Microsoft Windows
[Version 6.0.6001
](C) Copyright 2006 Microsoft Corp.
c
:\windows>netsh advfirewall set global ?
Usage
: set global statefulftp
|statefulpptp enable
|disable
|notconfigured
set global ipsec (parameter) (value)
set global mainmode (parameter) (value)
| notconfigured
IPsec Parameters
:
strongcrlcheck - Configures how CRL checking is enforced.
0
: Disable CRL checking
1
: Fail if cert is revoked (default)
2
: Fail on any error
notconfigured
: Returns the value to its not
configured state.
saidletimemin - Configures the security association idle time in
minutes.
- Usage
: 5-60
|notconfigured (default=5)
defaultexemptions - Configures the default IPsec exemptions. Default is
to exempt IPv6 neighbordiscovery protocol from
IPsec.
- Usage
: none
|neighbordiscovery
|notconfigured
ipsecthroughnat - Configures when security associations can be
established with a computer behind a network
address translator.
- Usage
: never
|serverbehindnat
|
serverandclientbehindnat
|
notconfigured(default=never)
Main Mode Parameters
:
mmkeylifetime - Sets main mode key lifetime in minutes
or sessions, or both.
- Usage
: min,sess
mmsecmethods - configures the main mode list of proposals
- Usage:
keyexch:enc-integrity,enc-integrity[,...]|default
- keyexch=dhgroup1|dhgroup2|dhgroup14|
ecdhp256|ecdhp384
- enc=3des|des|aes128|aes192|aes256
- integrity=md5|sha1
Remarks:
- Configures global settings, including advanced IPsec options.
- The use of DES, MD5 and DHGroup1 is not recommended. These
cryptographic algorithms are provided for backward compatibility
only.
- The mmsecmethods keyword default sets the policy to:
dhgroup2-aes128-sha1,dhgroup2-3des-sha1
Examples:
Disable CRL checking:
netsh advfirewall set global ipsec strongcrlcheck 0
Turn on firewall stateful FTP support on server:
netsh advfirewall set global statefulftp enable
Set global main mode proposals to the default value:
netsh advfirewall set global mainmode mmsecmethods default
Set global main mode proposals to a customer list:
netsh advfirewall set global mainmode mmsecmethods
dhgroup1:des-md5,3des-sha1
