Caution Do not use preshared keys in a production environment. They are not considered secure, and are not easily managed. Use computer certificates either purchased from a third-party vendor, or created by an in-house certification authority, such as a computer that is running Windows Server 2008 R2 with the Active Directory Certificate Services server role. The Preshared key authentication method is used in this guide only because it is beyond the scope of the guide to create a certification authority for this one step. 11. On the Profile page, click Next. 12. On the Name page, type Tunnel on Gateway, and then click Finish. Next topic: Step 3: Test Your Tunnel Mode Rules With the tunnel mode rules defined, you can now try to access your domain controller through the member server from the client on the public network. Important This section of the guide uses features that are present only on computers that are running Windows 7 and Windows Server 2008 R2, and will not work as written on computers that are running earlier versions of Windows. To communicate with the private network through the tunnel 1. On CLIENT1, start the Windows Firewall with Advanced Security MMC snap-in. 2. Expand Monitoring, expand Security Associations, and then click Quick Mode. The list of quick mode security associations (QMSAs) is empty, unless you tried to communicate with the private network. 3. Open a command prompt, and then position the Command Prompt window and the Windows Firewall with Advanced Security snap-in so that you can see the list of QMSAs and still type in the Command Prompt window. 4. At the command prompt, type the command ping 192.168.0.1. The connection succeeds. The first packet might report a loss because of the delay caused by the IPsec tunnel negotiations. 5. On the Actions pane of the Windows Firewall with Advanced Security snap-in, click Refresh. The QMSA between the client and the gateway is displayed. 6. At the command prompt, type the command net view \\dc1.
Caution Do not use preshared keys in a production environment. They are not considered secure, and are not easily managed. Use computer certificates either purchased from a third-party vendor, or created by an in-house certification authority, such as a computer that is running Windows Server 2008 R2 with the Active Directory Certificate Services server role. The Preshared key authentication method is used in this guide only because it is beyond the scope of the guide to create a certification authority for this one step. 11. On the Profile page, click Next. 12. On the Name page, type Tunnel on Gateway, and then click Finish. Next topic: Step 3: Test Your Tunnel Mode Rules With the tunnel mode rules defined, you can now try to access your domain controller through the member server from the client on the public network. Important This section of the guide uses features that are present only on computers that are running Windows 7 and Windows Server 2008 R2, and will not work as written on computers that are running earlier versions of Windows. To communicate with the private network through the tunnel 1. On CLIENT1, start the Windows Firewall with Advanced Security MMC snap-in. 2. Expand Monitoring, expand Security Associations, and then click Quick Mode. The list of quick mode security associations (QMSAs) is empty, unless you tried to communicate with the private network. 3. Open a command prompt, and then position the Command Prompt window and the Windows Firewall with Advanced Security snap-in so that you can see the list of QMSAs and still type in the Command Prompt window. 4. At the command prompt, type the command ping 192.168.0.1. The connection succeeds. The first packet might report a loss because of the delay caused by the IPsec tunnel negotiations. 5. On the Actions pane of the Windows Firewall with Advanced Security snap-in, click Refresh. The QMSA between the client and the gateway is displayed. 6. At the command prompt, type the command net view \\dc1.
Step-by-Step%20Guide%20to%20Deploying%20Windows%20Firewall%20and%20IPsec%20Policies.docx