Encryption Key Auto Exchange Settings Configuration Flow
To use a certificate to authenticate the transmission partner in encryption key auto exchange settings, a device certificate must be installed.
After configuring IPsec, you can use "Ping" command to check if the connection is established correctly. However, you cannot use "Ping" command when ICMP is excluded from IPsec transmission on the computer side. Also, because the response is slow during initial key exchange, it may take some time to confirm that transmission has been established.
To change the transmission partner authentication method for encryption key auto exchange settings to "Certificate", you must first install and assign a certificate. For details about creating and installing a device certificate, see User Guide of your device. For the method of assigning installed certificates to IPsec, see Selecting the certificate for IPsec.
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [IPsec] under "Security".
Click [Edit] under "Encryption Key Auto Exchange Settings".
Make encryption key auto exchange settings in [Settings 1].
If you want to make multiple settings, select the settings number and add settings.Click [OK].
Select [Active] for "IPsec" in "IPsec".
Set "Exclude HTTPS Communication" to [Active] if you do not want to use IPsec for HTTPS transmission.
Click [OK].
Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Log out.
Using Web Image Monitor, select the certificate to be used for IPsec. You must install the certificate before it can be used. For details about creating and installing a device certificate, see User Guide of your device.
Log in as the network administrator from Web Image Monitor.
For details on how to log in, see User Guide of your device.Point to [Device Management], and then click [Configuration].
Click [Device Certificate] under "Security".
Select the certificate to be used for IPsec from the drop-down list box in "IPsec" under "Certification".
Click [OK].
The certificate for IPsec is specified.Updating... appears. Wait for about 1 or 2 minutes, and then click [OK].
If the previous screen does not appear again after you click [OK], wait for a while, and then click the web browser's refresh button.Log out.
Configure the computer's IPsec SA settings, so that they exactly match the machine's security level on the machine. Setting methods differ according to the computer's operating system. The example procedure shown here uses Windows 10 when the "Authentication and Low Level Encryption" security level is selected.
Click the [Start] button, and click [Windows System] - [Control Panel] - [System and Security] - [Windows Defender Firewall].
Click [Advanced settings] - [Properties], and select the [IPsec Settings] tab.
Select [Yes] in [IPsec exemptions], and then click [Customize] in [IPsec defaults].
Select [Advanced] in [Key exchange (Main Mode)], and then click [Customize].
Click [Add] in [Security methods] to add a new security method.
Select [SHA-1] for [Integrity algorithm], [3DES] for [Encryption algorithm], [Diffie-Hellman Group 14] for [Key exchange algorithm].Set [Minutes] to [300] in [Key lifetimes] and select the [Use Diffie-Hellman for enhanced security.] check box in [Key exchange options], and then click [OK].
Select [Advanced] in [Data protection (Quick Mode)], and then click [Customize].
Select the [Require encryption for all connection security rules that use these settings] check box.
Click [Add] in [Data integrity and encryption] to add a new setting.
Select [ESP] for [Protocol], [3DES] for [Encryption algorithm], [SHA-1] for [Integrity algorithm], and set [Key lifetimes] to “5 (minutes)/100,000 (KB)”.
If a combination of [ESP], [3DES], and [SHA-1] has already been registered, a new setting cannot be created. In that case, select the registered setting, click [Edit] and change [Key lifetimes].Click [OK].
Select [Advanced] in [Authentication method], and then click [Customize].
Click [Add] in [First authentication methods] to add a new authentication method.
Select [Preshared key] as the credential type and enter the key.Click [OK] three times.
In the [Windows Defender Firewall with Advanced Security] screen, right-click [Connection Security Rules] and click [New Rule].
The [New Connection Security Rule Wizard] appears.Select [Custom], and then click [Next] twice.
Select [Request authentication for inbound and outbound connections] and click [Next].
Select [Default] and click [Next].
Select [Any] or [TCP] in [Protocol type] and click [Next].
If [TCP] is selected, specify the endpoint port if necessary.Make sure the [Domain] check box is selected, and click [Next].
Enter a name that you want to use for [Name], enter a [Description] if necessary, and click [Finish].
Right-click the created rule and click [Properties].
In the [Remote Computers] tab, select [These IP addresses] for [Endpoint 1] and [Endpoint 2], and click [Add] to set the IP addresses.
Enter the IP address of the PC for [Endpoint 1] and the IP address of the device for [Endpoint 2].In the [Authentication] tab, select [Request inbound and outbound] in [Authentication mode] and click [OK].
To enable Perfect Forward Secrecy (PFS), proceed to Step 24.
If PFS will not be used, proceed to Step 27.Click the [Start] button, and click [Windows PowerShell] - [Windows PowerShell].
Enter “Get-NetIPsecQuickModeCryptoSet” and press the [Enter] key.
Enter “Set-NetIPsecQuickModeCryptoSet” and press the [Enter] key to set “Name” and “PerfectForwardSecrecyGroup”.
For “Name”, enter the value of the name displayed by “Get-NetIPsecQuickModeCryptoSet”.
For “PerfectForwardSecrecyGroup”, specify “none/DH1/DH2/DH14”.In the [Windows Defender Firewall with Advanced Security] screen, right-click the rule you created and click [Enable Rule].
The IPsec settings on your computer will be enabled.