Configure the global IPsec On the Windows Firewall You cannot use netsh to main mode default settings. with Advanced Security configure the global main mode The global default settings are Properties dialog box, on the default settings. used when a connection Settings tab, under security rule does not specify IPsec defaults, click its own main mode settings, Customize, and then under and a separate main mode Key Exchange (Main Mode), rule (Windows 7 or Windows select Advanced and then Server 2008 R2 only) does not click Customize. match the connection. Configure network On the Windows Firewall You cannot use to configure connections are protected by with Advanced Security per profile enabling or disabling each profile. If the check box Properties dialog box, under of specific connection types. for a network connection is any of the Profile tabs, next cleared then that network to Protected network connection is not protected by connections, click the profile even if the attached Customize. network matches that network location type. Create main mode rules that You cannot use the MMC Use the netsh advfirewall specify authentication settings snap-in to create main mode mainmode add rule command. for connections between rules. specified IP addresses, or for connections using specific network location profiles. If a connection matches a main mode rule then it is used instead of the global default settings, or even the settings specified in the connection security rule. Main mode rules are supported on Windows 7 and Windows Server 2008 R2 only. Create a connection security You cannot use the MMC Use the qmsecmethods rule that uses a specific quick snap-in to create rules with parameter of the advfirewall mode configuration instead of per-rule quick mode settings. consec add rule command. the global defaults. Rules created in the MMC snap-in, they always use the
Configure the global IPsec main mode default settings. The global default settings are used when a connection security rule does not specify its own main mode settings, and a separate main mode rule (Windows 7 or Windows Server 2008 R2 only) does not match the connection. On the Windows Firewall with Advanced Security Properties dialog box, on the Settings tab, under IPsec defaults, click Customize, and then under Key Exchange (Main Mode), select Advanced and then click Customize. You cannot use netsh to configure the global main mode default settings. Configure network connections are protected by each profile. If the check box for a network connection is cleared then that network connection is not protected by the profile even if the attached network matches that network location type. On the Windows Firewall with Advanced Security Properties dialog box, under any of the Profile tabs, next to Protected network connections, click Customize. You cannot use to configure per profile enabling or disabling of specific connection types. Create main mode rules that specify authentication settings for connections between specified IP addresses, or for connections using specific network location profiles. If a connection matches a main mode rule then it is used instead of the global default settings, or even the settings specified in the connection security rule. Main mode rules are supported on Windows 7 and Windows Server 2008 R2 only. You cannot use the MMC snap-in to create main mode rules. Use the netsh advfirewall mainmode add rule command. Create a connection security rule that uses a specific quick mode configuration instead of the global defaults. You cannot use the MMC snap-in to create rules with per-rule quick mode settings. Rules created in the MMC snap-in, they always use the Use the qmsecmethods parameter of the advfirewall consec add rule command.
Step-by-Step%20Guide%20to%20Deploying%20Windows%20Firewall%20and%20IPsec%20Policies.docx