mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 03:43:39 +00:00
48 lines
2.0 KiB
Markdown
48 lines
2.0 KiB
Markdown
---
|
||
title: How to configure Diffie Hellman protocol over IKEv2 VPN connections (Windows 10 and Windows 11)
|
||
description: Learn how to update the Diffie Hellman configuration of VPN servers and clients by running VPN cmdlets to secure connections.
|
||
ms.prod: windows-client
|
||
author: paolomatarazzo
|
||
ms.author: paoloma
|
||
ms.localizationpriority: medium
|
||
ms.date: 09/23/2021
|
||
manager: aaroncz
|
||
ms.reviewer: pesmith
|
||
appliesto:
|
||
- ✅ <b>Windows 10</b>
|
||
- ✅ <b>Windows 11</b>
|
||
ms.technology: itpro-security
|
||
ms.topic: how-to
|
||
---
|
||
|
||
# How to configure Diffie Hellman protocol over IKEv2 VPN connections
|
||
|
||
>Applies To: Windows Server (General Availability Channel), Windows Server 2016, Windows 10, Windows 11
|
||
|
||
In IKEv2 VPN connections, the default configuration for Diffie Hellman group is Group 2, which is not secure for IKE exchanges.
|
||
|
||
To secure the connections, update the configuration of VPN servers and clients by running VPN cmdlets.
|
||
|
||
## VPN server
|
||
|
||
For VPN servers that run Windows Server 2012 R2 or later, you need to run [Set-VpnServerConfiguration](/powershell/module/remoteaccess/set-vpnserverconfiguration?view=win10-ps&preserve-view=true) to configure the tunnel type. This makes all IKE exchanges on IKEv2 tunnel use the secure configuration.
|
||
|
||
```powershell
|
||
Set-VpnServerConfiguration -TunnelType IKEv2 -CustomPolicy
|
||
```
|
||
|
||
On an earlier version of Windows Server, run [Set-VpnServerIPsecConfiguration](/previous-versions/windows/powershell-scripting/hh918373(v=wps.620)). Since `Set-VpnServerIPsecConfiguration` doesn’t have `-TunnelType`, the configuration applies to all tunnel types on the server.
|
||
|
||
```powershell
|
||
Set-VpnServerIPsecConfiguration -CustomPolicy
|
||
```
|
||
|
||
## VPN client
|
||
|
||
For VPN client, you need to configure each VPN connection.
|
||
For example, run [Set-VpnConnectionIPsecConfiguration (version 4.0)](/powershell/module/vpnclient/set-vpnconnectionipsecconfiguration?view=win10-ps&preserve-view=true) and specify the name of the connection:
|
||
|
||
|
||
```powershell
|
||
Set-VpnConnectionIPsecConfiguration -ConnectionName <String>
|
||
``` |