4.1 KiB
title, description, ms.prod, ms.topic, ms.date
| title | description | ms.prod | ms.topic | ms.date |
|---|---|---|---|---|
| Configure Key Exchange (Main Mode) Settings | Learn how to configure the main mode key exchange settings used to secure the IPsec authentication traffic in Windows Defender Firewall with Advanced Security. | windows-client | conceptual | 09/07/2021 |
Configure Key Exchange (Main Mode) Settings
This procedure shows you how to configure the main mode key exchange settings used to secure the IPsec authentication traffic.
Administrative credentials
To complete these procedures, you must be a member of the Domain Administrators group, or otherwise be delegated permissions to modify the GPOs.
To configure key exchange settings
-
Open the Group Policy Management Console to Windows Defender Firewall with Advanced Security.
-
In the details pane on the main Windows Defender Firewall with Advanced Security page, click Windows Defender Firewall Properties.
-
On the IPsec Settings tab, click Customize.
-
In the Key exchange (Main Mode) section, click Advanced, and then click Customize.
-
Select the security methods to be used to help protect the main mode negotiations between the two devices. If the security methods displayed in the list aren't what you want, then do the following steps:
Important In Windows Vista, Windows Server 2008, or later, you can specify only one key exchange algorithm. This rule means that if you want to communicate by using IPsec with another device running Windows 8 or Windows Server 2012, then you must select the same key exchange algorithm on both devices.
Also, if you create a connection security rule that specifies an option that requires AuthIP instead of IKE, then only the one combination of the top integrity and encryption security method is used in the negotiation. Ensure that all of your devices that are running at least Windows Vista and Windows Server 2008 have the same methods at the top of the list and the same key exchange algorithm selected.
Note When AuthIP is used, no Diffie-Hellman key exchange protocol is used. Instead, when Kerberos V5 authentication is requested, the Kerberos V5 service ticket secret is used in place of a Diffie-Hellman value. When either certificate authentication or NTLM authentication is requested, a transport level security (TLS) session is established, and its secret is used in place of the Diffie-Hellman value. This event happens no matter which Diffie-Hellman key exchange protocol you select.
-
Remove any of the security methods that you don't want by selecting the method and then clicking Remove.
-
Add any required security method combinations by clicking Add, selecting the appropriate encryption algorithm and integrity algorithm from the lists, and then clicking OK.
Caution: We recommend that you do not include MD5 or DES in any combination. They are included for backward compatibility only.
-
After the list contains only the combinations you want, use the "up" and "down" arrows to the right of the list to arrange them in the order of preference. The combination that appears first in the list is tried first, and so on.
-
-
From the list on the right, select the key exchange algorithm that you want to use.
Caution: We recommend that you do not use Diffie-Hellman Group 1. It is included for backward compatibility only.
-
In Key lifetime (in minutes), type the number of minutes. When the specified number of minutes has elapsed, any IPsec operation between the two devices requires a new key.
Note: You need to balance performance with security requirements. Although a shorter key lifetime results in better security, it also reduces performance.
-
In Key lifetime (in sessions), type the number of sessions. After the specified number of quick mode sessions have been created within the security association protected by this key, IPsec requires a new key.
-
Click OK three times to save your settings.