CmdID

CmdID / Commands / netsh

netsh ipsec

The netsh ipsec command is used to configure and manage Internet Protocol Security (IPsec) policies and settings. Windows commands reference

On Windows

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from the Windows commands reference, CC BY 4.0

The netsh ipsec command is used to configure and manage Internet Protocol Security (IPsec) policies and settings. IPsec is a comprehensive protocol suite that secures network communications by authenticating and encrypting each IP packet within a communication session, ensuring the confidentiality, integrity, and authenticity of the data being transmitted. - name: This is the name you set for the mmpolicy, qmpolicy, filteraction, filterlist, policy, rule, or gpoassignedpolicy. - qmpermm: Specifies the number of Quick Mode sessions allowed per Main Mode session in Internet Key Exchange (IKE) . - mmlifetime: Specifies the duration, in minutes, before the Main Mode security association is renegotiated in IKE. - mmsecmethods: Specifies one or more security methods, separated by spaces, using the format *"ConfAlg-HashAlg-GroupNum"*. - ConfAlg: Encryption algorithm, such as DES or 3DES. - HashAlg: Hash algorithm, such as MD5 or SHA1. - GroupNum: Diffie-Hellman group number, where 1 = Low, 2 = Medium, 3 = DH2048. The use of DES and MD5 isn't recommended. These cryptographic algorithms are provided for backward compatibility only. - soft: Specifies whether to permit unsecured communication with computers that don't support IPsec using yes or no values. - qmsecmethods: Specifies the IPsec security offer using one of the following formats: - ESP[ConfAlg,AuthAlg]:k/s - AH[HashAlg]:k/s - AH[HashAlg]+ESP[ConfAlg,AuthAlg]:k/s Where: - ConfAlg: Encryption algorithm (DES, 3DES, or None) - AuthAlg: Authentication algorithm (MD5, SHA1, or None) - HashAlg: Hash algorithm (MD5 or SHA1) - k: Lifetime in kilobytes - s: Lifetime in seconds - srcaddr / dstaddr: Specifies the source address (starting point of the network traffic) and destination address (endpoint of the network traffic) respectively. Options are: - ipv4: Designates an IPv4 address. - ipv6: Designates an IPv6 address. - ipv4-ipv4: Represents an IPv4 range. - ipv6-ipv6: Represents an IPv6 range. - dns: Uses a DNS name to specify the source or the destination. - server: Refers to a server address. - mmpolicy: Refers to the Main Mode policy to be used for the rule. Main Mode policies define the security settings for establishing secure, authenticated communications. …

netsh ipsec [dump | dynamic | help | static | ?]
netsh ipsec dynamic add mmpolicy [name=]<string> [qmpermm=]<integer> [mmlifetime=]<integer> [softsaexpirationtime=]<integer> mmsecmethods=
netsh ipsec dynamic add qmpolicy [name=]<string> soft= pfsgroup= qmsecmethods=
netsh ipsec dynamic add rule srcaddr= dstaddr=
[mmpolicy=]<string> [qmpolicy=]<string> protocol= [srcport=]<port> [dstport=]<port>
mirrored= conntype= actioninbound= actionoutbound=
srcmask= dstmask= tunneldstaddress= kerberos= [psk=]<preshared key>
[rootca=]"<certificate> certmap:(yes|no) excludecaname:(yes|no)"
netsh ipsec dynamic delete <all> [[mmpolicy|qmpolicy [name=]<string>|all]
netsh ipsec dynamic delete rule srcaddr= dstaddr=
protocol= [srcport=]<port> [dstport=]<port> mirrored=
conntype= srcmask= dstmask= tunneldstaddress=

To add a Main Mode IPsec policy named "MyMM-Policy" with 100 Quick Mode sessions, a 4800-minute lifetime, 1800-second soft expiration, and 3DES/SHA1 security, run the following command

netsh ipsec dynamic add mmpolicy name="MyMM-Policy" qmpermm=100 mmlifetime=4800 softsaexpirationtime=1800 mmsecmethods="3DES-SHA1"Identify

To add a Quick Mode IPsec policy named "MyQM-Policy" with unsecured communication fallback enabled, set to group 2 PFS, and two security methods for ESP: 3DES/SHA1 and AES128/SHA256, run the following command

netsh ipsec dynamic add qmpolicy name="MyQM-Policy" soft=yes pfsgroup=GRP2 qmsecmethods="ESP:3DES-SHA1 ESP:AES128-SHA256"Identify

To create a security rule that permits TCP traffic on port 80 between the source IP 192.168.1.10 and destination IP 192.168.1.20 over a LAN connection, using the 'MainModePolicy' and 'QuickModePolicy', run the following command

netsh ipsec dynamic add rule srcaddr=192.168.1.10 dstaddr=192.168.1.20 mmpolicy="MainModePolicy" qmpolicy="QuickModePolicy" protocol=TCP srcport=80 dstport=80 mirrored=no conntype=lan actioninbound=permit actionoutbound=permitIdentify

To delete all IPsec dynamic policies, including both main mode and quick mode policies, run the following command

netsh ipsec dynamic delete allIdentify

To delete a specific quick mode policy named "QuickModePolicy", run the following command

netsh ipsec dynamic delete qmpolicy name="QuickModePolicy"Identify

To delete a specific IPsec rule that permits TCP traffic on port 80 between the source IP 192.168.1.10 and destination IP 192.168.1.20 over a LAN connection, run the following command

netsh ipsec dynamic delete rule srcaddr=192.168.1.10 dstaddr=192.168.1.20 protocol=TCP srcport=80 dstport=80 conntype=lanIdentify

To export the current IPsec configuration to a script file that can be used to reconfigure the system or another system with the same settings, run the following command

netsh ipsec dump > C:\Users\Admin\MyFolder\ipsec_settings.txtIdentify

To add an IPsec filter that permits TCP traffic on port 80 from source IP 192.168.1.10 to destination IP 192.168.1.20 with mirrored configuration, run the following command

netsh ipsec static add filter filterlist=MyWebTraffic srcaddr=192.168.1.10 dstaddr=192.168.1.20 protocol=TCP srcport=80 dstport=80 description="Allow web traffic" mirrored=yesIdentify

To create a filter action that allows traffic to pass without engaging in IPsec negotiation or encryption, run the following command

netsh ipsec static add filteraction name=AllowTraffic description="Permit traffic without negotiation" qmpfs=no inpass=yes soft=no action=permitIdentify

To create a new IPsec filter list for grouping related IPsec filters, run the following command

netsh ipsec static add filterlist name=WebTrafficFilters description="Filters for managing web traffic"Identify

To create an IPsec policy named "SecurePolicy" that uses specific encryption methods and settings to protect sensitive network traffic, run the following command

netsh ipsec static add policy name=SecurePolicy description="Policy for securing sensitive traffic" mmpfs=yes qmpermm=50 mmlifetime=28800 activatedefaultrule=no pollinginterval=600 assign=yes mmsecmethods="3DES-SHA1 DHGroup2;AES128-SHA256 DHGroup14"Identify

To add an IPsec rule named "WebServerRule" that implements security measures for LAN connections to a web server by using specified filter lists and actions with authentication, run the following command

netsh ipsec static add rule name=WebServerRule policy=SecurePolicy filterlist=WebTrafficFilters filteraction=AllowTraffic tunnel=no conntype=lan activate=yes description="Secures web server traffic with specified filters and Kerberos authentication" kerberos=yesIdentify
Show 29 options
ipsec dynamic add mmpolicyAdds a Main Mode policy to the Security Policy Database (SPD). softsaexpirationtime - Specifies the time, in seconds, before a soft expiration of the security association. Other subparameters: - name - qmpermm - mmlifetime - mmsecmethods See Remarks for description details.
ipsec dynamic add qmpolicyAdds a Quick Mode policy to the SPD. pfsgroup - Specifies the Perfect Forward Secrecy (PFS) group for key exchange. Options are: - GRP1, GRP2, GRP3 - Specifies different Diffie-Hellman groups (security levels). - GRPMM - Specifies the Main Mode group. - NOPFS - Specifies no PFS (default setting). Other subparameters: - name - soft See Remarks for description details.
ipsec dynamic add ruleAdds a new IPsec rule to the dynamic policy configuration. Unlike static policies, dynamic policies are typically temporary and can be used for testing, troubleshooting, or temporarily modifying security configurations without changing the permanent static policy settings. actioninbound - Specifies the action to be taken on inbound traffic. actionoutbound - Specifies the action to be taken on outbound traffic. Options are: - permit: Allows the matching traffic to pass through without any IPsec protection. - block: Prevents the matching traffic from passing through. - negotiate: Requires that the matching traffic performs IPsec negotiation to establish a secure connection. Other subparameters: - srcaddr - dstaddr - mmpolicy - qmpolicy - protocol - srcport - dstport - mirrored - conntype - srcmask - dstmask - tunneldstaddress - kerberos - psk - rootca See Remarks for description details.
ipsec dynamic delete allRemoves all dynamic IPsec rules from the current policy configuration. Other subparameters: - mmpolicy - qmpolicy - name - all See Remarks for description details.
ipsec dynamic delete ruleRemoves a specific IPsec rule from the dynamic policy configuration. When you execute this command, you're instructing the system to delete a rule that was dynamically added to the IPsec policy engine. This action affects how network traffic is treated in terms of security policies. Other subparameters: - srcaddr - dstaddr - protocol - srcport - dstport - mirrored - conntype - srcmask - dstmask - tunneldstaddress See Remarks for description details.
ipsec dumpExports the current IPsec configuration settings to a text file.
ipsec static add filterAdds a specific traffic filter to an existing IPsec policy. This filter defines which network traffic (based on criteria like IP addresses, protocols, and ports) is subject to the security rules and actions specified by the IPsec policy. Other subparameters: - filterlist - srcaddr - dstaddr - description - protocol - mirrored - srcmask - dstmask - srcport - dstport See Remarks for description details.
ipsec static add filteractionAdds a filter action within an IPsec policy. A filter action specifies the actions that should be taken on traffic that matches the criteria of an IPsec filter. These actions determine how matching traffic is handled, such as whether it should be allowed, blocked, or secured. Other subparameters: - name - description - qmpfs - inpass - soft - action - qmsecmethods See Remarks for description details.
ipsec static add filterlistA new filter list in an IPsec policy configuration in Windows. A filter list is essentially a collection of one or more filters, each defining specific criteria for network traffic, such as source and destination IP addresses, ports, and protocols. Other subparameters: - name - description See Remarks for description details.
ipsec static add policyAdds a new IPsec policy. This command doesn't apply any specific rules or filters by itself, rather, it serves as the starting point for defining how you want to manage or secure network traffic on the device. Other subparameters: - name - description - mmpfs - qmpermm - mmlifetime - activatedefaultrule - pollinginterval - assign - mmsecmethods See Remarks for description details.
ipsec static add ruleAdds a rule to an existing IPsec policy. Once you've created an IPsec policy, you'll typically need to define specific rules that dictate how traffic matching certain criteria should be handled. Other subparameters: - name - policy - filterlist - filteraction - tunnel - conntype - activate - description - kerberos - psk - rootca See Remarks for description details.
ipsec static delete filterRemoves a specified filter from the IPsec configuration. Filters in IPsec are used to define criteria for matching network traffic, such as specifying particular IP addresses, protocols, or port numbers to which certain rules or actions should apply. Other subparameters: - filterlist - srcaddr - dstaddr - protocol - mirrored - srcmask - dstmask - srcport - dstport See Remarks for description details.
ipsec static delete all netsh ipsec static delete [filteraction | filterlist | policy]Removes all IPsec policies, rules, filters, filter actions, and associated components from the system. This command can also remove specific components or from the IPsec configuration. Other subparameters: - name See Remarks for description details.
ipsec static delete ruleRemoves a specific rule from an existing IPsec policy. Other subparameters: - name - id - all - policy See Remarks for description details.
ipsec static [exportpolicy | importpolicy] file=<string>This command is used to manage the export and import of IPsec policies, allowing you to save or load IPsec configurations to or from a file. This can be useful for backing up configurations or applying the same configuration to multiple systems. - exportpolicy - Exports the current IPsec policy configuration to a specified file. - importpolicy - Imports an IPsec policy configuration from a specified file. - file - Specifies the path and name of the file you wish to use for exporting or importing the policy.
ipsec static set batch mode=(enabledisable) Executes multiple IPsec commands in a group, reducing the chances of policy inconsistencies during changes. When you enable batch mode, you can enter multiple IPsec commands, and they're queued up. Once you complete entering the commands and exit batch mode, the policy changes are applied all at once. When you enable batch mode, it allows multiple IPsec policy commands to be processed as a batch, which means they can be applied together to minimize the time during which policy changes might be inconsistent or incomplete. When you disable batch mode, each command is executed independently as you enter them.
ipsec static set defaultruleConfigures the default IPsec rule that is applied in the absence of more specific rules. Other subparameters: - policy - qmpfs - activate - qmsecmethods - kerberos - psk - rootca See Remarks for description details.
ipsec static set filteractionModifies the action associated with a specific IPsec filter. Filter actions determine how traffic is handled, such as permitting or blocking it. Other subparameters: - name - guid - newname - description - qmpfs - inpass - soft - action - qmsecmethods See Remarks for description details.
ipsec static set filterlistUpdates an existing filter list, which consists of filters defining which traffic is affected by IPsec policies. Other subparameters: - name - guid - newname - description See Remarks for description details.
ipsec static set policyAlters the rules and settings for secure communication, including filter lists and actions set in the IPsec policy. gponame - Specifies the name of the Group Policy Object (GPO) where the IPsec policy is set. Other subparameters: - name - guid - newname - description - mmpfs - qmpermm - mmlifetime - activatedefaultrule - pollinginterval - assign - mmsecmethods See Remarks for description details.
ipsec static set ruleModifies a specific IPsec rule within a policy. Other subparameters: - name - id - policy - newname - description - filterlist - filteraction - tunnel - conntype - activate - kerberos - psk - rootca See Remarks for description details.
ipsec static set storeSpecifies which configuration store, either the local policy store or the Active Directory-based store, that the IPsec commands apply to when you configure or view IPsec settings. location - Specifies where the IPsec policies are stored. Options are: local: Indicates that the policies are stored on the local computer. domain: Indicates that the policies are stored in a domain-level policy, which is managed through Active Directory (AD). domain= : Designates the domain name when the location is set to domain. Replace <string> with the actual domain name you're using. This is applicable only if the location is specified as domain, and it determines which domain's policies are being accessed or altered.
ipsec static show allDisplays all currently configured IPsec policies, rules, filter lists, and actions. Other subparameters: - format - wide See Remarks for description details.
ipsec static show filteractionDisplays details about the filter actions configured in the system. resolvedns - Specifies whether to resolve and display the Domain Name System (DNS) names for the IP addresses in the filter list. Options are: yes: The command attempts to resolve the IP addresses to their corresponding DNS names. no: The command displays the raw IP addresses without attempting DNS resolution. Other subparameters: - name - rule - all - level - format - wide See Remarks for description details.
ipsec static show filterlistDisplays the filter lists defined in the system, which helps identify how traffic is matched against policy rules. Other subparameters: - name - rule - all - level - format - wide See Remarks for description details.
ipsec static show gpoassignedpolicyDisplays the IPsec policies assigned through GPO. Other subparameters: - name See Remarks for description details.
ipsec static show policyDisplays detailed information about specific IPsec policies, including rules, filters, and actions. Other subparameters: - name - all - level - format - wide See Remarks for description details.
ipsec static show ruleDisplays information for a specified IPsec rule. Other subparameters: - name - id - all - policy - type - level - format - wide See Remarks for description details.
ipsec static show storeDisplays the current store context that is being used for IPsec commands. It shows whether the commands are targeting the local policy store or the Active Directory-based store.