Microsoft Windows 8, RT, Windows Server 2012 IPsec VPN client Supplemental Admin Guidance
விளம்பரம்
விளம்பரம்
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Microsoft Windows
Common Criteria Evaluation
Microsoft Windows 8
Microsoft Windows RT
Microsoft Windows Server 2012
Microsoft Windows 8, Microsoft
Windows Server 2012, Microsoft
Windows RT Common Criteria
Supplemental Admin Guidance for IPsec
VPN Clients
D
OCUMENT
I
NFORMATION
Version Number
Updated On
1.0
May 29, 2013
Microsoft © 2013 Page 1 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
This is a preliminary document and may be changed substantially prior to final commercial release of the software described herein.
The information contained in this document represents the current view of Microsoft Corporation on the issues discussed as of the date of publication.
Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information presented after the date of publication.
This document is for informational purposes only.
MICROSOFT MAKES NO WARRANTIES, EXPRESS
OR IMPLIED, AS TO THE INFORMATION IN THIS
DOCUMENT.
Complying with all applicable copyright laws is the responsibility of the user.
This work is licensed under the Creative Commons Attribution-NoDerivs-
NonCommercial License (which allows redistribution of the work). To view a copy of this license, visit http://creativecommons.org/licenses/by-nd-nc/1.0/ or send a letter to Creative Commons, 559 Nathan
Abbott Way, Stanford, California 94305, USA.
Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document.
Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property.
The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred.
© 2013 Microsoft Corporation. All rights reserved.
Microsoft, Active Directory, Visual Basic, Visual
Studio, Windows, the Windows logo, Windows NT, and Windows Server are either registered trademarks or trademarks of Microsoft Corporation in the United
States and/or other countries.
The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Microsoft © 2013 Page 2 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
T
ABLE OF
C
ONTENTS
......................................................................................5
...............................................................................................6
...................................................... 6
......................................................... 6
......................................................................... 10
1 ..................................................... 13
2 ..................................................... 17
......................................................................................... 22
.............................................................................................. 23
....................................................................................... 25
................................................ 26
............................................................. 27
............................................................ 29
........................................................................................... 30
.......................................................................................... 30
..................................................................................... 31
................................................................. 31
................................................... 31
................................................... 32
............................................................................................... 32
Microsoft © 2013 Page 3 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
............................................................................................... 36
................................................... 37
......................................................... 37
....................................................................................... 42
........................................... 46
......................................................................... 49
) ............................................................... 52
................................................... 52
................................... 56
............................................................... 57
............................................................................................... 58
......................................................... 58
Microsoft © 2013 Page 4 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
1 Version Information
Specification Filename
Specification version, date
IPSEC Client Evaluation Administration Guide (July 31 2013).docx
1.0, May 29, 2013
This document provides administrative guidance used in the Windows 8, Windows RT, and Server 2012
IPsec VPN Client Common Criteria security to configure IPsec and RAS IPsec VPN.
1.1 VPN Client Scenario Configuration
This document describes configuring an IPsec VPN connection between a Windows 8, Windows RT, or
Server 2012 IPsec VPN client and a VPN gateway (as represented in the figure above).
The machines necessary are a VPN Client, a VPN Gateway, a Domain Controller, and a Certificate
Authority (CA) for the domain. The VPN Gateway should be a member of the domain. The VPN Client may be a member of the domain or a standalone machine. The Domain Controller and the Certificate
Authority must be in the private network. The VPN Client and VPN Server may be installed with any of the product editions listed in the Security Target.
The VPN Gateway must have two network adapters, one connecting to the public network and one connecting to the private network. So the VPN Server is straddling the two networks. If the VPN Client and VPN Gateway are configured as described in this document, then all processes running on the VPN
Client receive data on the VPN connection through the network interfaces on the VPN Gateway.
This administrative guide provides configuration instructions for the VPN Client only.
2 RAS IPsec VPN Client Configuration
This section provides information on how to configure the RAS IPsec VPN Client for IKEv1 and IKEv2 in tunnel mode. Transport mode is not supported for VPN connections.
Microsoft © 2013 Page 5 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The RAS IPsec VPN client is a Windows 8 or Windows Server 2012 computer that is domain joined to a private network, or a Windows 8, Windows Server 2012 or Windows RT standalone (not domain-joined) computer. The RAS IPsec VPN client will establish a VPN connection with the VPN gateway while on the public network. However, initial configuration of the RAS IPsec VPN client machine is done while the RAS
IPsec VPN client machine is connected to the private network. After the initial RAS IPsec VPN client configuration is completed in the private network, then the RAS IPsec VPN client machine can be moved to the public network to establish the VPN connection.
2.1 RAS IPsec VPN Configuration
This portion of the RAS IPsec VPN configuration is performed while the client is connected to the private network.
2.1.1 Configuring the Root Certificate on the RAS IPsec VPN Client
This section gives steps for installing the root certificate for the CA on the RAS IPsec VPN Client machine.
The CA root certificate is required for the client computer to trust the VPN Server certificate and complete the VPN connection. A domain certificate authority’s root certificate is installed by default in the machine Trusted Root Store of a domain joined machine. So if the client has the CA root certificate already installed then this part of the configuration may be skipped.
If the CA root certificate is not already installed (e.g. on a standalone client), then it can be installed manually by conducting the following steps:
1. On the client machine, click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7. In the navigation pane, expand Certificates (Local Computer), expand Trusted Root Certification
Authorities, right-click Certificates, click All Tasks, and then click Import.
8. On the Certificate Import Wizard welcome page, click Next.
9. On the File to Import page, click Browse.
10. In the File name text box, type the location of your root certificate file, and then press ENTER.
2.1.2 Enrolling for the RAS IPsec VPN Client Machine Certificate
Instructions are included for the case of domain-joined or standalone VPN client machines.
VPN client machine certificates must be managed by an administrator. A user who is not an administrator cannot add or delete machine certificates.
2.1.2.1 Enrollment for a Domain-joined Machine
1. On the client machine, click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
Microsoft © 2013 Page 6 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7.
In the navigation pane, expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Request New Certificate. See the figure below.
8. On the Certificate Enrollment begin page, click Next.
9. On the Select Certificate Enrollment Policy page, make sure the Active Directory Enrollment
Policy is selected and click Next.
10. On the Request Certificates page find the Enrollment template that is needed for the RAS IPsec
VPN Client (this is the template name configured on the CA), check the box and click the Enroll button.
11. Click the Finish button once enrollment is completed.
Microsoft © 2013 Page 7 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The new machine certificate for the RAS IPsec VPN Client should now be in the Personal certificate store for the machine. It may be prudent to make sure the certificate has the proper EKU, Client
Authentication (1.3.6.1.5.5.7.3.2), see the figure below.
Note: The client’s machine certificate must have the following EKU: Client Authentication
(1.3.6.1.5.5.7.3.2). The client machine certificate can also include the Server Authentication
(1.3.6.1.5.5.7.3.1) and IP Security IKE Intermediate (1.3.6.1.5.5.8.2.2) EKUs in order to simplify testing
(since a single certificate template can be used for multiple scenarios).
2.1.2.2 Enrollment for a Standalone Machine
The standalone RAS IPsec VPN Client configuration is identical to a domain-joined RAS IPsec VPN Client with the exception that the certificate enrollment is different.
Enroll for a RAS IPsec VPN Client certificate on a domain-joined RAS IPsec VPN Client machine as described in the previous section and then export the certificate from the domain-joined RAS IPsec VPN
Client machine as follows:
1. Click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
Microsoft © 2013 Page 8 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7. In the navigation pane, expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Export…
8. Click Next on the Certificate Export Wizard
9. Click the radio button Yes, Export the private key
10. Check the radio button Personal Information Exchange – PKCS #12 (.PFX)
11. Click the checkbox Include all certificates in the certification path if possible
12. Click Next on the Certificate Export Wizard
13. Click the checkbox Password and fill in a password value in the Password and Confirm Password edit boxes
14. Click Next on the Certificate Export Wizard
15. Choose an appropriate file name and location for the certificate file (e.g. a USB drive) and click
Next
16. Click the Finish button to complete the Certificate Export Wizard
Move the certificate file to the standalone RAS IPsec VPN Client machine and do the following steps to import the RAS IPsec VPN Client certificate:
1. Double-click the .PFX file for the RAS IPsec VPN Client certificate
2. Check the radio button Local Machine on the Certificate Import Wizard and click Next
3. Click Next on the Certificate Import Wizard
4. Type in the password chosen in step 13 above in the Password edit box and click Next
5. Check the radio button Place all certificates into the following store, browse to the Personal store and click Next
6. Click Finish on the Certificate Import Wizard
Move the CA root certificate to the Trusted Root Certification Authorities on the standalone RAS IPsec
VPN Client machine by conducting the following steps:
Microsoft © 2013 Page 9 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
1. Click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7. In the navigation pane, expand Certificates (Local Computer)\Personal, click the CA root certificate and drag/drop it onto the Trusted Root Certification Authorities node in the navigation pane
2.1.3 Configuring the Client Lifetimes
The client lifetime settings are not configurable on the RAS IPsec VPN interface for IKEv1 and IKEv2. The following are the values used for lifetimes by the RAS IPsec VPN Client:
Main Mode
Lifetime in Seconds : 10800
Quick Mode
Lifetime in Seconds : 3600
Lifetime in Packets : 2147483647
Lifetime in Kilobytes : 250000
Idle Duration in Seconds : 300
Lifetime settings configured on the VPN gateway take precedence over the RAS IPsec VPN Client lifetime settings if the RAS IPsec VPN Client settings are larger than the server settings. For example, if the VPN gateway has a lifetime kilobytes setting for a quick mode Security Association that is less than 250000, then the VPN server will renegotiate the quick mode Security Association before the RAS IPsec VPN
Client would otherwise have done so.
2.2 Configuring the RAS IPsec VPN Connection
Once the VPN client has a machine certificate then it can be moved to the public network (i.e. removed from the private network) to configure the VPN connection.
The following steps to create the VPN connection are applied for both RAS IPsec IKEv1 and IKEv2:
1. Log onto the RAS IPsec VPN Client machine as administrator and open the Control Panel.
Microsoft © 2013 Page 10 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2. Using the small icons view of the Control Panel click on Network and Sharing Center.
3. In the Network and Sharing Center window click on the Setup a new connection or network link.
See figure below.
4. In the Set Up a Connection or Network window select Connect to a Workplace and click Next.
See the figure below.
Microsoft © 2013 Page 11 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
5. In the Connect to a Workplace window click on Use my Internet connection (VPN), see figure below.
6. In the Connect to a Workplace window click on I’ll set up an Internet connection later, see figure below.
Microsoft © 2013 Page 12 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
7. In the Connect to a Workplace window in the Internet Address textbox enter the DNS name of the VPN gateway, and then click the Create button. The VPN Gateway DNS name is configured as dm1.prtm.com in the figure below.
8. The RAS IPsec VPN connection should now be created. The next step is to configure the VPN connection properties to negotiate using either the IKEv1 or IKEv2 protocol.
2.2.1 Configuring RAS IPsec VPN Connection Properties for IKEv1
The following steps are required to configure the RAS IPsec VPN connection properties for IKEv1:
1. Click the network icon in the lower right corner of the task bar to bring up the Connections slide bar, right-click VPN Connection and then click View connection properties to open the VPN
Connections Properties dialog.
2. Click on the Security tab, select Layer 2 Tunneling Protocol with IPsec (L2TP/IPsec) in the Type
of VPN dropdown list and select the Allow these protocols radio button, and then check the
Microsoft CHAP Version 2 (MS-CHAP v2) checkbox. See the figure below.
Microsoft © 2013 Page 13 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3. Click the OK button on VPN Connection Properties
Note: When the RAS IPsec VPN is configured to use L2TP/IPsec (also known as IKEv1), then IKEv1 Phase
1 negotiation operates in main mode only; aggressive mode operation is not supported and cannot be configured.
2.2.1.1 Configuring the Client Authentication Protocol for IKEv1
The following are steps to configure the authentication protocol for IKEv1 protocol after the VPN connection settings have been configured to use IKEv1 in the previous step:
1. Click the network icon in the lower right corner of the task bar to bring up the Connections slide bar, right-click VPN Connection and then click View connection properties to open the VPN
Connections Properties dialog
2. Click on the Advanced settings button to open the Advanced Properties dialog
3. In Advanced Properties select the radio button for Use preshared key for authentication or Use
certificate for authentication to select the desired authentication type using the Advanced
Properties dialog. See the figures below.
Microsoft © 2013 Page 14 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Note: the secret value for the preshared key must be a text-based value manually entered as shown in the Key editbox in the Advanced Properties dialog below. The secret value must match the secret value configured on the VPN server. While the secret can be any length, it should include at least 22 characters and up to 100 characters as determined at the discretion of the administrator. For example organizational policies can enforce the use of strong passwords containing a minimum number of characters using at least one upper and one lower case letter, one number, and one special character from among the following: ! @ # $ % ^ & * ().
Note: Only RSA certificates are supported by the RAS IPsec VPN Client for authentication.
4. Click OK on the Advanced Properties dialog and then click OK on VPN Connection Properties.
Microsoft © 2013 Page 15 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2.2.1.2 Configuring the Client Cryptographic Algorithms for IKEv1
The following are the cryptographic algorithms from the Security Target that are supported by the RAS
IPsec VPN Client for IKEv1:
DH Group:
DH Group 20
DH Group 14
Symmetric Encryption:
AES-CBC-128
AES-CBC-256
Hashing:
SHA1
Certificate Authentication:
RSA
The Data encryption listbox selection on the Security tab supports four choices shown in the figure below:
The RAS IPsec VPN Require encryption and Maximum strength encryption choices produce the cryptographic algorithms as shown in the table below according to the VPN Server configuration:
Microsoft © 2013 Page 16 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
VPN Server configured for DH20
(default)
Main mode:
DH Group20
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-128
Main mode:
DH Group20
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
VPN Server configured for DH14
Only RSA certificates are supported by RAS IPsec VPN for authentication.
Main mode:
DH Group 14
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-128
Main mode:
DH Group 14
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Note: The NegotiateDH2048_AES256 registry key discussed in the section Configuring DH Group 14 and
AES256 for IKEv2 has no bearing on the client cryptographic algorithm selection for IKEv1.
2.2.2 Configuring RAS IPsec VPN Connection Properties for IKEv2
Microsoft © 2013 Page 17 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Open the VPN connection properties and navigate to the security tab. Select IKEv2 in the Type of VPN dropdown and select the Use machine certificates radio button. See the figure below.
The VPN connection should now be ready to use for IKEv2 using the default cryptographic algorithms.
See section Connecting to the VPN Gateway
to inspect the SAs negotiated by the RAS IPsec VPN Client and VPN Server.
2.2.2.1 Configuring the Client Cryptographic Algorithms for IKEv2
There are two options to configure the cryptographic algorithms used by RAS IPsec VPN. The first is the
Data encryption selection on the Security tab of the RAS IPsec VPN Client connection properties window. The second is the value of the DWORD NegotiateDH2048_AES256 registry value; see the
“Configuring DH Group 14 and AES256 for IKEv2” section of this document for instructions on how to set the NegotiateDH2048_AES256 registry value.
The following are the cryptographic algorithms from the Security Target that are supported by the RAS
IPsec VPN Client:
DH Groups:
DH Group 2
Microsoft © 2013 Page 18 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
DH Group 14
Symmetric Encryption:
AES-CBC-256
Hashing:
SHA1
SHA256
SHA384
Certificate Authentication:
RSA
The Data encryption selection on the Security tab supports the four choices in the figure below:
Microsoft © 2013 Page 19 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The DWORD NegotiateDH2048_AES256 registry value supports the values 0, 1 and 2. Note that a
DWORD value of 0 for the NegotiateDH2048_AES256 registry value is the same as not having the value in the registry.
The following table specifies the required configurations necessary to use algorithms from the Security
Target. Other configurations may cause the RAS IPsec VPN client to use an algorithm not in the Security
Target.
RAS IPsec
VPN Client registry value
0 and VPN
Server configured for DH2,
SHA1 and
AES256
Main mode:
DH Group2
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group2
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group2
SHA256
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group2
SHA256
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
RAS IPsec
VPN Client registry value
0 and VPN
Server configured for DH2 and
SHA256 (for main mode) and
AES256Error!
Bookmark
not defined.
RAS IPsec
VPN Client registry value
0 and VPN
Server configured for DH2 and
SHA384 (for main mode) and
AES256Error!
Bookmark
not defined.
Main mode:
DH Group2
SHA384
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group2
SHA384
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
RAS IPsec
VPN Client registry value
1 or 2 and VPN server configured for DH14,
AES256 and
SHA1
Main mode:
DH Group14
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group14
SHA1
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
RAS IPsec
VPN Client registry value
1 or 2 and VPN server configured for DH14,
AES256 and
SHA256
Main mode:
DH Group14
SHA256
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group14
SHA256
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
RAS IPsec
VPN Client registry value
1 or 2 and VPN server configured for DH14,
AES256 and
SHA384
Main mode:
DH Group14
SHA384
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Main mode:
DH Group14
SHA384
AES-CBC-256
Quick mode:
SHA1
AES-CBC-256
Note that only RSA certificates are supported by RAS IPsec VPN for authentication.
Microsoft © 2013 Page 20 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2.2.2.2 Configuring DH Group 14 and AES256 for IKEv2
By default IPsec RAS VPN will use DH Group 2 and 3DES for main mode, however it can be configured to use DH Group 14 and AES256 during main mode. The following instructions configure IPsec RAS VPN to use the stronger algorithms.
1) As an Administrator open Registry Editor
2) Locate and then right-click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Rasman\Parameters
Point to New, and then click DWORD Value.
Type NegotiateDH2048_AES256, and then press ENTER.
3) Right-click NegotiateDH2048_AES256, and then click Modify.
In the Value data box, type 0, 1, or 2 as appropriate, and then click OK.
0 (default value): The DH Group 14 algorithm together with the AES-256 algorithm to negotiate IKE is not supported. Note that a value of 0 for this registry value is the same as if the registry value did not exist.
1: The DH Group 14 algorithm together with the AES-256 algorithm is available in the
IKE list.
2: Only the DH Group 14 algorithm together with the AES-256 algorithm is supported.
4) Exit the Registry Editor.
5) Reboot the RAS IPsec VPN Client machine.
2.2.3 Configuring the Hosts File
For IPsec RAS VPN to establish a VPN connection with the VPN gateway it must have the DNS name of the VPN gateway configured. If the network setup is such that IP addresses are statically assigned and the public network does not have a DNS server to look up the VPN gateway name, then it may be necessary to configure the hosts file on the VPN client computer with the DNS name of the VPN gateway. Below are the instructions on how to add the VPN gateway IP address to the hosts file:
1) On the client start an elevated Command Windows, run as administrator.
2) Navigate to %windir%\system32\drivers\etc\hosts and open the file in notepad, “notepad hosts”.
3) Add the following text in a new line at the end of the document:
<IP address of the VPN gateway> <DNS name of the VPN gateway >
Microsoft © 2013 Page 21 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
For example if the IP address of the VPN gateway is 157.59.20.171 and the DNS name of the
VPN gateway is dm3.prtm.com the entry looks like the following:
157.59.20.171 dm3.prtm.com
4) Save and close the hosts file.
2.3 Connecting to the VPN Gateway
Unless otherwise noted below the VPN gateway connection instructions are identical for IKEv1 and
IKEv2.
To connect to the VPN gateway from the VPN client click on the network icon in lower right corner on the task bar to bring up the Connections slide bar. Click on the VPN Connection that was just created and then click on Connect. The VPN client should then connect to the VPN gateway. See the figure below.
Note: the MS-CHAPv2 authentication protocol used in IKEv1 includes a prompt for the user’s credentials in the Connections slide bar required to negotiate the Main Mode SA. The user account that is provided must be allowed remote access as described below for the case of the domain administrator account:
1. On the Domain Controller open Server Manager and click the Active Directory Users and
Computers item in the Tools menu
2. In Active Directory Users and Computers click Users in the navigation pane and right-click the
Administrator user account
3. In Administrator Properties window click the Dial-in tab and then click the Allow access radio button
Microsoft © 2013 Page 22 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
If a connection is broken due to network interruption then the established SA remains in use until the SA lifetime limits are reached.
2.3.1 Checking the Established IPSEC SAs
Once the VPN client has connected to the VPN gateway a main mode IPsec Security Association (SA) and two quick mode IPsec SAs are established between the two machines. The main mode SA may be verified by opening an elevated PowerShell command window running as an administrator. At the
PowerShell command line executing the “Get-NetIPsecMainModeSA” cmdlet will display any main mode
SAs that have been established.
The KeyModule parameter indicates use of the IKEv1 or IKEv2 protocol in the main mode SA. See the figures below showing an IKEv1 main mode SA authenticated by a preshared key and an IKEv2 main mode SA authenticated using machine certificates.
Microsoft © 2013 Page 23 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Microsoft © 2013 Page 24 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The quick mode SAs may be checked by opening an elevated PowerShell command window running as an administrator. For a VPN connection there should be two quick mode SAs, one inbound and one outbound. At the PowerShell command line executing the “Get-NetIPsecQuickModeSA” cmdlet will display any quick mode SAs that have been established.
The quick mode “MmSaId” parameter value can be correlated with the main mode “Name” parameter value to correlate the quick mode SAs with their associated main mode SA. See the figure below showing a quick mode SA associated with the IKEv2 main mode SA shown above.
2.3.2 Recovering an Interrupted Connection
If network connectivity is interrupted, then the established SA remains in use until either the SA lifetime limits or the configured network outage time is exceeded. If network connectivity is re-established within these the two timeframes, then the established SA will continue to function on the re-established network connection.
Microsoft © 2013 Page 25 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
outage time is configured in the Advanced Properties dialog that is opened from the VPN Connection properties dialog as shown in the figure below:
3 IPsec Configuration
The following URL links to an article, Securing End-to-End IPsec Connections by Using IKEv2 in Windows
Server 2012, with instruction on creating a group policy for applying IPsec rules to computers in a domain. It also provides instructions for creating a rule on computers that are not domain joined.
- http://technet.microsoft.com/en-us/library/hh831807.aspx
The above article is the starting point and basis for the IPsec rule configuration using the IKEv2 protocol.
Complete the steps in the above article before executing the additional instructions provided below that describe how to re-configure the rule created in the above article to use additional cryptographic algorithms and authentication methods. The additional instructions indicated below also describe how to re-configure the IPsec rule to use the IKEv1 protocol instead of IKEv2 without affecting the set of supported cryptographic algorithms and authentication methods. Transport and tunnel modes can be configured for IKEv1 and transport only for IKEv2. By default transport mode is initiated.
3.1 Configuring DH Groups, Symmetric Encryption and Hashing
The following table lists the DH Groups supported for IPsec by Windows 8, Windows RT, and Windows
Server 2012.
DH Groups
DH Group 2 (1024-bit MODP)
DH Groups 14 (2048-bit MODP)
DH Group 19 (256-bit Random ECP)
DH Group 20 (384-bit Random ECP)
PowerShell Value
DH2
DH14
DH19
DH20
The following table lists the symmetric encryption algorithms supported for IPsec by Windows 8,
Windows RT and Windows Server 2012.
Microsoft © 2013 Page 26 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Symmetric Encryption
AES-CBC-128
AES-CBC-256
AES-GCM-128 (only supported in quick mode)
AES-GCM-256 (only supported in quick mode)
PowerShell Value
AES128
AES256
AESGCM128
AESGCM256
Note that AES-GCM-128 and AES-GCM-256 may only be configured for quick mode. In addition, when
AES-GCM-128 is configured then the hashing algorithm must be AES-GMAC-128 and when AES-GCM-256 is configured the hashing algorithm must be AES-GMAC-256.
The following table lists the hashing algorithms supported for IPsec by Windows 8, Windows RT and
Windows Server 2012.
Hashing Algorithm
SHA-1
PowerShell Value
SHA1
SHA-256
SHA-384
SHA256
SHA384
AES-GMAC-128 (only supported in quick mode) AESGMAC128
AES-GMAC-256 (only supported in quick mode) AESGMAC256
Note that AES-GMAC-128 and AES-GMAC-256 may only be configured for quick mode. AES-GMAC-128 may be combined with the following symmetric encryption algorithms AES128, AES256, and
AESGCM128. AES-GMAC-256 may be used with the following symmetric encryption algorithms AES128,
AES256, and AESGCM256.
The hashing algorithm may also be set to None, which means there will be no hashing. A hashing algorithm should be configured to avoid this case.
The following sections provide instructions to configure any of the above cryptographic algorithms, as well as using preshared key and machine certificates for authentication, and modifying the lifetime settings by executing various PowerShell commands to modify the IPsec rule in the group policy on the domain controller. After each set of commands are executed, the IPsec client computers must receive the updated rule through a GPO policy update. This update can be accomplished by restarting the IPsec client computers while they are connected to the corporate domain or alternatively by forcing a GPO update with the following command executed with administrator credentials: “gpupdate /force”.
To satisfy the requirement FCS_IPSEC_EXT.1.13 in the Security Target, care must be taken to ensure that the cryptographic algorithm configuration specifies a main mode encryption algorithm that is at least as strong as the quick mode algorithm. The various scripts below configure the main mode and quick mode algorithms such that this requirement is met. If the scripts are modified, then care must be taken to ensure this rule is not broken. Further, the FCS_IPSEC_EXT.1.13 requirement specifies the set of hash and encryption algorithms that are allowed by the Security Target and this rule is reflected in the set of algorithms shown as available in the tables below. While other algorithms may be used, doing so violates this requirement and so they should not be used.
Microsoft © 2013 Page 27 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3.1.1 Configuring Cryptographic Algorithms for Main Mode
This section provides instructions on how to configure main mode cryptographic algorithms.
3.1.1.1 Initial Main Mode Rule Configuration
The document, Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012, does not address configuring a main mode rule, so to configure other main mode cryptographic algorithms, a main mode rule must first be created. This can be done with the following PowerShell commands.
1. Set up the GPO name and the proposal for the phase 1 authentication set.
$gponame = "<FQDN of domain>\IPsecRequireInRequestOut"
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
#Create an auth proposal for selecting the local certificate to send in the negotiation
$certprop1 = New-NetIPsecAuthProposal -SelectionCriteria -machine -cert -
Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA"
#Create an auth proposal for the remote machine’s certificate
#The proposal below requires a certificate with a subject name that is a
#CN and the CN must be the hostname of the remote machine.
#Of course the hostname string below must be replace with the hostname
#of the remote machine.
#Note the hostname of the remote machine will be different on
#the two machines since it is the name of the other machine.
#The certificate subject name must match the string used in the proposal
$certprop2 = New-NetIPsecAuthProposal -ValidationCriteria -machine -cert -
Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -SubjectNameType CN –
SubjectName hostname
$myauth = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2TestPhase1AuthSet" proposal $certprop1,$certprop2 –PolicyStore GPO:$gponame
2. Create a main mode crypto proposal
$DH = New-NetIPsecMainModeCryptoProposal -KeyExchange DH19 -Encryption AES256 -
Hash SHA256
3. Create a main mode crypto set
$MainModeCS = New-NetIPsecMainModeCryptoSet -DisplayName "Main Mode DH
CryptoSet" -Proposal $DH -PolicyStore GPO:$gponame
4. Create a main mode rule
New-NetIPsecMainModeRule -DisplayName "Main Mode Rule" -RemoteAddress any -
MainModeCryptoSet $MainModeCS.Name -Phase1AuthSet $myauth.InstanceID -
PolicyStore GPO:$gponame
Microsoft © 2013 Page 28 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3.1.1.2 Changing Main Mode Rule Cryptographic Algorithms
Once a main mode rule is initially configured then the cryptographic algorithms may be changed by performing the following steps. The PowerShell cmdlets below may be used to configure any of the algorithms supported by main mode.
Below is an example for setting the cryptographic algorithms used in the client main mode SAs to be the key exchange group DH20, the symmetric encryption algorithm AES256 and the hashing algorithm
SHA256. Note that the following steps are performed in PowerShell and are used to edit a rule in a group policy object.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the group policy object (GPO) that will be applied to the IPsec clients:
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
2. Set a variable to hold the main mode cryptoset:
$mmcryptoset = Get-NetIPsecMainModeCryptoSet -PolicyStore GPO:$gponame
3. Create a new main mode crypto proposal with the appropriate algorithms:
$mmproposal = (New-NetIPsecMainModeCryptoProposal -Encryption AES256 -Hash
SHA256 -KeyExchange DH20)
4. Now set the new crypto proposal onto the main mode cryptoset of the rule:
$mmcryptoset | Set-NetIpsecMainModeCryptoSet -Proposal $mmproposal
3.1.2 Configuring Cryptographic Algorithms for Quick Mode
This section provides instructions on how to configure quick mode cryptographic algorithms. The
PowerShell cmdlets below may be used to configure any of the algorithms supported by quick mode.
Below is an example for setting the cryptographic algorithms used in the client quick mode SAs to be the symmetric encryption algorithm AES256 and the hashing algorithm SHA256. Note that the following steps are performed in PowerShell and are used to edit a rule in a global policy object.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Set a variable to hold the quick mode cryptoset:
$qmcryptoset = Get-NetIPsecQuickModeCryptoSet -PolicyStore GPO:$gponame
Microsoft © 2013 Page 29 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3. Create a new quick mode crypto proposal with the appropriate algorithms:
$qmproposal = (New-NetIPsecQuickModeCryptoProposal -Encapsulation ESP -EspHash
SHA256 -Encryption AES256)
4. Now set the new crypto proposal onto the quick mode cryptoset of the rule:
$qmcryptoset | Set-NetIpsecQuickModeCryptoSet -Proposal $qmproposal
5. Create an IPsec rule
New-NetIPsecRule -DisplayName "My IKEv2 Rule" -RemoteAddress any -
Phase1AuthSet $myauth.InstanceID -InboundSecurity Require -OutboundSecurity
Request -KeyModule IKEv2 -PolicyStore GPO:$gponame -QuickModeCryptoSet
$qmcryptoset.Name
3.2 Configuring SA Lifetimes
This section provides instructions on how to configure SA lifetime values.
3.2.1 Configuring Main Mode SA Lifetimes
This section provides instructions on how to configure main mode SA lifetime in minutes.
Below is an example for setting the main mode SA lifetime to 240 minutes.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Set a variable to hold the main mode cryptoset:
$mmcryptoset = Get-NetIPsecMainModeCryptoSet -PolicyStore GPO:$gponame
3. The maximum lifetime in minutes of the a main mode SA is set with the following cmdlet:
$mmcryptoset | Set-NetIpsecMainModeCryptoSet -MaxMinutes 240
3.2.2 Configuring Quick Mode SA Lifetimes
This section provides instructions on how to configure quick mode SA lifetime.
Below is an example for setting the quick mode SA lifetime to 70 minutes and 90,000 kilobytes.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Set a variable to hold the quick mode cryptoset:
Microsoft © 2013 Page 30 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
$qmcryptoset = Get-NetIPsecQuickModeCryptoSet -PolicyStore GPO:$gponame
3. Create a new quick mode crypto proposal with the lifetime values:
$qmproposal = (New-Netipsecquickmodecryptoproposal -maxkilobytes 90000 maxminutes 72 -Encapsulation ESP -EspHash SHA256 -Encryption AES256)
4. Now set the new crypto proposal onto the quick mode cryptoset of the rule:
$qmcryptoset | Set-NetIpsecQuickModeCryptoSet -Proposal $qmproposal
3.3 Configuring Signature Algorithms
The following table lists the signature algorithms that are supported for IPsec authentication with certificates by Windows 8, Windows RT, and Windows Server 2012.
Signature Algorithms
RSA
ECDSA P256
ECDSA P384
3.3.1 Configuring RSA Machine Certificate Authentication
This section provides instructions on how to configure RSA machine certificate authentication.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Create a new authentication proposal using RSA and that has the CA root:
#DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA must be replaced by the actual CA root
$authprop = New-NetIPsecAuthProposal –SelectionCriteria -Machine -Cert -
Authority "DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -Signing RSA
3. Set a variable to hold the authentication set:
$authset1 = Get-NetIPsecPhase1AuthSet -PolicyStore GPO:$gponame
4. Create a new authentication proposal:
$authset1 | Set-NetIPsecPhase1AuthSet -Proposal $authprop
3.3.2 Configuring ECDSA P256 Machine Certificate Authentication
This section provides instructions on how to configure ECDSA P256 machine certificate authentication.
The PowerShell cmdlets below should be run on the domain controller.
Microsoft © 2013 Page 31 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Create a new authentication proposal using ECDSA P256
#DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA must be replaced by the actual CA root
$authprop = New-NetIPsecAuthProposal –SelectionCriteria -Machine -Cert -
Authority " DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -Signing ECDSA256
3. Set a variable to hold the authentication set:
$authset1 = Get-NetIPsecPhase1AuthSet -PolicyStore GPO:$gponame
4. Create a new authentication proposal:
$authset1 | Set-NetIPsecPhase1AuthSet -Proposal $authprop
configure the Certificate Authority and enroll machines for certificates.
3.3.3 Configuring ECDSA P384 Machine Certificate Authentication
This section provides instructions on how to configure ECDSA P384 machine certificate authentication.
The PowerShell cmdlets below should be run on the domain controller.
1. Set a variable with the name of the GPO applied to clients:
#<FQDN of domain> must be replaced with the actual name (e.g. corp.contoso.com)
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
2. Create a new authentication proposal using ECDSA P384:
#DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA must be replaced by the actual CA root
$authprop = New-NetIPsecAuthProposal –SelectionCriteria -Machine -Cert -
Authority " DC=com, DC=contoso, DC=corp, CN=corp-APP1-CA" -Signing ECDSA384
3. Set a variable to hold the authentication set:
$authset1 = Get-NetIPsecPhase1AuthSet -PolicyStore GPO:$gponame
4. Create a new authentication proposal:
$authset1 | Set-NetIPsecPhase1AuthSet -Proposal $authprop
Microsoft © 2013 Page 32 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
3.3.4 Configuring Machine Certificates
This section provides instructions on how to configure the certificate authority to issue machine certificates for main mode authentication as well as instructions on how to enroll for the certificates on the machines with the IPsec policy. The instructions below will be for RSA certificates, but there are notes for what would be change for ECDSA P256 and ECDSA P384 certificates.
3.3.4.1 Configuring a Certificate Template on the Certificate Authority
The Certificate Authority needs a certificate template for IPsec certificates in order to enroll the computers using IPsec.
Create a certificate template so that requesting computers can enroll for machine certificates to be used for authentication.
Create an IPsec Cert certificate template
1. On APP1, from the Start screen, click Certification Authority.
2. In the details pane, expand corp-APP1-CA.
3. Right-click Certificate Templates, and then click Manage.
4. In the Certificate Templates console, right-click the IPsec template, and then click
Duplicate Template.
5. Click the General tab, and type IPsec Cert RSA in the Display Name.
Note that if ECDSA P256 or ECDSA_P384 is to be used then the certificate template would be named IPsec Cert ECDSA256 or IPsec Cert ECDSA384 respectively. The template name in the following steps will then be as specified in this step.
6. Click the Compatibility tab and select Windows Server 2012 for Certification Authority and Windows 8/Windows Server 2012 for Certificate recipient.
7. Click the Request Handling tab and select Signature for the Purpose.
8. Click the Cryptography tab and select Key Storage Provider for the Provider Category and RSA for the Algorithm Name.
Note that if you are trying to use ECDSA P256 or ECDSA P384 then ECDSA_P256 or
ECDSA_P384 must be selected for the Algorithm name respectively.
9. Click the Security tab, and then click Authenticated Users.
10. In Permissions for Authenticated Users, click Enroll under Allow, and then click OK.
Note: The Authenticated Users group is configured here for simplicity in the test lab. In a real deployment, you would specify the name of a security group that contains the
Microsoft © 2013 Page 33 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients computer accounts of the computers in your organization that can request custom certificates.
11. In the Properties of IPsec Cert RSA window click OK.
12. Enable the IPsec Cert RSA template by navigating back to the Certification Authority
MMC console, open the Certification Authority node in the left pane and right click on the Certificate Templates node and then click on the New -> Certificate Template to
Issue sub-menu item. This will start the Enable Certificate Templates window.
13. Select the IPsec Cert RSA template that was just created and click OK.
3.3.4.2 Enrolling for a Certificate
Instructions are included for the case of domain-joined or standalone IPsec client machines.
IPsec client machine certificates must be managed by a local administrator. A user who is not an administrator cannot add or delete machine certificates.
3.3.4.2.1 Domain-joined IPsec machine
The CLIENT1 machine and the SERVER1 machine both need a machine certificate. Each machine must be enrolled separately. The certificate installation process for the CLIENT1 machine is described here and must be performed on the SERVER1 machine as well.
To install an RSA authentication certificate on CLIENT1
1. On CLIENT1, from the Start screen, type mmc, and then press ENTER.
2. Click File, and then click Add/Remove Snap-in.
3. Click Certificates, click Add, click Computer account, click Next, select Local computer, click Finish, and then click OK.
4. In the console tree of the Certificates snap-in, open Certificates (Local
Computer)\Personal\Certificates.
5. Right-click Certificates, point to All Tasks, and then click Request New Certificate.
6. Click Next twice.
7. On the Request Certificates page, click IPsec Cert RSA, and then click More information
is required to enroll for this certificate.
If ECDSA P256 or ECDSA P384 certificates are desired then the certificate template should be IPsec Cert ECDSA256 or IPsec Cert ECDSA384 respectively.
8. On the Subject tab of the Certificate Properties dialog box, in Subject name, for Type,
Microsoft © 2013 Page 34 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients select Common Name.
9. In Value, type client1.corp.contoso.com, and then click Add.
10. In the Alternative name area, under Type, select DNS.
11. In Value, type client1.corp.contoso.com, and then click Add.
12. Click OK, click Enroll, and then click Finish.
13. In the details pane of the Certificates snap-in, verify that a new certificate with the name client1.corp.contoso.com was enrolled with Intended Purposes of Server
Authentication and Client Authentication.
14. Close the console window. If you are prompted to save settings, click No.
3.3.4.2.2 Standalone IPsec machine
Enroll for the desired type of client certificate on a domain-joined IPsec machine as described in the previous section and then export the certificate from the domain-joined IPsec machine as follows:
1. Click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7. In the navigation pane, expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Export…
8. Click Next on the Certificate Export Wizard
9. Click the radio button Yes, Export the private key
10. Check the radio button Personal Information Exchange – PKCS #12 (.PFX)
11. Click the checkbox Include all certificates in the certification path if possible
12. Click Next on the Certificate Export Wizard
13. Click the checkbox Password and fill in a password value in the Password and Confirm Password edit boxes
14. Click Next on the Certificate Export Wizard
Microsoft © 2013 Page 35 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
15. Choose an appropriate file name and location for the certificate file (e.g. a USB drive) and click
Next
16. Click the Finish button to complete the Certificate Export Wizard
Move the certificate file to the standalone IPsec machine and conduct the following steps to import the
IPsec machine certificate:
1. Double-click the .PFX file for the IPsec machine certificate
2. Check the radio button Local Machine on the Certificate Import Wizard and click Next
3. Click Next on the Certificate Import Wizard
4. Type in the password chosen in step 13 above in the Password edit box and click Next
5. Check the radio button Place all certificates into the following store, browse to the Personal store and click Next
6. Click Finish on the Certificate Import Wizard
Move the CA root certificate to the Trusted Root Certification Authorities on the standalone IPsec machine by conducting the following steps:
1. Click Start, type mmc, and then press ENTER.
2. In the Console1 window, click File, and then click Add/Remove snap-in.
3. Under Available snap-ins, select Certificates, and then click Add.
4. In the Certificates snap-in dialog box, select Computer account, and then click Next.
5. In the Select Computer dialog box, click Finish to accept the default selection of Local computer.
6. Click OK to close the Add/Remove snap-ins dialog box.
7. In the navigation pane, expand Certificates (Local Computer)\Personal, click the CA root certificate and drag/drop it onto the Trusted Root Certification Authorities node in the navigation pane
3.4 Configuring PreShared Keys
This section provides instructions on how to configure a preshared key for authentication.
1. Set a variable with the name of the GPO that will be applied to the IPsec clients:
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
#Notice that the <FQDN of domain> needs to be replaced with the actual name, for example corp.contoso.com.
Microsoft © 2013 Page 36 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2. Create a new authentication proposal using a preshared key. The key is simply a string value:
$authprop = New-NetIPsecAuthProposal -Machine -PreSharedKey
"!@#$%^&*()0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV"
3. Set a variable to hold the authentication set:
$authset1 = Get-NetIPsecPhase1AuthSet -PolicyStore GPO:$gponame
4. Create a new authentication proposal:
$authset1 | Set-NetIPsecPhase1AuthSet -Proposal $authprop
3.5 Configuring the IKEv1 or IKEv2 Protocol in the IPsec Rule
The instructions above are identical for the case of using IKEv1 protocol with the exception of the following PowerShell command that must be run on the domain controller:
1. Set a variable with the name of the GPO applied to clients:
$gponame="<FQDN of domain>\IPsecRequireInRequestOut"
#Notice that the <FQDN of domain> needs to be replaced with the actual name, for example corp.contoso.com.
2. Set a variable with the name of the IPsec rule and modify the rule to use IKEv1 protocol:
$rule = get-netipsecrule –policystore GPO:$gponame
$rule | set-netipsecrule –keymodule ikev1 –phase2authset None
Note that the IKEv1 protocol could also have been initially applied by setting the keymodule parameter
Quick Mode. The second command shown in step (2) above that modifies the rule can also be used to
select either the IKEv1 or the IKEv2 protocol. For the protocol change to take affect, any existing Security
Associations must first be removed (e.g. by using the PowerShell cmdlet “remove-netipsecmainmodesa, or by breaking the network connection or restarting either of the IPsec machines).
Note that the –mode tunnel parameter can be used in the set-netipsecrule for the ikev1 keymodule to change the default transport mode to instead use tunnel mode.
3.6 Configuring IPsec Connections on Standalone Clients
The TechNet article Securing End-to-End IPsec Connections by Using IKEv2 in Windows Server 2012 includes instructions for creating an IPsec rule on a machine that is not domain joined. The described rule covers the case of using machine certificate authentication.
Note the PolicyStore parameter that was utilized in the PowerShell scripts for storing the IPsec rules on domain-joined machines is not used in the example for machines not joined to a domain. That is because domain-joined machines store the IPsec rules using group policy whereas standalone machines use a local policy store. On standalone machines the local policy store is called the “PersistentStore” and
Microsoft © 2013 Page 37 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients is used by default. In other words, not specifying the PolicyStore parameter is equivalent to using “–
PolicyStore PersistentStore”.
A rule could as easily be created for using preshared keys rather than machine certificates for authentication such as the following:
1. Create a new authentication proposal for the preshared key:
$authprop = New-NetIPsecAuthProposal -Machine -PreSharedKey
""!@#$%^&*()0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUV""
2. Create a new authentication set based on the proposal $authprop:
$authset = New-NetIPsecPhase1AuthSet -DisplayName "IKEv2-Standalone-AuthSet" proposal $authprop
3. Create the preshared key rule:
New-NetIPsecRule -DisplayName "IKEv2-Standalone-Rule" -RemoteAddress any -
Phase1Authset $authset.InstanceID -InboundSecurity Require -OutboundSecurity
Request -KeyModule IKEv2
This rule must be configured on each of two standalone machines to create a main mode SA using the indicated preshared key and the default cryptographic algorithms for integrity and encryption. The procedure for configuring other cryptographic algorithms is the same as explained above for domainjoined machines except the PersistentStore policy store must be used to store the IPsec rules.
3.7 Verifying the SAs
This section provides instructions on how look at SAs in PowerShell to confirm that the SAs have been negotiated and that the SA is configured as desired.
To establish a connection you can ping from one machine with the IPsec policy to another machine with the IPsec policy.
Once the machines are connected then there should be a main mode SA and two quick mode SAs. The main mode SA may be checked on the given machine by opening an elevated PowerShell command window running as an administrator. At the Power Shell command line type the following “Get-
NetIPsecMainModeSA”, to display the main mode SAs that have been established. See the figure below.
Microsoft © 2013 Page 38 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The quick mode SAs may be checked by opening an elevated Power Shell command window running as an administrator. At the Power Shell command line type the following “Get-NetIPsecQuickModeSA”, this will display any quick mode SAs that have been established. See the figure below.
Microsoft © 2013 Page 39 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The information provided by the two cmdlets can be used to verify the configuration is correct.
4 Audit Policy
With exception of the startup and shutdown of the audit function, IPsec VPN client audit policies are disabled by default. The relevant audits for IPsec VPN client are produced within the Audit object
access, Audit Account Management, Audit system events and Audit logon events security policy audit
Microsoft © 2013 Page 40 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients policy categories
1
. They are enabled by modifying local policy, if domain policy allows it, or by modifying domain policy. The steps below describe how to configure the local or domain policy to enable the IPsec
VPN client audit policy categories.
1. Open an elevated command window as a machine administrator. On the command line type
“gpedit.msc” and press the Enter key to start the Local Group Policy Editor MMC console.
Note: Alternatively, to configure domain audit policy, logon as domain administrator on a domain controller for the domain and start Group Policy Management in the Tools menu for Server Manager, open the Group Policy Objects node within the desired domain node, right-click the appropriate object (e.g. Default Domain Policy) to reveal its context menu and select Edit… to open the Group Policy Management Editor. The remaining instructions for configuring the local audit policy are similar for the domain audit policy.
2. Navigate to Local Computer Policy->Computer Configuration->Windows Settings->Security
Settings->Local Policies->Audit Policy. See the figure below.
3. Double click on the Audit system events. This will bring up the Audit system events
Properties page.
4. Check the Success checkbox and the Failure checkbox and click the OK button.
1
Microsoft © 2013 Page 41 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
5. Double click on the Audit logon events. This will bring up the Audit logon events Properties page.
6. Check the Success checkbox and the Failure checkbox and click the OK button.
See the figure below for the case of Audit system events.
4.1 Audit Policy for IPsec Operations
Audits for IPsec operations are outlined in the two tables below where the first table correlates the functional requirements with their associated audits by audit Id values and the second table provides details for each audit Id. The indicated audits may be viewed in the Event Viewer application
(eventvwr.exe) by a user with administrator credentials on the local computer.
To enable audit policy subcategories for IPsec operations, run the following commands at an elevated command prompt:
- auditpol /set /subcategory:”IPsec Main Mode” /success:enable /failure:enable
- auditpol /set /subcategory: “IPsec Quick Mode” /success:enable /failure:enable
Microsoft © 2013 Page 42 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
- auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /failure:enable
- auditpol /set /subcategory:"Filtering Platform Connection" /success:enable /failure:enable
- auditpol /set /subcategory:"IPsec Driver" /success:enable /failure:enable
Requirement
FCS_IPSEC_EXT.1
FTP_ITC.1
FCS_IPSEC_EXT.1
Description
- Failure to establish an IPsec SA.
- Establishment/Termination of an IPsec SA.
- All attempts to establish a trusted channel.
- Detection of modification of channel data.
- Decisions to DISCARD, BYPASS, PROTECT network packets processed by the TOE.
Id
4650, 4651, 4652, 4653,
4654, 4655, 5451, 5452
4650, 4651, 4652, 4653,
4654, 4655, 5451, 5452,
4960
2
5152, 5153, 5156
Id
4650,
4651
4652,
4653
Policy
Subcategory
IPsec Main
Mode
IPsec Main
Mode
Message
Ipsec main mode security association was established. A certificate was used for authentication.
IPsec main mode negotiation failed
Fields
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address>
Remote Endpoint: <Subject identity as IP address of non-TOE endpoint of connection >
Keying Module Name: <Transport layer protocol as IKEv1 or IKEv2>
Local Certificate: <The entry in the SPD that applied to the decision as certificate SHA
Thumbprint>
Remote Certificate: <The entry in the SPD that applied to the decision as certificate SHA
Thumbprint>
Cryptographic Information: <The entry in the
SPD that applied to the decision as MM SA Id and cryptographic parameters established in the
SA>
Keywords: <Outcome as Success>
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address>
Remote Endpoint: <Subject identity as IP address of non-TOE endpoint of connection/channel>
Keying Module Name: <Transport layer protocol as IKEv1 or IKEv2>
Failure Information: <Outcome as Failure;
Reason for failure asthe entry in the SPD that
2
4960 Id audits dropping packets failing integrity check, remaining audit IDs audit attempts to establish a channel.
Microsoft © 2013 Page 43 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
4654
4655
5451
5452
IPsec Quick
Mode
IPsec Main
Mode
IPsec Quick
Mode
IPsec Quick
Mode
IPsec quick mode negotiation failed
IPsec main mode security association ended
IPsec quick mode security association was established
IPsec quick mode security association ended applied to the decision>
Cryptographic Information: <The entry in the
SPD that applied to the decision as cryptographic parameters attempted to establish in the SA>
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address/port>
Remote Endpoint: <Subject identity as IP address/port of non-TOE endpoint of connection/channel >
Keying Module Name: <Transport layer protocol as IKEv1 or IKEv2>Failure Information:
<Outcome as Failure; Reason for failure as the entry in the SPD that applied to the decision as the MA SA Id, QM Filter Id, Tunnel Id, Traffic
Selector Id >
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address/port >
Remote Endpoint: <Subject identity as IP address/port of non-TOE endpoint of connection/channel >
Keying Module Name: <Transport layer protocol as IKEv1 or IKEv2>
Keywords: <Outcome as Success>
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address/port>
Remote Endpoint: <Subject identity as IP address/port of non-TOE endpoint of connection
>
Keying Module Name: <Transport layer protocol as IKEv1 or IKEv2>
Cryptographic Information: <The entry in the
SPD that applied to the decision as MM SA Id,
QM SA Id, Inbound SPI, Outbound SPI and cryptographic parameters established in the SA
>
Keywords: <Outcome as Success>
Logged: <Date and time of event>
Task category: <type of event>
Local Endpoint: <Subject identity as IP address/port>
Remote Endpoint: <Subject identity as IP address/port of non-TOE endpoint of connection
Microsoft © 2013 Page 44 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
4960
5152
5153
5156
IPsec Driver
Filtering
Platform
Packet Drop
Filtering
Platform
Packet Drop
Filtering
Platform
Connection
IPsec dropped an inbound packet that failed an integrity check
The Windows
Platform packet
has
The Windows Filtering
Platform has allowed a connection.
Filtering blocked a
A more restrictive
Windows Filtering Platform filter has blocked a packet .
>
Cryptographic Information: <The entry in the
SPD that applied to the decision as the QM SA
Id, Tunnel Id, Traffic Selector Id>
Keywords: <Outcome as Success>
Logged: <Date and time of event>
Task category: <type of event>
Cryptographic Parameters <Identification of the non-TOE endpoint of the channel as IP address/port and security parameter index>
Keywords: <Outcome as Failure>
Logged: <Date and time of event>
Task category: <type of event>
Direction: <direction of the packet, inbound or outbound>
Source Address: <source IP address>
Source Port: <source port number>
Destination Address: <destination IP address>
Destination Port: <destination port number>
Protocol: <Network protocol>
FilterRTID: <Filter Run time ID>
LayerRTID: <Layer Run Time ID>
Layer Name: <Layer Name>
Logged: <Date and time of event>
Task category: <type of event>
Direction: <direction of the packet, inbound or outbound>
Source Address: <source IP address>
Source Port: <source port number>
Destination Address: <destination IP address>
Destination Port: <destination port number>
Protocol: <Network protocol>
FilterRTID: <Filter Run Time ID>
LayerRTID: <Layer Run Time ID>
Layer Name: <Layer Name>
Logged: <Date and time of event>
Task category: <type of event>
Direction: <direction of the packet, inbound or outbound>
Source Address: <source IP address>
Source Port: <source port number>
Destination Address: <destination IP address>
Destination Port: <destination port number>
Protocol: <Network protocol>
FilterRTID: <Filter Run Time ID>
LayerRTID: <Layer Run Time ID>
Layer Name: <Layer Name>
Microsoft © 2013 Page 45 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
4.2 Audit Policy for Audit Function and Administrator Operations
Audits for audit function and administrator operations are shown in the two tables below. Startup and shutdown of the audit function and clearing the audit log are audited by default.
To enable auditing audit policy changes, run the following command at an elevated command prompt:
- auditpol /set /subcategory:"Audit Policy Change" /success:enable /failure:enable
To enable auditing for administrator actions other than IKEv1 and IKEv2 configuration changes, and file system and registry changes, run the following commands at an elevated command prompt:
- auditpol /set /subcategory:"Filtering Platform Policy Change" /success:enable /failure:enable
- auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable
To enable auditing for IKEv1 and IKEv2 connection properties changes, run the following command at an elevated command prompt:
- auditpol /set /subcategory:"Security Group Management" /success:enable /failure:enable
To enable auditing for file system object changes, run the following command at an elevated command prompt:
- auditpol /set /subcategory:"File System" /success:enable /failure:enable
To enable auditing for registry changes, run the following command at an elevated command prompt:
- auditpol /set /subcategory:"Registry" /success:enable /failure:enable
In the case of auditing registry changes, in addition to enabling audit policy as noted above, each registry key to be audited must also have its auditing permissions enabled. This is done as follows:
1. Start the registry editor tool by executing the command regedit.exe as an administrator
2. Navigate to the registry path for the key that should be audited, right-click the key’s node and select
Permissions… on the key’s context menu to open the Permissions dialog
3. Click the Advanced button to open the Advanced Security Settings dialog, click on the Auditing tab and click the Add button to open the Auditing Entry dialog
4. Click the Select a principal to open the Select User or Group dialog to select a user (e.g.
Administrator) and click the OK button.
5. Choose the desired audits using the Type, Applies to and Basic Permissions attributes and click OK
6. Click OK on the Advanced Security Settings dialog
7. Click OK on the Permissions dialog
In the case of auditing file system object changes, in addition to enabling audit policy as noted above, each file system object to be audited must also have its auditing enabled. This is done as follows:
1. Start the Windows Explorer tool by executing the command explorer.exe as an administrator
Microsoft © 2013 Page 46 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2. Navigate to the file path for the file that should be audited, right-click the file object name and select Properties on the context menu to open the <file object name> Properties dialog
3. Click the Security tab and then click the Advanced button to open the Advanced Security Settings
for <file object name> dialog
4. Click the Auditing tab to open a second Advanced Security Settings for <file object name> dialog
5. Click the Add… button to open the Auditing Entry for <file object name> dialog, choose the principal that should be audited using the Select a principal link and choose the file permissions that should be audited in the Basic Permissions: checkboxes, and then click the OK button
6. Click the OK button in the Advanced Security Settings for <file object name> dialog
7. Click the OK button in the <file object name> Properties dialog
Requirement
FAU_SEL.1
FAU_GEN.1
FAU_GEN.1
FAU_GEN.1
Description
All modifications to the audit configuration that occur while the audit collection functions are operating. a) Start-up and shutdown of the audit functions, b) All auditable events for the not specified level of audit, c) All administrative actions, d) Specifically defined auditable events listed in
Table 5-2.
Id
4719
4608, 4609
1102, 4719, 4657, 5058,
5446, 5449, 5450, 5447,
4663
<see further tables below in this section of the document>
Id
4719
4608
4609
1102
Policy
Subcategory
Audit Policy
Change
<default>
<default>
<default>
Message
System audit policy was changed
Fields
Logged: <Date and time of event>
Task category: <category of audit>
Task Subcategory: <subcategory of audit>
Subcategory GUID: <subcategory GUID name>
Security ID: <user identity>
Account Name: <account name>
Account Domain: <account domain>
Login ID: <login Id>
Changes: <Success/Failure changes>
Keywords: <Outcome as Success or Failure>
Startup of audit functions Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success or Failure>
Shutdown of audit functions Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success or Failure>
Audit log clear Logged: <Date and time of event>
Task category: <type of event>
Microsoft © 2013 Page 47 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
4657
5058
5446
5449
5450
5447
Registry
Other
System
Events
Filtering
Platform
Policy
Change
Filtering
Platform
Policy
Change
Filtering
Platform
Policy
Change
Security
Group
Management
Registry entry change
Key file operation
Windows Filtering
Platform callout has been changed
Windows Filtering
Platform provider context has been changed
Windows Filtering
Platform sub-layer has been changed
Windows Filtering
Platform filter has been changed
Security ID: <user identity>
Keywords: <Outcome as Success or Failure>
Logged: <Date and time of event>
Task category: <type of event>
Security ID: <user identity>
Object name: <key path>
Changes: <old and new registry values>
Keywords: <Outcome as Success or Failure>
Logged: <Date and time of event>
Task category: <type of event>
Provider Name: <Key provider>
Algorithm name: <Key algorithm provider>
Key name: <Certificate template identifier>
Key type: <Key type>
Keywords: <Outcome as Success or Failure>
Logged: <Date and time of event>
Task category: <type of event>
Change type: <Operation as add, change or delete>
Callout ID: <Callout identifier as GUID>
Callout Name: <Callout identifier as text-based name>
Layer ID: <Layer identifier as GUID>
Layer Name: <Layer identifier as text-based name>
Keywords: <Outcome as Success or Failure>
Logged: <Date and time of event>
Task category: <type of event>
Change type: <Operation as add, change or delete>
Provider ID: <Provider Id as GUID>
Provider Name: <Provider identifier as textbased name>
Logged: <Date and time of event>
Task category: <type of event>
Change type: <Operation as add, change or delete>
Sub-layer ID: <Sub-layer Id as GUID>
Sub-layer Name: <Sub-layer identifier as textbased name>
Logged: <Date and time of event>
Task category: <type of event>
Change type: <Operation as add, change or delete>
Filter ID: <Filter Id as GUID>
Filter Name: <Filter identifier as text-based name>
Layer ID: <Layer Id as GUID>
Microsoft © 2013 Page 48 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
4663 File System
An attempt was made to access an object
Layer Name: <Layer identifier as text-based name>
Additional Information: <Filter conditions>
Logged: <Date and time of event>
Task category: <type of event>
Security ID: <user identity>
Account Name: <account name>
Account Domain: <account domain>
Login ID: <login Id>
Object Server: <object server name>
Object Type: <object type name>
Object Name: <object path name>
Process ID: <process Id for file object operation>
Process Name: <process name for file object operation>
Accesses: <file object operation>
The following table correlates the set of administrative operations described in this document with their associated audits:
Administrative Action
2.1.1 Configuring the Root Certificate on the RAS IPsec VPN Client
2.1.2 Enrolling for the RAS IPsec VPN Client Machine Certificate
2.2 Configuring the RAS IPsec VPN Connection
3.3.4 Configuring Machine Certificates
3.4 Configuring PreShared Keys
3.5 Configuring the IKEv1 or IKEv2 Protocol in the IPsec Rule
5.1 Windows Firewall (Windows Filtering Platform)
5.2 Configuring the Firewall Setting to Require CDP Checking
5.4 Cryptographic Engine Configuration for FIPS Compliant Algorithms
4.3 Audit Policy for Cryptographic Operations
Audits for cryptographic operations are shown in the two tables below.
Event
5058
5058
5447, 4657, 4663
5446, 5449, 5450
5058
5446, 5449, 5450
5446, 5449, 5450
4719
5446, 5449, 5450
4657
4657
5038
To enable auditing of cryptographic operations, run the following commands at an elevated command prompt.
- auditpol /set /subcategory:"Other System Events" /success:enable /failure:enable
- auditpol /set /subcategory:"System Integrity" /success:enable /failure:enable
The indicated audit Id 20 for FPT_TST_EXT.1 is logged by default in the Windows System event log.
The indicated audits for FPT_TUD_EXT.1 are logged by default in the “Windows Logs\Setup” log.
Microsoft © 2013 Page 49 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Requirement
FCS_CKM.1(ASYM)
FCS_CKM.1(IKE)
FCS_CKM_EXT.4
FCS_COP.1(SYM)
FCS_COP.1(SIGN)
FCS_COP.1(HASH)
FCS_COP.1(HMAC)
FCS_RBG_EXT.1
FPT_TST_EXT.1
FPT_TUD_EXT.1
Description
Failure of the key generation activity.
Failure of the key generation activity.
Failure of the key zeroization process.
Failure of encryption or decryption.
Failure of cryptographic signature.
Failure of hashing function. 2452
Failure in Cryptographic Hashing for Non- Data Integrity. 2452
Failure of the randomization process.
Execution of this set of TSF self-tests. Detected integrity violations.
Initiation of the update.
Any failure to verify the integrity of the update.
Id
2439
2481
5057
2483, 2484
2451
2432, 2436
20, 5038
1, 2
3
Id
2439
2481
5057
Policy
Subcategory
Other
System
Events
Other
System
Events
System
Integrity
Message
Key failed pair wise consistency check
Create Key
Cryptographic primitive operation failed
Fields
2483
2484
2451
Other
System
Events
Other
System
Events
Other
System
Events
Encrypt
Decrypt
Signature verification failed
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Failure>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success>
Logged: <Date and time of event>
Task category: <type of event>
Cryptographic Parameters: < Identity of object or entity being cleared>
Cryptographic Operation: < Identity of object or entity being cleared>
Keywords: <Outcome as Failure>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success or Failure >
Cryptographic Parameters: < name/identifier of object being encrypted/decrypted>
Cryptographic Operation: <Cryptographic mode of operation>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success or Failure>
Cryptographic Parameters: < name/identifier of object being encrypted/decrypted>
Cryptographic Operation: <Cryptographic mode of operation>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Failure>
Microsoft © 2013 Page 50 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
2452
2432
2436
20
5038
1
2
3
Other
System
Events
Other
System
Events
Other
System
Events
N/A
System
Integrity
<N/A>
<N/A>
<N/A>
Sign hash
Random number generator failure
Random number generation failed FIPS-140 pre-hash check
The last boot’s success was <LastBootGood event data>.
Cryptographic Parameters: < name/identifier of object being encrypted/decrypted>
Cryptographic Operation: <Cryptographic mode of operation>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Success or Failure>
Cryptographic Parameters: < name/identifier of object being encrypted/decrypted>
Cryptographic Operation: <Cryptographic mode of operation>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Failure>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Failure >
Logged: <Date and time of event>
LastBootGood: <Outcome as true or false indicating if the kernel-mode cryptographic selftests succeeded or failed>
Logged: <Date and time of event>
Task category: <type of event>
Keywords: <Outcome as Failure>
Filename: < TSF code filename that caused the integrity violation>
Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.
Initiating changes for package
Package was successfully changed to the Installed state
Windows update could not be installed because …
“The data is invalid”
Logged: <Date and time of event>
PackageIdentifier: <KB package Id>
InitialPackageState: Resolved
IntendedPackageState: Installed
ErrorCode: <success outcome indicated by 0x0>
Logged: <Date and time of event>
PackageIdentifier: <KB package Id>
IntendedPackageState: Installed
ErrorCode: <success outcome indicated by 0x0>
Logged: <Date and time of event>
Commandline: <KB package Id>
ErrorCode: <install failure indicated by
0x800700D (2147942413)>
4.4 For More Information
Documentation applicable to Windows 8, Windows RT and Windows Server 2012 for the following topics is available:
Microsoft © 2013 Page 51 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
- Advanced Security Audit Policy Settings: http://technet.microsoft.com/enus/library/dd772712(v=ws.10).aspx
- Cryptographic operation audit logs: http://msdn.microsoft.com/enus/library/windows/desktop/bb204775(v=vs.85).aspx#auditing
5 Other Configuration Guidance
5.1 Windows Firewall (Windows Filtering Platform)
The Windows Filtering Platform must be turned on in order to support any of the described IPSEC scenarios. The Windows Filtering Platform is the IPsec Security Policy Database (SPD) for Windows 8,
Windows RT and Windows Server 2012. The IPsec rules in the Windows Filtering Platform are the entries
in the SPD. For example the My IKEv2 Rule IPSEC rule specified in step (5) of section Configuring
PROTECT all network traffic received by a computer (e.g. CLIENT1) with the IpsecRequireInRequestOut local or group policy and DISCARD all traffic that is not IPSEC. Network traffic not between CLIENT1 and another computer BYPASSes this rule. Similarly, the VPN Connections in section 2 use an IPSEC rule in
Windows Filtering Platform that PROTECTs traffic between the client and the server.
In addition, the Windows Filtering Platform can be configured to use Inbound and Outbound rules that
DISCARD and ALLOW traffic specified by the Inbound and Outbound rules. Notice that in the following
Technet article there are instructions to configure an Inbound rule for ICMPv4 and ICMPv6 traffic to be
ALLOWed by the Windows Filtering Platform:
- Create an Inbound ICMP Rule on Windows 7, Windows Vista, Windows Server 2008, or Windows
Server 2008 R2: http://technet.microsoft.com/en-us/library/cc972926(v=ws.10).aspx
The following TechNet topic explains the priority for applying firewall rules:
- Understanding the Firewall: http://technet.microsoft.com/enus/library/dd421709(v=ws.10).aspx.
In particular, the topic notes that “Block connection” rules have higher priority than “Allow connection” rules (where “Block connection” is equivalent to DISCARD and “Allow connection” is equivalent to
ALLOW). Further, it says that the “Default profile behavior” when the Windows Filtering Platform is turned on (which is mandatory for IPSEC configuration) explicitly DISCARDs all network traffic that is not specified as ALLOWed by the combination of the IPSEC rules as well as Inbound and Outbound Firewall rules. The Windows Filtering Platform in this way implements the final catch-all denial SPD entry.
5.2 Configuring the Firewall Setting to Require CDP Checking
The firewall settings must be configured to require the CDP to be accessible so the certificate chain can be verified up to the root for revoked certificates. This is done using the following PowerShell cmdlet
(see http://technet.microsoft.com/en-us/library/jj554878.aspx for more information):
Set-NetFirewallSetting -CertValidationLevel RequireCrlCheck
Microsoft © 2013 Page 52 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
This security policy affects the following registry key (where 1 enables the RequireCrlCheck policy):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Servcies\SharedAccess\Parameters\FirewallPolicy\S trongCRLCheck. Changes to this security policy are audited by Id 4657 due to modification of this registry key.
5.3 Traversing a NAT
This section describes the steps for introducing a NAT into the network configuration. The figure below shows the NAT between the IPsec client and the public network.
The network addressing on the IPsec client may need to be updated to accommodate the NAT. For example if the network configuration originally used a static IP address for the client, the NAT could provide the IP address to the client.
Regardless of how the client gets its IP address, the IPsec connection does not change and remains as originally configured. The RAS VPN Server configuration also remains the same and the steps for connecting to the RAS VPN Server also remain the same. The client and gateway automatically traverse the NAT as specified in the IKEv1 and IKEv2 protocols and the SAs are negotiated.
If NAT traversal occurs, then traffic between the client and the gateway is UDP-encapsulated as shown in the figures below for the case of using a VPN gateway using the Get-NetIPsecMainModeSA Cmdlet in
PowerShell for the case of IKEv1 and IKEv2, respectively.
Microsoft © 2013 Page 53 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
Microsoft © 2013 Page 54 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The figure below shows the UDP-encapsulation setting in the quick mode SA when getting information about the SA using the Get-NetIPsecQuickModeSA commandlet in PowerShell for IKEv1 and IKEv2.
Microsoft © 2013 Page 55 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
5.4 Cryptographic Engine Configuration for FIPS Compliant Algorithms
The IPsec VPN client computer must have the FIPS policy configured by enabling the “Require FIPS
compliant algorithms” security policy as shown in the figure below for the case of setting the policy by using Local or Group Policy Editor (the policy could alternatively be configured on the domain controller for application to all computers in the domain).
This security policy affects the following registry key (where 1 enables and 0 disables the policy):
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\Enabled. Changes to the FIPS security policy are audited by Id 4657 due to modification of this registry key.
Note: This policy must be enabled after creating firewall connection rules.
Microsoft © 2013 Page 56 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
5.5 List of Processes That May Process Network Data
The TcpIP Protocol Driver(TcpIP.sys) is the only process running on the TOE in its evaluated configuration during its operation that is capable of processing data received on the network interfaces. TcpIP.sys runs in kernel-mode and implements the core elements of the network architecture for IP-based network traffic.
5.6 Protection of the TSF
Windows executable files are protected by the mechanisms listed below:
All Windows Update packages are signed.
Windows Code Integrity verifies signatures on all kernel mode device drivers.
Windows Code Integrity verifies signatures on key OS user mode binaries.
An administrator may check the file integrity for all Windows executable files using the sfc.exe utility.
Windows Code Integrity will generate events as specified in the “Auditing for Cryptographic Operations” section of this document if a binary signature does not verify. However, if a signature fails to verify that is critical for the system to log audits then the audit will not be generated, in this case the operating system will not boot.
The sfc.exe utility must be run in an elevated command window. The following is an example command to verify the Windows binary bcrypt.dll. sfc.exe –verifyfile=c:\windows\system32\bcrypt.dll
Microsoft © 2013 Page 57 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
The success or failure of the integrity check when using the sfc utility is displayed in the output of the utility.
5.7 Managing Product Updates
5.7.1 Updating the TOE
Updates to Windows are delivered as Microsoft Update Standalone Package files (.msu files) and are signed by Microsoft with two digital signatures, a SHA1 signature for legacy applications and a SHA256 signature for modern applications. The RSA SHA256 digital signature is signed by Microsoft Corporation, with a certification path through a Microsoft Code Signing certificate and ultimately the Microsoft Root
Certification Authority.
The Windows operating system will check that the certificate is valid and has not been revoked using a standard PKI.
Updates to Windows are delivered through the Windows Update capability, which is enabled by default, or the user can go to http://www.microsoft.com/security/default.aspx to search and obtain security updates on their own volition.
5.7.2 Verifying the TOE version
In order to verify the TOE version the following command can be executed at the command prompt to list the OS Name, OS Version and installed Hotfixes: systeminfo
The OS Name, OS Version, and list of installed Hotfixes are listed.
5.7.3 Verifying Product Updates using Authenticode Signatures
Update packages downloaded by Windows Update are signed by an agent with the Microsoft Root
Certificate Authority to prove their integrity. This signature is verified by the Windows Update service before installing any of the product updates contained in a given package. The packages are stored in the folder c:\windows\servicing\packages. The package signatures may be independently verified by using the Get-AuthenticodeSignature PowerShell cmdlet as shown in the figure below for one of the KB packages available for Windows 8 and Server 2012:
Microsoft © 2013 Page 58 of 59
Microsoft Windows 8, Microsoft Windows Server 2012, Microsoft Windows RT Common Criteria
Supplemental Admin Guidance for IPsec VPN Clients
To obtain more information regarding a given update package (e.g. the files that will be updated from the package) go to http://support.microsoft.com/kb/XXX where XXX is the given KB number indicated in the filename for the given package in c:\windows\servicing\packages or in the Windows Update listing of proposed packages to be installed on a given system (e.g. KB2770917 as shown in the figure above).
Microsoft © 2013 Page 59 of 59
பதிவிறக்கு
பொது இணைப்பு புதுப்பிக்கப்பட்டது
உங்கள் அரட்டைக்கான பொது இணைப்பு புதுப்பிக்கப்பட்டுள்ளது. You may view and manage your chat links after registration here.
ஆவண பொது இணைப்பு
விளம்பரம்