Copyright: Monday, July 09, 2001 08:14:35


Specifies that your computer be added as a computer to monitor.


Specifies that a remote computer be added as a computer to monitor. The IP Security Monitor snap-in can only be used to monitor IPSec on computers running Windows XP. To monitor IPSec on a computer running Windows 2000, use the ipsecmon command at a Windows 2000 command prompt.


Provides a space for you to type the computer name, DNS name, or IP address (in dotted decimal notation) of the remote computer to monitor. The IP Security Monitor snap-in can only be used to monitor IPSec on computers running Windows XP. To monitor IPSec on a computer running Windows 2000, use the ipsecmon command at a Windows 2000 command prompt.


Click to browse for a remote computer to monitor.


Lists the IP security statistics for the IPSec driver component. These statistics include information on both IPSec driver processes and the traffic flow processed by the IPSec driver.

For more information, see IP Security Monitor statistics in Help.


Lists the IP security statistics for the Internet Key Exchange (IKE) protocol and component. These statistics include information on IKE processes and the negotiation of both main mode (or Phase I) and quick mode (or Phase II) security associations (SAs).

For more information, see IP Security Monitor statistics in Help.


Refreshes the display of IP security statistics.


Specifies whether the display of the details pane refreshes automatically.


Provides a space for you to type the number of minutes after which the display of the details pane refreshes automatically. You can also click the arrows to select the number of minutes.


Provides a space for you to type the number of seconds after which the display of the details pane refreshes automatically. You can also click the arrows to select the number of seconds.


Specifies whether you want to use Domain Name System (DNS) reverse queries and NetBIOS Adapter Status messages to resolve the DNS or NetBIOS computer name associated with an IP address when displaying sources or destinations. To resolve the DNS name from its IP address, your DNS infrastructure must have the appropriate reverse domains and pointer (PTR) records configured either manually or using DNS dynamic update. To resolve the NetBIOS computer name of a computer from its IP address, NetBIOS over TCP/IP must be enabled on the computer.


Displays the source IP address or computer name for this generic main mode filter.


Displays the source subnet mask for this generic main mode filter.


Displays the destination IP address or computer name for this generic main mode filter.


Displays the destination subnet mask for this generic main mode filter.


Displays the connection type for this generic main mode filter.


Displays whether this generic main mode filter creates a mirrored filter.


Displays the Internet Key Exchange (IKE) policy used for this generic main mode filter. To view IKE policy details, you can obtain properties for the IKE policy name from Main Mode\IKE Policies.


Lists the specific main mode filters that were created from this generic main mode filter.


Lists the authentication methods in preference order for this generic filter.


Specifies that you want to search for specific main mode filters with any source IP address.


Specifies that you want to search for specific main mode filters with a specific source IP address.


Provides a space for you to type a specific source IP address in dotted decimal notation.


Specifies that you want to search for specific main mode filters with any destination IP address.


Specifies that you want to search for specific main mode filters with a specific destination IP address.


Provides a space for you to type a specific destination IP address in dotted decimal notation.


Searches for specific main mode filters based on the configured search criteria. Results are displayed in Search Result.


Specifies whether you want to search for inbound specific main mode filters. Because a specific main mode filter is always either an inbound filter or an outbound filter, if you clear both the Inbound and Outbound check boxes, no main mode filters will be displayed when you click Search.


Specifies whether you want to search for outbound specific main mode filters. Because a specific main mode filter is always either an inbound filter or an outbound filter, if you clear both the Inbound and Outbound check boxes, no main mode specific filters will be displayed when you click Search.


Specifies that you want to find a single specific main mode filter that most closely matches all of the search criteria.


Specifies that you want to find all specific main mode filters that match the search criteria.


Lists the results (the specific main mode filters that match the search criteria) of the search. To start the search, click Search.


Lists the main mode key exchange security methods. For key exchange methods configured with the IP Security Policies snap-in, this is the list of key exchange security methods that are configured from the Advanced button, which is available on the General tab in the properties of the assigned IPSec policy.


Displays the IP address or computer name of the computer for which IP Security Monitor is running for this main mode security association.


Displays the IP address or computer name of the IPSec peer of the computer for which IP Security Monitor is running for this main mode security association.


Displays the authentication method used to create this main mode security association.


Displays the Internet Key Exchange (IKE) policy used for this main mode security association. To view IKE policy details, you can obtain properties for the IKE policy name from Main Mode\IKE Policies.


Displays the security settings of the selected offer for this main mode security association.


Displays the encryption algorithm used for this main mode security association.


Displays the data integrity and authentication algorithm used for this main mode security association.


Displays the Diffie-Hellman group used to generate keying material for this main mode security association.


Displays the key lifetime settings for this main mode security association. The first number, the number of kilobytes (KB) of data before a new main mode security association is negotiated, is set to 0 and is not important. Main mode security associations are not renegotiated based on the amount of data sent and this setting cannot be configured. The second number, the number of seconds before a new main mode security association is negotiated, is configured from the Advanced button on the General tab in the properties of the assigned IPSec policy for key exchange methods configured with the IP Security Policies snap-in. The value of 28800 seconds reflects the default value of 480 minutes (8 hours).


Lists the quick mode security associations that are established using this main mode security association.


Displays the source port for this generic quick mode filter.


Displays the source IP address or computer name for this generic quick mode filter.


Displays the source subnet mask for this generic quick mode filter.


Displays the destination port for this generic quick mode filter.


Displays the destination IP address or computer name for this generic quick mode filter.


Displays the destination subnet mask for this generic quick mode filter.


Displays the IP protocol name or number for this generic quick mode filter.


Displays the filter action type for inbound traffic for this generic quick mode filter.


Displays the filter action type for outbound traffic for this generic quick mode filter.


Displays the interface or connection type for this generic quick mode filter.


Displays whether this generic quick mode filter creates a mirrored filter.


Displays the assigned IPSec policy name for this generic quick mode filter.


Lists the specific quick mode filters that were created from this generic quick mode filter.


Specifies that you want to search for specific quick mode filters with any source IP address.


Specifies that you want to search for specific quick mode filters with a specific source IP address.


Provides a space for you to type a specific source IP address in dotted decimal notation.


Specifies that you want to search for specific quick mode filters with any destination IP address.


Specifies that you want to search for specific quick mode filters with a specific destination IP address.


Provides a space for you to type a specific destination IP address in dotted decimal notation.


Searches for specific quick mode filters based on the configured search criteria. Results are displayed in Search Result.


Lists the common IP protocol types for which to search for specific quick mode filters. Select Any for any IP protocol. To manually configure the protocol type, select Other.


Provides a space for you to type the Internet Protocol (IP) protocol number in decimal. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose Other as the protocol type.


Provides a space for you to type a specific source port in decimal.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Provides a space for you to type a specific destination port in decimal.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Specifies whether you want to search for inbound specific quick mode filters. Because a specific quick mode filter is always either an inbound filter or an outbound filter, if you clear both the Inbound and Outbound check boxes, no quick mode filters will be displayed when you click Search.


Specifies whether you want to search for outbound specific quick mode filters. Because a specific quick mode filter is always either an inbound filter or an outbound filter, if you clear both the Inbound and Outbound check boxes, no quick mode filters will be displayed when you click Search.


Specifies that you want to find a single specific quick mode filter that most closely matches all of the search criteria.


Specifies that you want to find all specific quick mode filters that match the search criteria.


Lists the results (the specific quick mode filters that match the search criteria) of the search. To start the search, click Search.


Lists the security method preference order for this negotiation policy. For security methods configured with the IP Security Policies snap-in, this is the list of security methods configured from the Security Methods tab on a filter action selected for an IPSec rule in the assigned IPSec policy.


Displays the source IP address or computer name for this quick mode security association.


Displays the destination IP address or computer name for this quick mode security association.


Displays the source port for this quick mode security association.


Displays the destination port for this quick mode security association.


Displays the Internet Protocol (IP) protocol name or number for this quick mode security association.


Displays the local tunnel endpoint for this quick mode security association. If this security association is not tunneled, N/A is displayed.


Displays the remote tunnel endpoint for this quick mode security association. If this security association is not tunneled, N/A is displayed.


Displays the negotiation policy used for this quick mode security association. To view details for the negotiation policy, you can obtain properties for the negotiation policy name from Quick Mode\Negotiation Policies.


Displays the security settings of the selected offer for this quick mode security association.


Displays the Authentication Header (AH) data integrity and authentication algorithm used for this quick mode security association. If AH was not used, <None> is displayed.


Displays the Encapsulating Security Payload (ESP) encryption algorithm used for this quick mode security association. If ESP was either not used or was used and configured for the <None> encryption algorithm, <None> is displayed.


Displays the Encapsulating Security Payload (ESP) data integrity and authentication algorithm used for this quick mode security association. If ESP was either not used or was used and configured for the <None> integrity algorithm, <None> is displayed.


Displays the key lifetime settings for this quick mode security association. The first number represents the number of kilobytes (KB) of data sent on this quick mode security association before a new quick mode security association is negotiated. The second number represents the number of seconds that elapse before a new main mode security association is negotiated.


Displays whether session key perfect forward secrecy (PFS) is enabled for this quick mode security association. With session key PFS disabled, session keys for renewed quick mode security associations are derived from the current master key keying material. With session key PFS enabled, master key keying material is renegotiated each time a new session key for a quick mode security association is required. The new master key keying material is then used to derive a new session key.


Displays the Diffie-Hellman group used to derive new keying material for session keys for this quick mode security association. If session key perfect forward secrecy (PFS) is not enabled (PFS Enabled displays No), 0 is displayed.


Specifies that IP security policies are configured only for this computer (the computer on which this snap-in is running).


Specifies that IP security policies are configured for all computers in this domain (the domain to which the computer on which this snap-in is running belongs). This option is not valid for computers running Windows XP Home Edition.


Specifies that IP security policies are configured for another computer.


Provides a space for you to type the name of the computer for which you will be configuring IP security policies. Your current domain is searched for a list of computers.


Click to select the computer for which you will be configuring IP security policies. Your current domain is searched for a list of computers.


Provides a space for you to type the policy name. Type a unique name of up to 255 characters that will help you quickly identify the policy.


Provides a space for you to type the policy name. Type a unique name of up to 255 characters that will help you quickly identify the policy.


Provides a space for you to type the policy description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of the policy (for example, to what computers the policy applies and which communication scenarios it encompasses).


Provides a space for you to type the policy description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of the policy (for example, to what computers the policy applies and which communication scenarios it encompasses).


Lists the security methods used to protect identities during authentication and key exchange. This list is in order of precedence and determines which security services, key settings, and algorithms will be used for protection. Unless you have special requirements, these can be left at the default settings.


Lists the security methods used to protect identities during authentication and key exchange. This list is in order of precedence and determines which security services, key settings, and algorithms will be used for protection. Unless you have special requirements, these can be left at the default settings.


Click to add a new security method to the list.


Click to edit the selected security method.


Removes the selected security method.


Moves the selected security method up one level in the security method preference order.


Move the selected security method down one level in the security method preference order.


Provides a space for you to type the policy name. Type a unique name of up to 255 characters that will help you quickly identify the policy.


Provides a space for you to type the policy description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of the policy (for example, to what computers the policy applies and which communication scenarios it encompasses).


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128-bit key to compute a hash of the data.

•	Use SHA1 to use a 160-bit key to compute a hash of the data (stronger).


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128-bit key to compute a hash of the data.

•	Use SHA1 to use a 160-bit key to compute a hash of the data (stronger).


Lists the algorithms for data confidentiality:

•	Use DES for medium strength encryption (a 56-bit encryption key).

•	Use 3DES for strong encryption (three 56-bit encryption keys).

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and computational overhead of 3DES. Computers running Windows 2000 must have the High Encryption Pack or Service Pack 2 or later installed in order to perform the 3DES algorithm.


Lists the algorithms for data confidentiality:

•	Use DES for medium strength encryption (a 56-bit encryption key).

•	Use 3DES for strong encryption (three 56-bit encryption keys).

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and computational overhead of 3DES. Computers running Windows 2000 must have the High Encryption Pack or Service Pack 2 or later installed in order to perform the 3DES algorithm.


Lists the Diffie-Hellman Group which is the basis for future keys:

•	Use Low (Diffie-Hellman Group 1) to provide keying material for a 768-bit key.

•	Use Medium (Diffie-Hellman Group 2) to provide keying material for a 1024-bit key (stronger).


Lists the Diffie-Hellman Group which is the basis for future keys:

•	Use Low (Diffie-Hellman Group 1) to provide keying material for a 768-bit key.

•	Use Medium (Diffie-Hellman Group 2) to provide keying material for a 1024-bit key (stronger).


Provides a space for you to type the name of the IP filter list. Type a unique name of up to 255 characters that will help you quickly identify the IP filter list.


Provides a space for you to type the IP filter list description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of the IP filter list (for example, which computers and traffic types it encompasses).


Lists the filters contained in this IP filter list.


Click to add a new filter to this IP filter list.


Click to edit the selected filter.


Removes the selected filter.


Lists the rules contained in this IPSec policy. A check indicates that the rule is currently active. You can add, edit, or remove rules. The predefined default response rule cannot be removed, only edited or deactivated.


Lists the rules contained in this IPSec policy. A check indicates that the rule is currently active. You can add, edit, or remove rules. The predefined default response rule cannot be removed, only edited or deactivated.


Click to add a new rule to this policy.


Click to edit the selected rule.


Removes the selected rule. The predefined default response rule cannot be removed, only edited or deactivated.


Specifies whether you want to use the Security Rule Wizard when adding a rule to this policy. The Security Rule Wizard assists you in creating a new rule for this policy.


Lists the IP filter lists available to all policies. The selected filter list is the active IP filter list for this rule. You can select only a single filter list for each rule.


Click to add a new IP filter list that will be available to all policies.


Click to edit the selected IP filter list.


Removes the selected IP filter list. The IP filter list will no longer be available to any policies.


Specifies whether you want to use the IP Filter Wizard when adding a filter to this filter list. The IP Filter Wizard assists you in creating a new filter.


Lists the filter actions available to all IP security policies. The selected filter action is the active filter action for this rule. You can select only a single filter action for each rule.


Lists the filter actions available to all IP security policies. The selected filter action is the active filter action for this rule. You can select only a single filter action for each rule.


Click to add a new filter action that will be available to all policies.


Click to edit the selected filter action.


Removes the selected filter action. The filter action will no longer be available to any policies.


Specifies whether you want to use the Filter Action Wizard when adding a filter action. The Filter Action Wizard assists you in creating a new filter action.


Specifies that IPSec tunneling is not used for this rule.


Specifies that IPSec tunneling is used for this rule, when communication is exchanged with a specific computer only, and you know the DNS name of that computer.


Provides a space for you to type the DNS name of the computer with which you want to establish an IPSec tunnel.


Specifies that IPSec tunneling is used for this rule. This option should only be used when each tunnel endpoint has a static IP address.


Provides a space for you to type the IP address of the tunnel endpoint. Because you cannot mirror filters for tunneled traffic, you must configure two rules. One rule is used for the outbound traffic, and the other is used for inbound traffic. For the outbound traffic rule, the tunnel endpoint is the IP address of the IPSec peer on the other end of the tunnel. For the inbound traffic rule, the tunnel endpoint is an IP address configured on the local computer.


Specifies that the Kerberos version 5 (V5) protocol is used for authentication. Kerberos V5 is the default authentication protocol for computers that are members of an Active Directory domain. This method can be used for any IPSec peers running the Kerberos V5 protocol that are members of the same domain or in trusted domains.

The Kerberos V5 protocol authentication method cannot be used for computers running Windows XP Home Edition, or for computers running Windows 2000 and Windows XP Professional that are not members of an Active Directory domain.

Note  Policies that do not specify a common authentication method for traffic between the same two computers will result in failed negotiations for secure communications.


Specifies that a public key certificate from a trusted certification authority (CA) be used for authentication. A public key certificate should be used in situations that include Internet access, remote access to corporate resources, external business partner communications, or computers that do not run the Kerberos V5 authentication protocol. This requires that at least one trusted CA has been configured. Computers running Windows 2000 and this operating system support X.509 Version 3 certificates, including CA certificates generated by commercial certification authorities.

Note  Policies that do not specify a common authentication method for traffic between the same two computers will result in failed negotiations for secure communications.


Displays the name of the certification authority (CA) that you have selected for authentication. Click Browse to select the CA.


Click to select a certification authority (CA) for authentication. Windows searches your local certificate store for a list of trusted root CAs.


Specifies that you want to use a string that you specify as a preshared key for authentication. This is a shared, secret key that is previously agreed upon by two users. Both computers must be configured to use the same preshared key. This is a simple method for authenticating computers that are running Windows XP Home Edition, stand-alone computers, computers not running Windows 2000 or Windows XP Professional, or any clients that are not running the Kerberos V5 protocol. This key is for authentication only. It is not used to encrypt or provide data integrity or authentication for the IP packet for secured traffic.

Note  Policies that do not specify a common authentication method for traffic between the same two computers will result in failed negotiations for secure communications.


Provides a space for you to type the preshared key (or string) that you want to use for authentication.


Specifies that this rule apply to all network connections configured on the computers to which this policy is assigned.


Specifies that this rule apply only to Local Area Network connections configured on the computers to which this policy is assigned.


Specifies that this rule apply only to remote access (dial-up) connections configured on the computers to which this policy is assigned.


Specifies that this rule apply only to this specific adapter type on the computers to which this policy is assigned.


Lists the adapter to which this rule applies.


Specifies whether you want to reauthenticate the main mode security association (SA) and negotiate new master key keying material each time a new session key for a quick mode SA is required. When Master key perfect forward secrecy (PFS) is disabled, new session keys are derived from current master key keying material, subject to the number of times the master key keying material can be used to derive the session key. Although enabling Master key perfect forward secrecy (PFS) provides greater security, performance and throughput might be impacted.


Provides a space for you to type the number of minutes after which a new master key will be generated.


Provides a space for you to type the number of minutes after which a new master key will be generated.


Provides a space for you to type the number of minutes after which a new master key will be generated.


Provides a space for you to type the number of times the master key keying material can be used to derive the session key. The same master key keying material can be reused because a security association was recently established with the other computer. If you want to limit the number of times this reuse occurs, specify a session key limit. A value of 0 means that an unlimited number of session keys can be created from the master key keying material.

Note  This item is set to 1 and is not configurable if you have enabled Master key perfect forward secrecy (PFS), because each new session causes the master key keying material to be renegotiated.


Provides a space for you to type the number of times the master key keying material can be used to derive the session key. The same master key keying material can be reused because a security association was recently established with the other computer. If you want to limit the number of times this reuse occurs, specify a session key limit. A value of 0 means that an unlimited number of session keys can be created from the master key keying material.

Note  This item is set to 1 and is not configurable if you have enabled Master key perfect forward secrecy (PFS), because each new session causes the master key keying material to be renegotiated.


Provides a space for you to type the number of times the master key keying material can be used to derive the session key. The same master key keying material can be reused because a security association was recently established with the other computer. If you want to limit the number of times this reuse occurs, specify a session key limit. A value of 0 means that an unlimited number of session keys can be created from the master key keying material.

Note  This item is set to 1 and is not configurable if you have enabled Master key perfect forward secrecy (PFS), because each new session causes the master key keying material to be renegotiated.


Click to configure security methods for the key exchange to determine the master key. Unless you have special requirements, these can be left at the default settings.


Specifies that data is protected using confidentiality (data is encrypted), integrity (data is verified as unmodified in transit), and authentication (data is verified as having originated from an IPSec peer).


Specifies that data is protected using confidentiality (data is encrypted), integrity (data is verified as unmodified in transit), and authentication (data is verified as having originated from an IPSec peer).


Specifies that data is protected using integrity (data is verified as unmodified in transit) and authentication (data is verified as having originated from an IPSec peer). Data confidentiality using encryption is not provided.


Specifies that data is protected using integrity (data is verified as unmodified in transit) and authentication (data is verified as having originated from an IPSec peer). Data confidentiality using encryption is not provided.


Specifies that you want to configure your own security method.


Click to configure your own security method.


Specifies whether you want to see future warning messages.


Specifies whether data is protected using integrity (data is verified as unmodified in transit) and authentication (data is verified as having originated from an IPSec peer) using the IPSec Authentication Header (AH). Data confidentiality using encryption is not provided. The AH provides data integrity and authentication for the entire packet (including the source and destination IP addresses), with the exception of mutable fields in the Internet Protocol (IP) header.


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128-bit key to compute a hash of the data.

•	Use SHA1 to use a 160-bit key to compute a hash of the data (stronger).


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128 bit key to compute a hash of the data.

•	Use SHA1 to use a 160 bit key to compute a hash of the data (stronger).


Specifies whether data is protected using confidentiality (data is encrypted), integrity (data is verified as unmodified in transit), and authentication (data is verified as having originated from an IPSec peer) using the IPSec Encapsulating Security Payload (ESP) header.  The ESP header provides data confidentiality, integrity, and authentication for the ESP payload. The outer Internet Protocol (IP) header is not protected. To provide data integrity and authentication for the entire packet (including the source and destination IP addresses), with the exception of mutable fields in the IP header, enable both Data and address integrity without encryption (AH) and Data integrity and encryption (ESP).


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128-bit key to compute a hash of the data.

•	Use SHA1 to use a 160-bit key to compute a hash of the data (stronger).

•	Use <None> if you have also enabled Data and address integrity without encryption (AH).

Note  You cannot choose <None> for both the ESP integrity and encryption algorithms.


Lists the algorithms for data integrity and data authentication:

•	Use MD5 to use a 128-bit key to compute a hash of the data.

•	Use SHA1 to use a 160-bit key to compute a hash of the data (stronger).

•	Use <None> if you have also enabled Data and address integrity without encryption (AH).

Note  You cannot choose <None> for both the ESP integrity and encryption algorithms.


Lists the algorithms for data confidentiality:

•	Use DES for medium strength encryption (a 56-bit encryption key).

•	Use 3DES for strong encryption (three 56-bit encryption keys).

•	Use <None> if you want the ESP format but do not require data confidentiality.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and computational overhead of 3DES. Computers running Windows 2000 must have the High Encryption Pack or Service Pack 2 or later installed in order to perform the 3DES algorithm.

Note  You cannot choose <None> for both the ESP integrity and encryption algorithms.


Lists the algorithms for data confidentiality:

•	Use DES for medium strength encryption (a 56-bit encryption key).

•	Use 3DES for strong encryption (three 56-bit encryption keys).

•	Use <None> if you want the ESP format but do not require data confidentiality.

You must include DES in your list of security methods if you are required to connect to computers that do not have 3DES or if you do not want the higher security and computational overhead of 3DES. Computers running Windows 2000 must have the High Encryption Pack or Service Pack 2 or later installed in order to perform the 3DES algorithm.

Note  You cannot choose <None> for both the ESP integrity and encryption algorithms.


Specifies whether you want to configure the interval, in seconds or in kilobytes, after which a new session key is generated.


Specifies whether you want to configure the interval, in kilobytes, after which a new session key is generated.


Provides a space for you to type the number of kilobytes of data transferred after which a new session key is generated.


Specifies whether you want to configure the interval, in seconds, after which a new session key is generated.


Provides a space for you to type the number of seconds after which a new session key is generated.


Specifies that you want to permit traffic without negotiating IP security. Permitted traffic is transmitted or received without negotiating or applying IP security.


Specifies that you want to block traffic without negotiating or applying IP security. Blocked traffic is silently discarded.


Specifies that you want to use IP security to negotiate and secure traffic and use the list of security methods to determine how the traffic is secured. The list is in descending order of preference.


Lists the security methods in descending order of preference.


Lists the security methods used when negotiating IP security for secured traffic. The list is in descending order of preference.


Specifies whether to accept initial unsecured traffic sent by another computer, but require secure communication when replying. This option is typically enabled on a policy that is assigned to server computers when the client computers have a policy assigned in which the default response rule is enabled. This simplifies IPSec deployment because the policy assigned to the client computers is not required to be configured with additional rules that initiate secured communication to all secured servers.


Specifies whether to allow unsecured communications with computers that cannot negotiate the use of IPSec or process IPSec-secured traffic. You can use this option to secure traffic with computers on your network that are IPSec-capable while allowing unsecured communications with computers on your network that are not IPSec-capable.

Caution  When you enable this option, unsecured traffic is allowed when IPSec negotiations with an IPSec-capable computer fail.


Specifies whether you want to renegotiate new master key keying material each time a new session key is required. When Session key perfect forward secrecy (PFS) is disabled, new session keys are derived from current master key keying material, subject to the number of times the master key keying material can be used to derive the session key. Although enabling Session key perfect forward secrecy (PFS) provides greater security, performance and throughput might be impacted.


Click to add a new security method.


Click to edit the selected security method.


Removes the selected security method.


Moves the selected security method up one level in order of preference.


Moves the selected security method down one level in order of preference.


Provides a space for you to type the policy name. Type a unique name or up to 255 characters that will help you quickly identify the policy.


Provides a space for you to type the policy name. Type a unique name of up to 255 characters that will help you quickly identify the policy.


Provides a space for you to type the policy description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of this policy (for example, to what computers the policy applies and which communication scenarios it encompasses).


Provides a space for you to type the policy description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of this policy (for example, to what computers the policy applies and which communication scenarios it encompasses).


Provides a space for you to type how often, in minutes, Active Directory is polled for changes to this policy. This is only applicable if you are configuring policy for a computer that is an Active Directory domain member.


Provides a space for you to type how often, in minutes, Active Directory is polled for changes to this policy. This is only applicable if you are configuring policy for a computer that is an Active Directory domain member.


Provides a space for you to type how often, in minutes, Active Directory is polled for changes to this policy. This is only applicable if you are configuring policy for a computer that is an Active Directory domain member.


Click Advanced to change the default security settings for the master key exchange.


Click to change the default security settings for the master key exchange.


Lists the possible source addresses:

•	My IP Address matches any packets being sent from the computer to which this filter applies to the destination address that you specify.

•	Any IP Address matches any packets being sent from any computer to the destination address that you specify.

•	A specific DNS Name allows you to specify the Domain Name System (DNS) name of a computer, resolve the DNS name to its IP addresses, and then automatically create filters for the resolved IP addresses. This option is only available when creating new filters.

•	A specific IP Address matches any packets being sent from the IP address to the destination address that you specify. For example, if this filter should apply only to a file server with the IP address of 172.16.0.10, you can type that exact address.

•	A specific IP Subnet matches any packets being sent from an IP subnet, as specified by an IP address and subnet mask, to the destination address that you specify. For example, to filter only packets sent from any computers on the 172.16.0.0/16 subnet to the specified destination, configure 172.16.0.0 as the IP address and 255.255.0.0 as the subnet mask.


For A specific IP Address or A specific IP Subnet, provides a space for you to type the IP address in dotted decimal notation. For A specific DNS Name, provides a space for you to type the DNS name to resolve.


For A specific IP Address or A specific IP Subnet, provides a space for you to type the IP address in dotted decimal notation. For A specific DNS Name, provides a space for you to type the DNS name to resolve.


Provides a space for you to type the subnet mask in dotted decimal notation. If you have selected A specific IP Address, the subnet mask is set to 255.255.255.255 and is not configurable.


Provides a space for you to type the subnet mask in dotted decimal notation. If you have selected A specific IP Address, the subnet mask is set to 255.255.255.255 and is not configurable.


Lists the possible destination addresses:

•	My IP Address matches any packets sent from the specified source address to the address of the computer to which this filter applies.

•	Any IP Address matches any packets sent from the specified source address to any computer.

•	A specific DNS Name allows you to specify the Domain Name System (DNS) name of a computer, resolve the DNS name to its IP addresses, and then automatically create filters for the resolved IP addresses. This option is only available when creating new filters.

•	A specific IP Address matches any packets sent from the specified source address to a specified IP address. For example, to match only packets sent from the specified source address to a file server with the IP address of 172.16.0.10, configure that exact IP address.

•	A specific IP Subnet matches any packets sent from the specified source address to an IP subnet, as specified by an IP address and subnet mask. For example, to filter only packets sent from the specified source address to any computers on the 172.16.0.0/16 subnet, configure 172.16.0.0 as the IP address and 255.255.0.0 as the subnet mask.


Provides a space for you to type the IP address in dotted decimal notation.


Provides a space for you to type the IP address in dotted decimal notation.


Provides a space for you to type the subnet mask in dotted decimal notation. If you have selected A specific IP Address, the subnet mask is set to 255.255.255.255 and is not configurable.


Provides a space for you to type the subnet mask in dotted decimal notation. If you have selected A specific IP Address, the subnet mask is set to 255.255.255.255 and is not configurable.


Specifies whether you want to automatically create a mirrored copy of the configured filter. The mirrored filter is an exact opposite of the configured filter.

For example, if you configured a filter with a source of My IP Address and a destination of Any IP Address, enabling mirroring would automatically create a second filter with a source of Any IP Address and a destination of My IP Address.

Note  If you are configuring filters for tunnel traffic, clear this option. Mirrored filters are not automatically created when configured with an IPSec rule that has tunneling enabled. When tunneling, you must manually create two filter lists: one filter list that defines all traffic that is sent through the tunnel and another filter list that defines all traffic that is received through the tunnel. Next, you must create two rulesone for each filter list.


Lists the Internet Protocol (IP) protocol types if, in addition to addressing information, you want to filter a specific IP protocol. Select Any to filter packets sent and received on any IP protocol. To manually configure the protocol type, select Other.


Provides a space for you to type the Internet Protocol (IP) protocol number in decimal. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose Other as the protocol type.


Allows you to configure port values if, in addition to filtering by addressing information, you want to specify source and destination ports for the selected protocol type.

Note  These options are only available if you chose TCP or UDP as the protocol type.


Specifies that you want to match packets sent from any port for the selected protocol type.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Specifies that you want to match packets sent from a specific port for the selected protocol type. If you select this option, you must type a source port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Provides a space for you to type the source port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Specifies that you want to match packets sent to any port for the selected protocol type.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Specifies that you want to match packets sent to a specific port for the selected protocol type. If you select this option, you must type a destination port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Provides a space for you to type the destination port number. If you are unsure of this value, contact your system or network administrator to obtain this information.

Note  This option is only available if you chose TCP or UDP as the protocol type.


Provides a space for you to type the filter description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of this filter (for example, to what types of traffic it applies).


Specifies whether you want to use the IP Filter Wizard when adding a filter to this filter list. The IP Filter Wizard assists you in creating a new filter.


Lists the authentication methods to be used for validating computer identities. The list is in descending order of preference.


Click to add a new authentication method.


Click to edit the selected authentication method.


Removes the selected authentication method.


Moves the selected authentication method up one level in order of preference.


Moves the selected authentication method down one level in order of preference.


Specifies that you want to configure IP security policies for all computers in another domain. This option is not valid for computers running Windows XP Home Edition.


Provides a space for you to type the fully qualified domain name (FQDN) of the domain for which you will be remotely configuring IP security policies. To successfully configure policies in a remote domain, you must have permissions to read and write policy in that domain and you must be using a computer that is a member of a domain that is trusted by the remote domain. You cannot configure policies in a remote domain from a computer that is a member of a workgroup (also known as a stand-alone computer).


Specifies whether you want to use the IP Filter Wizard when adding a filter to this filter list. The IP Filter Wizard assists you in creating a new filter.


Lists the IP filter lists available to all policies. You can create multiple IP filter lists, which can later be selected for individual rules of IPSec policies.


Click to add a new IP filter list.


Click to edit the selected IP filter list.


Removes the selected IP filter list.


Lists the filter actions that are available to all policies. You can create multiple filter actions, which can later be selected for individual rules of IPSec policies.


Lists the filter actions that are available to all policies. You can create multiple filter actions, which can later be selected for individual rules of IPSec policies.


Click to add a new IP filter list.


Click to edit the selected IP filter list.


Removes the selected IP filter list.


Specifies whether you want to use the Security Rule Wizard when adding a rule to this policy. The Security Rule Wizard assists you in creating a new rule for this policy.


Specifies whether to delete all existing IPSec policies and replace them with the imported policies.


Provides a space for you to type the filter action name. Type a unique name of up to 255 characters that will help you quickly identify the filter action.


Provides a space for you to type the filter action description. Type a unique description of up to 255 characters that will help you quickly identify the purpose of this filter action (for example, a summary of the security settings).