How To Configure IPSec Tunneling in Windows Server 2003

Back to the top

Create IPSec Policy

1. Click Start, click Run, and then type secpol.msc to start the IP Security Policy Management snap-in.
2. Right-click IP Security Policies on Local Computer, and then click Create IP Security Policy.
3. Click Next, and then type a name for your policy (for example, IPSec Tunnel with non-Microsoft Gateway). Click Next.
   
   Note You can also type information in the Description box.
4. Click to clear the Activate the default response rule check box, and then click Next.
5. Click Finish (leave the Edit check box selected).

Back to the top

Build a Filter List from NetA to NetB

1. In the new policy properties, click to clear the Use Add Wizard check box, and then click Add to create a new rule.
2. Click the IP Filter List tab, and then click Add.
3. Type an appropriate name for the filter list, click to clear the Use Add Wizard check box, and then click Add.
4. In the Source address box, click A specific IP Subnet, and then type the IP Address and Subnet maskto for NetA.
5. In the Destination address box, click A specific IP Subnet, and then type the IP Address and Subnet mask for NetB.
6. Click to clear the Mirrored check box.
7. Click the Protocol tab. Make sure that the protocol type is set to Any, because IPSec tunnels do not support protocol-specific or port-specific filters.
8. If you want to type a description for your filter, click the Description tab. It is generally a good idea to give the filter the same name that you used for the filter list. The filter name appears in the IPSec monitor when the tunnel is active.
9. Click OK.

Back to the top

Build a Filter List from NetB to NetA

1. Click the IP Filter List tab, and then click Add.
2. Type an appropriate name for the filter list, click to clear the Use Add Wizard check box, and then click Add.
3. In the Source address box, click A specific IP Subnet, and then type the IP Address and Subnet mask for NetB.
4. In the Destination address box, click A specific IP Subnet, and then type the IP Address and Subnet mask for NetA.
5. Click to clear the Mirrored check box.
6. If you want to type a description for your filter, click the Description tab.
7. Click OK.

Back to the top

Configure a Rule for a NetA-to-NetB Tunnel

1. Click the IP Filter List tab, and then click to select the filter list that you created.
2. Click the Tunnel Setting tab, click The tunnel endpoint is specified by this IP Address box, and then type 3rdextip (where 3rdextip is the IP address that is assigned to the non-Microsoft gateway external network adapter).
3. Click the Connection Type tab, click All network connections (or click Local area network (LAN) if WIN2003extIP is not an ISDN, PPP, or direct-connect serial connection).
4. Click the Filter Action tab, click to clear the Use Add Wizard check box, and then click Add to create a new filter action because the default actions allow incoming traffic in clear text.
5. Keep the Negotiate security option enabled, and then click to clear the Accept unsecured communication, but always respond using IPSec check box. You must do this for secure operation.
   
   Note None of the check boxes at the bottom of the Filter Action dialog box are selected as an initial configuration for a filter action that applies to tunnel rules. Only the Use session key perfect forward secrecy (PFS) check box is a valid setting for tunnels if the other end of the tunnel is also configured to use PFS.
6. Click Add, and keep the Integrity and encryption option selected (or you can select the Custom (for expert users) option if you want to define specific algorithms and session key lifetimes). Encapsulating Security Payload (ESP) is one of the two IPSec protocols.
7. Click OK. Click the General tab, type a name for the new filter action (for example, IPSec tunnel: ESP DES/MD5), and then click OK.
8. Click to select the filter action that you just created.
9. Click the Authentication Methods tab, configure the authentication method that you want (use preshared key for testing, and otherwise use certificates). Kerberos is technically possible if both ends of the tunnel are in trusted domains, and each trusted domain's IP address (IP address of a domain controller) is reachable on the network by both ends of the tunnel during IKE negotiation of the tunnel (before it is established). But this is rare.
10. Click Close.

Back to the top

Configure a Rule for a NetB-to-NetA Tunnel

1. In IPSec policy properties, click Add to create a new rule.
2. Click the IP Filter List tab, click to select the filter list that you created (from NetB to NetA).
3. Click the Tunnel Setting tab, click The tunnel endpoint is specified by this IP Address box, and then type WIN2003extIP (where WIN2003extIP is the IP address that is assigned to the Windows Server 2003 gateway external network adapter).
4. Click the Connection Type tab, click All network connections (or click Local area network (LAN) if WIN2003extIP is not an ISDN, PPP, or direct-connect serial connection). Any outbound traffic on the interface type that matches the filters tries to be tunneled to the tunnel endpoint that is specified in the rule. Inbound traffic that matches the filters is discarded because it must be received secured by an IPSec tunnel.
5. Click the Filter Action tab, and then click to select the filter action that you created.
6. Click the Authentication Methods tab, and then configure the same method that you used in the first rule (the same method must be used in both rules).
7. Click OK, make sure both rules that you created are enabled in your policy, and then click OK again.

Back to the top

Assign Your New IPSec Policy to Your Windows Server 2003 Gateway

Local IPSec Policy Active: 'IPSec tunnel with {tunnel endpoint}' IP Security Policy Path:
SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local\ipsecPolicy{-longnumber-} 

There are two filters
From NetA to NetB
Filter ID: {-long number-}
Policy ID: {-long number-}
IPSEC_POLICY PolicyId = {-long number-}
Flags: 0x0
Tunnel Addr: 0.0.0.0
PHASE 2 OFFERS Count = 1
Offer #0:
ESP[ DES MD5 HMAC] 
Rekey: 0 seconds / 0 bytes. 
AUTHENTICATION INFO Count = 1
Method = Preshared key: -actual key-
Src Addr: NetA Src Mask: -subnet mask-
Dest Addr: NetB Dest Mask: -subnet mask-
Tunnel Addr: 3rdExtIP Src Port: 0 Dest Port: 0
Protocol: 0 TunnelFilter: Yes
Flags : Outbound
From NetB to NetA
Filter ID: {-long number-}
Policy ID: {-long number-}
IPSEC_POLICY PolicyId = {-long number-}
Flags: 0x0
Tunnel Addr: 0.0.0.0
PHASE 2 OFFERS Count = 1
Offer #0:
ESP[ DES MD5 HMAC] 
Rekey: 0 seconds / 0 bytes. 
AUTHENTICATION INFO Count = 1
Method = Preshared key: -actual key-
Src Addr: NetB Src Mask: -subnet mask-
Dest Addr: NetA Dest Mask: -subnet mask-
Tunnel Addr: W2KextIP Src Port: 0 Dest Port: 0
Protocol: 0 TunnelFilter: Yes
Flags: Inbound

Back to the top

Configure Routing and Remote Access Filtering

Application layer 
Transport layer (TCP|UDP|ICMP|RAW) 
---- Network layer start ---- 
IP Packet Filter (where NAT/Routing and Remote Access filtering is done) 
IPSec (where IPSec filters are implemented) 
Fragmentation/Reassembly 
---- Network layer end ------ 
NDIS Interface 
Datalink layer 
Physical layer 

1. Expand your server tree under Routing and Remote Access, expand the IP Routing subtree, and then click General.
2. Right-click WIN2003extIP, and then click Properties.
3. Click Outbound Filters, and then click New.
4. Click to select the Source network and Destination network check boxes.
5. In the Source network box, type the IP address and Subnet mask for NetA.
6. In the Destination network box, type the IP address and Subnet mask for NetB.
7. Keep the protocol set to Any, and then click OK.
8. Click New, and then click to select the Source network and Destination network check boxes.
9. In the Source network box, type the IP address and Subnet mask for WIN2003extIP.
10. In the Destination network box, type the IP address and Subnet mask for 3rdExtIP (for IKE negotiation use a subnet mask of 255.255.255.255).
11. Keep the protocol set to Any, and then click OK.
12. Click to select the Drop all packets except those that meet the criteria below check box, and then click OK.
13. Click Input Filters, click Add, and then click to select the Source network and Destination network check boxes.
14. In the Source network box, type the IP address and Subnet mask for NetB.
15. In the Destination network box, type the IP address and Subnet mask for NetA.
16. Keep the protocol set to Any, and then click OK.
17. Click New, and then click to select the Source network and Destination network check boxes.
18. In the Source network box, type the IP address and Subnet mask for 3rdExtIP.
19. In the Destination network box, type the IP address and Subnet mask for WIN2003extIP (for IKE negotiation use a subnet mask of 255.255.255.255).
20. Keep the protocol set to Any, and then click OK.
21. Click to select the Drop all packets except those that meet the criteria below check box, and then click OK two times.
    
    Note If the Routing and Remote Access server has more than one interface that is connected to the Internet, or if you have multiple IPSec tunnels, create Routing and Remote Access exempt filters for each IPSec tunnel (each source and destination IP subnet) for every Internet interface.

Back to the top

Configure Static Routes in Routing and Remote Access

• Outbound tunnel traffic leaves on one interface, and the inbound tunnel traffic is received on a different interface. Even if you use IPSec offload network adapters, receiving on a different interface (than the outbound tunnel traffic is sent on) does not allow the receiving network adapter to process the encryption in hardware, because only the outbound interface can offload the Security Association (SA).
• Outbound tunnel traffic leaves on an interface that is different from the interface that has the tunnel endpoint IP address. The source IP of the tunneled packet is the source IP on the outbound interface. If this is not the source IP that is expected by the other end, the tunnel is not established (or packets are dropped by the remote endpoint if the tunnel has already been established).

1. In the Routing and Remote Access MMC, expand your server tree, expand the IP Routing subtree, right-click Static Routes, and then click New Static Route.
2. In the Interface box, click WIN2003extIP (if this is the interface that you want to always use for outbound tunnel traffic).
3. Type the Destination network and Network mask for NetB.
4. In the Gateway box, type 3rdextip.
5. Keep the Metric value set to its default (1), and then click OK.
   
   Note To address the issue of receiving inbound tunnel traffic on the wrong interface, do not advertise the interface's IP address by using a routing protocol. Also, configure a filter in the Routing and Remote Access service to drop packets to NetA or WIN2003extIP as indicated in the "Configure Routing and Remote Access Filtering" section of this article.

Back to the top

Test Your IPSec Tunnel

Back to the top

Enable Auditing for Logon Events and Object Access

1. Using the Group Policy MMC snap-in, expand Local Computer Policy, expand Computer Configuration, expand Windows Settings, expand Security Settings, expand Local Policies, and then click Audit Policy.
2. Enable Success and Failure auditing for Audit logon events and Audit object access.
   
   Note If the Windows Server 2003 gateway is a member of a domain and if you are using a domain policy for auditing, the domain policy overwrites your local policy. In this case, modify the domain policy.

Back to the top

IP Security Monitor

1. Click Start, click Run, type MMC, and then click OK.
2. Click File, click Add/Remove Snap-in, and then click Add.
3. Click IP Security Monitor, and then click Add.
4. Click Close, and then click OK.

Back to the top

Network Monitor

1. Click Start, click Control Panel, click Add or Remove Programs, and then click Add/Remove Windows Components.
2. In the Windows Components wizard, click Management and Monitoring Tools, and then click Details.
3. In Subcomponents of Management and Monitoring Tools, click to select the Network Monitor Tools check box, and then click OK.
4. If you are prompted for additional files, insert the installation CD for your operating system, or type a path of the location of the files on the network.

Back to the top

Actual Test

1. Before you try to ping from a computer on one subnet to the other (NetA or NetB), type ipconfig at a command prompt. The network interfaces that are initialized in the TCP/IP stack are displayed.
2. Start the IP Security Monitor tool.
3. Start Network Monitor, and then on the Capture menu, click Networks. Click the WIN2003extIP interface, and then click OK.
4. Try to ping the computer. The first ICMP echo packets may time out while the IPSec tunnel is being built. If the ping is not successful, check the security and system logs.
5. If the ping is successful, stop the Network Monitor capture and see if the ICMP traffic went "on the clear" or if you just see the ISAKMP and IPSec protocol packets. Check IP Security Monitor to see if an SA was created using the NetA to NetB filter you created. Also check the security log. You should see Event ID 541 (IKE security association established).
6. Type ipconfig at a command prompt again to verify that there is no additional TCP/IP interface while the tunnel is in use. This behavior occurs because IPSec is protecting the traffic that is going through the physical interface (WIN2003extIP).
   
   If the remote gateway is also a Windows Server 2003 node, remember that:
   • The default gateway for clients in NetA is WIN2003extIP. The default gateway for clients in NetB is 3rdIntIP.
   • An IPSec tunnel does not change the way traffic is routed in the Windows Server 2003 gateway. (This gateway can route packets because routing is enabled in Routing and Remote Access. The actual LAN or WAN interface metrics are still used.)

Back to the top

• IPSec
  http://www.ietf.org/rfc/rfc2401.txt (http://www.ietf.org/rfc/rfc2401.txt)
• L2TP
  http://www.ietf.org/html.charters/pppext-charter.html (http://www.ietf.org/html.charters/pppext-charter.html)
  ftp://ftp.isi.edu/in-notes/rfc2661.txt (ftp://ftp.isi.edu/in-notes/rfc2661.txt)
  http://www.ietf.org/html.charters/l2tpext-charter.html (http://www.ietf.org/html.charters/l2tpext-charter.html)

Back to the top