How to configure ipsec policy on windows server 2008 r2 to permit local machine only access to gateway,one other server and it's local ip?

I have applied IPsec policy on local machine(ip address:10.82.138.76) with windows server 2008 ent r2 installed,only permit local machine to comunicate with itself,one other server(ip address:10.82.138.77) and the gateway device(ip address:10.82.138.1).After
i asigned this policy,i can ping the gateway (ip address:10.82.138.1),and the other server(ip address:10.82.138.77),but i can't ping local machine itself(ip address:10.82.138.76),could anybody tell me why and how to solve this problem?When i applied the same
policy to windows server 2003 ent,i can ping the local machine ip address.

Hi,
Thanks for your post.
First, try to ping the loopback address 127.0.0.1. If the loopback test succeeds but you cannot ping the local IP address, please post the unedited
ipconfig /all and route print of the problematic computer.
For test purpose, you may refer to the following lab step by step guide to deployment Tunnel Mode IPsec. Hope it helps.
Windows Firewall and IPsec Policy Deployment Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc732400(v=ws.10)
Connection Security and IPsec
http://technet.microsoft.com/en-us/library/cc771593(v=ws.10).aspx
Connection Security Rule Wizard: Tunnel Endpoints Page - Client-to-Gateway
http://technet.microsoft.com/en-us/library/dd759083
Best Regards,
Aiden
Aiden Cao
TechNet Community Support

Similar Messages

How to configure IPsec/IKE on Sun.

Hi
I was new to SUN Ipsec configuration and hope to get help to configure IPsec and test with windows XP or a device.
I did the following configuration on a SUN 5.10 OS:
1. Configured an IKE rule in the config file
label "simple inheritor2"
local_id_type ipv4
local_addr 10.62.18.131
remote_addr 10.62.18.139
p1_xform
{auth_method preshared oakley_group 2 auth_alg sha encr_alg 3des }
and was able to verify the file using in.iked.
2. Configured preshared key in ike.preshared
{ localidtype IP
localid 10.62.18.131
remoteidtype IP
remoteid 10.62.18.139
key ac077cc699c17055848a3cf34377980aac077cc699c17055
3. Configured IPsec policy in ipsecinit.conf as
{laddr 10.62.18.131 raddr 10.62.18.139} ipsec {
encr_algs 3DES
encr_auth_algs SHA1
I configured matching policy in XP. After I reboot the Sun system, trigger traffic from XP to Sun system, I saw the first two IKE phase one exchange were fine but Sun system didn't response to the ID payload sent from XP.
I suspect few things: one is the id, if I use ikeadm to dump the rule, it says unknow local id and remote id, where and how should I specify the local and remote ID?
the other thing I suspect is the preshared key, the admin guide the key should be corresponding to the algorithm, I used the one for 3des(24 bytes), should I also consider sha1 when specifying the preshared key or it doesn't matter?
Also where is the IPsec/ike log file? the admin guide doesn't indicate that.
Thanks a lot!

Hi Dan
Thanks. Your suggestion is constructive. I hope to get your furhter help to straight it up. I tried to use the following key in Sun:
key 606162636465666768696a6b6c6d6e6f7071727374
and used abcdefghijklmnopqrst on XP as the preshared key. The length should be good for both DES and SHA1.
When triggering traffic from Sun, I got the following from Sun log file:
hu Nov 15 17:42:05 2007: in.iked: In ssh_policy_isakmp_nonce_data_len.
Thu Nov 15 17:42:05 2007: in.iked: ssh_policy_isakmp_nonce_data_len: natt_state 0
Thu Nov 15 17:42:05 2007: in.iked: spsi: ike_send_packet 0
Thu Nov 15 17:42:06 2007: in.iked: spsi: ike_udp_callback_common 0
Thu Nov 15 17:42:06 2007: in.iked: spsi: portjump -1
Thu Nov 15 17:42:06 2007: in.iked: In ssh_policy_find_pre_shared_key.
Thu Nov 15 17:42:06 2007: in.iked: spsi: ike_send_packet -1
Thu Nov 15 17:42:06 2007: in.iked: spsi: ike_send_packet -1
Thu Nov 15 17:42:06 2007: in.iked: spsi: ike_udp_callback_common -1
Thu Nov 15 17:42:07 2007: in.iked: spsi: ike_send_packet -1
Thu Nov 15 17:42:08 2007: in.iked: spsi: ike_udp_callback_common -1
Thu Nov 15 17:42:08 2007: in.iked: spsi: ike_send_packet -1
Thu Nov 15 17:42:09 2007: in.iked: spsi: ike_udp_callback_common -1
Thu Nov 15 17:42:09 2007: in.iked: IKE error: type 8194 (No SA established), decrypted 0, rx 1
Thu Nov 15 17:42:09 2007: in.iked: pm_info null! (msg type 8194 (No SA established))
Windows XP was able to process the KE payload sent from Sun and sent KE payload but complains the ID payload from Sun is invalid.
Any thoughts on what was going on? Thanks a lot!

How to Configure Mighty Mouse in Windows 7?

How to Configure Mighty Mouse in Windows 7?
For example the 3rd and 4th Buttons on the Mighty Mouse.
How to configure those actions in Windows 7?

There is no need for additional drivers.
Why?
If you have a Wireless Mighty Mouse you have to turn your computer visible for other devices in the Bluetooth preferences - then simply search for Bluetooth devices, connect - done!
To configure the Mighty Mouse's buttons, you might want to have a look at a tool called X-Mouse Button Control (http://www.highrez.co.uk/downloads/XMouseButtonControl.htm).

Hey guys, how can i password protect my files in external hard drive? I want to access those files both from mac and windows PC!

Hey guys, how can i password protect my files in external hard drive? I want to access those files both from mac and windows PC!

If you want a cross-platform solution that doesn't require the use of third-party software, use an external drive with hardware encryption. The device will have either a physical key or a numeric keypad. I don't have a specific recommendation.

SQL Server 2008 R2 Express with SP2: 'SQLEXPRESS'-instance installation fails while any other instance name installation succeeds.

We supply our software package that also includes the unattended installation (with /QS and so on) of SQL Server R2 Express (with SP2).
The setup works good in about 99.9% cases, but one customer complained that after the "successful SQL Sever installation (at least, it looked so!) he could not open the supplied database getting some strange error messages...
After some months of trial-n-error attempts we are now able to reproduce the problems this custumer had. But we cannot find the reason of the problem.
So the test computer is a virtual machine with Windows 7 + sp1 32-bit.
Among the programs/tools installed on this machine there were (in the following order):
SQL Server 2008 Express - the default SQLEXPRESS instance
SSMS
VS 2010 Pro (German)
SQL Server 2008 Express R2 (with SP 1 or SP2 - ?) - the default SQLEXPRESS instance
Then some of them were uninstalled in the following order:
SQL Server 2008 Express
SSMS
SQL Server 2008 Express R2
Now we tried to install (in normal mode with UI) the SQL Server 2008 Express R2 with SP2.
When we chose the default SQLEXPRESS instance - it failed with the following info:
Configuration status: Failed: see details below
Configuration error code: 0x7FCCE689
Configuration error description: External component has thrown an exception.
and the Detail.txt file contained the following:
2015-01-20 10:44:09 Slp: External component has thrown an exception.
2015-01-20 10:44:09 Slp: The configuration failure category of current exception is ConfigurationValidationFailure
2015-01-20 10:44:09 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing Validation and scenario Validation.
2015-01-20 10:44:09 Slp: System.Runtime.InteropServices.SEHException (0x80004005): External component has thrown an exception.
2015-01-20 10:44:09 Slp: at SSisDefaultInstance(UInt16* , Int32* )
2015-01-20 10:44:09 Slp: at Microsoft.SqlServer.Configuration.SniServer.NLRegSWrapper.NLregSNativeMethod Wrapper.SSIsDefaultInstanceName(String sInstanceName, Boolean& pfIsDefaultInstance)
2015-01-20 10:44:09 Slp: Exception: System.Runtime.InteropServices.SEHException.
2015-01-20 10:44:09 Slp: Source: Microsoft.SqlServer.Configuration.SniServerConfigExt.
2015-01-20 10:44:09 Slp: Message: External component has thrown an exception..
2015-01-20 10:44:09 Slp: Watson Bucket 1 Original Parameter Values
2015-01-20 10:44:09 Slp: Parameter 0 : SQL Server 2008 R2@RTM@
2015-01-20 10:44:09 Slp: Parameter 1 : SSisDefaultInstance
2015-01-20 10:44:09 Slp: Parameter 2 : SSisDefaultInstance
2015-01-20 10:44:09 Slp: Parameter 3 : System.Runtime.InteropServices.SEHException@-2147467259
2015-01-20 10:44:09 Slp: Parameter 4 : System.Runtime.InteropServices.SEHException@-2147467259
2015-01-20 10:44:09 Slp: Parameter 5 : SniServerConfigAction_Install_atValidation
2015-01-20 10:44:09 Slp: Parameter 6 : INSTALL@VALIDATION@SQL_ENGINE_CORE_INST
When we chose some other instance name then the installation has completed successfully.
So the questions are:
What could be the reason of the problem (and only for SQLEXPRESS instance that was earlier installed and then uninstalled)? I will provide the complete Detail.txt file if needed.
How could we check (if we could) the conditions so some name would be allowed as an instance name for SQL Server installer to success?
With the best regards,
Victor
Victor Nijegorodov

Thank you Lydia!
Unfortunately the simple check the registry
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Microsoft SQL Server\Instance Names\SQL does /did not work in our case since there is no any instance
name there,
However there seem to be some "rudiments" under
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall and/or HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.
So I will now try to check the subkeys of these two keys as it was mentioned by Xiao-Min Tan.
Best regards,
Victor Nijegorodov
Victor Nijegorodov

How do I export pictures from my IMac to my iPad. I have only certain albums I want to export and not all my albums?

How do I export pictures from my IMac to my iPad. I have only certain albums I want to export and not all my albums?

You can select only the albums that you want to sync in the photos tab of iTunes when you sync your iPad. If you are using iPhoto it is very easy. Simply select iPhoto in the Sync Photos From heading and then select the albums that you want to sync.
If you are using iTunes 11 - enable the side bar by going to View>Show Sidebar from the iTunes Menu. This explains how to sync photos.
iOS and iPod: Syncing photos using iTunes - Apple - Support

How to configure terminal services in Windows 2012 server to make multiple connection simulteniously

Hi I am configuring a Windows Server 2012 in a way so that 10 user can access this server through remote desktop connection simultaneously. We have purchased 10 UserCal license for this server.
Please guide me step by step ho to configure this server?

Server comes with 2 concurrent administrative RDP sessions. To enable it in server manager:
Click Yes on the pop-up message to enable the corresponding firewall rule.
To use more than 2 concurrent sessions, you need RDS. See this blog post
for how-to. Note that there's an RDS license required. This
this post for RDS features.
Sam Boutros, Senior Consultant, Software Logic, KOP, PA http://superwidgets.wordpress.com (Please take a moment to Vote as Helpful and/or Mark as Answer, where applicable)

How to configure IPv6 DHCP on Windows Server 2012?

I see LOTS of help and what to do for IPv4, but it's a ghost town for IPv6 DHCP configuration? Hardly anything on youtube etc that shows this simply. Lots of complicated unrelated IPv6 stuff though.
Seems many here as best practice set up server to handle DHCP. Not router or firewall. So how are you setting up IPv6 on the server?
Anyone have any tutorials or simple step by step help how to properly configure DHCPv6 on server?
Currently the router is handling DHCP. I want to use Active Directory. I know its best to have server handle DHCP, but will AD work just fine with router doing both ipv4 and ipv6 dhcp and for simplicity and wireless? Small 5 user office.
Thank you.
This topic first appeared in the Spiceworks Community

I see LOTS of help and what to do for IPv4, but it's a ghost town for IPv6 DHCP configuration? Hardly anything on youtube etc that shows this simply. Lots of complicated unrelated IPv6 stuff though.
Seems many here as best practice set up server to handle DHCP. Not router or firewall. So how are you setting up IPv6 on the server?
Anyone have any tutorials or simple step by step help how to properly configure DHCPv6 on server?
Currently the router is handling DHCP. I want to use Active Directory. I know its best to have server handle DHCP, but will AD work just fine with router doing both ipv4 and ipv6 dhcp and for simplicity and wireless? Small 5 user office.
Thank you.
This topic first appeared in the Spiceworks Community

How to configure group policy for emet via a command line

I have been tasked with installing emet on 50 servers that I only have access to with our patching server (so I can't remote in and open the gpedit gui). I can get it to install, but now the problem that I'm facing is I need to enable 6 of the group policies
for emet. Is there a way to do this while installing it? or a way to do it after the install?

cmd line you need to deal with is in the C:\Program Files (x86)\EMET 4.1 folder
specifically emet_conf --refresh would tell the systems to pull in the settings from a GPO they have already applied.
In a non - SCCM environment I would probably recommend using group policy preferences and create a task scheduler item on your servers that runs emet_conf --import
\\fileserver\settingsfile.xml on some sort of automated basis. Then you can just configure a client like you need and run the emet_conf --export
\\fileserver\settingsfile.xml whenever you need to change a mitigation etc and the clients will pick up on the change on their next run of the task scheduler item.
In general installing on servers isn't a great idea and is not the intended use case for emet however if you are DoD/Gov then DISA has mandated it so won't argue there. There's also the people that still have Internet access from servers so then it
would make sense in that environment as well.
CSS Security Support Engineer (FCS/MBSA/WUA/Incident Response/FOPE) Check out my blog http://blogs.technet.com/kfalde or better yet check out http://technet.com/wiki and start contributing :)

How to configure Fault policy for the Mediator??

Hi All,
I failed to configure fault policy for the mediator on FMW 11g. Below are my configurations.
1. I created simple ESB project: Consume message(using JMS adapter) from AQ topic: Q1 and produce to another AQ topic: Q2. In order to test the fault policy, The project will thorw an exception when produce to the AQ topic Q2 (Q2 didnt exist).
2. Created fault-policies.xml and fault-bindings.xml files in the Composite project directory.
But it didnt work, I didnt find any retry action in the log file. Is this the correct way to configure the fault policy? your suggestions are welcome. thanks.
fault-policies.xml
======================================================
<?xml version="1.0" encoding="UTF-8"?>
<faultPolicies>
<faultPolicy version="2.0.1" id="CRM_ServiceFaults">
<Conditions>
<faultName xmlns:medns="http://schemas.oracle.com/mediator/faults"
name="medns:mediatorFault">
<condition>
<test>contains($fault.mediatorErrorCode, "TYPE_FATAL_MESH")</test>
<action ref="ora-retry"/>
</condition>
</faultName>
</Conditions>
<Actions>
<Action id="ora-retry">
<retry>
<retryCount>3</retryCount>
<retryInterval>40</retryInterval>
<exponentialBackoff/>
<retryFailureAction ref="ora-terminate"/>
<retrySuccessAction ref="ora-terminate"/>
</retry>
</Action>
<Action id="ora-terminate">
<abort/>
</Action>
</Actions>
</faultPolicy>
</faultPolicies>
fault-bindings.xml
==========================================================
<?xml version="1.0" encoding="UTF-8"?>
<faultPolicyBindings version="2.0.1"
xmlns="http://schemas.oracle.com/bpel/faultpolicy"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<composite faultPolicy="CRM_ServiceFaults"/>
</faultPolicyBindings>
Thanks Mingzhuang

http://download.oracle.com/docs/cd/E12839_01/integration.1111/e10224/bp_faults.htm#SOASE9906

ISE: How to configure a policy to check if a users is in AD OR in local ?

Hello,
With ACS 5, I could do an authorization policy that checks if a user is in a specific AD group or if it is in a specific group locally in the ACS.
For example:
(AD-AD1:ExternalGroups contains any LANSwitchAdmins Or Internal Users:UserIdentityGroup in All Groups:Level 15)
In ISE, I don't know how to do that because I am creating an authorization rule as follows:
- Device:DeviceType Equals All Devices#Switches AND
- AD1:ExternalGroups Equals LANSwitchAdmins
I would like to be able to add a rule : OR
- Internal Users:UserIdentityGroup in All Groups:Level 15
But I cannot because the UI only allows to have only AND or only OR, without being able to change that...
Any clue ?
Best regards,
David

Hi,
The real way to get this to work is to use a compound authorizatoin condition where you can select the OR for AD or identity user group name, however I have not had any luck making this work even on ISE 1.1.4.
basically I was in the same situation as you where I had to build two different policies to make this work.
May want to open a TAC case since I am sure there is a bug on this but I havent had a chance to dig into this issue.
Tarik Admani
*Please rate helpful posts*

Windows Server 2008 R2 Remote Desktop - The requested session access is denied

Hi, I have been using Windows Server 2008 R2 since it was released, and have 100 servers up and running. I configured Allow Remote Desktop on all of them and have been able to connect to them and manage them via RDP since then. I also have two servers configured as Remote Desktop Services.
That was up until yesterday. Yesterday afternoon I started getting the The requested session access is denied. I managed all Terminal services via Group Policy and have three users entered.
I am connecting to the servers via Windows XP SP3 and Windows 7. Both clients have been updated to the latest Remote Desktop Services client.
I have been searching for the answer, and I am not finding it.
I have also tried KB954369 without any success.
Thanks,
Brian

Ok, from my trials and tribulations and discussions with Microsoft I have identified the following;
Assumptions;
A. My terminal server is in domain widget
B. All the users are in domain contoso
1. I had the Terminal Server configurured with a specific Login, which would launch a specific application only and not give them any desktop functions. Wiht this configured this way, I get the error I wrote about.
2. If I turn the specific login off, then I can login normally and perform the functions as Administrator that I need/want to do.
3. Microsoft said to configure the Terminal Server with Single Sign-on. I did as instructed and went thru all the steps, however because my terminal server is in domain widget, the users get prompted twice each time for login. Once on the website, and then again as the application launches. Microsoft said that the users needed to Remote Desktop Client 7.x or the self-signed certificate that I have has to be included in the domain contoso certificate authority so that they will not be prompted for the second sign-on.
4. Conclusions - I need to have a chat with our enterprise security team about including the self-signed certificate in the contoso certificate authority. I need to also work on my RDWeb website so that it meets our company standard look.
Here are the links that Microsoft provided;
http://technet.microsoft.com/en-us/library/cc772108(WS.10).aspx
Enable RDC Client Single Sign-On for Remote Desktop Services
http://technet.microsoft.com/en-us/library/cc742808.aspx
Blogs -
http://blogs.msdn.com/rds/archive/2007/04/19/how-to-enable-single-sign-on-for-my-terminal-server-connections.aspx
http://blogs.msdn.com/rds/archive/2009/08/11/introducing-web-single-sign-on-for-remoteapp-and-desktop-connections.aspx
http://blogs.msdn.com/rds/archive/2009/06/05/publishing-in-windows-server-2008-r2.aspx
http://blogs.technet.com/pfe-ireland/archive/2008/09/05/windows-server-2008-terminal-services-presentation-virtualisation-and-windows-xp-clients.aspx
I hope this help you in your troubleshooting.
Brian

Getting Windows Server 2008 to Create a Virtual Machine to Run Windows 8.1 Is Easy -- Not So Getting Windows Server 2012 To Do So

I spent an entire work day trying to configure HYPER-V on Windows 2012 R2 Server to run Windows 8.1 in a virtual operating system. Gave up entirely on Windows 2012 R2 Server since no matter how I changed the memory configuration, it insisted there was
too little memory available to perform bootstrap and initialization of the Windows 2012 R2 Server / Windows 8.1 combination. In vivid contrast, getting Windows 8.1 installed and operational under HYPER-V running on Windows 2008 Server is a snap. No whining
from HYPER-V about a purported lack of memory. The machine has 2GB of main memory and nothing much running on it besides HYPER-V. This situation is, of course, all my fault.
MARK D ROCKMAN

Hi Sir ,
Personally , 2 GB for 2012R2 host and a windows8.1 VM is a little low .
Also the memory consumption is different between 2012R2 and 2008 .
I would suggest you run RAMmap.exe to check the free space , then you may see how many RAM can be used ：
http://technet.microsoft.com/en-us/sysinternals/ff700229.aspx
By the way , win8.1 is not in the
supported guest OS list of 2008 hyper-v server .
Best Regards
Elton JI
We
are trying to better understand customer views on social support experience, so your participation in this
interview project would be greatly appreciated if you have time.
Thanks for helping make community forums a great place.

Server 2008 R2 with WSUS need to specify location for Feature install for Server 2012 and Windows 8

Having a problem where we need to add .net 3.5, amongst other things, in server 2012 and windows 8.1. We're using WSUS on server 2008 R2, so when I go to add roles or features, I'm not able to as it tries to use Windows Update but it's set to use WSUS.
I'm aware in server 2012 gpo's that you enable the policy 'specify settings for optional component installation and component repair' in Administrative Templates>System, however that setting is not available in Server 2008 R2.
I've downloaded the templates from http://www.microsoft.com/en-us/download/details.aspx?id=36991 but the setting is still not there.
Any suggestions on how to do this/allow feature install with Server 2008 R2?

Hi,
To upgrade the Administrative Templates, please run the downloaded msi file, then copy the needed admx files and adml files to the PolicyDefinitions folder.
For detailed information, please refer to the link below,
Managing Group Policy ADMX Files Step-by-Step Guide
http://technet.microsoft.com/en-us/library/cc709647(v=WS.10).aspx
Best Regards.
Steven Lee Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Error While Creating Windows Server 2008 SP2 32-BIT Virtual Machine

I am facing an error while creating a Virtual Machine on the Cloud. The Error is below:
Error (610)
Virtual Machine Manager was unable to find a value for the required Sysprep parameter ProductKey.
Recommended Action
Add the missing Sysprep parameter either to the answer file or to the operating system configuration, and then try the operation again.
My Template does not have the Product Key defined. The OS is Windows Server 2008 SP2 32-BIT. Is defining Product Key absolutely necessary? I have other Templates for other Operating Systems and they are working fine. Only facing problem
with this.
Any help would be appreciated.

In the SCVMM world a 'template' is composed of the following: a VHD with an OS that has been generalized (sysprep), virtual hardware profile (settings), and an OS profile.
The OS profile is required to have a product key. A MAC activation key at the minimum. But the key is required.
If you deploy a VM from a VHD, the same customization assumptions are not at play. Which is why it succeeds. (there is no template in this case, there is also no requirement that the OS in the VHD be sysprep'd).
SCVMM has rules. And lots of things don't make sense until you begin to understand them and play within them. (I am not saying that the SCVMM rules are a good thing, just saying they exist)
Brian Ehlert
http://ITProctology.blogspot.com
Learn. Apply. Repeat.

How to configure ipsec policy on windows server 2008 r2 to permit local machine only access to gateway,one other server and it's local ip?

Similar Messages

Maybe you are looking for