Configuring Firewall Profiles and IPsec Settings by Using Group Policy
To configure firewall profiles on targeted computers using Group Policy, right-click the firewall policy node in your GPO and select Properties to display the properties for the firewall policy. For each firewall profile (domain, private, and public), you can use the tab for the profile to perform the following tasks:
- Enable or disable the firewall state for that profile.
- Configure default rules for inbound and outbound connections.
- Configure whether users should receive notifications when firewall rules for that profile block inbound connections.
- Configure whether a unicast response should be allowed for broadcast or multicast traffic.
- Configure whether rule merging should be enabled or disabled for firewall and/or connection security rules (this can only be configured using Group Policy).
- Configure firewall logging for traffic filtered by that profile.
Note You can use the netsh advfirewall monitor show currentprofile command in Windows 7 to display all currently active firewall profiles on the computer and also the networks assigned to each active profile.
The IPsec tab of this properties sheet can be used to configure default and system-wide IPsec settings on the targeted computers. Examples of settings you can configure here include:
- IPsec Defaults Clicking Customize opens other dialog boxes that allow you to configure the default key exchange methods, data protection algorithms, and authentication methods used by IPsec. These default settings are used for new connection security rules that you create. However, when you create a connection security rule, you can also override the default authentication methods specified here.
- IPsec Exemptions This option determines whether ICMP traffic should be protected by IPsec. Because ICMP is used by many network troubleshooting tools, exempting such traffic from IPsec can ensure that such troubleshooting tools function as intended.
- IPsec Tunnel Authorization New in Windows 7, this option determines whether you
can specify authorized and exempted users and computers for IPsec tunnel connections
to the computer. Selecting Advanced and clicking Customize opens a dialog box that
lets you specify two types of information:
- Authorized computers, users, or groups of computers or users
- Exempted computers, users, or groups of computers or users
For more information on configuring firewall profiles and IPsec settings, see the following sections of the TechNet Library:
- "Configuring a Profile" at http://technet.microsoft.com/en-us/library/cc754139.aspx
- "Configuring IPsec Settings" at http://technet.microsoft.com/en-us/library/cc733077.aspx
- "Windows Firewall with Advanced Security Properties Page" at http://technet.microsoft.com/en-us/library/cc753002.aspx
In this tutorial:
- Configuring Windows Firewall and IPsec
- Understanding Windows Firewall with Advanced Security
- Improvements to Windows Firewall Introduced Previously in Windows Vista
- Additional Improvements to Windows Firewall in Windows 7
- Understanding the Windows Filtering Platform
- Windows Firewall and the Startup Process
- Understanding Windows Service Hardening
- Understanding Service SIDs
- Windows Firewall and WSH
- Windows Firewall and Service Triggers
- Understanding Multiple Active Firewall Profiles
- Understanding Rules
- Understanding Firewall Rules
- Inbound vs . Outbound Rules
- Allow vs . Block Rules
- Allow If Secure Rules
- Authenticated Bypass Rules
- Filtering Conditions FOR Firewall RULES
- Understanding Connection Security Rules
- Types of Connection Security Rules
- Supported IPsec Settings for Connection Security Rules
- Default IPsec Settings for Connection Security Rules
- Windows Firewall and Windows PE
- Understanding Default Rules
- Understanding WSH Rules
- Understanding Rules Processing
- Managing Windows Firewall with Advanced Security
- Tools for Managing Windows Firewall with Advanced Security
- Managing Windows Firewall Using Control Panel
- Managing Windows Firewall Using the Windows Firewall with Advanced Security Snap-in
- Managing Windows Firewall Using Group Policy
- Considerations When Managing Windows Firewall Using Group Policy
- Managing Windows Firewall Using the Netsh Command
- Common Management Tasks
- Enabling or Disabling Windows Firewall
- Configuring Firewall Profiles and IPsec Settings by Using Group Policy
- Creating and Configuring Firewall Rules
- Creating and Configuring Connection Security Rules
- Monitoring Windows Firewall
- Troubleshooting Windows Firewall
- Troubleshooting Windows Firewall Using Firewall Logs
- Troubleshooting Windows Firewall Using Event Logs
- Troubleshooting Windows Firewall Using Auditing
- Troubleshooting IPsec Issues Using Netsh Wfp
- Troubleshooting Windows Filtering Platform and IPsec Issues Using Netsh Trace