Specifying IPsec Settings on the Computer
Specify exactly the same settings for IPsec SA settings on your computer as are specified for the IPsec Settings on the machine. Setting methods differ according to the computer's operating system. The following procedure is based on Windows 10 in an IPv4 environment as an example.
On the [Start] menu, click [Control Panel], [System and Security], and then click [Administrative Tools].
Double-click [Local Security Policy], and then click [IP Security Policies on Local Computer].
In the "Action" menu, click [Create IP Security Policy...].
The IP Security Policy Wizard appears.
Click [Next].
Enter a security policy name in "Name", and then click [Next].
Clear the "Activate the default response rule" check box, and then click [Next].
Select "Edit properties", and then click [Finish].
In the "General" tab, click [Settings...].
In "Authenticate and generate a new key after every", enter the same validity period (in minutes) that is specified on the machine in [IKE Life Time], and then click [Methods...].
Confirm that the Encryption Algorithm ("Encryption"), Hash Algorithm ("Integrity"), and IKE Diffie-Hellman Group ("Diffie-Hellman Group") settings in "Security method preference order" all match those specified on the machine in [IKE Settings].
If the settings are not displayed, click [Add...].
Click [OK] twice.
Click [Add...] in the "Rules" tab.
The Security Rule Wizard appears.
Click [Next].
Select "This rule does not specify a tunnel", and then click [Next].
Select the type of network for IPsec, and then click [Next].
Click [Add...] in the IP Filter List.
In [Name], enter an IP Filter name, and then click [Add...].
The IP Filter Wizard appears.
Click [Next].
In [Description:], enter a name or a detailed explanation of the IP filter, and then click [Next].
You may click [Next] and proceed to the next step without entering any information in this field.
Select "My IP Address" in "Source address", and then click [Next].
Select "A specific IP Address or Subnet" in "Destination address", enter the machine's IP address, and then click [Next].
For the IPsec protocol type, select "Any", and then click [Next].
Click [Finish], and then click [OK].
Select the IP filter that you have just created, and then click [Next].
Click [Add...] in the Filter Action.
The Filter Action Wizard appears.
Click [Next].
In [Name], enter a Filter Action name, and then click [Next].
Select "Negotiate security", and then click [Next].
Select "Allow unsecured communication if a secure connection cannot be established.", and then click [Next].
Select "Custom" and click [Settings].
In "Integrity algorithm", select the authentication algorithm that was specified on the machine.
In "Encryption algorithm", select the encryption algorithm that specified on the machine.
In "Session key settings", select "Generate a new key every", and enter the validity period (in seconds) that was specified on the machine.
Click [OK].
Click [Next].
Click [Finish].
Select the filter action that you have just created, and then click [Next].
Select one of options for an authentication method, and then click [Next].
Click [Finish], and then click [OK].
The new IP security policy (IPsec settings) is specified.
Click [IP Security Policies on Local Computer].
Select the security policy that you have just created, right click on it, and then click [Assign].
IPsec settings on the computer are enabled.
To disable the computer's IPsec settings, select the security policy, right click, and then click [Un-assign].