Windows 2000 IPSec Policy Implementation Using MMC

This article explains how Microsoft Windows 2000 implements IP Security (IPSec) policies on a standalone system using the Microsoft Management Console (MMC). It details the process of loading the IP Security Policy Management snap-in, the architectural components that make up a local policy—such as filter lists, filter actions, and authentication methods—and how the operating system's underlying services enforce these rules to protect network traffic.

Accessing the IP Security Snap-in

In Windows 2000, local IPSec policies are managed through a dedicated MMC administrative tool. To access this interface:

  1. Open the Run dialog, type mmc, and press Enter.
  2. From the Console menu, select Add/Remove Snap-in, then click Add.
  3. Select IP Security Policy Management from the list of available standalone snap-ins.
  4. When prompted to specify the computer this snap-in will manage, select Local computer and finish the wizard.

Default Built-in Policies

Once loaded, the snap-in provides three predefined IPSec policies stored in the local registry:

  • Client (Respond Only): Communicates normally (unencrypted) for all outbound traffic but can negotiate IPSec if requested by a remote server.
  • Server (Request Security): Attempts to negotiate IPSec for all incoming and outgoing communications, but falls back to unsecured transmission if the remote party does not support IPSec.
  • Secure Server (Require Security): Mandates that all incoming and outgoing communications use IPSec. Any traffic that cannot be successfully secured is blocked.

Core Components of an IPSec Policy

Creating or modifying an IPSec policy in Windows 2000 involves configuring three interdependent components:

  1. IP Filter Lists: These define which network traffic triggers the policy. An IP filter specifies parameters such as the source IP address, destination IP address, protocol type (e.g., TCP, UDP, ICMP), and source/destination port numbers.
  2. Filter Actions: These dictate how the system handles traffic that matches an IP filter. The three available actions are:
    • Permit: Allows the packet to pass without IPSec processing.
    • Block: Discards the packet entirely.
    • Negotiate Security: Initiates an Internet Key Exchange (IKE) handshake to establish security associations using Authentication Header (AH) for integrity or Encapsulating Security Payload (ESP) for encryption and integrity.
  3. Authentication Methods: During the IKE exchange, endpoints must authenticate each other. Windows 2000 supports:
    • Kerberos v5: Used primarily in Active Directory domains.
    • Public Key Certificates: Used for enterprise public key infrastructure (PKI) deployments.
    • Preshared Keys: A shared secret string, commonly used for testing or third-party device compatibility.

Creating and Assigning a Policy

Administrators can create custom configurations using the Create IP Security Policy Wizard:

  1. Right-click the snap-in node and select Create IP Security Policy.
  2. Provide a name and description, then configure default response rules if needed.
  3. Add custom rules by pairing a specific IP Filter List with a Filter Action and an Authentication Method.
  4. Define the Connection Type (All network connections, Local Area Network (LAN) only, or Remote access).

For a policy to take effect, it must be explicitly assigned. Right-click the desired policy in the MMC details pane and select Assign.

Enforcement Mechanism

Once assigned, the local IPSec Policy Agent service reads the policy parameters from the local registry (HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\IPSec\Policy\Local) and passes them to the TCP/IP stack driver (IPSEC.SYS). The driver then intercepts packets at the network layer, checks them against the active filters, and transparently enforces the defined security actions. Only one IPSec policy can be active on a Windows 2000 system at any given time.