Windows Server 2012 : Configuring IPsec (part 6) - Configuring connection security rules - Creating a custom rule, Configuring authenticated bypass

Creating a custom rule involves configuring options on the Endpoints, Requirements, Authentication Method, Protocols And Ports, and Profile And Name pages. The only new page here is the Protocol And Ports page shown in Figure 8. You can use this page to specify which protocol and which port or ports specified in a network packet match this connection security rule. Once you have done this, only network traffic that matches the criteria on this page and the Endpoints page match the rule and will be subject to its authentication requirements.

Figure 8. Configuring protocols and ports for a custom connection security rule.

You can also use Windows PowerShell to view, create, configure, and remove connection security rules either in the policy store on the local computer, a remote computer, or a GPO. You can do this using the cmdlets from the NetSecurity module of Windows PowerShell.

For example, you can use the New-NetIPsecRule to create a new server isolation rule in the persistent store on the local machine that requires both inbound and outbound authentication:

PS C:\> New-NetIPsecRule -DisplayName "Server Isolation Rule"`
-InboundSecurity Require -OutboundSecurity Require

IPsecRuleName         : {8215b76f-e6f2-42da-a8b9-1f8416b9a358}
DisplayName           : Server Isolation Rule
Description           :
DisplayGroup          :
Group                 :
Enabled               : True
Profile               : Any
Platform              : {}
Mode                  : Transport
InboundSecurity       : Require
OutboundSecurity      : Require
QuickModeCryptoSet    : Default
Phase1AuthSet         : Default
Phase2AuthSet         : Default
KeyModule             : Default
AllowWatchKey         : False
AllowSetKey           : False
LocalTunnelEndpoint   :
RemoteTunnelEndpoint  :
RemoteTunnelHostname  :
ForwardPathLifetime   : 0
EncryptedTunnelBypass : False
RequireAuthorization  : False
User                  : Any
Machine               : Any
PrimaryStatus         : OK
Status                : The rule was parsed successfully from the store. (65536)
EnforcementStatus     : NotApplicable
PolicyStoreSource     : PersistentStore
PolicyStoreSourceType : Local

If you open the Windows Firewall with Advanced Security snap-in at this point and select the Connection Security Rules node, you will see the new rule that you created.

You can also use the Get-NetIPsecRule cmdlet to view connection security rules, Set-NetIPsecRule to modify them, or Remove-NetIPsecRule to delete them. For more help concerning any of these cmdlets, use the Get-Help cmdlet.

One of the configuration options in that wizard was deferred until later because it had to do with how firewall rules interact with IPsec. That setting is the Allow The Connection If It Is Secure option on the Action page. (See Figure 9.)

Selecting this option specifies that only connections protected by IPsec will be allowed by the new firewall rule. Such IPsec protection is implemented separately using connection security rules.

Figure 9. Configuring a new firewall rule to allow only connections that are protected by IPsec.

As Figure 9 shows, selecting the Allow The Connection If It Is Secure option also adds two new wizard pages named Users and Computers to the New Inbound (or Outbound) Rules Wizard. You can use these two new pages to specify trusted users, computers, or both that are allowed to connect to the local computer.

The default behavior of a firewall rule that has the Allow The Connection If It Is Secure option selected is for network traffic matching the firewall rule to be allowed if the traffic is both authenticated and integrity-protected by IPsec. This default option is supported on computers running Windows Vista, Windows Server 2008, or later.

By clicking Customize on the Action page, you can change this behavior by selecting a different option on the Customize Allow If Secure Settings dialog box shown in Figure 10. Specifically, you can select from the following options:

Figure 10. Configuring the behavior of a firewall rule that has the Allow The Connection If It Is Secure option selected.

Selecting the Override Block Rules option when creating a new firewall rule is called authenticated bypass, because it means that matching network traffic is allowed because it has been authenticated as coming from an authorized and trusted user or computer. As Figure 11 shows, you must specify at least one trusted computer when configuring authenticated bypass for a firewall rule.

Figure 11. Configuring trusted computers for an authenticated bypass firewall rule.