windows-itpro-docs/windows/security/threat-protection/windows-firewall/checklist-creating-rules-for-clients-of-a-standalone-isolated-server-zone.md

title, description, ms.prod, ms.topic, ms.date, appliesto

title	description	ms.prod	ms.topic	ms.date	appliesto
Create Rules for Standalone Isolated Server Zone Clients (Windows)	Checklist for when creating rules for clients of a Standalone Isolated Server Zone	windows-client	conceptual	09/07/2021	✅ <a href="https://learn.microsoft.com/windows/release-health/supported-versions-windows-client" target="_blank">Windows 10 and later</a> ✅ <a href="https://learn.microsoft.com/windows/release-health/windows-server-release-info" target="_blank">Windows Server 2016 and later</a>

Checklist: Creating Rules for Clients of a Standalone Isolated Server Zone

This checklist includes tasks for configuring connection security rules and IPsec settings in the GPOs for client devices that must connect to servers in an isolated server zone.

Checklist: Configuring isolated server zone client rules

Task	Reference
Create a GPO for the client devices that must connect to servers in the isolated server zone, and that are running one of the versions of Windows. After you've finished the tasks in this checklist, you can make a copy of it.	Checklist: Creating Group Policy Objects Copy a GPO to Create a New GPO
To determine which devices receive the GPO, assign the NAG for the isolated servers to the security group filter for the GPO. Make sure that each GPO has the WMI filter for the correct version of Windows.	Modify GPO Filters to Apply to a Different Zone or Version of Windows
Configure IPsec to exempt all ICMP network traffic from IPsec protection.	Exempt ICMP from Authentication
Create a rule that exempts all network traffic to and from devices on the exemption list from IPsec.	Create an Authentication Exemption List Rule
Configure the key exchange (main mode) security methods and algorithms to be used.	Configure Key Exchange (Main Mode) Settings
Configure the data protection (quick mode) algorithm combinations to be used.	Configure Data Protection (Quick Mode) Settings
Configure the authentication methods to be used.	Configure Authentication Methods
Create a rule that requests authentication for network traffic. Because fallback-to-clear behavior in Windows Vista and Windows Server 2008 has no delay when communicating with devices that can't use IPsec, you can use the same any-to-any rule used in an isolated domain.	Create an Authentication Request Rule
Link the GPO to the domain level of the Active Directory organizational unit hierarchy.	Link the GPO to the Domain
Add your test devices to the NAG for the isolated server zone. Be sure to add at least one for each operating system supported by a different GPO in the group.	Add Test Devices to the Membership Group for a Zone