Monitoring IPsec

Monitoring IPsec

You can use the IP Security Monitor snap-in to view and monitor Internet Protocol security (IPsec)-related statistics and the IPsec policy applied to this computer and other computers. This information can help you troubleshoot IPsec and test the policies you are creating. To change the IPsec policies, use the IP Security Policies snap-in.

If you create a policy using the Windows Firewall with Advanced Security snap-in, you cannot use the IP Security Monitor snap-in to view these rules. You must use the Monitoring node of the Windows Firewall with Advanced Security snap-in.

Monitoring tasks

This is a brief list of the most common tasks you might perform using the IP Security Monitor snap-in:

Adding a computer

Before you can monitor IPsec on a remote computer, you must first add the computer to the snap-in. You must have administrator-level access to the remote computer to add it and monitor IPsec.

To add a computer

1. In the console tree, right-click IP Security Monitor, and then click Add computer.

2. In the Add Computer dialog box, click The following computer, and then type the name of the remote computer. Or, click Browse to find it on the network.

Finding a specific filter

There are two ways to find information about a specific filter, which might be helpful, for example, during troubleshooting: you can sort the Specific Filters view to find the filter or you can search for the filter in the Specific Filter node of either Main Mode or Quick Mode.

To find a filter in the filter list by browsing

1. In the Specific Filter folder of either the Main Mode or Quick Mode folders, click the column heading for the property that you want to browse. If you click the column heading again, the list will be sorted in reverse order.

2. Browse through the list to find the filter.

To find a specific filter by searching

1. Under either the Main Mode or Quick Mode folder, right-click the Specific Filter folder, and then click Find Matching Filters.

2. In the Find Matching Filters dialog box, select the criteria you want to search for, and then click Search.

Looking for signs of possible attacks

The statistics collected and displayed by the IP Security Monitor snap-in can be useful when looking for possible attacks against this computer or other computers you have added to the snap-in. This information is located in the Statistics folders of both the Main Mode and Quick Mode folders. For more information about the statistics available, see Monitoring Main Mode or Monitoring Quick Mode.

Viewing security associations

A security association (SA) is the combination of a negotiated key, security protocol, and security parameters index (SPI), which together define the security used to protect the communication from sender to receiver. By looking at the SAs for this computer, you can determine which computers have connections with this computer, which type of data integrity and encryption is being used for that connection, and other information.

This information can be helpful when you are testing IPsec policies or troubleshooting access issues.

Changing other settings

You can configure whether the snap-in automatically refreshes the information it provides. You can also configure how often it refreshes and whether the views display IP addresses or DNS names.

To configure automatic refresh

1. Under the IP Security Monitor folder, right-click the computer's node, and then click Properties.

2. In the computer Properties dialog box, select the Enable auto refresh check box.

3. To change the frequency with which the snap-in updates the information, type the preferred interval.

To view IP addresses as DNS names

1. Right-click the computer's node in the IP Security Monitor snap-in, and then click Properties.

2. In the computer Properties dialog box, select the Enable DNS name resolution check box, and then click OK.

See Also

Concepts

Active Policy
Monitoring Quick Mode
Monitoring Main Mode