated, but allow the connection if authentication fails. If authentication can proceed, that traffic will be authenticated. This option is typically used in either a low-security environment or an environment with computers that must be able to connect, but cannot perform the types of authentication available with Windows Firewall with Advanced Security.

Require authentication for inbound connections and request authentication for outbound connections

Use this option to require that all inbound traffic be authenticated or the traffic will be blocked. Outbound traffic can be authenticated but will be allowed if authentication fails. If authentication can proceed for outbound traffic, that traffic will be authenticated. This option is used most in IT environments in which the computers that must be able to connect can perform the types of authentication available with Windows Firewall with Advanced Security.

Require authentication for inbound and outbound connections

Use this option to require that all inbound and outbound traffic be authenticated or the traffic will be blocked. This option is typically used in higher-security IT environments where traffic flow must be secured and controlled and where the computers that must be able to connect can perform the types of authentication available with Windows Firewall with Advanced Security.

Additional references

Authentication Settings

First Authentication

Second Authentication

Connection Security Rules


Add or Edit IP Addresses

Add or edit IP addresses

Use this dialog box to specify computers by IP address. You can use either IPv4 or IPv6 addresses.

This IP address or subnet

You can specify a single IP address or a subnet for either IPv4 or IPv6 addresses.

This IP address range

The range consists of all IP addresses between the beginning and ending IP addresses. The range endpoints must use the same IP address version, either IPv4 or IPv6.

Predefined set of computers

You can specify one of the predefined computers: Default Gateway, WINS servers, DHCP servers, DNS servers, or Local Subnet. The Local Subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses. These addresses are resolved at runtime for each request.


Customize Service Settings

Service settings

Use the following options to configure the way in which Windows Firewall with Advanced Security responds to connection requests from or to services:

Option | Description
Apply to all programs and services | Use this option to apply the rule to all processes.
Apply to services only | Use this option to apply the rule only to services, not to other processes.
Apply to this service | From the list, select the service to which you want the rule to be applied.
Apply to service with this service short name | Specify the short name of the service to which you want the rule to be applied. You can specify any short name even if it is not in the list. Misspelled short names and short names that do not specify a service will be ignored.
Notes
  • You can specify both a program and a service in the same firewall rule. Both conditions must be met for the rule to apply to the requested connection.
  • When you select the Apply to all programs and services option, any service running as the LocalSystem or NetworkService accounts have appropriate access. When you select an option where you specify one or more services, the specific service's SID is given access.


Firewall Rule Properties - Customize ICMP Settings

ICMP Properties

Use this dialog box to configure criteria based on the Internet Control Message Protocol (ICMP).

All ICMP types

This specifies any message using the ICMP protocol.

Specific ICMP types

Use this to select one or more ICMP message types.

This ICMP type

Use this to specify any ICMP message type that is not provided by the ICMP Properties dialog box. Click Add to List to add the type to the list.

Type

This is a number that correlates to an ICMP message type. For example, 3 is the number for the "Destination Unreachable" message.

Code

This is a number that correlates to a code for an ICMP message type. These codes are details that are useful for troubleshooting and understanding the circumstances that prompted the sending of the message. The same code number can mean different things for different message types. For example, 3 is the code for "Port Unreachable" for the "Destination Unreachable" message, but it is also the code for "Redirect Datagram for the Type of Service and Host" for the "Redirect" message type.

By combining the message type and code, you can specify very detailed criteria for the exception. One use for this would be to make sure specific ICMP messages pass through Windows Firewall with Advanced Security for remote troubleshooting, while blocking other ICMP messages.

Additional references

Firewall Rules


Predefined Rules

This list shows predefined rules in a selected group and the properties of each predefined rule. Predefined rules provide the appropriate network connectivity for Microsoft® Windows® services and experiences. Most of the well-known Windows services and programs available on computers running this version of Windows and Windows Server® 2008 appear in this list.

If you select a rule or group of rules from the list that are designated Already exists in the Rules Exists column, and subsequently complete the wizard, the new settings will overwrite the predefined settings.


Monitor Quick Mode

Monitoring Quick Mode

To protect data, the Quick Mode Internet Key Exchange (IKE) negotiation establishes a secure channel between two computers. This phase involves the establishment of security associations (SAs) that are negotiated on behalf of the Internet Protocol security (IPsec) service. During Quick Mode, keying material is refreshed or, if necessary, new keys are generated. A protection suite that protects specific IP traffic is also selected. Quick Mode is not considered a complete exchange because it is dependent on a Main Mode exchange.

Monitoring Quick Mode SAs can provide information about which peers are currently connected to this computer, which protection suite was used to form the SA, and other information.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the Results pane:

  • Local IP address The local IP address.

  • Local port The TCP or UDP port of the local computer used in the filter.

  • Remote IP address The IP address of the remote computer or peer.

  • Remote port The TCP or UDP port of the remote computer used in the filter.

  • Protocol The protocol specified in the filter.

  • AH integrity The AH protocol-specific data integrity method used for peer communications.

  • ESP integrity The ESP protocol-specific encryption method used for peer communications.

  • ESP confidentiality The ESP protocol-specific encryption method used for peer communications.

To add, remove, or reorder a column

  1. Right-click in a blank area in the Results pane for the Quick Mode folder, select View, and then click Add/Remove Columns.

  2. In the Add/Remove Columns dialog box, select the column you want to view from the Available columns list, and then click Add. You can select only one column name at a time.

  3. You can also select columns that you do not want to view. From the Displayed columns list, click Remove. You can select only one column name at a time.

  4. To list the columns in the order you prefer, from left to right, select a column in the Displayed columns list, and then click Move Up or Move Down to establish the correct order. You can select only one column name at a time.

  5. When you are finished, click OK. The view will change to match your preferences.

Additional references

Monitor Main Mode


Profile

Profile

Use this wizard page to specify to which profile this firewall rule will be applied.

Domain

This rule will be applied only to the domain profile. The domain profile is applied when a computer is connected to a network in which the computer's domain account resides.

Private

This firewall rule will be applied only to the private profile. The private profile is applied when a computer is connected to a network in which the computer's domain account does not reside, such as a public network like the Internet. The private profile settings should be more restrictive than the domain profile settings.

Public

This firewall rule will be applied only to the public profile. The public profile is applied when a computer is connected to a domain through a public network, such as those available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be a tightly controlled as it is in an IT environment.

Adjusting these settings after creating a rule

You can also adjust these settings in the Firewall Rule Properties dialog box in the Inbound Rules and Outbound Rules nodes. To change the profile, use the Advanced tab.

Additional references

Firewall Profiles

Firewall Rules


Firewall Rule Properties - Protocols and Ports

Specifying Protocols and Ports

You can further refine the exception by specifying the protocol and ports to which the rule applies.

Protocol type and number

If you specified the Custom protocol type, you can specify a protocol by its protocol number. You can use any protocol number listed by the Internet Assigned Numbers Authority (IANA).

The following table provides a partial list of the protocols, their protocol numbers, and, where available, a brief description.

Protocol (Protocol Number) | Description
Any | Used so that rule settings will apply to any protocol, even if it is not in the following list.
Custom | Used to specify a protocol by its protocol number. You can use any protocol number listed by IANA.
EGP - Exterior Gateway Protocol (8) | Used for transferring routing information to gateways between autonomous systems. These autonomous systems are large networks, such as regional segments of the Internet.
GRE - Generic Routing Encapsulation (47) | Used to encapsulate a variety of generic network layer packets. The protocol is designed to be stateless.
HMP - Host Monitoring Protocol (20) | Used to collect information from hosts in various networks for the purpose of monitoring these hosts. (RFC 869).
HOPOPT - IPv6 Hop-by-Hop Option (0) | Used to alert routers that an IP datagram contains control data that the router will need to handle. The router performs additional parsing on the packets with this option set in the header. (RFC 2711)
ICMPv4 - Internet Control Message Protocol (1) | Used to send errors and other messages used to analyze networks.
ICMPv6 - Internet Control Message Protocol for IPv6 (58) | Used to send errors and other messages used to analyze networks.
IPsec AH - Internet Protocol Security (IPsec) using Authentication Header (AH) (51) | Uses the Authentication Header (AH) method to provide authentication and message integrity using a hashing function.
IPsec ESP - Internet Protocol Security (IPsec) using Encapsulating Security Payload (ESP) (50) | Uses the Encapsulating Security Payload (ESP) method to provide authentication, message integrity, and message privacy using a hashing function and encryption.
IPv6 - Internet Protocol version 6 (Related protocol numbers: 0, 43, 44, 50, 51, 59, 60) | Improves on Internet Protocol version 4 (IPv4) by vastly increasing the number of available addresses and by enabling more efficient routing, simpler configuration, built-in IP security, better support for real-time data delivery, and other essential enhancements.
IPv6NoNxt - No-Next-Header for IPv6 (59) | Used to communicate that there are no additional headers to process.
IPv6Opts - Destination Options for IPv6 (60) | Used to indicate that the next header is the Destination Options header, which is used to specify processing or delivery parameters to either intermediate or final destinations.
L2TP - Layer 2 Tunneling Protocol (115) | Used to facilitate virtual private network (VPN) connections.
RAW - (none) | Describes any IP protocol other than TCP or UDP.
RDP - Reliable Data Protocol (27) | Supports bulk transfers of data in a reliable, connection-oriented way. (RFC 908 and RFC 1151)
RVD - MIT Remote Virtual Disk Protocol (66) | This protocol is used to control computers from a remote computer.
TCP - Transmission Control Protocol (6) | Provides a reliable, connection-oriented packet delivery service and is based on point-to-point communication between two network hosts. TCP guarantees delivery and verifies sequencing for any datagrams.
UDP - User Datagram Protocol (17) | Provides fast, lightweight, unreliable transportation of data between TCP/IP hosts. Unlike TCP, UDP does not guarantee delivery or verify sequencing for any datagrams.
XNS IDP - Xerox Network Systems - Independent Datagram Protocol (22) | Used to configure, enable, and disable Xerox Network System protocol modules on both ends of a Point-to-Point Protocol (PPP) connection (RFC 1764).

Local port

If you are using the TCP or UDP protocol type, you can specify the local port by using one of the choices from the drop-down list, or by specifying a port or a list of ports. The local port is the port on the computer on which the firewall profile is applied.

Remote port

If you are using the TCP or UDP protocol type, you can specify the local port and remote port by using one of the choices from the drop-down list, or by specifying a port or a list of ports. The remote port is the port on the computer that is attempting to communicate with the computer on which the firewall profile is applied.

ICMP Settings

Click the Settings button to configure settings for Internet Control Message Protocol (ICMP). The Settings button is enabled when you choose the ICMPv4 or ICMPv6 protocol types.

Additional references

Firewall Rule Properties - Customize ICMP Settings


Choosing a Connection Security Rule Type

Choosing a connection security rule type

You can use the New Connection Security Rule wizard to create rules for the way in which Windows Firewall with Advanced Security authenticates the computers and users that match the rule criteria. Windows Firewall with Advanced Security uses Internet Protocol security (IPsec) to protect traffic using the settings in these rules.

IPsec also provides authentication, data integrity, and data privacy (encryption) according to the profile defaults configured on the IPsec Settings tab of the Windows Firewall with Advanced Security Properties dialog box.

Important

Connection security rules determine only how authentication takes place for allowed connections; they do not allow a connection. However, if you configure the connection security rule to require authentication, the rule will deny the connection if authentication fails. To allow a connection, you must create an inbound or outbound firewall rule.

The wizard provides four predefined types of rules. You can also create a custom rule that you can configure to suit your security needs.

Note

As a best practice, give connection security rules a unique name. Unique names makes management using the netsh commands much easier.

Isolation

An isolation rule restricts connections based on authentication criteria that you define. For example, you can use this rule type to isolate computers in your domain from computers outside your domain, such as computers on the Internet or another domain.

Authentication exemption

You can use this rule type to exempt specific computers or a group or range of IP addresses (computers) from being required to authenticate themselves, regardless of other connection security rules. This rule type is commonly used to grant access to infrastructure computers that this computer must communicate with before authentications can be performed. It is also used for other computers that cannot use the form of authentication you configured for this policy and profile.

Infrastructure computers, such as Active Directory domain controllers, certification authorities (CAs), or DHCP servers, might be allowed to communicate with this computer before authentication can be performed.

To create an authentication exemption rule, you only need to specify the computers or a group or range of IP addresses (computers) and give the rule a name and description (optional).

Note

Although the computers are exempt from authentication, they might still be blocked by the firewall unless a firewall rule is created to allow them to connect.

Server-to-server

Use this rule type to authenticate the communications between two specific computers, between two groups of computers, between two subnets, or between a specific computer and a group of computers or a subnet. You might use this rule to authenticate the traffic between a database server and a business-layer computer, or between an infrastructure computer and another server.

Tunnel

Use this rule type to secure communications traveling between two peer computers through tunnel endpoints, such as virtual private networking (VPN) or IPsec Layer Two Tunneling Protocol (L2TP) tunnels.

Custom

Use this rule type to create a rule that requires special settings.

Additional references

Connection Security Rules


Monitor Main Mode

Monitoring Main Mode

Main Mode negotiation establishes a secure channel between two computers by determining a set of cryptographic protection suites, exchanging keying material to establish the shared secret key, and authenticating computer identities. You can monitor Main Mode security associations (SAs) for information such as which peers are currently connected to this computer and which protection suite was used to form the SA.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the Results pane:

  • Local Address The local computer IP address.

  • Remote Address The remote computer or peer IP address.

  • 1st Authentication Method The authentication method used in creating the SA.

  • 2nd Authentication Method The authentication method used in creating the SA.

  • Encryption The encryption method used by the SA for Quick Mode key exchanges.

  • Integrity The data integrity method used by the SA for Quick Mode key exchanges.

  • Key Exchange The Diffie-Hellman group used to create the Main Mode SA.

To add, remove, or reorder a column

  1. Right-click in a blank area in the Results pane for the Main Mode folder, select View, and then click Add/Remove Columns.

  2. In the Add/Remove Columns dialog box, select the column you want to view from the Available columns list, and then click Add. You can only select one column name at a time.

  3. You can also select columns that you do not want to view. From the Displayed columns list, click Remove. You can only select one column name at a time.

  4. To list the columns in the order you prefer, from left to right, select a column in the Displayed columns list, and then click Move Up or Move Down to establish the correct order. You can only select one column name at a time.

  5. When you are finished, click OK. The view will change to match your preferences.

Additional references

Monitor Quick Mode


Monitor Firewall Rules - General

Firewall Rule Properties - General

This view shows the following information for an inbound or outbound firewall rule that is being applied to the computer:

  • Local IP address This lists the local IP address, range of addresses, or subnet to which the rule applies.

  • Remote IP address This lists the remote IP address, range of addresses, or subnet to which the rule applies.

  • Protocol This indicates the protocol type to which the rule applies.

  • Local port If the rule applies to UDP or TCP messages, this indicates the UDP or TCP port to which the rule applies, on the computer where the firewall rule is applied.

  • Remote port If the rule applies to UDP or TCP messages, this indicates the UDP or TCP port to which the rule applies, on the computer that is attempting to communicate with the computer where the firewall rule is applied.

  • Direction This indicates whether the rule is an inbound (In) or outbound (Out) rule.

  • ICMP settings If the rule applies to Internet Control Message Protocol (ICMPv4 or ICMPv6) messages, this indicates the ICMP type and code.

  • Application This indicates the program file name and path of the application to which the rule applies.

  • Service This indicates the service to which the rule applies.


Monitor Connection Security Rules - Authentication

Monitoring rule authentication

Use this tab to see details about the connection security rule specific to authentication, including the First Authentication and Second Authentication.

Note

Certificate authentication details, such as whether the Accept only health certificates or Enable Certificate to Account mapping options are being used, do not appear here. To view these details, right click the rule from the Connection Security Rules node and then select Properties to view the Connection Security Rules property dialog box.

Requirements

This refers to the action taken on connections matching the rule criteria.

First Authentication Methods

Both the First and Second Authentication methods happen during the Main Mode phase of Internet Protocol security (IPsec) negotiations. In the First Authentication, you can view how the two peer computers authenticate using the Kerberos version 5 authentication protocol, computer certificates, or a preshared key.

For First Authentication, the Details column displays information for certificates and preshared keys only. For certificates, it displays the issuer details. For a preshared key, the details display the key in plain text.

Second Authentication Methods

For Second Authentication, you can view the user authentication method: either Kerberos version 5, NTLMv2, user certificates, or a computer health certificate.

For Second Authentication, the Details column displays information for certificates and preshared keys only. For certificates, it displays the issuer details.

Additional references

Authentication Settings

First Authentication

Second Authentication


Customize Logging Settings for a Firewall Profile

Logging options

Windows Firewall with Advanced Security can be configured to log events that indicate the successes and failures of processes. The logging settings involve two groups of settings: settings for the log file itself and settings that determine which events the file will record.

You can specify where the log file will be created (or you can use an existing file), how big the file can grow, and whether you want the log file to record information about dropped packets, successful connections, or both.

Log dropped packets

Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log will detail why and when the packet was dropped.

Log successful connections

Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log will detail why and when the connection was formed.


Specify Tunnel Endpoints

Tunnel endpoints

Tunneling is the process of encapsulation, routing, and decapsulation. Tunneling wraps, or encapsulates, the original packet inside a new packet. The network can be a private intranet or the Internet. After the encapsulated packets reach their destination, the encapsulation is removed and the original packet header is used to route the packet to its final destination.

The tunnel itself is the logical data path through which the encapsulated packets travel. To the original source and destination peer, the tunnel is usually transparent and appears as just another point-to-point connection in the network path. When tunneling is combined with data confidentiality, it can be used to provide a virtual private network (VPN).

The primary reason for using Internet Protocol security (IPsec) Tunnel Mode is interoperability with other routers, gateways, or end systems that do not support L2TP/IPsec or PPTP VPN tunneling. IPsec Tunnel Mode is supported only in gateway-to-gateway tunneling scenarios and, as an advanced feature, for certain server-to-server or server-to-gateway configurations. IPsec Tunnel Mode is not supported for remote access VPN scenarios. L2TP/IPsec or PPTP should be used for remote access VPN connections.

An IPsec tunnel must be defined at both ends of the connection, and at each end, the entries for the local tunnel computer and remote tunnel computer must be swapped (because the local computer at one end of the tunnel is the remote computer at the other end, and vice versa).

Endpoints

Use these two lists to specify one or more computers that comprise the first endpoint of the tunnel. Communications pass between these computers and the computers you specify for the other endpoint. You can specify these computers by individual IP address, IP address rages, subnets, or by using predefined IP addresses, such as a gateway or DNS server.

The order of the computers in the list is not important. Any computer specified in Endpoint 1 can communicate with any computer specified in Endpoint 2.

Tunnel closest to computer in endpoint

Use these two text boxes to specify the IP address of the tunnel computer closest to the computers in an endpoint. The tunnel computer is a gateway. You can specify either an IPv4 address or an IPv6 address.

You must use the same IP address version for both ends of the tunnel. For example, if you use an IPv4 address for one end of the tunnel, you must use an IPv4 address for the other. You can, however, specify tunnel endpoints for both versions, as long as the versions on each end match.

Adjusting these settings after creating the rule

You can also adjust these settings in the <Connection Security Rule Name> Properties dialog box in the Connection Security node. To change the computers in each endpoint, use the Computers tab. To change the tunnel endpoints, on the Advanced tab, under IPsec Tunneling, click Settings.

Additional references

Add or Edit IP Addresses

Connection Security Rules


Connection Security Properties - Computers

Endpoints

Use these settings to apply the rule to a pair of computers or a set of endpoint computers. You can specify one or more computers as either endpoint. You can specify a specific IP address, a subnet, a predefined address, or an IP address range.

The computers in the list do not have any priority or order. Any computer specified for Endpoint 1 can form a connection with any computer specified for Endpoint 2.

Note

The connection security rule will apply to communications between any computer in Endpoint 1 and any computer in Endpoint 2. To have connection security rules that apply only to specific pairs of computers, create a connection security rule for each pair.

Additional references

Add or Edit IP Addresses

Connection Security Rules


Integrity Algorithms

Configuring data integrity settings

Hash message authentication codes (HMAC) sign packets to verify that the information received is exactly the same as the information sent. This is called integrity and it is critical when data is exchanged over unsecured media. Using a hash of the transmitted message makes it computationally infeasible to change the message without a resulting mismatch with the HMAC. This provides a way to know that the message was not changed during transit.

The hash is a cryptographic checksum or message integrity code (MIC) that each party must compute to verify the message. For example, the sending computer uses a hash function and shared key to compute the checksum for the message, including it with the packet. The receiving computer must perform the same hash function on the received message and shared key and compare it to the original (included in the packet from the sender). If the message has changed in transit, the hash values are different and the packet is rejected.

ESP

Encapsulating Security Payload (ESP) provides confidentiality (in addition to authentication, integrity, and anti-replay) for the IP payload. ESP in Transport Mode does not sign the entire packet. Only the IP payload (not the IP header) is protected. ESP can be used alone or in combination with AH. With ESP, the hash calculation only includes the ESP header, trailer, and payload. ESP provides data confidentiality services by encrypting the ESP payload with the Data Encryption Standard (DES) or triple DES (3DES) encryption algorithms. Packet replay services are provided through the inclusion of a sequence number for each packet.

AH

Authentication Header (AH) provides authentication, integrity, and anti-replay for the entire packet (both the IP header and the data payload carried in the packet). It does not provide confidentiality, which means that it does not encrypt the data. The data is readable, but protected from modification. (Some fields that are allowed to change in transit are excluded.) Packet replay services are provided through the inclusion of a sequence number for each packet.

Important

The AH protocol is not compatible with network address translation (NAT) because NAT devices need to change information in the packet headers. To allow IPsec-based traffic to pass through a NAT device, you must ensure that IPsec NAT-T is supported on your IPsec peer computers.

SHA1

Secure Hash Algorithm 1 (SHA1) was developed by the National Institute of Standards and Technology, as described in Federal Information Processing Standard (FIPS) PUB 180-1. The SHA process is closely modeled after MD5. The SHA1 computation results in a 160-bit hash that is used for the integrity check. Because longer hash lengths provide greater security, SHA is stronger than MD5.

MD5

Message Digest 5 (MD5) is based on RFC 1321. It was developed in response to a weakness found in MD4. MD5 completes four passes over the data blocks (MD4 completes three passes), using a different numeric constant for each word in the message on each pass. The number of 32-bit constants used during the MD5 computation equates to 64, ultimately producing a 128-bit hash that is used for the integrity check. While MD5 is more resource-intensive, it provides stronger integrity than MD4.

Caution

The MD5 algorithm is no longer considered secure because the key can be computationally derived.

Key regeneration

Lifetime settings determine when a new key is generated. Lifetimes allow you to force the generation of a new key (regeneration) after a specified interval or after a specified amount of data has been transmitted. For example, if the communication takes 100 minutes and you specify a key lifetime of 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised.

Note

This key regeneration is for data integrity only. These settings do not affect the key lifetime settings for key exchange. To change these settings, on the IPsec Settings dialog box, under Key Exchange, use the Custom option.

Key lifetime (in minutes)

You can use this setting to configure how long the key used to perform data integrity lasts, in minutes. After this interval, the key will be regenerated. Subsequent communications will use the new key.

The maximum lifetime is 2,879 minutes (48 hours). The minimum lifetime is 5 minutes.

Key lifetime (in KB)

You can use this setting to configure how many megabytes (MB) of data are sent using the key. After this threshold is reached, the counter is reset, and the key is regenerated. Subsequent communications will use the new key.

The maximum lifetime is 2,147,483,647 KB. The minimum lifetime is 20,480 MB.

Additional references

Security Method

Firewall Profiles

Advanced Integrity and Encryption

Integrity and Encryption Algorithms


Firewall Rule Properties - Scope

Scope

Scope is the local and remote addresses for an inbound or outbound firewall rule. You use scope to specify the IP addresses, ranges, subnets, or keywords (applies to remote computers only) that represent IP addresses for the local computer or the remote computer for the rule. The rule is then applied to any connection between any of the local and remote addresses that also meet the other criteria in the rule. Keywords represent sever types, such as Local Subnet, DNS Server, DHCP server, WINS Servers, and Default Gateway. IP addresses are derived by expanding keywords at run time.

The rule is applied between any computer in the Local Addresses list and any computer in the Remote Addresses list.

Additional references

Firewall Rules


Action

Action

Use this wizard page to specify the action Windows Firewall with Advanced Security will take for incoming or outgoing packets that match the firewall rule criteria.

Allow the connection

Use this option to allow a connection that matches all specified criteria. This option will allow connections no matter if they have been protected by using IPsec, as defined by a connection security rule.

Allow the connection if it is secure

Use this option to specify that only connections that are protected by using IPsec are allowed. These settings are defined in a connection security rule. Connections from computers or users that do not match the criteria in this rule will be filtered according to another rule or according to the settings for the active profile.

When you choose this option, the Users and Computers page is automatically added to the wizard. You can use this page to specify the users or computers to whom you want to grant access, or leave the page blank to allow access to all users and computers. If you choose to specify users or computers, you must use an authentication method that includes user or computer information as appropriate because Windows Firewall with Advanced Security will use the authentication method from the connection security rule to match the users and computers you specify. For example, for computers, you can use Computer (Kerberos V5) or Computer Certificate with certificate-to-account mapping enabled. If you do not specify users or computers, you can use any authentication method.

Require the connection to be encrypted

Use this option to require that all communications that match the rule criteria use data encryption as defined in a connection security rule. If the peer computer does not support data encryption, then the connection is blocked. Windows Firewall with Advanced Security uses the Data Protection settings on the IPsec Settings tab of the Windows Firewall with Advanced Security Properties dialog box.

Override block rules

Use this option to allow the connections that match this firewall rule to override any Block firewall rules. This option is also known as authenticated bypass. Normally, rules that explicitly block connections have priority over rules that allow connections. If you use this option, the connection is allowed even if another rule blocks the connection. This option is most often used for vulnerability scanners. If you do not use this option, any Block firewall rules that match the same firewall rule criteria will take precedence and the connections will be blocked. If you select this option, you must specify at least one computer or computer group for authorization on the Users and Computers page of the wizard.

Notes
  • The Override block rules option is not for outbound firewall rules.
  • Also, if you have configured Inbound connections to be Block all connections under State on the Windows Firewall with Advanced Security Properties dialog box, then the connections will be blocked, regardless of this option's setting.

Block the connection

Use this option to explicitly block communications with peers when the packet information matches the firewall rule criteria. The block action takes precedence over the allow action, unless the Override block rules option is selected when the firewall rule is created.

Adjusting these settings after creating the firewall rule

You can also adjust these settings in the Firewall Rule Properties dialog box in the Inbound Rules and Outbound Rules nodes. To change the action for a rule, right click the rule, select Properties, and then use the General tab.

Additional references

Firewall Rules

Users and Computers

Advanced Integrity and Encryption


Monitor Firewall - Advanced

Monitor Firewall - Advanced Properties

This view shows the following information for firewall rules that are being applied to this computer. These rules are the resultant set of rules that have been merged from Group Policy or Local Policy and any firewall rules specifically added to this computer:

  • User Authorization (This is the method used to authorize the user accounts associated with this exception.)

  • Computer Authorization (This is the method used to authorize the computer accounts associated with this exception.)

  • Interface Type (This is the type of network interface to which this exception is applied. The values are: Local Area Network, Remote Access, Wireless, or All connections.)

  • GPO Name (This is the name of the Group Policy object that includes the exception applied to this computer)


Interface Types

Interface types

You can specify to which interface type the rule is applied, including the local area network (LAN), a wireless network adapter, remote access, or all network connection types.

All interface types

The rule applies to communications sent through any of the network connections that you have configured on the computer.

Local area network

The rule applies only to communications sent through LAN connections that you have configured on the computer.

Remote access

The rule applies only to communications sent through any remote access, such as a virtual private network (VPN) connection or dial-up connections that you have configured on the computer.

Wireless

The rule applies only to communications sent through wireless network adapters that you have configured on the computer.


Computer Endpoints

Computer endpoints are the computers or the group of computers that form peers for the connection. You can specify a single computer, a group of computers, such as a subnet or computers in an IP address range, or one of the predefined computers: Default Gateway, WINS servers, DHCP servers, DNS servers, or Local Subnet. The Local Subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses.

Note

The connection security rule will apply to communications between any computer in Endpoint 1 and any computer in Endpoint 2. To have connection security rules that apply only to specific pairs of computers, create a connection security rule for each pair.

Additional references

Add or Edit IP Addresses


Connection Security Authentication Exemptions

You can use this rule type to exempt computers or a group or range of IP addresses (computers) from being required to authenticate themselves, regardless of other connection security rules. This rule type is commonly used to grant access to infrastructure computers that this computer must communicate with before authentications can be performed. It is also used for other computers that cannot use the form of authentication you configure for this policy and profile.

Infrastructure computers, such as Active Directory domain controllers, certification authorities (CAs), or DHCP servers, might be allowed to communicate with this computer before authentication can be performed.

To create an authentication exemption rule, you only need to specify the computers or a group or range of IP addresses (computers) and give the rule a name and description (optional).

Exempt Computers

On this wizard page, you add one or more computers or computer groups to the list to exempt them from authentication requirements. Click the Add button to specify computers by IPv4 or IPv6 address, subnet, IP address range, or by using one of the predefined IP addresses: Default Gateway, WINS servers, DHCP servers, DNS servers, or Local Subnet. The Local Subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses.

Note

Although the computers are exempt from authentication, they might still be blocked by the firewall unless a firewall rule is created to allow them to connect.

Additional references

Add or Edit IP Addresses


Customize Settings for a Firewall Profile

Settings

Use these options to define who can make changes to firewall properties and profiles.

Allow local firewall rules

Select this option when, in addition to firewall rules applied by Group Policy that are specific to this computer, you want to allow administrators to create firewall rules on this computer. When you clear this option, administrators can still create rules, but the rules will not be applied. This setting is available only when configuring the policy through Group Policy.

Allow local connection security rules

Select this option when, in addition to connection security rules applied by Group Policy that are specific to this computer, you want to allow administrators to create connection security rules on this computer. When this option is cleared, administrators can still create rules, but the rules will not be applied.

Display a notification when a program is blocked

Select this option to have Windows Firewall with Advanced Security display notifications to the user when a program is blocked from receiving inbound connections.

Allow unicast response to multicast or broadcast requests

This option is useful if you need to control whether this computer receives unicast responses to its outgoing multicast or broadcast messages. If you enable this setting, and this computer sends multicast or broadcast messages to other computers, Windows Firewall with Advanced Security waits as long as three seconds for unicast responses from the other computers and then blocks all later responses. If you disable this setting, and this computer sends a multicast or broadcast message to other computers, Windows Firewall with Advanced Security blocks the unicast responses sent by those other computers.

Note

This setting has no effect if the unicast message is a response to a Dynamic Host Configuration Protocol (DHCP) broadcast message sent by this computer. Windows Firewall with Advanced Security always permits those DHCP unicast responses. However, this setting can interfere with the correct operation of any of the out-of-box discovery protocols that use broadcasts: for example, NetBIOS, SSDP, and WSDAPI.

Additional references

Firewall Rules

Connection Security Rules


Firewall Rule Properties - General

General rule properties

Name

This is the name of the firewall rule.

Note

As a best practice, give the firewall rules a unique name. Unique names makes management using the netsh commands much easier.

Description (optional)

This is a description of the rule. You can use this to provide information about the rule that can be useful, such as the rule owner, the rule requestor, or the date of creation.

Enabled

Select this check box to enable the rule. Enabling a rule causes Windows Firewall with Advanced Security to filter connections according to the criteria in this rule.

Action

Select one of these options to determine which action Windows Firewall with Advanced Security will take for incoming or outgoing packets that match the firewall rule criteria.

Firewall rules are applied with the following precedence:

  • Allow this firewall rule to override block rules

  • Block connection

  • Allow connection

  • Default profile behavior (allow connection or block connection, as specified on the Profile tab of the Windows Firewall with Advanced Security Properties dialog)

Allow the connections

Use this option to allow a connection that matches all specified criteria. This option will allow connections whether or not they have been protected by using IPsec, as defined by a connection security rule.

Allow only secure connections

Use this option to specify that only connections that are protected by using IPsec are allowed. These settings are defined in a connection security rule. Connections from computers or users that do not match the criteria in this rule will be filtered according to another rule or according to the settings for the active profile.

If you use this option and then select authorized users or authorized computers on the Users and Computers tab, you must use an authentication method that includes user or computer information as appropriate because Windows Firewall with Advanced Security will use the authentication method from the connection security rule to match the users and computers you specify on the Users and Computers tab. For example, for computers, the authentication method must include Computer (Kerberos V5) or a Computer Certificate with certificate-to-account mapping. If you do not specify users or computers, you can use any authentication method.
Require encryption

Use this option to require that all communications that match the rule criteria use data encryption as defined in a connection security rule. If the peer computer does not support data encryption, then the connection is blocked. Windows Firewall with Advanced Security uses the Data Protection settings on the IPsec Settings tab of the Windows Firewall with Advanced Security Properties dialog box.

Override block rules

Use this option to allow the connections that match this firewall rule to override any firewall rules that explicitly block connections. This option is also known as authenticated bypass. Normally, rules that explicitly block connections have priority over rules that allow connections. If you use this option, the connection is allowed even if another rule blocks the connection. This option is most often used for vulnerability scanners. If you do not use this option, any blocking firewall rules that match the same firewall rule criteria will take precedence and the connections will be blocked. If you select this option, you must specify at least one computer or computer group for authorization on the Users and Computers tab.

Notes
  • The Override block rules option is not for outbound firewall rules.
  • Also, if you have configured Inbound connections to be Block all connections under State on the Windows Firewall with Advanced Security Properties dialog box, then the connections will be blocked regardless of this option's setting.

Block the connections

Use this option to explicitly block communications with peers when the packet information matches the firewall rule criteria. The block action takes precedence over the allow action unless the Override block rules option is selected when the firewall rule is created.

Additional references

Firewall Rules


Default Settings

Default settings for Windows Firewall with Advanced Security

These are the default IPsec configuration settings for connection security rules that Windows Firewall with Advanced Security uses before any configuration changes are made.
Key Exchange

Settings | Value
Key lifetime (minutes) | 480 minutes
Key lifetime (sessions) | 0 sessions*
Key exchange algorithm | Diffie-Hellman Group 2
Security methods (integrity) | SHA1
Security methods (encryption) | AES-128 (primary)/3-DES (secondary)

*A session limit of zero (0) causes rekeys to be determined only by the Key lifetime (minutes) setting.

Data Integrity

Setting | Value
Protocol | ESP (primary)/AH (secondary)
Data integrity | SHA1
Key lifetimes | 60 minutes/100,000 KB
Data encryption

Setting | Value
Protocol | ESP
Data integrity | SHA1
Data encryption | AES-128 (primary)/3-DES (secondary)
Key lifetimes | 60 minutes/100,000 KB
Authentication Method

By default, computer Kerberos (Kerberos version 5 authentication) is used as the authentication method.

How default settings work with Group Policy

Policies created using the Windows Firewall with Advanced Security snap-in and distributed with Group Policy, are applied in this order of precedence:

  1. Highest precedence Group Policy object (GPO)

  2. Dynamic

  3. Local

  4. Service defaults (if no other defaults are configured)


Firewall Properties - IPsec

IPsec properties

Windows Firewall with Advanced Security integrates Widows Firewall features and Internet Protocol security (IPsec) into one console. These advanced options allow you to configure the key exchange, data protection (integrity and encryption), and authentication settings in ways required by your environment.

Key Exchange (Main Mode)

Key exchange settings you select here will apply to all connection security rules. To ensure successful and secure communication, Internet Key Exchange (IKE) performs a two-phase operation. Confidentiality and authentication are ensured during each phase by the use of encryption and authentication algorithms that are agreed upon by the two computers during security negotiations. With the duties split between two phases, key creation can be accomplished quickly.

During the first phase, the two computers establish a secure, authenticated channel. This is called the Phase I or Main Mode security association (SA). IKE automatically provides identity protection during this exchange.

Default

This is the key exchange settings that are installed by default or configured as defaults through Group Policy. This setting is used for all key exchanges. For more information, see Default Settings.

Advanced

Use this option to specify the key exchange settings that are applied to all key exchanges. This setting overrides the installed defaults.

Data Protection

Data protection settings you select here apply to all connection security rules created using the Windows Firewall with Advanced Security snap-in. Custom data protection settings are available using the netsh advfirewall context.

Default

This is the data integrity and encryption settings that are installed by default or configured as defaults through Group Policy. This setting is used for all key exchanges. For more information, see Default Settings.

Advanced

Use this option to specify data integrity and encryption settings that are applied by default. This setting overrides the installed defaults.

Authentication Method

Authentication method settings you select here apply only to connection security rules that have Default selected as the authentication method.

Default

This is the authentication settings that are installed by default or configured as defaults by using Group Policy. This setting is used whenever the Default method is selected on the Authentication tab of the Computer Connection Security Rule Properties dialog box. For more information, see Default Settings.

Computer and User (using Kerberos V5)

This method uses both computer and user authentication. This means that both the user and the computer must authenticate properly before communications can continue. Use this option to use user and computer authentication by default. This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Using this option effectively creates domain isolation by limiting the computers and users that can access this computer to domain-joined computers or users.

Computer (using Kerberos V5)

This method requests or requires the computer to authenticate using the Kerberos version 5 authentication protocol. You can use this method to authenticate peer computers that are part of the same domain or in separate domains that have a trust relationship. This method uses the Kerberos version 5 authentication protocol and does not require any further configuration.

This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Using this option effectively creates domain isolation by limiting the computers that can access this computer to domain-joined computer.

User (using Kerberos V5)

You can use this method to authenticate a user logged on to a remote computer that is part of the same domain or in separate domains that have a trust relationship. This method uses the Kerberos version 5 authentication protocol and does not require any further configuration. The logged-on user must have a domain account. This method requests or requires the user to authenticate using the Kerberos version 5 authentication protocol.

This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Using this option effectively creates domain isolation by limiting the users that can access this computer to domain-joined users.

Computer certificate from this certification authority

You can use this method to authenticate peer computers based on computer certificates. To use this method, you must have a certification authority (CA). This method is useful when the computers are not in a domain or are in separate domains without a two-way trust relationship. This method might require further configuration of your CA.

This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Accept only health certificates

This method requests or requires a valid health certificate to authenticate. Health certificates confirm that a computer has all of the software updates and other updates that are required for access to the network. These certificates are distributed during the Network Access Protection (NAP) process. For more information, see the NAP documentation.

Health certificates are published by Network Access Protection (NAP), a new feature in this version of Windows and Windows Server 2008, which helps you define and enforce health policies so that unhealthy computers, such as computers with viruses or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. NAP Client Management, a Microsoft Management Console (MMC) snap-in, helps you configure NAP settings on your client computers. For more information, see the NAP snap-in Help.

Note

To use this method you must have at least one NAP server set up in the domain.

This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Advanced

You can use this option to create a method that is specific to your needs. For more information, see Authentication Settings.

The Custom option allows you to specify all of the settings available with all of the other options, giving you more flexibility when configuring a firewall rule.

This setting overrides the installed defaults. However, if you create a connection security rule that uses another method, you can override this setting by selecting it using the Method setting on the Authentication tab of the Computer Connection Security Rule Properties dialog box for the specific rule.

Additional references

Connection Security Rules

Authentication Settings

Default Settings


Advanced Key Exchange Settings

Key exchange settings

Security methods

Security methods include integrity algorithms and encryption algorithms. You can use any combination of these algorithms to secure the key exchanges. You can have as many suites as you need, and you can arrange them in sequential order in the list. These suites will be attempted in the order in which you arrange them. The first set to be agreed upon by both peer computers is used. If the peer computer is not capable of using any of the suites you define, the connection will not be established.

Some algorithms are supported only by computers running this version of Windows. To add a method to the list, click Add.

Note

As a best practice, order the suites in decreasing levels of security. This ensures that the most secure method that both peers can support is used.

Key lifetimes

Lifetime settings determine when a new key is generated. Lifetimes allow you to force the generation of a new key (regeneration) after a specified interval or after a specified number of sessions. For example, if the communication takes 100 minutes and you specify a key lifetime of 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised. You can specify the lifetime in both minutes and number of sessions. The first threshold reached is used and the key is regenerated.

Shorter key lifetimes increase the security level of the exchanges, but also require more computing resources.

Key lifetime (in minutes)

You can use this setting to configure how long the key used to perform data integrity lasts, in minutes. After this interval, the key will be regenerated. Subsequent communications will use the new key.

The maximum lifetime is 2880 minutes (48 hours). The minimum lifetime is 5 minutes.

Key lifetime (in sessions)

A session is a distinct message or set of messages. This setting specifies how many sessions can be protected using the same master key information. After this threshold is reached, the counter is reset, and the key is regenerated. Subsequent communications will use the new key. The maximum lifetime is 2,147,483,647 sessions. The minimum lifetime is 0 sessions.

A session limit of zero (0) will cause rekeys to be determined only by the Key life time (minutes) setting.

Important

The higher the number of sessions allowed per master key, the greater the chances of the master key being discovered. If you want to limit the number of times this reuse occurs, you can specify a session key limit.

Key exchange algorithm

Elliptic Curve Diffie-Hellman P-384 and P-256

Elliptic Curve Cryptography (ECC) uses mathematical algorithms that provide a much higher level of security than standard Diffie-Hellman (DH) algorithms while requiring only slightly greater resources. For example, a 256-bit ECC parameter has the same equivalent protection as a 3,072-bit standard DH parameter. A 384-bit ECC parameter has the same equivalent protection as a 7,680-bit standard DH parameter.

Note

The ECC P-384, P-256, and DH Group 14 algorithms are not available on earlier versions of Windows. If you are protecting communications with Windows XP or Windows 2000, then you should use the DH Group 2 key exchange algorithm.

Diffie-Hellman Group 14, Group 2, and Group 1

Windows Firewall with Advanced Security supports the following DH groups (in order of descending strength):

  • Diffie-Hellman Group 14 (2048 bits)

  • Diffie-Hellman Group 2 (1024 bits)

  • Diffie-Hellman Group 1 (768 bits)

    Caution

    We recommend that you do not use Diffie-Hellman Group 1 in a production environment because it is no longer considered to be a secure choice. It is provided only for interoperability with earlier operating systems. Use DH Group 2, Group 14, or one of the Elliptic Curve DH groups to secure your network traffic.

    Note

    DH Group 14 and the Elliptic Curve DH algorithms are not available on earlier versions of Windows. If you are protecting communications with Windows XP or Windows 2000, then you should use the DH Group 2 key exchange algorithm.

More information about key exchange and key management

Dynamic rekeying

Windows Firewall with Advanced Security uses keys to protect data that is communicated between computers. It also controls how often a new key is generated during communication, using a method called dynamic rekeying. The communication is sent in blocks; each block of data is secured with a different key. This prevents an attacker who has obtained part of a communication and the corresponding session keys from obtaining the remainder of the communication. If no values are configured, keys are regenerated automatically at default intervals.

Session key refresh limit

Repeated rekeying based on a session key can compromise the Diffie-Hellman shared secret. Because of this, a session key refresh limit is implemented.

For example, Alice on Computer A sends a message to Bob on Computer B, and then sends another message to Bob a few minutes later. The same session key material might be reused because an SA was recently established. If you want to limit the number of times this occurs, set the session key refresh limit to a low number.

If both a master key lifetime and a session key refresh limit are specified, the limit reached first causes the subsequent rekey. By default, IPsec policy does not specify a session key refresh limit.

Key exchange

Before secured data can be exchanged, a contract between the two computers must be established. This is a two-step process involving Main Mode and Quick Mode security associations (SAs).

An SA is the combination of a negotiated key, security protocol, and security parameters index (SPI), which together define the security used to protect the communication from sender to receiver. The SPI is a unique, identifying value in the SA that is used to distinguish among multiple SAs that exist at the receiving computer. For example, multiple associations might exist if a computer is securely communicating with multiple computers at the same time. This is a common occurrence when the computer is a file server or a remote access server that serves multiple clients. In these situations, the receiving computer uses the SPI to determine which SA is used to process the incoming packets.

SA lifetimes

The Main Mode SA is cached to allow multiple Quick Mode SA negotiations (unless master key PFS is enabled). When a key lifetime is reached for the master or session key, the SA is renegotiated. In addition, the key is refreshed or regenerated.

When the default timeout period elapses for the Main Mode SA, or the master or session key lifetime is reached, a delete message is sent to the responder, which tells the responder to cause the Main Mode SA to expire. This prevents additional new Quick Mode SAs from being created from the expired Main Mode SA. IKE does not cause the Quick Mode SA to expire because only the IPsec driver contains the number of seconds or bytes that have passed to reach the key lifetime.

Use caution when setting very different key lifetimes for master and session keys. For example, setting a master key lifetime of eight hours and a session key lifetime of two hours might leave a Quick Mode SA in place for almost two hours after the Main Mode SA has expired. This occurs when the Quick Mode SA is generated shortly before Main Mode SA expiration.

Additional references

Security Method


Firewall Rule Properties - Advanced

Advanced properties

Use this dialog box to configure the profile and interface type to which this firewall rule will be applied.

Profiles

A firewall profile is a way of grouping settings, such as firewall rules and connection security rules, that are applied to the computer depending on where the computer is connected. On computers running this version of Windows, there are three profiles for Windows Firewall with Advanced Security. Only one profile is applied at a time.

The following profiles are available:

Profile | Description
Domain | Applied when a computer is connected to a network in which the computer's domain account resides.
Private | Applied when a computer is connected to a network in which the computer's domain account does not reside, such as a home network. The private profile settings should be more restrictive than the domain profile settings.
Public | Applied when a computer is connected to a domain through a public network, such as those available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as within an IT environment.

Interface types

Click Customize to specify to which interface type the connection security rule is applied, including the local area network (LAN), a wireless network adapter, remote access, or all network connection types.

Edge traversal

Select Allow edge traversal to have the application, service or port to which the rule applies globally addressable and accessible from outside a NAT or edge device.

Additional references

Firewall Rules

Firewall Profiles

Interface Types


Integrity and Encryption Algorithms

Protocol

ESP

Encapsulating Security Payload (ESP) provides confidentiality (in addition to authentication, integrity, and anti-replay) for the IP payload. ESP in Transport Mode does not sign the entire packet. Only the IP payload, not the IP header, is protected. ESP can be used alone or in combination with Authentication Header (AH). With ESP, the hash calculation only includes the ESP header, trailer, and payload. ESP provides data confidentiality services by encrypting the ESP payload with the Data Encryption Standard (DES) or triple DES (3DES) encryption algorithms. Packet replay services are provided through the inclusion of a sequence number for each packet.

ESP and AH

This option combines the security of the ESP protocol with the AH protocol. AH provides authentication, integrity, and anti-replay for the entire packet (both the IP header and the data payload carried in the packet).

Important

The AH protocol is not compatible with network address translation (NAT) because NAT devices need to change information in the packet headers. To allow IPsec-based traffic to pass through a NAT device, you must ensure that IPsec NAT-T is supported on your IPsec peer computers.

Encryption Algorithm

AES-256, AES-192, and AES-128

The Advanced Encryption Standard (AES) specifies a FIPS-approved cryptographic algorithm that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) information in data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits.

Note

These algorithms are supported only by computers running this version of Windows. If you are encrypting communications with an earlier version of Windows or a computer with an operating system that does not support these algorithms, you must use the 3DES (recommended) or DES algorithm.

3DES

IPsec policies allow the choice of a strong encryption algorithm, 3DES, which provides stronger encryption than DES for higher security. 3DES is a block cipher that uses a three-step encryption process that is much more secure than DES. A block cipher is an encryption algorithm that operates on a fixed size block of data.

DES

DES is a block cipher that uses a 56-bit key. A block cipher is an encryption algorithm that operates on a fixed size block of data. DES encrypts data in 64-bit blocks using a 64-bit key. The key appears to be a 64-bit key, but one bit in each of the 8 bytes is used for error checking, resulting in 56 bits of usable key.

Cipher block chaining (CBC) is also used to hide patterns of identical blocks of data within a packet. An initialization vector (an initial random number) is used as the first random block to encrypt and decrypt a block of data. Different random blocks are used in conjunction with the secret key to encrypt each successive block. This ensures that identical sets of unsecured data (plaintext) result in unique, encrypted data blocks.

Caution

This algorithm is no longer considered secure and should only be used for testing purposes or in cases where the remote computer cannot use a more secure algorithm.

Integrity Algorithm

SHA1

Secure Hash Algorithm 1 (SHA1) was developed by the National Institute of Standards and Technology, as described in Federal Information Processing Standard (FIPS) PUB 180-1. The SHA process is closely modeled after MD5. The SHA1 computation results in a 160-bit hash that is used for the integrity check. Because longer hash lengths provide greater security, SHA is stronger than MD5.

MD5

Message Digest 5 (MD5) is based on RFC 1321. It was developed in response to a weakness found in MD4. MD5 completes four passes over the data blocks (MD4 completes three passes), using a different numeric constant for each word in the message on each pass. The number of 32-bit constants used during the MD5 computation equates to 64, ultimately producing a 128-bit hash that is used for the integrity check. While MD5 is more resource-intensive, it provides stronger integrity than MD4.

Caution

The MD5 algorithm is no longer considered secure because the key can be computationally derived.

Key regeneration

Lifetime settings determine when a new key is generated. Lifetimes allow you to force the generation of a new key (regeneration) after a specified interval or after a specified amount of data has been transmitted. For example, if the communication takes 100 minutes and you specify a key lifetime of 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised.

Note

This key regeneration is for data protection (encryption) and these settings do not affect the key lifetime settings for key exchange. To change these settings, on the IPsec Settings dialog box, under Key Exchange, use the Custom option.

Key lifetime (in minutes)

You can use this setting to configure how long the key used to perform data integrity lasts, in minutes. After this interval, the key will be regenerated. Subsequent communications will use the new key.

The maximum lifetime is 2,879 minutes (48 hours). The minimum lifetime is 5 minutes.

Key lifetime (in KB)

You can use this setting to configure how many kilobytes (KB) of data are sent using the key. After this threshold is reached, the counter is reset, and the key is regenerated. Subsequent communications will use the new key.

The maximum lifetime is 2,147,483,647 KB. The minimum lifetime is 20,480 KB.

Additional references

Integrity Algorithms

Advanced Integrity and Encryption

Advanced Key Exchange Settings


Program

Program

Use this wizard page to specify how Windows Firewall with Advanced Security will match criteria based on which program on the local computer is sending the packets to, or receiving the packets from, the remote computer. If all other criteria are matched, Windows Firewall with Advanced Security will take the action that you specify on the Action page.

Note

To specify services using the wizard, choose the Custom option on the Rule Type page of the wizard.

All programs

Use this option to specify that packets being received by any program will match.

This program path

Use this option to match packets from a specific program. You can either specify the program path (including environment variables) or browse to the program executable (.exe) file and select it.

Adjusting these settings after creating the firewall rule

You can also adjust these settings in the Firewall Rule Properties dialog box in the Inbound Rules and Outbound Rules nodes. To change the program path, use the Programs and Services tab.

Additional references

Firewall Rule Properties - Programs and Services


Firewall Rule Properties - Users and Computers

Authorized users and computers

Use these settings to specify which remote users or user groups or remote computers or computer groups can connect with the local computer.

Important

To use these options, the firewall rule action must be set to Allow only secure connections. There must be a corresponding connection security rule for the computers or users specified by this firewall rule.

The computer and user information is derived from the credential used by the connection security rule. The credentials must be either a Kerberos version 5 authentication protocol credential or a certificate with account mapping enabled.

Authorized computers

Select the Only allow connections from these computers check box and specify which computers can connect to this computer. These computer accounts must be available in Active Directory Domain Services.

Authorized users

Select the Only allow connections from these users check box and specify which users can connect to this computer. These user accounts must be available in Active Directory Domain Services.

Note

This option is available for inbound firewall rules only.

Additional references

Firewall Rules

Firewall Rule Properties - Users and Computers


IPsec Tunneling

IPsec tunneling

Internet Protocol security (IPsec) tunnels are used primarily for interoperability with other routers, gateways, or end systems that do not support L2TP/IPsec or PPTP connections. IPsec Tunnel Mode is supported as an advanced feature; it is used only in gateway-to-gateway (also known as router-to-router) tunneling scenarios and for server-to-server or server-to-gateway configurations. IPsec tunnels are not supported for remote access virtual private network (VPN) scenarios. L2TP/IPsec or PPTP should be used for remote access VPN connections.

IPsec can perform Layer 3 tunneling for scenarios in which Layer Two Tunneling Protocol (L2TP) cannot be used. If you are using L2TP for remote communications, no tunnel configuration is needed because the client and server VPN components of this version of Windows automatically create the rules to secure L2TP traffic

IPsec tunnels provide security for IP traffic only. The tunnel is configured to protect traffic between two endpoints that can consist of either individual IP addresses or IP subnets. If the tunnel is used between two computers instead of two routers (also known as gateways), the IP address outside the AH or ESP payload is the same as the IP address inside the AH or ESP payload. In this version of Windows, IPsec does not support protocol-specific or port-specific tunnels.

An IPsec tunnel must be defined at both ends of the connection, and at each end, the entries for the local tunnel computer and remote tunnel computer must be swapped (because the local computer at one end of the tunnel is the remote computer at the other end, and vice versa).

Tunnel computers

Enter the IPv4 or IPv6 address of the two computers that form the tunnel that are the closest to the endpoint computers. You can specify two different sets of endpoints, one using IPv4 address and the other using IPv6 addresses.

Important

You must specify the same version of IP address for both endpoints. For example, if you specify an IPv4 address for Endpoint 1, you must also specify an IPv4 address for Endpoint 2.

Additional references

Connection Security Rules


Monitor Firewall - General

Monitoring Firewall Rule - General Properties

This view shows the following information for firewall rules that are being applied to this computer. These rules are the resultant set of rules that have been merged from Group Policy or Local Policy and any firewall rules specifically added to this computer:

  • Local Address (the local IP address.)

  • Local Port (the TCP or UDP port of the local computer used in the filter.)

  • Remote Address (the remote computer or peer.)

  • Remote Port (the TCP or UDP port of the remote computer used in the filter.)

  • Direction (the direction of the connection for which the filter is created - "In" or "Out.")

  • Protocol (the protocol specified in the filter.)

  • ICMP Settings (For exceptions with ICMP properties defined, this includes the ICMP type and code.)

  • Application (For exceptions that specify a program or application, this is the path to the executable (.exe) file on the computer.)

  • Service (This is the short name of the service, if one was specified.)


Security Method

Encryption Algorithm

AES-256, AES-192, and AES-128

The Advanced Encryption Standard (AES) specifies a cryptographic algorithm approved by the Federal Information Processing Standard (FIPS) that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) information in data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits.

Note

These algorithms are supported only by computers running this version of Windows. If you are encrypting communications with an earlier version of Windows or a computer with an operating system that does not support these algorithms, you must use the 3DES (recommended) or DES algorithm.

3DES

Internet Protocol security (IPsec) policies allow the choice of a strong encryption algorithm, 3DES, which provides stronger encryption than DES for higher security. 3DES is a block cipher that uses a three-step encryption process that is much more secure than DES. A block cipher is an encryption algorithm that operates on a fixed size block of data.

DES

DES is a block cipher that uses a 56-bit key. A block cipher is an encryption algorithm that operates on a fixed size block of data. DES encrypts data in 64-bit blocks using a 64-bit key. The key appears to be a 64-bit key, but one bit in each of the 8 bytes is used for error checking, resulting in 56 bits of usable key.

Cipher block chaining (CBC) is also used to hide patterns of identical blocks of data within a packet. An initialization vector (an initial random number) is used as the first random block to encrypt and decrypt a block of data. Different random blocks are used in conjunction with the secret key to encrypt each successive block. This ensures that identical sets of unsecured data (plaintext) result in unique, encrypted data blocks.

Caution

This algorithm is no longer considered secure and should only be used for testing purposes or in cases in which the remote computer cannot use a more secure algorithm.

Integrity Algorithm

SHA1

Secure Hash Algorithm 1 (SHA1) was developed by the National Institute of Standards and Technology, as described in FIPS PUB 180-1. The SHA process is closely modeled after MD5. The SHA1 computation results in a 160-bit hash that is used for the integrity check. Because longer hash lengths provide greater security, SHA is stronger than MD5.

MD5

Message Digest 5 (MD5) is based on RFC 1321. It was developed in response to a weakness found in MD4. MD5 completes four passes over the data blocks (MD4 completes three passes), using a different numeric constant for each word in the message on each pass. The number of 32-bit constants used during the MD5 computation equates to 64, ultimately producing a 128-bit hash that is used for the integrity check. While MD5 is more resource-intensive, it provides stronger integrity than MD4.

Caution

The MD5 algorithm is no longer considered secure because the key can be computationally derived.

Additional references

Advanced Key Exchange Settings


Authentication Methods

Authentication methods

Default

Select this option to use the authentication method as configured on the IPsec Settings tab of the Windows Firewall with Advanced Security Properties dialog box.

Computer and user (Kerberos V5)

This method uses both computer and user authentication. This means that you can request or require both the user and the computer to authenticate before communications can continue. The Kerberos version 5 authentication protocol can only be used if both computers and users are members of a domain.

Computer (Kerberos V5)

This method requests or requires the computer to authenticate using the Kerberos version 5 authentication protocol. The Kerberos version 5 authentication protocol can only be used if both computers are members of a domain.

User (Kerberos V5)

This method requests or requires the user to authenticate using the Kerberos version 5 authentication protocol. The Kerberos version 5 authentication protocol can only be used if user is a member of a domain.

Computer certificate

This method requests or requires a valid computer certificate to authenticate. You must have at least one certification authority (CA) to use this method.

Only accept health certificates

This method requests or requires a valid health certificate to authenticate. Health certificates declare that a computer has all of the software updates and other updates that are required for access to the network. These certificates are distributed during the Network Access Protection (NAP) process. For more information, see the NAP documentation.

Advanced

You can configure any available method. You can specify methods for First Authentication and Second Authentication. First Authentication methods include Computer Kerberos, computer certificate, and a preshared key. Second Authentication methods include User Kerberos, User NTLM, user certificates, and computer health certificates.

Additional references

Authentication Settings

Authentication Requirements


Monitor Firewall Rules - Advanced

Firewall Rule Properties - Advanced

This view shows the following information for an inbound or outbound firewall rule that is being applied to this computer:

  • Authorized users This is a list of the users or groups of users authorized by this rule.

  • Authorized computers This is a list of the computers or group of computers authorized by this rule.

  • Interface types This is a list of the network interface types to which this rule applies (for example, Local Area Network, Remote Access, Wireless, or All interface types).

  • Edge traversal This indicates whether edge traversal is enabled (Yes) or disabled (No). When edge traversal is enabled, the application, service, or port to which the rule applies is globally addressable and accessible from outside a network address translation (NAT) or edge device.

  • Rule source This indicates that the rule is either a Local Setting or indicates the name of the Group Policy object (GPO) applied to the computer.


Choosing a Firewall Rule Type

Choosing a firewall rule type

Windows Firewall with Advanced Security provides four basic types of firewall rules. By using one of these firewall rule types, you can create exceptions to explicitly allow or explicitly deny a connection through the firewall.

You can change the settings for any of these firewall rules after you create them. You can add further specificity to the criteria for the firewall rule, for example, to specify to which users or computers the firewall rule applies, to which scope the firewall rule applies, and to which interface types the firewall rule applies. To make these changes, right-click the firewall rule in the Results pane and select Properties.

Note

As a best practice, give the firewall rules a unique name. Unique names make management using the netsh commands much easier.

Program

You can use this type of firewall rule to allow a connection based on the program that is trying to connect. This provides easy configuration to allow connections for Microsoft Outlook or other programs. It is also useful if you are not sure of the port or other settings required to allow access. You only need to specify the path to the program executable (.exe) file.

Port

You can use this type of firewall rule to allow a connection based on the port over which the remote user or computer is trying to connect. You specify the protocol (either UDP or TCP) and the local port. You can specify more than one port number.

Predefined

You can use this type of firewall rule to allow a connection by selecting one of the programs or experiences from the list. Most of the well known services and programs available on computers running this version of Windows appear in this list.

Custom

You can use this type of firewall rule to create a firewall rule that you can configure as needed to allow a connection based on criteria not covered by the other types of firewall rules.

Additional references

Firewall Rules


Second Authentication

Second Authentication

The Second Authentication method is performed by Authenticated IP in an Extended Mode of the Main Mode phase of IPsec negotiations. In this authentication, you can specify how the user authenticates: through the Kerberos version 5 authentication protocol, user NTLM, or a user certificate. You can also specify that the computer must have a computer health certificate. To use the Kerberos version 5 authentication protocol, both computers must belong to an Active Directory domain. If they are in separate domains, the domains must have a trust relationship between them. To use certificates, you must have a certification authority (CA).

You can specify multiple methods to use for this authentication. The methods are attempted in the order you specify. The first successful method is used.

Caution

Configuring both the First Authentication and Second Authentication to be optional is not recommended. This is equivalent to turning authentication off. For a more secure environment, you should require at least First Authentication.

User Kerberos

You can use this method to authenticate a user logged on to a remote computer that is part of the same domain or in separate domains that have a trust relationship. This method uses the Kerberos version 5 authentication protocol. The logged-on user must have a domain account and the computer must be a domain member.

User NTLM

Windows Challenge/Response (NTLM) is the authentication protocol used on networks that include systems running an earlier version of the Windows operating system and on stand-alone systems.

The Microsoft Kerberos security package adds greater security to networked systems than NTLM. Although Microsoft Kerberos is the protocol of choice, NTLM is still supported and must be used for network authentication if the network includes systems running earlier versions of the Windows operating system. NTLM must also be used for logon authentication on stand-alone systems.

User certificate

You can use this method to authenticate peers based on user certificates. To use this method, you must have a CA. This method is useful when the users are not in the same domain or are in separate domains without a two-way trust relationship. This method might require further configuration of your CA.

Enable Certificate to Account mapping

For user certificates, this allows you to map a certificate to a user account in Active Directory.

Computer health certificate

Health certificates are published by Network Access Protection (NAP), a new feature in this version of Windows, which helps you define and enforce health policies so that unhealthy computers, such as computers with viruses or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. NAP Client Management, a Microsoft Management Console (MMC) snap-in, helps you configure NAP settings on your client computers. For more information, see the NAP snap-in Help.

Note

To use this method, you must have at least one NAP server set up in the domain.

Enable Certificate to Account mapping

For computer certificates, this allows you to map a certificate to one or more computer accounts in Active Directory. This allows you to use a single certificate for a group of computers.

Additional references

Authentication Settings

First Authentication


Protocols and Ports

Specify protocol and ports

Use this wizard page to specify which protocol and which port, or ports, Windows Firewall with Advanced Security will match and act upon. Windows Firewall with Advanced Security inspects the inbound packets (for inbound firewall rules) and outbound packets (for outbound firewall rules) and matches the protocol and port information in the packet with firewall rules. If all other rule criteria match, Windows Firewall with Advanced Security then takes the action that you specify on the Action page.

Protocol

Use this to select which protocol Windows Firewall with Advanced Security will match. You can specify either the TCP or UDP protocol, but not both.

Port

Use this to specify which local port, or ports, Windows Firewall with Advanced Security will match. The port is the port on the local computer. You can specify that All local ports will match or you can specify one or more Specific local ports by using a comma-delimited list.

Adjusting these settings after creating the firewall rule

You can also adjust these settings in the Firewall Rule Properties dialog box in the Inbound Rules and Outbound Rules nodes. To change the protocol and port, use the Protocols and Ports tab.

Note

The list of available protocols in the property dialog box is more extensive than in the wizard. You can specify a different port for the local computer and remote computer and specify ICMP properties.

Additional references

Firewall Rule Properties - Protocols and Ports

Firewall Rules


Connection Security Properties - Advanced

Profile

Select the profile to which the connection security rule applies. You can apply the rule to the domain profile, public profile, or private profile.

Profile | Description
Domain | Applied when a computer is connected to a network in which the computer's domain account resides.
Private | Applied when a computer is connected to a network in which the computer's domain account does not reside, such as a home network. The private profile settings should be more restrictive than the domain profile.
Public | Applied when a computer is connected to a domain through a public network, such as those available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as within an IT environment.

Interface types

You can use this setting to specify to which interface type this rule applies. You have different rules that regulate traffic for different types of traffic. For example, if you specify only the wireless interface type for this rule, then Windows Firewall with Advanced Security will only take the action specified by the rule for wireless traffic. The default setting is All interface types.

Click the Settings button to select either all interface types or specific interface types.

IPsec tunneling

Configure this setting if you are creating firewall rules for traffic that passes between computers or through gateways that do not support L2TP/IPsec or PPTP VPN connections.

Windows Firewall with Advanced Security can use Internet Protocol security (IPsec) to perform Layer 3 tunneling for scenarios in which Layer Two Tunneling Protocol (L2TP) cannot be used. If you are using L2TP for remote communications, no tunnel configuration is required because the client and server VPN components of this version of Windows create the rules to secure L2TP traffic automatically.

You can specify either an IPv4 address or an IPv6 address. You must specify an endpoint for each side of the tunnel. The address protocol version must be the same for both sides. That is, if you specify an IPv6 address for the local side of the tunnel, then you must also use an IPv6 address for the remote side of the tunnel. If you do not specify tunnel endpoints, the connection security rule specifies an IPsec transport connection.

Additional references

Connection Security Rules

Firewall Profiles

IPsec Tunneling

Interface Types


Monitor Connection Security Rules - Advanced

Advanced rule properties

Local tunnel computer/Remote tunnel computer

These are the IP addresses of the two tunnel computers.

Interface types

This is the type of network interface to which this exception is applied. The values are: Local Area Network, Remote Access, Wireless, or All interface types.

Rule source

Indicates that the rule is the result of a Local Setting or lists the name of the Group Policy object that includes the connection security rule applied to this computer.

See Also

  • IPsec Tunneling
  • Interface Types


Firewall Rule Properties - Programs and Services

Programs and services

Use this tab to specify how Windows Firewall with Advanced Security will match criteria based on which program or service on the local computer is sending the packets to the peer computer. When this criteria is matched, and all other criteria are matched, Windows Firewall with Advanced Security will take the action that you specify in the Action section of the General tab.

Programs

All programs that meet the specified conditions

Use this option to specify that packets being sent by any program will match.

This program

Use this option to match packets from a specified program. You can either specify the program path (including environment variables) or you can browse to the program executable (.exe) file and select it.

Services

Click Settings to match packets from all services on the computer or a specified service. You can also specify that only packets sent by services will apply to this firewall rule. For more information about specifying services, see Customize Service Settings.

Configuring program or service settings

To add a program to the rule, you must specify the .exe file used by the program. A system service that runs within its own unique .exe file and is not hosted by a service container is considered to be a program and can be added to the rule. In the same way, a program that behaves like a system service and runs whether or not a user is logged on to the computer is also considered a program as long as it runs within its own unique .exe file.

Caution

Adding service containers or programs that host services, such as Svchost.exe, Dllhost.exe, and Inetinfo.exe, to the rules list without further restrictions in the rule might expose the computer to security threats. Also, adding these containers might conflict with other service-hardening policies on computers running this version of Windows.

When you add a program to the rule, Windows Firewall with Advanced Security dynamically opens (unblocks) and closes (blocks) the ports required by the program. When the program is running and listening for incoming traffic, Windows Firewall with Advanced Security opens the required ports; when the program is not running or is not listening for incoming traffic, Windows Firewall with Advanced Security closes the ports. Because of this dynamic behavior, adding programs to a rule is the recommended method for allowing unsolicited incoming traffic through Windows Firewall with Advanced Security.

Note

You can use program rules to allow unsolicited incoming traffic through Windows Firewall with Advanced Security only if the program uses Windows Sockets (Winsock) to create port assignments. If a program does not use Winsock to assign ports, you must determine which ports the program uses and add those ports to the rules list.

In addition to adding program rules, you can also edit and delete program rules. Editing a program rule allows you to change the path or file name that is associated with the program and configure scope settings for the rule. Deleting a program from the rules list prevents the program from receiving unsolicited incoming traffic (unless a port rule or some other rule allows unsolicited incoming traffic to reach the program).

To add a system service with an associated service SID to the rule, you use the Programs and Services tab in the <Rule Name> Properties dialog box. This provides more precise control of services because a lot of services are hosted in processes like Svchost.exe. This method is more secure than adding the Svchost.exe process to the rules list.

Additional references

Firewall Rules

Firewall Rule Properties - Programs and Services

Customize Service Settings


Advanced Integrity and Encryption

Use this dialog box to add, edit, change priority, or remove data integrity or data encryption algorithms. You can use more than one algorithm in each list and you can assign the order in which the algorithms are attempted. The first algorithm in the list that is compatible with both peers will be used.

A best practice is to list the algorithms in order of greatest security to least security. This way, the most secure algorithm is used. The less secure algorithms can be used for backward compatibility.

Additional references

Integrity Algorithms

Integrity and Encryption Algorithms


Authentication Settings

Authentication settings

Windows Firewall with Advanced Security integrates Windows Firewall features and Internet Protocol security (IPsec) security into one console. These settings allow you to configure the authentication in ways required by your environment. You can configure advanced authentication to apply as the default for all connection security rules or on a rule-by-rule basis.

If you configure these advanced authentication settings by using the IPsec tab of the Firewall Properties dialog box, they apply when you create connection security rules that have Default selected as the authentication method.

If you configure these advanced authentication settings by using the Authentication tab of the Connection Security Properties dialog box, the settings will apply only to the connection security rule whose properties you are editing.

Caution

It is not recommended that you configure both the First Authentication and Second Authentication to be optional. This is equivalent to turning authentication off.

First Authentication

The First Authentication method is performed during the Main Mode phase of IPsec negotiations. In this authentication, you can specify how the peer computer authenticates using the Kerberos version 5 authentication protocol, computer NTLM, computer certificates, or a preshared key. To use the Kerberos version 5 authentication protocol, both computers must belong to an Active Directory domain. If they are in separate domains, the domains must have a trust relationship between them. To use certificates, you must have a certification authority (CA).

You can specify multiple methods to use for this authentication. The methods are attempted in the order you specify; the first successful method is used.

First Authentication is optional

You can select this option to have the First Authentication performed with anonymous credentials. This is useful when the Second Authentication provides the primary, required means of authentication, and the First Authentication is to be performed only when both peers support it. For example, if you want to require User (Kerberos V5) authentication, which is only available as a Second Authentication, you can select First authentication is optional and select User (Kerberos V5) as the Second Authentication.

Second Authentication

With Second Authentication, you can specify how the user logged on to the peer computer authenticates, using the Kerberos version 5 authentication protocol, user certificates, or a computer health certificate. To use the Kerberos version 5 authentication protocol, both computers must belong to an Active Directory domain. If they are in separate domains, the domains must have a trust relationship between them. To use certificates, you must have a CA in your domain.

You can specify multiple methods to use for this authentication. You must use either all user-based authentication methods or all computer-based authentication methods. You cannot use the Second Authentication if you are using a preshared key for the First Authentication method regardless of where it appears on the list. The methods are attempted in the order you specify; the first successful method is used.

Second Authentication is optional

You can select this option to have the Second Authentication performed only opportunistically. This is useful when the First Authentication provides the primary, required means of authentication, and the Second Authentication is to be performed opportunistically when both peers support it. For example, if you want to require Computer (Kerberos V5) authentication and you'd like to opportunistically use User (Kerberos V5) authentication, you can select Computer (Kerberos V5) as the First Authentication, and select User (Kerberos V5) as the Second Authentication with Second authentication is optional selected.

Additional references

First Authentication

Second Authentication


First Authentication

First Authentication

The First Authentication method is performed during the Main Mode phase of Internet Protocol security (IPsec) negotiations. In this authentication, you can specify how the peer computer authenticates, using the Kerberos version 5 authentication protocol, computer NTLM, computer certificates, or a preshared key. To use the Kerberos version 5 authentication protocol, both computers must belong to an Active Directory domain. If they are in separate domains, the domains must have a trust relationship between them. To use certificates, you must have a certification authority (CA).

You can specify multiple methods to use for this authentication. The methods are attempted in the order you specify. The first successful method is used.

Caution

Configuring both the First Authentication and Second Authentication to be optional is not recommended. This is equivalent to turning authentication off. For a more secure environment, you should require at least First Authentication.

Computer (Kerberos V5)

You can use this method to authenticate peer computers that are part of the same domain or in separate domains that have a trust relationship. This method uses the Kerberos version 5 authentication protocol.

Computer certificate from this certification authority (CA)

You can use this method to authenticate peer computers based on computer certificates. To use this method, you must have a CA set up in your domain. This method is useful when the computers are not in a domain or are in separate domains without a two-way trust relationship. This method might require further configuration of your CA.
Accept only health certificates

Health certificates are published by Network Access Protection (NAP), a new feature in this version of Windows, which helps you define and enforce health policies so that unhealthy computers, such as computers with viruses or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. NAP Client Management, a Microsoft Management Console (MMC) snap-in, helps you configure NAP settings on your client computers. For more information, see the NAP snap-in Help.

Note

To use this method, you must have a NAP server set up in the domain.

Enable certificate to account mapping

For computer certificates, this allows you to map a certificate to one or more computer accounts in Active Directory. This allows you to use a single certificate for a group of computers.

Preshared key (not recommended)

You can use preshared keys for authentication. This is a shared, secret key that is previously agreed on by two users. Both parties must manually configure IPsec to use this preshared key. During security negotiation, information is encrypted by using the shared key before transmission and decrypted by using the same key on the receiving end. If the receiver can decrypt the information, identities are considered to be authenticated.

Caution
  • Preshared key methodology is provided for interoperability purposes and to adhere to IPsec standards. You should use the preshared key for testing purposes only. Regular use of preshared key authentication is not recommended because the authentication key is stored in an unprotected state in the IPsec policy.
  • If a preshared key is used for the Main Mode authentication, Quick Mode authentication cannot be used.

Additional references

Authentication Settings

Second Authentication