The information in this article applies to:
Microsoft Windows 2000 Advanced Server Microsoft Windows 2000 Datacenter Server Microsoft Windows 2000 Server
SUMMARYYou can use IP Security (IPSec) in tunnel mode to encapsulate Internet Protocol (IP) packets and optionally encrypt them. The primary reason for using IPSec tunnel mode (sometimes referred to as "pure IPSec tunnel") in Windows 2000 is for interoperability with third-party routers or gateways that do not support Layer 2 Tunneling Protocol (L2TP)/IPSec or PPTP Virtual Private Networking (VPN) tunneling technology.
MORE INFORMATIONWindows 2000 supports IPSec tunneling for situations where both tunnel endpoints have static IP addresses. This is primarily useful in gateway-to-gateway implementations, but may also work for specialized network security scenarios between a gateway/router and a server (like a Windows 2000 router routing traffic from its external interface to an internal Windows 2000-based computer securing the internal path by establishing an IPSec tunnel to the internal server providing services to the external clients).
Windows 2000 IPSec tunneling is not supported for client remote access VPN use because the IETF IPSec RFCs do not currently provide a remote access solution in the Internet Key Exchange (IKE) protocol for client-to-gateway connections. The IETF RFC 2661 for Layer 2 Tunneling Protocol (L2TP) was specifically developed by Cisco, Microsoft, and others for the purpose of providing client remote access VPN connections. In Windows 2000, client remote access VPN connections are protected using an automatically generated IPSec policy that uses IPSec transport mode (not tunnel mode) when the L2TP tunnel type is selected.
Windows 2000 IPSec tunneling also does not support protocol and port-specific tunnels. While the Microsoft Management Console (MMC) IPSec Policy snap-in is very general and allows you to associate any type of filter with a tunnel, make sure you use only address information in the specification of a filter for a tunnel rule.
Details on how the IPSec and IKE protocols work can be found in the Microsoft Windows 2000 Resource Kit and in the Windows 2000 IPSec end-to-end walkthrough. Information about where you can find these documents is included at the end of this article.
This article explains how to configure an IPSec tunnel on a Windows 2000 gateway. Because the IPSec tunnel secures only traffic specified in the IPSec filters you configure, this article also describes how to configure filters in Routing and Remote Access Service (RRAS) to prevent traffic outside the tunnel from being received or forwarded. This article outlines the following scenario to make it easy to follow the configuration steps: NetA - Windows 2000 gateway --- Internet --- third-party gateway - NetB W2KintIP W2KextIP 3rdExtIP 3rdIntIP
NetA is the network ID of the Windows 2000 gateway internal network.
W2KintIP is the IP address assigned to the Windows 2000 gateway internal network adapter.
W2KextIP is the IP address assigned to the Windows 2000 gateway external network adapter.
3rdExtIP is the IP address assigned to the third-party gateway external network adapter.
3rdIntIP is the IP address assigned to the third-party gateway internal network adapter.
NetB is the network ID of the third-party gateway internal network. The goal is for the Windows 2000 gateway and the third-party gateway to establish an IPSec tunnel when traffic from NetA needs to be routed to NetB or when traffic from NetB needs to be routed to NetA so traffic is routed over a secure session.
You need to configure an IPSec policy. You must build two filters; one to match packets going from NetA to NetB (tunnel 1), and one to match packets going from NetB to NetA (tunnel 2). You need to configure a filter action to specify how the tunnel should be secured (a tunnel is represented by a rule, so two rules are created). How to Create IPSec PolicyTypically, a Windows 2000 gateway is not a member of a domain, so a local IPSec policy is created. If the Windows 2000 gateway is a member of a domain that has IPSec policy applied to all members of the domain by default, this prevents the Windows 2000 gateway from having a local IPSec policy. In this case, you can create an Organizational Unit (OU) in Active Directory, make the Windows 2000 gateway a member of this OU, and assign the IPSec policy to the Group Policy Object (GPO) of the OU. For more information, refer to the "Assigning IPSec Policy" section of Windows 2000 online help. Use the MMC to work on the IP Security Policy Management snap-in (a quick way to load this is to click Start, click Run, and then type secpol.msc).
Right-click IP Security Policies on Local Machine, and then click Create IP Security Policy.
Click Next, and then type a name for your policy (for example, IPSec Tunnel with third-party Gateway).
NOTE: You can also type more information in the Description box.
Click to clear the Activate the default response rule check box, and then click Next.
Click Finish (keep the Edit check box selected).
NOTE: The IPSec policy is created with default settings for the IKE main mode (phase 1) on the General tab, in Key Exchange. The IPSec tunnel consists of two rules, each of which specifies a tunnel endpoint. Because there are two tunnel endpoints, there are two rules. The filters in each rule must represent the source and destination IP addresses in IP packets that are sent to that rule's tunnel endpoint. How to Build a Filter List from NetA to NetBIn the new policy properties, click to clear the Use Add Wizard check box, and then click Add to create a new rule.
On the IP Filter List tab, click Add.
Type an appropriate name for the filter list, click to clear the Use Add Wizard check box, and then click Add.
In the Source address area, click A specific IP Subnet, and then fill in the IP Address and Subnet mask boxes to reflect NetA.
In the Destination address area, click A specific IP Subnet, and fill in the IP Address and Subnet mask boxes to reflect NetB.
Click to clear the Mirrored check box.
On the Protocol tab, make sure the protocol type is set to Any, because IPSec tunnels do not support protocol-specific or port-specific filters.
If you want to type a description for your filter, click the Description tab. It is generally a good idea to give the filter the same name you used for the filter list. The filter name is displayed in the IPSec monitor when the tunnel is active.
Click OK, and then click Close.
How to Build a Filter List from NetB to NetAOn the IP Filter List tab, click Add.
Type an appropriate name for the filter list, click to clear the Use
