Microsoft Windows [Version 6.0.6001] (C) Copyright 2006 Microsoft Corp. c:\windows>netsh advfirewall set global ?
Usage: set global statefulftp|statefulpptp enable|disable|notconfigured set global ipsec (parameter) (value) set global mainmode (parameter) (value) | notconfigured
IPsec Parameters:
strongcrlcheck - Configures how CRL checking is enforced. 0: Disable CRL checking 1: Fail if cert is revoked (default) 2: Fail on any error notconfigured: Returns the value to its not configured state. saidletimemin - Configures the security association idle time in minutes. - Usage: 5-60|notconfigured (default=5) defaultexemptions - Configures the default IPsec exemptions. Default is to exempt IPv6 neighbordiscovery protocol from IPsec. - Usage: none|neighbordiscovery|notconfigured ipsecthroughnat - Configures when security associations can be established with a computer behind a network address translator. - Usage: never|serverbehindnat| serverandclientbehindnat| notconfigured(default=never)
Main Mode Parameters:
mmkeylifetime - Sets main mode key lifetime in minutes or sessions, or both. - Usage:min,sess mmsecmethods - configures the main mode list of proposals - Usage: keyexch:enc-integrity,enc-integrity[,...]|default - keyexch=dhgroup1|dhgroup2|dhgroup14| ecdhp256|ecdhp384 - enc=3des|des|aes128|aes192|aes256 - integrity=md5|sha1
Remarks:
- Configures global settings, including advanced IPsec options. - The use of DES, MD5 and DHGroup1 is not recommended. These cryptographic algorithms are provided for backward compatibility only. - The mmsecmethods keyword default sets the policy to: dhgroup2-aes128-sha1,dhgroup2-3des-sha1
Examples:
Disable CRL checking: netsh advfirewall set global ipsec strongcrlcheck 0
Turn on firewall stateful FTP support on server: netsh advfirewall set global statefulftp enable
Set global main mode proposals to the default value: netsh advfirewall set global mainmode mmsecmethods default
Set global main mode proposals to a customer list: netsh advfirewall set global mainmode mmsecmethods dhgroup1:des-md5,3des-sha1
NETSH / ADVFIREWALL / SET / GLOBAL
netsh advfirewall set global - Windows Vista - commandSets the global properties. - Windows Vista netsh, advfirewall, set, global, cmd, command, Windows, Vista