Monitoring IPsec

You can use the IP Security Monitor snap-in to view and monitor IPsec-related statistics and the IPsec policy applied to this computer and other computers. This information can help you troubleshoot IPsec and test the policies you are creating. To change the IPsec policies, use the IP Security Policies snap-in.

If you create a policy using the Windows Firewall with Advanced Security snap-in, you cannot use the IP Security Monitor snap-in to view these rules. You must use the Monitoring item of the Windows Firewall with Advanced Security snap-in.

Notes
  • The IP Security Monitor snap-in can be used to monitor IPsec only on computers running Windows XP and later. To monitor IPsec on a computer running Windows 2000, use the ipsecmon command.
  • The IP Security Policy snap-in can be used to create IPsec policies that can be applied to computers running Windows Vista®, Windows Server® 2008, and later versions of Windows, but this snap-in does not use the new security algorithms and other new features available in those later versions. To create IPsec polices using the newer algorithms, use the Windows Firewall with Advanced Security snap-in. The Windows Firewall with Advanced Security snap-in does not create policies that can be applied to earlier versions of Windows.

Monitoring tasks

This is a brief list of the most common tasks you might perform using the IP Security Monitor snap-in:

Adding a computer

Before you can monitor IPsec on a remote computer, you must first add the computer to the snap-in. You must have administrator-level access to the remote computer to add it and monitor IPsec.

To add a computer to the IP Security Monitor snap-in

  1. In the console tree, right-click IP Security Monitor, and then click Add computer.

  2. In the Add Computer dialog box, click The following computer, and then type the name of the remote computer. Or, click Browse to find it on the network.
Notes
  • If the IPsec services are not started on the computer that is being monitored, the server icon is displayed as a stopped service. To refresh the IP Security Monitor after the IPsec services on that computer have been restarted, right-click the computer, and then click Reconnect.
  • On computers running Windows Server 2003 and later, you must set the EnableRemoteMgmt registry key to 1 on the remote computer and restart the IPsec service. Otherwise, you will get an "IPsec service not running" error from the snap-in. The registry key is located at HKEY_LOCAL_MACHINE \SYSTEM\\CurrentControlSet\Services\PolicyAgent.

Finding a specific filter

There are two ways to find information about a specific filter, which might be helpful, for example, during troubleshooting: you can sort the Specific Filters view to find the filter or you can search for the filter in the Specific Filter folder of either Main Mode or Quick Mode.

To find a filter in the filter list by browsing

  1. In the Specific Filter folder of either the Main Mode or Quick Mode folders, click the column heading for the property that you want to browse. If you click the column heading again, the list will be sorted in reverse order.

  2. Browse through the list to find the filter.
To find a specific filter by searching

  1. Under either the Main Mode or Quick Mode folder, right-click the Specific Filter folder, and then click Find Matching Filters.

  2. In the Find Matching Filters dialog box, select the criteria you want to search for, and then click Search.

    Note

    The Find the best match only option will find only one match, the one that best matches the criteria. If you do not see the filter you were searching for, try the search again using the Find all matches option. The source and destination choice Any does not search for any source or destination. Instead, the choice is used to find the "Any" source or destination, as listed in the Specific Filter list view.

Looking for signs of possible attacks

The statistics collected and displayed by the IP Security Monitor snap-in can be useful when looking for possible attacks against this computer or other computers you have added to the snap-in. This information is located in the Statistics folders of both the Main Mode and Quick Mode folders. For more information about the statistics available, see Monitoring Main Mode or Monitoring Quick Mode.

Viewing security associations

A security association (SA) is the combination of a negotiated key, security protocol, and security parameters index (SPI), which together define the security used to protect the communication from sender to receiver. By looking at the SAs for this computer, you can determine which computers have connections with this computer, which type of data integrity and encryption is being used for that connection, and other information.

This information can be helpful when you are testing IPsec policies or troubleshooting access issues.

Changing other settings

You can configure whether the snap-in automatically refreshes the information it provides. You can also configure how often it is refreshed and whether the views display IP addresses or DNS names.

To configure automatic refresh

  1. Under the IP Security Monitor folder, right-click the computer's node, and then click Properties.

  2. In the computer Properties dialog box, select the Enable auto refresh check box.

  3. To change the frequency with which the snap-in updates the information, type the preferred interval.

    Note

    By default, automatic refresh is enabled with an interval of 45 seconds. Configuring the automatic refresh too frequently might lead to performance problems, especially when you are monitoring multiple computers from the snap-in and you have enabled DNS name resolution.
To view IP addresses as DNS names

  1. Right-click the computer's node in the IP Security Monitor snap-in, and then click Properties.

  2. In the computer Properties dialog box, select the Enable DNS name resolution check box, and then click OK.

    Notes
    • DNS name resolution is not enabled by default. It works only in the Quick Mode Specific Filter view and in the Security Associations view for both Main Mode and Quick Mode.
    • DNS name resolution might affect performance if many items need to be resolved in this view.
    • To resolve the DNS name from its IP address, the appropriate reverse domains and pointer (PTR) resource records must be configured on your DNS infrastructure. PTR resource records can be configured either manually or through the use of DNS dynamic update. To resolve the NetBIOS computer name of a computer from its IP address, NetBIOS over TCP/IP must be enabled on the computer.

Additional references

  • Active Policy

  • Monitoring Quick Mode

  • Monitoring Main Mode


Active Policy

The Active Policy item of the IP Security Monitor snap-in describes the Internet Protocol security (IPsec) policy that has been applied to this computer. You cannot use the IP Security Monitor snap-in to change the policy.

Only one IPsec policy can be active at a time. The active policy is the IPsec policy that has been applied to this computer, either manually by the administrator of this computer or through the use of Active Directory Domain Services (AD DS) and Group Policy objects (GPOs). The active policy might be defined using GPOs instead of on the computer in the IP Security Policies snap-in.

Name and Description

This is the name and description given to the policy when it was created.

Last Modified

This is the time and date (local time) when the policy was last changed.

Store

This is where the policy is stored, in the local store (on the local computer) or in a GPO.

Path

This is the Active Directory Lightweight Directory Access Protocol (LDAP) path that describes the exact, fully-qualified location in AD DS for the IPsec policy that has been applied to this computer. This only applies to policies stored in GPOs in AD DS. Locally stored policies will not have this path.

Organizational Unit

This is the LDAP path that describes the exact, fully-qualified Active Directory organizational unit (OU) to which the policy was applied. This only applies to policies stored in a GPO in AD DS. Locally stored policies will not have an OU.

Group Policy Object Name

This is the name of the GPO and not the IPsec policy. This only applies to policies stored in GPOs in AD DS. Locally stored policies will not have a GPO name.

Additional references

  • Monitoring IPsec


Monitoring Main Mode

Main Mode Internet Key Exchange (IKE) negotiation establishes a secure channel, known as the Internet Security Association and Key Management Protocol (ISAKMP) security association (SA), between two computers. The ISAKMP SA is used to protect subsequent key exchanges between peer computers, known as Quick Mode negotiation. To establish the secure channel, Main Mode negotiation determines a set of cryptographic protection suites, exchanges keying material to establish the shared secret key, and authenticates computer identities.

Monitoring Main Mode SAs can provide information about which peers are currently connected to this computer, when the SA was formed, which protection suite was used to form the SA, and other information.

Generic filters

Generic filters are IP filters that are configured to use any of the IP address options as either a source or destination address. IPsec allows you to use keywords, such as My IP Address, DNS Server, DHCP Server, WINS Servers, and Default Gateway, in the configuration of filters. When keywords are used, generic filters show the keywords in the IP Security Monitoring snap-in. Specific filters are derived by expanding keywords into IP addresses.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Name.

  • Source. This is the IP address of the packet source.

  • Destination. This is the IP address of the packet destination.

  • IKE Policy. This is the name of the IKE policy associated with this generic filter, not the name of the IPsec policy that you created using the IPsec Policy snap-in. The policy details, such as which set of cryptographic algorithms was used, can be viewed in the IKE Policy item.

  • Authentication Methods. This is a list of all the authentication methods available to the filter, in order of preference.

  • Connection Type. This is the type of connection that this filter is applied to, either local area network (LAN), remote access, or all network connection types.

Specific filters

Specific filters are expanded from generic filters by using the IP addresses of the source or destination computer for the actual connection. For example, if you have a filter that used the My IP Address option as the source address and the DHCP Server option as the destination address, then when a connection is formed using this filter, a filter that has your computer's IP address and the IP address of the DHCP server that this computer uses is automatically created.

Note

The IP Security Monitor snap-in can also resolve IP addresses to DNS names for the Specific Filters folder in the Quick Mode folder, but not in the Main Mode folder.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Name.

  • Source. This is the IP address of the packet source.

  • Destination. This is the IP address of the packet destination.

  • Direction. This specifies whether the filter is inbound or outbound.

  • IKE Policy. This is the name of the IKE policy, not the name of the IPsec policy that you created using the IPsec Policy snap-in. The policy details, such as which set of cryptographic algorithms was used, can be viewed in the IKE Policy item.

  • Authentication Methods. This is a list of all the authentication methods available to the filter, in order of preference.

  • Weight. This is the priority the IPsec service gives to the filter. Weight is derived from a number of factors. For more information about filter weights, see http://go.microsoft.com/fwlink/?LinkId=62212.

    Note

    The weight property is always set to 0 on computers running Windows Vista®, Windows Server® 2008, or later versions of Windows.

IKE policies

The IKE policy refers to the integrity or encryption methods that the two peer computers can negotiate with in the Main Mode key exchange.

Statistics

This table displays the statistics available from the Main Mode Statistics view:

Note

Some of these statistics do not apply to computers running Windows Vista, Windows Server 2008, or later versions of Windows.

IKE Statistic | Description
Active Acquire | An acquire is a request by the IPsec driver to have IKE perform a task. The Active Acquire statistic includes the outstanding request and the number of queued requests, if any. Typically, the number of active acquires is 1. Under a heavy load, the number of active acquires is 1 and the number of requests that are queued by IKE for processing increases.
Active Receive | The number of IKE messages received that are queued for processing.
Acquire Failures | The number of times that an acquire has failed.
Receive Failures | The number of times that the Windows Sockets WSARecvFrom() function has failed while receiving IKE messages.
Send Failures | The number of times that the Windows Sockets WSASendTo() function has failed while sending IKE messages.
Acquire Heap Size | The number of entries in the acquire heap, which stores active acquires. This number increases under a heavy load and then gradually decreases over time, as the acquire heap is cleared.
Receive Heap Size | The number of entries in the IKE receive buffers for incoming IKE messages.
Authentication Failures | The total number of identity authentication failures (Kerberos, certificate, and preshared key) that occurred during Main Mode negotiation. If you are having difficulty communicating securely, attempt the communication and refer to this statistic to see if this number increases. If it does, check your authentication settings for either an unmatched authentication method or an incorrect authentication method configuration (for example, the use of preshared keys that do not match).
Negotiation Failures | The total number of negotiation failures that occurred during Main Mode or Quick Mode negotiations. If you are having difficulty communicating securely, attempt the communication and refer to this statistic to see if this number increases if this number increases. If it does, check your authentication and security method settings for an unmatched authentication method, an incorrect authentication method configuration (for example, the use of preshared keys that do not match), or unmatched security methods or settings.
Invalid Cookies Received | A cookie is a value contained in a received IKE message that is used by IKE to find the state of an active Main Mode. A cookie in a received IKE message that cannot be matched with an active Main Mode is invalid.
Total Acquire | The total number of work requests submitted by IKE to the IPsec driver.
Total Get SPI | The total number of requests submitted by IKE to the IPsec driver to obtain a unique Security Parameters Index (SPI).
Key Additions | The number of outbound Quick Mode SAs added by IKE to the IPsec driver.
Key Updates | The number of inbound Quick Mode SAs added by IKE to the IPsec driver.
Get SPI Failures | The number of failed requests submitted by IKE to the IPsec driver to obtain a unique SPI.
Key Addition Failures | The number of failed outbound Quick Mode SA addition requests submitted by IKE to the IPsec driver.
Key Update Failures | The number of failed inbound Quick Mode SA addition requests submitted by IKE to the IPsec driver.
ISADB List Size | The number of Main Mode state entries, including negotiated Main Modes, Main Modes in progress, and Main Modes that failed and have not been deleted.
Connection List Size | The number of Quick Mode state entries.
IKE Main Mode | The total number of successful SAs created during Main Mode negotiations.
IKE Quick Mode | The total number of successful SAs created during Quick Mode negotiations. Because there are typically multiple Quick Mode SAs created for each Main Mode SA, this number does not necessarily match the Main Mode number.
Soft Associations | The total number of negotiations that resulted in the use of plaintext (also known as soft SAs). This typically reflects the number of associations formed with computers that did not respond to Main Mode negotiation attempts. This can include both computers that are not IPsec-compatible and computers that are IPsec-compatible but do not have IPsec policy to negotiate security with this IPsec peer. Although soft SAs are not the result of Main Mode and Quick Mode negotiations, they are still treated as Quick Mode SAs.
Invalid Packets Received | The number of received IKE messages that are invalid, including IKE messages with invalid header fields, incorrect payload lengths, and incorrect values for the responder cookie (when it should be set to 0). Invalid IKE messages are commonly caused by stale retransmitted IKE messages or an unmatched preshared key between the IPsec peers.
Note

Some of these statistics can be used to detect network attack attempts.

Security associations

This view displays the active SAs with this computer. An SA is the combination of a negotiated key, security protocol, and SPI, which together define the security used to protect the communication from sender to receiver. Therefore, by looking at the security associations for this computer, you can determine which computers have connections with this computer, which type of data integrity and encryption is being used for that connection, and other information.

This information can be helpful when you are testing IPsec policies and troubleshooting access issues.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Me. This is the local computer IP address.

  • My ID. This is the local computer DNS name.

  • Peer. This is the remote computer or peer IP address.

  • Peer ID. This is the remote computer or peer DNS name.

  • Authentication . This is the authentication method used in creating the SA.

  • Encryption. This is the encryption method used by the SA for Quick Mode key exchanges.

  • Integrity. This is the data integrity method used by the SA for Quick Mode key exchanges.

  • Diffie-Hellman. This is the Diffie-Hellman group used to create the Main Mode SA.

Additional references

  • Monitoring IPsec

  • Monitoring Quick Mode


Monitoring Quick Mode

Quick Mode (also known as Phase 2) IKE negotiation establishes a secure channel between two computers to protect data. Because this phase involves the establishment of security associations (SAs) that are negotiated on behalf of the IPsec service, the SAs created during Quick Mode are called the IPsec SAs. During Quick Mode, keying material is refreshed or, if necessary, new keys are generated. A protection suite that protects specified IP traffic is also selected. A protection suite is a defined set of data integrity or data encryption settings. Quick Mode is not considered a complete exchange because it is dependent on a Main Mode exchange.

Monitoring Quick Mode SAs can provide information about which peers are currently connected to this computer, which protection suite was used to form the SA, and other information.

Generic filters

Generic filters are IP filters that are configured to use any of the IP address options as either a source or destination address. IPsec also allows you to use keywords, such as My IP Address, DNS Server, DHCP Server, WINS Servers, and Default Gateway, in the configuration of filters. When keywords are used, generic filters show the keywords in the IP Security Monitoring snap-in. Specific filters are derived from the generic filters by expanding keywords into IP addresses.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Name.

  • Source. This is the IP address of the packet source.

  • Destination. This is the IP address of the packet destination.

  • Source Port. This is the TCP or UDP port of the packet source.

  • Destination Port. This is the TCP or UDP port of the packet destination.

  • Source Tunnel Endpoint. This is the tunnel endpoint nearest the local computer, if one was specified.

  • Destination Tunnel Endpoint. This is the tunnel endpoint nearest the destination computer, if one was specified.

  • Protocol. This is the protocol specified in the filter.

  • Inbound Action. This indicates whether inbound traffic is Allowed, Blocked, or uses the Negotiate Security action.

  • Outbound Action. This indicates whether outbound traffic is Allowed, Blocked, or uses the Negotiate Security action.

  • Negotiation Policy. This is the name of the Quick Mode negotiation policy, or cryptographic settings.

  • Connection Type. This is the type of connection that this filter is applied to, either local area network (LAN), remote access, or all network connection types.

Specific filters

Specific filters are expanded from generic filters by using the IP addresses of the source or destination computer for the actual connection. For example, if you have a filter that used My IP Address option as the source address and the DHCP Server option as the destination address, then when a connection is formed using this filter, a filter that has your computer's IP address and the IP address of the DHCP server that this computer uses is created automatically.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Name.

  • Source. This is the IP address of the packet source.

  • Destination. This is the IP address of the packet destination.

  • Source Port. This is the TCP or UDP port of the packet source.

  • Destination Port. This is the TCP or UDP port of the packet destination.

  • Source Tunnel Endpoint. This is the tunnel endpoint nearest the local computer, if one was specified.

  • Destination Tunnel Endpoint. This is the tunnel endpoint nearest the destination computer, if one was specified.

  • Protocol. This is the protocol specified in the filter.

  • Inbound Action. This indicates whether inbound traffic is Allowed, Blocked, or uses Negotiate Security action.

  • Outbound Action. This indicates whether outbound traffic is Allowed, Blocked, or uses Negotiate Security action.

  • Negotiation Policy. This is the name of the Quick Mode negotiation policy, or cryptographic settings.

  • Weight. This is the priority the IPsec service gives to the filter. Weight is derived from a number of factors. For more information about filter weights, see http://go.microsoft.com/fwlink/?LinkId=62212.

    Note

    The weight property is always set to 0 on computers running Windows Vista®, Windows Server® 2008, or later versions of Windows.

Negotiation policies

The negotiation policy is the security method preference order that the two peer computers agree to use when communicating with each other during Quick Mode negotiations.

Statistics

This table displays the statistics available from the Quick Mode Statistics view:

IPsec Statistic | Description
Active Security Associations | This is the number of active IPsec SAs.
Offloaded Security Associations | This is the number of active IPsec SAs offloaded to hardware.
Pending Key Operations | This is the number of IPsec key operations in progress.
Key Additions | This is the total number of successful IPsec SA negotiations.
Key Deletions | This is the number of key deletions for IPsec SAs.
Rekeys | This is the number of rekey operations for IPsec SAs.
Active Tunnels | This is the number of active IPsec tunnels.
Bad SPI Packets | This is the total number of packets for which the Security Parameters Index (SPI) was incorrect. The SPI is used to match inbound packets with SAs. If the SPI is incorrect, it might mean that the inbound SA has expired and a packet using the old SPI has recently arrived. This number is likely to increase if rekey intervals are short and there are a large number of SAs. Because SAs expire under normal conditions, a bad SPI packet does not necessarily mean that IPsec is failing.
Packets Not Decrypted | This is the total number of packets that failed decryption. This failure might indicate that a packet arrived for an SA that had expired. If the SA expires, the session key used to decrypt the packet is also deleted. This does not necessarily indicate that IPsec is failing.
Packets Not Authenticated | This is the total number of packets for which data could not be verified. This failure is most likely caused by an expired SA.
Packets With Replay Detection | This is the total number of packets that contained a valid Sequence Number field.
Confidential Bytes Sent | This is the total number of bytes sent using the ESP protocol.
Confidential Bytes Received | This is the total number of bytes received using the ESP protocol.
Authenticated Bytes Sent | This is the total number of bytes sent using the AH protocol.
Authenticated Bytes Received | This is the total number of bytes received using the AH protocol.
Transport Bytes Sent | This is the total number of bytes sent using IPsec Transport Mode.
Transport Bytes Received | This is the total number of bytes received using IPsec Transport Mode.
Bytes Sent in Tunnels | This is the total number of bytes sent using IPsec Tunnel Mode.
Bytes Received in Tunnels | This is the total number of bytes received using IPsec Tunnel Mode.
Offloaded Bytes Sent | This is the total number of bytes sent using hardware offload.
Offloaded Bytes Received | This is the total number of bytes received using hardware offload.
Note

Some of these statistics can be used to detect network attack attempts.

Security associations

This view displays the active SAs with this computer. An SA is the combination of a negotiated key, security protocol, and SPI, which together define the security used to protect the communication from sender to receiver. Therefore, by looking at the security associations for this computer, you can determine which computers have connections with this computer, which type of data integrity and encryption is being used for that connection, and other information.

This information can be helpful when you are testing IPsec policies and troubleshooting access issues.

Adding, removing, and sorting columns

You can add, remove, rearrange, and sort by these columns in the results pane:

  • Me . This is the IP address of the local computer.

  • Peer. This is the IP address of the remote computer.

  • Protocol. This is the protocol specified in the filter.

  • My Port. This is the TCP or UDP port of the local computer specified in the filter.

  • Peer Port. This is the TCP or UDP port of the remote computer specified in the filter.

  • Negotiation Policy. This is the name of the Quick Mode negotiation policy, or cryptographic settings.

  • AH Integrity. This is the AH protocol-specific data integrity method used for peer communications.

  • ESP Confidentiality. This is the ESP protocol-specific encryption method used for peer communications.

  • ESP Integrity. This is the ESP protocol-specific data integrity method used for peer communications.

  • My Tunnel Endpoint. This is the tunnel endpoint nearest the local computer, if one was specified.

  • Peer Tunnel Endpoint. This is the tunnel endpoint nearest the local computer, if one was specified.

Additional references

  • Monitoring IPsec

  • Monitoring Main Mode