Configure the global IPsec main mode default settings. The global default settings are used when a connection security rule does not specify its own main mode settings, and a separate main mode rule (Windows 7 or Windows Server 2008 R2 only) does not match the connection. On the Windows Firewall with Advanced Security Properties dialog box, on the Settings tab, under IPsec defaults, click Customize, and then under Key Exchange (Main Mode), select Advanced and then click Customize. You cannot use netsh to configure the global main mode default settings. Configure network connections are protected by each profile. If the check box for a network connection is cleared then that network connection is not protected by the profile even if the attached network matches that network location type. On the Windows Firewall with Advanced Security Properties dialog box, under any of the Profile tabs, next to Protected network connections, click Customize. You cannot use to configure per profile enabling or disabling of specific connection types. Create main mode rules that specify authentication settings for connections between specified IP addresses, or for connections using specific network location profiles. If a connection matches a main mode rule then it is used instead of the global default settings, or even the settings specified in the connection security rule. Main mode rules are supported on Windows 7 and Windows Server 2008 R2 only. You cannot use the MMC snap-in to create main mode rules. Use the netsh advfirewall mainmode add rule command. Create a connection security rule that uses a specific quick mode configuration instead of the global defaults. You cannot use the MMC snap-in to create rules with per-rule quick mode settings. Rules created in the MMC snap-in, they always use the Use the qmsecmethods parameter of the advfirewall consec add rule command.
Caution Do not use preshared keys in a production environment. They are not considered secure, and are not easily managed. Use computer certificates either purchased from a third-party vendor, or created by an in-house certification authority, such as a computer that is running Windows Server 2008 R2 with the Active Directory Certificate Services server role. The Preshared key authentication method is used in this guide only because it is beyond the scope of the guide to create a certification authority for this one step. 11. On the Profile page, click Next. 12. On the Name page, type Tunnel on Gateway, and then click Finish. Next topic: Step 3: Test Your Tunnel Mode Rules With the tunnel mode rules defined, you can now try to access your domain controller through the member server from the client on the public network. Important This section of the guide uses features that are present only on computers that are running Windows 7 and Windows Server 2008 R2, and will not work as written on computers that are running earlier versions of Windows. To communicate with the private network through the tunnel 1. On CLIENT1, start the Windows Firewall with Advanced Security MMC snap-in. 2. Expand Monitoring, expand Security Associations, and then click Quick Mode. The list of quick mode security associations (QMSAs) is empty, unless you tried to communicate with the private network. 3. Open a command prompt, and then position the Command Prompt window and the Windows Firewall with Advanced Security snap-in so that you can see the list of QMSAs and still type in the Command Prompt window. 4. At the command prompt, type the command ping 192.168.0.1. The connection succeeds. The first packet might report a loss because of the delay caused by the IPsec tunnel negotiations. 5. On the Actions pane of the Windows Firewall with Advanced Security snap-in, click Refresh. The QMSA between the client and the gateway is displayed. 6. At the command prompt, type the command net view \\dc1.