Specifying IPsec settings on the computer

On the [Start] menu, click [Control Panel], click [System and Security], and then click [Administrative Tools].

If you are using under Windows 8, point to the bottom right part of the screen to display the Settings menu, and then click [Settings], [Control Panel], [System and Security], and then [Administrative Tools].

Double-click [Local Security Policy].

If the "User Account Control" dialog box appears, click [Yes].

Click [IP Security Policies on Local Computer].

In the "Action" menu, click [Create IP Security Policy].

The IP Security Policy Wizard appears.

Click [Next].

Enter a security policy name in "Name", and then click [Next].

Clear the "Activate the default response rule" check box, and then click [Next].

Select "Edit properties", and then click [Finish].

In the "General" tab, click [Settings].

In "Authenticate and generate a new key after every", enter the same validity period (in minutes) that is specified on the printer in "Encryption Key Auto Exchange Settings Phase 1", and then click [Methods].

Confirm that the hash algorithm ("Integrity"), encryption algorithm ("Encryption") and "Diffie-Hellman Group" settings in "Security method preference order" all match those specified on the printer in "Encryption Key Auto Exchange Settings Phase 1".

If the settings are not displayed, click [Add].

Click [OK] twice.

Click [Add] in the "Rules" tab.

The Security Rule Wizard appears.

Click [Next].

Select "This rule does not specify a tunnel", and then click [Next].

Select the type of network for IPsec, and then click [Next].

If you select "Certificate" for authentication method in "Encryption Key Auto Exchange Settings" on the printer, specify the device certificate. If you select "PSK", enter the same PSK text specified on the printer with the pre-shared key.

Click [Add] in the IP Filter List.

In [Name], enter an IP Filter name, and then click [Add].

The IP Filter Wizard appears.

Click [Next].

If required, enter a description of the IP filter, and then click [Next].

Select "My IP Address" in "Source address", and then click [Next].

Select "A specific IP Address or Subnet" in "Destination address", enter the printer's IP address, and then click [Next].

Select the protocol type for IPsec, and then click [Next].

Click [Finish].

Click [OK].

Select the IP filter that was just created, and then click [Next].

Click [Add].

Filter action wizard appears.

Click [Next].

In [Name], enter an IP Filter action name, and then click [Next].

Select "Negotiate security", and then click [Next].

Select "Allow unsecured communication if a secure connection connect be established.", and then [Next].

Select "Custom" and click [Settings].

In "Integrity algorithm", select the authentication algorithm that was specified on the printer in "Encryption Key Auto Exchange Settings Phase 2".

In "Encryption algorithm", select the encryption algorithm that specified on the printer in "Encryption Key Auto Exchange Settings Phase 2".

In Session key settings, select "Generate a new key every", and enter the validity period (in seconds) that was specified on the printer in "Encryption Key Auto Exchange Settings Phase 2".

Click [OK].

Click [Next].

Click [Finish].

Select the filter action that was just created, and then click [Next].

If you specify the "Authentication and High Level Encryption" security level in "Encryption Key Auto Exchange Settings", also select the "Use session key perfect forward secrecy (PFS)" check box in the filter action properties screen. If using PFS in Windows, the PFS group number used in phase 2 is automatically negotiated in phase 1 from the Diffie-Hellman group number (set in Step 11). Consequently, if you change the security level specified automatic settings on the printer and “User Setting” appears, you must set the same the group number for "Phase 1 Diffie-Hellman Group" and "Phase 2 PFS" on the printer to establish IPsec transmission.

Select the authentication method, and then click [Next].

If you select "Certificate" for authentication method in "Encryption Key Auto Exchange Settings" on the printer, specify the device certificate. If you select "PSK", enter the same PSK text specified on the printer with the pre-shared key.

Click [Finish].

If you are using IPv6, you must repeat this procedure from Step 13 and add ICMPv6 as an exception.

When you reach step 23, select [58] as the protocol number for the "Other" target protocol type, and then set [Negotiate security] to [Permit].

Click [OK].

The new IP security policy (IPsec settings) is specified.

Select the security policy that was just created, right-click,, and then click [Assign].

IPsec settings on the computer are enabled.