FAQ about IPSEC

• Q: Can you assign more than one IPSEC policy [such as "Client (respond only)" and "Server (request security)"] at a time on a machine?
• A: No. Only one IPSEC policy will function at a time on a machine. If one is assigned and you assign another, the new one becomes assigned and the old one is automatically un-assigned.
• Q: Why does it look like I have assigned a policy under the Local Security Control Panel but the settings do not seem to be working?
• A: Here are two possibilities that I know of:
  
  
  1. If you are receiving an IPSEC policy assignment via group policy, any local settings will be applied but ignored until the GP IPSEC is revoked, at which time your local policy assignment will then come into play. The IPSEC policy assigned via Group Policy is not viewable through the Local Security control panel. This can be confusing because there is no ready evidence that your local policy is being overridden except a warning upon opening the Local Security Policy control MMC (Control Panel). A good way to determine the status of your IPSEC policy is to download and run the Windows 2000 Resource Kit tool NETDIAG with the ?/test:ipsec? option. This tool among other things, reports the status of your IPSEC ? whether the IPSEC service is not running, your local policy is active, or if you are receiving IPSEC policy through a GPO. Download:  Netdiag
  2. If you have layered your local IPSEC policy using a series of command line statements that add on to an existing IPSEC rule set, the changes to the rule set will not be effective until you remove the policy assignment and then re-assign the policy. The batch files we provide include a stop and start after the rules are processed.

     To stop the rule set named :

     ipsecpol -w REG -p "" -y
     

     To start the rule set named :

     ipsecpol -w REG -p "" -x
     

• Q: I have assigned IPSEC via GP and then created an exception GPO for a couple of machines that have their own stricter local IPSEC policy. Why aren't they getting excluded from the IPSEC assignment?
• A: In order for local policy settings to apply, all IPSEC policy delivered by GP must be disabled for that machine.
• Q: I have a couple of machines to which I don't want to apply the domain-wide IPSEC policy. For these machines I created a superceding Group Policy Object where I marked the policy as not assigned. Why aren't they still getting the IPSEC policy assignment?
• A: Creating a new, superceding Group Policy Object that has the IPSEC policy unassigned DOES NOT revoke the assignment from the machines that had it assigned. It seems this is caused by a quirk in how the separate Active Directory Group Policy Objects and Active Directory IPSEC Policy Objects interact (see the following quote). Assigning a new IPSEC policy that specifically overrides the settings made by the preceding IPSEC policy is required. Note: This will still override local IPSEC policy settings.

  Assigning Domain IPSEC Policy
  
  "IPSEC policy will remain active even after the Group Policy object to which it is assigned has been deleted. You must unassign the IPSEC policy before you delete the policy object. If you delete the policy objects and keep the policy assigned, the IPSEC Policy Agent will assume it simply cannot find the policy and use a cached copy."

  This implies that unless an active change is made to the state of an IPSEC policy assignment, it will remain in effect. Merely applying a new GPO where a previously assigned IPSEC policy assignment is now set to "no" is not considered "disabled"; rather it seems to mean it is "not set".

Return to IPSEC Home