Copyright: Thursday, October 07, 1999 10:32:55


The number of active security associations with this computer.


The total number of bytes sent with Confidentiality, indicating the packets were sent using the Encapsulating Security Payload (ESP) security protocol, decimal ID 50.


The total number of bytes received with Confidentiality, indicating the packets were sent using the Encapsulating Security Payload (ESP) security protocol, decimal ID 50.


The total number of bytes sent with the authentication property enabled.


The total number of bytes received with the authentication property enabled.


The total number of packets for which the Security Parameters Index (SPI) was invalid. This probably indicates the security association (SA) has expired or is no longer valid.

The SPI is a unique, identifying value in the SA which allows the receiving computer to select the SA under which a packet will be processed.


The total number of packets the receiving IPSec driver was unable to decrypt. This may indicate the security association (SA) has expired or is no longer valid, authentication failed, or integrity checking failed.


The total number of packets which could not be successfully authenticated to the IPSec driver. This may indicate the security association (SA) has expired or is no longer valid. The information in the security association is required for the IPSec driver to process the packets.

It may also indicate the two computers have incompatible authentication settings. Verify the authentication method specified for each computer is the same.


The total number of keys that ISAKMP (the ISAKMP/Oakley mechanism) sent to the IPSec driver. This indicates the ISAKMP Phase II security associations were successfully negotiated.


The total number of successful security associations established during ISAKMP Phase I. This indicates the key information exchange was successful: identities were authenticated and common keying material established.


The total number of successful security associations established during ISAKMP Phase II. This indicates the negotiation for protection services during the data transfer was successful.


The total number of ISAKMP Phase II negotiations which resulted in the computers agreeing only to a clear-text data transfer (no encryption or signing of the packets).


The total number of failures to authenticate the computer identities. Verify the authentication method settings for each computer are compatible. This may also indicate the security association has expired.


Click to set the IPSec statistics refresh rate.


The number of seconds after which the statistics displayed in IPSec Monitor will be refreshed.


Enter the refresh rate, in seconds. The statistics displayed in IPSec Monitor will be refreshed at this interval.


Statistics for IP security processes and communications.


Statistics for the ISAKMP (ISAKMP/Oakley) security mechanism.


The list of active security associations with this computer. This list shows the configuration of the active IP security policy, which was used to form the associations.


Click to minimize the IPSec Monitor console.


The current status of IP Security on the computer on or for which you are running IPSec Monitor.


Click to configure IP security policies only for this computer (the computer on which this snap-in is running).


Click to configure IP security policies for all computers in this domain (the domain to which the computer on which this snap-in is running belongs).


Click to configure IP security policies for another computer.


Enter the name of the computer for which you will be configuring IP security policies. If you click Browse, your current domain will be searched for a list of computers.


Click to select the computer for which you will be configuring IP security policies. Windows searches your current domain for a list of computers.


Displays the current policy name. Enter a unique name, up to 255 characters, that will help you quickly identify the policy.


Displays the current policy name. Enter a unique name, up to 255 characters, that will help you quickly identify the policy.


Displays the current policy description. Enter a unique description, up to 255 characters, that will help you quickly identify why the policy was created, for example, to what computers the policy applies and what communication scenarios it encompasses.


Displays the current policy description. Enter a unique description, up to 255 characters, that will help you quickly identify why the policy was created, for example, to what computers the policy applies and what communication scenarios it encompasses.


Displays the list of security methods used to protect identities during authentication and key exchange. This list is in order of precedence, and determines which security services, key settings, and algorithms will be used for protection. Unless you have special requirements, these may be left at the default settings.


Displays the list of security methods used to protect identities during authentication and key exchange. This list is in order of precedence, and determines which security services, key settings, and algorithms will be used for protection. Unless you have special requirements, these may be left at the default settings.


Click to add a new method to the list.


Click to edit the selected method.


Click to remove the selected method from the list.


Click to move the selected method up one level in order of precedence.


Click to move the selected method down one level in order of precedence.


Displays the current policy name. Enter a unique name, up to 255 characters, that will help you quickly identify the policy.


Displays the current policy description. Enter a unique description, up to 255 characters, that will help you quickly identify why the policy was created, for example, to what computers the policy applies and what communication scenarios it encompasses.


Select the algorithm for integrity:

Use MD5 for a 128 bit key.

Use SHA for a 160 bit key (stronger).


Select the algorithm for integrity:

Use MD5 for a 128 bit key.

Use SHA for a 160 bit key (stronger).


Select the algorithm for confidentiality:

Use 3DES, for the strongest encryption.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and overhead of 3DES.


Select the algorithm for confidentiality:

Use 3DES, for the strongest encryption.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and overhead of 3DES.


Select the Diffie-Hellman Group which is the basis for future keys:

Use Low (Diffie-Hellman Group 1) to provide keying material for a 96-bit key

Use Medium (Diffie-Hellman Group 2) to provide keying material for a 128-bit key (stronger)


Select the Diffie-Hellman Group which is the basis for future keys:

Use Low (Diffie-Hellman Group 1) to provide keying material for a 96-bit key

Use Medium (Diffie-Hellman Group 2) to provide keying material for a 128-bit key (stronger)


Displays the current name of the IP filter list. Enter a unique name, up to 255 characters, which will help you quickly identify the IP filter list.


Displays the current IP filter list description. Enter a unique description, up to 255 characters, that will help you quickly identify why the IP filter list was created, for example, what computers and traffic types it encompasses.


Displays the list of filters contained in this IP filter list.


Click to add a new filter to this IP filter list.


Click to edit the selected filter.


Click to remove the selected filter.


Displays the list of rules contained in this IPSec policy. A check indicates the rule is currently active. Here, you can add, edit, or remove rules. Predefined rules cannot be removed; only edited, or de-activated.


Displays the list of rules contained in this IPSec policy. A check indicates the rule is currently active. Here, you can add, edit, or remove rules. Predefined rules cannot be removed; only edited, or de-activated.


Click to add a new rule to this policy.


Click to edit the selected rule.


Click to remove the selected rule. Predefined rules cannot be removed; only edited, or de-activated.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add. The wizard will assist you in creating a new rule for this policy.


Displays the IP filter lists available to all policies. The selected list is the active IP filter list for this rule.


Click to add a new IP filter list.


Click to edit the selected IP filter list.


Click to remove the selected IP filter list. It will no longer be available to any existing or new policies.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add. The wizard will assist in creating a new IP filter list, and filters.


Displays the list of filter actions available to all IP security policies. The selected option is the active filter action for this rule.


Displays the list of filter actions available to all IP security policies. The selected option is the active filter action for this rule.


Click to add a new filter action.


Click to edit the selected filter action.


Click to remove the selected filter action. It will no longer be available to existing or new policies.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add. The wizard will assist you in creating a new filter action and security methods.


Click to disable IPSec tunneling for this rule.


Click to use IPSec tunneling for this rule, when communications will be exchanged with a specific computer only, and you know the DNS name of that computer.


Enter the DNS name of the computer with which you want to establish an IPSec tunnel.


Click to use IPSec tunneling when communications will be exchanged with a specific computer only and you know the IP Address of that computer. This option should only be used when the other computer has a static IP address.


Enter the IP address of the computer with which you want to establish an IPSec tunnel.


Click to use the default Windows 2000 authentication technology: the Kerberos V5 protocol. This method can be used for any clients running the Kerberos V5 protocol which are members of a trusted domain.

Note  Policies which specify multiple authentication methods between the same two computers for the same traffic are considered invalid.


Click to use a public key certificate from a trusted certificate authority (CA). A public key certificate should be used in situations which include Internet access, remote access to corporate resources, external business partner communications, or computers which do not run the Kerberos V5 security protocol. This requires that at least one trusted certificate authority (CA) has been configured. Windows 2000 supports X.509 Version 3 certificates, including CA certificates generated by commercial certifying authorities.

Note  Policies which specify multiple authentication methods between the same two computers for the same traffic are considered invalid.


Displays the name of the certificate authority (CA) you want to use for authentication services. Click Browse to select the CA.


Click to select a certificate authority for authentication. Windows searches your domain for a list of configured certificate authorities.


Select to use a string which you specify as a pre-shared key for authentication. This is a shared, secret key which is previously agreed upon by two users. Both computers must be configured to use the same pre-shared key. This is a simple method for authenticating non-Windows 2000-based computers, stand-alone computers, or any clients not running the Kerberos V5 protocol. Note that this key is for authentication protection only; it is not used to encrypt the IP packet during the data protection phase.

Note  Policies which specify multiple authentication methods between the same two computers for the same traffic are considered invalid.


Enter the pre-shared key (or string) you want to use for authentication.


Click to apply this rule to all network connections configured on the computers to which this policy is assigned.


Click to apply this rule only to Local Area Network connections configured on the computer s to which this policy is assigned.


Click to apply this rule only to Remote Access (Dial-up) connections configured on the computer s to which this policy is assigned.


Click to apply this rule only to this specific adapter type on the computer s to which this policy is assigned.


Select the adapter to which this rule will apply.


Select to guarantee that no previously-used keying material or keys are re-used to generate additional master keys.


Determines the interval, in minutes, after which a new key will be generated.


Enter the number of minutes after which a new key will be generated.


Determines the interval, in minutes, after which a new key will be generated.


Limits the number of times the master key can be re-used as keying material for the session key. The same master key material may be re-used since a security association was recently established with the other computer. If you want to limit the number of times this re-use occurs, specify a session key limit.

Note  If you have enabled Perfect Forward Secrecy, this parameter will be ignored.


Enter a number to limit the number of times the master key can be re-used as keying material for the session key. The same master key material may be re-used since a security association was recently established with the other computer. If you want to limit the number of times this re-use occurs, specify a session key limit.

Note  If you have enabled Perfect Forward Secrecy, this parameter will be ignored.


Limits the number of times the master key can be re-used as keying material for the session key. The same master key material may be re-used since a security association was recently established with the other computer. If you want to limit the number of times this re-use occurs, specify a session key limit.

Note  If you have enabled Perfect Forward Secrecy, this parameter will be ignored.


Click to configure security methods for the key exchange. Unless you have special requirements, these may be left at the default settings.


Select to protect data at the highest security level, using confidentiality, integrity, and authentication. The data will be encrypted, making this setting best suited to remote, or highly-sensitive intranet communications.


Select to protect data at the highest security level, using confidentiality, integrity, and authentication. The data will be encrypted, making this setting best suited to remote, or highly-sensitive intranet communications.


Select to protect data at a medium security level, using integrity, and authentication.


Select to protect data at a medium security level, using integrity, and authentication.


Select if you want to specify your own security levels.


Click to specify your own security levels.


Select to disable any future warning messages.


Select to protect data with integrity, and authentication.


Select the algorithm for integrity:

Use MD5 to provide a 128 bit key

Use SHA to provide a 160 bit key (stronger).


Select the algorithm for integrity:

Use MD5 to provide a 128 bit key

Use SHA to provide a 160 bit key (stronger).


Select to protect data with confidentiality, integrity, and authentication. The data will be encrypted, making this setting best suited to remote, or highly-sensitive intranet communications.


Select the algorithm for integrity:

Use MD5 to provide a 128 bit key

Use SHA to provide a 160 bit key (stronger).

Use None if you have also enabled Authentication Header.


Select the algorithm for integrity:

Use MD5 to provide a 128 bit key

Use SHA to provide a 160 bit key (stronger).

Use None if you have also enabled Authentication Header.


Select the algorithm for confidentiality:

Use 3DES, for the strongest encryption.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and overhead of 3DES.

Use None if you want the ESP format but don’t need privacy.


Select the algorithm for confidentiality:

Use 3DES, for the strongest encryption.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and overhead of 3DES.

Use None if you want the ESP format but don’t need privacy.


Configure to determine the interval, in seconds or in kilobytes, after which a new session key will be generated.


Configure to determine the interval, in kilobytes, after which a new session key will be generated.


Enter the number of kilobytes after which a new session key will be generated.


Configure to determine the interval, in seconds, after which a new session key will be generated.


Enter the number of seconds, after which a new session key will be generated.


Click to block negotiation for IP security. This is appropriate if you never want to secure traffic to which this rule applies.


Click to block all traffic from computers specified in the IP filter list.


Click to use the list of security methods to determine security levels for the communication. The list is in descending order of preference.


The list of security methods in descending order of preference.


The list of security methods to be used when negotiating security levels for the communication. The list is in descending order of preference.


Click to accept unsecured communication initiated by another computer, but require the computers to which this policy applies to always use secure communication when replying or initiating.


Click to allow unsecured communications to or from another computers. This is appropriate if the computers listed in the IP filter lists are not IPSec-enabled.

Caution  If negotiations for security fail, this will disable IPSec for all communications to which this rule applies.


Click to ensure that session keys or keying material are not re-used.


Click to add a new security method.


Click to edit the selected security method.


Click to remove the selected security method.


Click to move the selected security method up one level in order of preference.


Click to move the selected security method down one level in order of preference.


Displays the current policy name. Enter a unique name, up to 255 characters, that will help you quickly identify the policy.


Displays the current policy name. Enter a unique name, up to 255 characters, that will help you quickly identify the policy


Displays the current policy description. Enter a unique description, up to 255 characters, that will help you quickly identify why this policy was created, for example, to what computers the policy applies, and what communication scenarios it encompasses.


Displays the current policy description. Enter a unique description, up to 255 characters, that will help you quickly identify why this policy was created, for example, to what computers the policy applies, and what communication scenarios it encompasses.


How often Active Directory will be polled for changes to this policy. This is only applicable if you are configuring policy for a computer which is a domain member.


Enter how often, in minutes, Active Directory will be polled for changes to this policy. This is only applicable if you are configuring policy for a computer which is a domain member.


How often Active Directory will be polled for changes to this policy. This is only applicable if you are configuring policy for a computer which is a domain member.


Click Advanced to change the default security settings for the key exchange.


Click to change the default security settings for the key exchange.


Click to select the source address.

My IP Address will attempt to secure any packets being sent from the computer for which you are configuring this filter to the destination address you specify.

Any IP Address will attempt to secure any packets being sent from any computer to which the policy containing this filter is applied to the destination address you specify.

A Specific DNS Name will attempt to secure any packets being sent from the computer you specify in the Computer Name field to the destination address you specify.

A Specific IP Address will attempt to secure any packets being sent from the IP address you specify in the IP Address field to the destination address you specify. For example, if this should only apply to a file server with the IP address 172.16.10.0, enter that exact address.

A Specific IP Subnet will attempt to secure any packets being sent from the IP address you specify in the Subnet Mask field to the destination address you specify. For example, if this should apply to all computers in the 172.16 network, enter 172.16.0.0.


Displays the DNS computer name or address.

For example, if you chose A Specific IP Address, if this should only apply to a file server with the IP address 172.16.10.0, enter that exact IP address. If you want this to apply to any computers with an address beginning with 172.16, enter 172.16.0.0


Enter the DNS computer name or address.

For example, if you chose A Specific IP Address, if this should only apply to a file server with the IP address 172.16.10.0, enter that exact IP address. If you want this to apply to any computers with an address beginning with 172.16, enter 172.16.0.0


Displays the subnet mask, for example, 255.255.0.0.


Enter the subnet mask, for example, 255.255.0.0.


Click to select the destination address.

My IP Address will filter any packets sent from the specified source address to the address of the computer for which you are configuring this filter.

Any IP Address will filter any packets sent from the specified source address to any computer.

A Specific DNS Name will filter any packets sent from the specified source address to the computer you specify in Computer Name.

A Specific IP Address will filter any packets sent from the specified source address to the IP address you specify in IP Address. For example, to filter only packets sent from the specified source address to a file server with the IP address 172.16.10.0, enter that exact IP address.

A Specific IP Subnet will filter any packets sent from the specified source address to the subnet IP address you specify in Subnet Mask. For example, to filter packets only packets sent from the specified source address to any computers in the 172.16 network, enter 172.16.0.0.


The DNS computer name or address.

For example, if you chose A Specific IP Address, to filter only packets sent from the specified source address to a file server with the IP address 172.16.0.0, enter that exact IP address.


Enter the DNS computer name or address.

For example, if you chose A Specific IP Address, to filter only packets sent from the specified source address to a file server with the IP address 172.16.0.0, enter that exact IP address.


Displays the subnet mask, for example, 255.255.0.0


Enter the subnet mask, for example, 255.255.0.0


Select to create a second filter automatically. It will be an exact opposite of the one you just created.

For example, if you created an outgoing, filter with a source of My IP address and a destination of Any IP address, enabling this selection would automatically create an incoming, filter with a source of Any IP address and a destination of My IP address.

Note  If this is associated with a rule which has tunneling enabled, do not enable this setting. You must manually create any other necessary filters.


Select a protocol type if, in addition to addressing information, you want to filter by a specific protocol. Select Any to filter packets sent and received on any protocol in the TCP/IP protocol suite. Click Other to only filter packets sent on a custom protocol type, and enter the port number.


Enter the protocol ID number, in decimal format. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose Other as the protocol type.


Configure port values if, in addition to filtering by addressing information, you want to specify source and destination ports for the selected protocol type.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Select to attempt to secure any packets sent on any port by the selected protocol type which also match the addressing information you have specified.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Select to attempt to secure any packets sent on a specific port, for the selected protocol type which also match the addressing information you have specified, and going to the specified destination port. If you select this option, you must enter a port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Enter the port number. Only packets sent on this port, for the selected protocol type, matching the specified addressing information and going to the specified destination port, will be filtered. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Select to filter packets received on any port for the selected protocol type which also match the specified addressing information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Select to filter packets received on a specific port for the selected protocol type which also match the specified addressing information from the specified source port. If you select this option, you must enter a port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Enter the port number. Only packets received on this port, for this protocol type, which also match the specified addressing information, from the specified source port, will be filtered. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Displays the current filter description. Enter a unique description, up to 255 characters, that will help you quickly identify why this filter was created, for example, to what computers it applies, and what communication scenarios it encompasses.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add.  The wizard will assist you in creating a new filter for this IP filter list.


Displays the list of authentication methods to be used for validating computer identities. The list is in descending order of preference.


Click to add a new authentication method.


Click to edit the selected authentication method.


Click to remove the selected authentication method.


Click to move the selected authentication method up one level in order of preference.


Click to move the selected authentication method down one level in order of preference.


Click to configure IP security policies for all computers in another domain, and enter the domain name.


Enter the name of the domain for which you will be remotely configuring IP security policies.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add.  The wizard will assist you in creating a new filter for this IP filter list.


Displays the IP filter lists available to all policies. From here, you can create a pool of IP filter lists, which can later be assigned to IPSec policies.


Click to add a new IP filter list.


Click to edit the selected IP filter list.


Click to remove the selected IP filter list.


Displays the filter actions available to all policies. From here, you can create a pool of filter actions, which can later be assigned to IPSec policies.


Displays the filter actions available to all policies. From here, you can create a pool of filter actions, which can later be assigned to IPSec policies.


Click to add a new IP filter list.


Click to edit the selected IP filter list.


Click to remove the selected IP filter list.


Confirm that the Use Add Wizard check box is selected in order to start the wizard when you click Add. The wizard will assist you in creating a new rule for this policy.


Select to delete all existing IPSec policies, and replace them with the imported policies.