|
|
v1.51 Copyright(c) 1998-2001, Microsoft CorporationUSAGE: ipseccmd \\machinename -f FilterList -n NegotiationPolicyList -t TunnelAddr -a AuthMethodList -1s SecurityMethodList -1k Phase1RekeyAfter -1p -1f MMFilterList -1e SoftSAExpirationTime -soft -confirm [-dialup OR -lan] {-w TYPE:DOMAIN -p PolicyName:PollInterval -r RuleName -x -y -o}ipseccmd \\machinename show filters policies auth stats sas all
BATCH MODE:ipseccmd -file filename File must contain regular ipseccmd commands, all these commands will be executed in one shot.
ipseccmd has three mutually exclusive modes: static, dynamic, and query.
The default mode is dynamic.
Dynamic mode will plumb policy directly into the IPSec ServicesSecurity Policies Database. The policy will be persisted, i.e. it will stayafter a reboot. The benefit of dynamic policy is that it can co-exist withDS based policy.
To delete all dynamic policies, execute "ipseccmd -u" command
When the tool is used in static mode,it creates or modifies stored policy. This policy can be used again and will last the lifetime of the store. Static mode is indicated by the -wflag. The flags in the {} braces are only valid for static mode. The usage for static mode is an extension of dynamic mode, so please read throughthe dynamic mode section.
In query mode, the tool queries IPSec Security Policies Database.
NOTE: references to SHA in ipseccmd are referring to the SHA1 algorithm.
------------ QUERY MODE ------------
The tool displays requested type of data from IPSec Security Policies Database
filters - shows main mode and quick mode filters policies - shows main mode and quick mode policies auth - shows main mode authentication methods stats - shows Internet Key Exchange (IKE) and IPSec statistics sas - shows main mode and quick mode Security Associations all - shows all of the above dataIt is possible to combine several flagsEXAMPLE: ipseccmd show filters policies
------------DYNAMIC MODE------------
Each execution of the tool sets an IPSec rule, an IKE policy,or both. When setting the IPSec policy, think of it as setting an "IP Security Rule" in the UI. So, if you need to set up a tunnel policy, you will needto execute the tool twice, once for the outbound filters and outgoing tunnelendpoint, and once for the inbound filters and incoming tunnel endpoint.
OPTIONS: \\machinename sets policies on that machine. If not included, the local machine is assumed. NOTE: that if you use this it must be the first argument AND you MUST have administrative privileges on that machine.
-confirm will ask you to confirm before setting policy can be abbreviated to -c *OPTIONAL, DYNAMIC MODE ONLY*
The following flags deal with IPSec policy. If omitted, a default value is used where specified.
-f FilterList where FilterList is one or more space separated filterspecs a filterspec is of the format: A.B.C.D/mask:port=A.B.C.D/mask:port:protocol you can also specify DEFAULT to create default response rule
The Source address is always on the left of the '=' and the Destination address is always on the right.
MIRRORING: If you replace the '=' with a '+' two filters will be created, one in each direction.
mask and port are optional. If omitted, Any port and mask 255.255.255.255 will be used for the filter.
You can replace A.B.C.D/mask with the following for special meaning: 0 means My address(es) * means Any address a DNS name (NOTE: multiple resolutions are ignored) a GUID of the local network interface in the form {12345678-1234-1234-1234-123456789ABC} GUIDs are NOT supported for static mode
protocol is optional, if omitted, Any protocol is assumed. If you indicate a protocol, a port must precede it or :: must preceded it. NOTE BENE: if protocol is specified, it must be the last item in the filter spec.
Examples: Machine1+Machine2::6 will filter TCP traffic between Machine1 and Machine2 172.31.0.0/255.255.0.0:80=157.0.0.0/255.0.0.0:80:TCP will filter all TCP traffic from the first subnet, port 80 to the second subnet, port 80
PASSTHRU and DROP filters: By surrounding a filter specification with (), the filter will be a passthru filter. If you surround it with [], the filter will be a blocking, or drop, filter. Example: (0+128.2.1.1) will create 2 filters (it's mirrored) that will be exempted from policy.
You can use the following protocol symbols: ICMP UDP RAW TCP
Star notation: If you're subnet masks are along octet boundaries, then you can use the star notation to wildcard subnets. Examples: 128.*.*.* is same as 128.0.0.0/255.0.0.0 128.*.* is the same as above 128.* is the same as above 144.92.*.* is same as 144.92.0.0/255.255.0.0
There is no DEFAULT, -f is required -n NegotiationPolicyList where NegotiationPolicyList is one or more space separated IPSec policies in the one of the following forms:
ESP[ConfAlg,AuthAlg]RekeyPFS[Group] AH[HashAlg] AH[HashAlg]+ESP[ConfAlg,AuthAlg]
where ConfAlg can be NONE, DES, or 3DES and AuthAlg can be NONE, MD5, or SHA and HashAlg is MD5 or SHA
NOTE: ESP[NONE,NONE] is not a supported config NOTE: SHA refers the SHA1 hash algorithm
Rekey is number of KBytes or number of seconds to rekey put K or S after the number to indicate KBytes or seconds, respectively Example: 3600S will rekey after 1 hour To use both, separate with a slash. Example: 3600S/5000K will rekey every hour and 5 MB.
REKEY PARAMETERS ARE OPTIONAL
PFS this is OPTIONAL, if it is present it will enable phase 2 perfect forward secrecy. You may use just P for short. It is also possible to specify which PFS Group to use: PFS1 or P1, PFS2 or P2 By Default, PFS Group value will be taken from current Main Mode settings DEFAULT: ESP[3DES,SHA] ESP[3DES,MD5] ESP[DES,SHA] ESP[DES,MD5]
-t tunnel address in one of the following forms: A.B.C.D DNS name
DEFAULT: omission of tunnel address assumes transport mode
-a AuthMethodList A list of space separated auth methods of the form: PRESHARE:"preshared key string" KERBEROS CERT:"CA Info"
The strings provided to preshared key and CA info ARE case sensitive. You can abbreviate the method with the first letter, ie. P, K, or C.
DEFAULT: KERBEROS
-soft will allow soft associations DEFAULT: don't allow soft SAs
-lan will set policy only for lan adapters -dialup will set policy only for dialup adapters *BOTH ARE OPTIONAL, if not specified, All adapters are used* DEFAULT: All adapters
The following deal with IKE phase 1 policy. An easy way to remember is that all IKE phase 1 parameters are passed with a 1 in the flag.
If no IKE flags are specified, the current IKE policy will be used. If there is no current IKE policy, the defaults specified below will be used.
-1s SecurityMethodList where SecurityMethodList is one or more space separated SecurityMethods in the form: ConfAlg-HashAlg-GroupNum where ConfAlg can be DES or 3DES and HashAlg is MD5 or SHA and GroupNum is: 1 (Low) 2 (Med)
Example: DES-SHA-1 DEFAULT: 3DES-SHA-2 3DES-MD5-2 DES-SHA-1 DES-MD5-1
-1p enable PFS for phase 1 DEFAULT: not enabled
-1k number of Quick Modes or number of seconds to rekey for phase 1 put Q or S after the number to indicate Quick Modes or seconds, respectively Example: 10Q will rekey after 10 quick modes To use both, separate with a slash. Example: 10Q/3600S will rekey every hour and 10 quick modes *OPTIONAL* DEFAULT: no QM limit, 480 min lifetime -1e SoftSAExpirationTime set Soft SA expiration time attribute of the main mode policy value is specified in seconds DEFAULT: not set if Soft SA is not allowed set to 300 seconds if Soft SA is allowed
-1f MMFilterList set specific main mode filters. Syntax is the same as for -f option except that you cannot specify passthru, block filters, ports and protocols DEFAULT: filters are generated automatically based on quick mode filters -----------STATIC MODE-----------
Static mode uses most of the dynamic mode syntax, but adds a few flagsthat enable it work at a policy level as well. Remember, dynamic modejust lets you add anonymous rules to the policy agent. Static modeallows you to create named policies and named rules. It also has somefunctionality to modify existing policies and rules, provided they wereoriginally created with ipseccmd.
Static mode is supposed to provide most of the functionality of the IPSec UIin a command line tool, so there are references here to the UI.
First, there is one change to the dynamic mode usage that static moderequires. In static mode, pass through and block filters are indicatedin the NegotiationPolicyList that is specified by -n. There are threeitems you can pass in the NegotiationPolicyList that have special meaning:
BLOCK will ignore the rest of the policies in NegotiationPolicyList and will make all of the filters blocking or drop filters. This is the same as checking the "Block" radio button in the UI
PASS will ignore the rest of the policies in NegotiationPolicyList and will make all of the filters pass through filters. This is the same as checking the "Permit" radio button in the UI
INPASS will plumb any inbound filters as pass through. This is the same as checking the "Allow unsecured communication, but always respond using IPSEC" check box in the UI
Static Mode flags:All flags are REQUIRED unless otherwise indicated.
-w Write the policy to storage indicated by TYPE:LOCATION TYPE can be either REG for registry or DS for Directory Storage if \\machinename was specified and TYPE is REG, will be written to the remote machine's registry DOMAIN for the DS case only. Indicates the domain name of the DS to write to. If omitted, use the domain the local machine is in. OPTIONAL
-p PolicyName:PollInterval Name the policy with this string. If a policy with this name is already in storage, this rule will be added to the policy. Otherwise a new policy will be created. If PollInterval is specified, the polling interval for the policy will be set.
-r RuleName Name the rule with this string. If a rule with that name already exists, that rule is modified to reflect the information supplied to ipseccmd. For example, if only -f is specified and the rule exists, only the filters of that rule will be replaced.
-x will set the policy active in the LOCAL registry case OPTIONAL
-y will set the policy inactive in the LOCAL registry case OPTIONAL
-o will delete the policy specified by -p OPTIONAL (NOTE: this will delete all aspects of the specified policy don't use if you have other policies pointing to the objects in that policy)
The command completed successfully.
|
