还能这么玩？Windows通过netsh命令配置IPsec

下列指令有效:此上下文中的命令:..             - 移到上一层上下文级。?              - 显示命令列表。abort          - 丢弃在脱机模式下所做的更改。add            - 在项目列表上添加一个配置项目。advfirewall    - 更改到 `netsh advfirewall' 上下文。alias          - 添加一个别名branchcache    - 更改到 `netsh branchcache' 上下文。bridge         - 更改到 `netsh bridge' 上下文。bye            - 退出程序。commit         - 提交在脱机模式中所做的更改。delete         - 在项目列表上删除一个配置项目。dhcpclient     - 更改到 `netsh dhcpclient' 上下文。dnsclient      - 更改到 `netsh dnsclient' 上下文。dump           - 显示一个配置脚本。exec           - 运行一个脚本文件。exit           - 退出程序。firewall       - 更改到 `netsh firewall' 上下文。help           - 显示命令列表。http           - 更改到 `netsh http' 上下文。interface      - 更改到 `netsh interface' 上下文。ipsec          - 更改到 `netsh ipsec' 上下文。ipsecdosprotection - 更改到 `netsh ipsecdosprotection' 上下文。lan            - 更改到 `netsh lan' 上下文。namespace      - 更改到 `netsh namespace' 上下文。nap            - 更改到 `netsh nap' 上下文。netio          - 更改到 `netsh netio' 上下文。offline        - 将当前模式设置成脱机。online         - 将当前模式设置成联机。popd           - 从堆栈上打开一个上下文。pushd          - 将当前上下文放入堆栈。quit           - 退出程序。ras            - 更改到 `netsh ras' 上下文。rpc            - 更改到 `netsh rpc' 上下文。set            - 更新配置设置。show           - 显示信息。trace          - 更改到 `netsh trace' 上下文。unalias        - 删除一个别名。wfp            - 更改到 `netsh wfp' 上下文。winhttp        - 更改到 `netsh winhttp' 上下文。winsock        - 更改到 `netsh winsock' 上下文。

下列指令有效:此上下文中的命令:?              - 显示命令列表。dump           - 显示一个配置脚本。dynamic        - 更改到 `netsh ipsec dynamic' 上下文。help           - 显示命令列表。static         - 更改到 `netsh ipsec static' 上下文。下列的子上下文可用:dynamic，static。

此上下文中的命令:?              - 显示命令列表。add            - 创建新的策略和有关信息。delete         - 删除策略和相关信息。dump           - 显示一个配置脚本。exportpolicy   - 从证书存储中导出所有策略。help           - 显示命令列表。importpolicy   - 从文件导入策略到证书存储。set            - 更改现存策略和相关信息。show           - 显示策略和相关信息的详细信息。

命令从 netsh 上下文继承:add helper     - 安装一个帮助者 DLL。此上下文中的命令:add filter     - 将筛选器添加到筛选器列表。add filteraction - 创建一个筛选器操作。add filterlist - 创建一个空的筛选器列表。add policy     - 用默认响应规则创建策略。add rule       - 为指定策略创建一个规则。

policy [ name = ] <string>[ [ description = ] <string> ][ [ mmpfs = ] (yes | no) ][ [ qmpermm = ] <integer> ][ [ mmlifetime = ] <integer> ][ [ activatedefaultrule = ] (yes | no) ][ [ pollinginterval = ] <integer> ][ [ assign = ] (yes | no) ][ [ mmsecmethods = ] (sec#1 sec#2 ... sec#n) ]

add policy Policy1 mmpfs= yes assign=yes mmsec="3DES-SHA1-3 DES-MD5-3 3DES-MD5-2"

netsh ipsec static add policy ipsec

filteraction [ name = ] <string>[ [ description = ] <string> ][ [ qmpfs = ] (yes | no) ][ [ inpass  = ] (yes | no) ][ [ soft = ] (yes | no) ][ [ action = ] (permit | block | negotiate) ][ [ qmsecmethods = ] (neg#1 neg#2 ... neg#n) ]

add filteraction name=FilterA qmpfs=yes soft=y action=negotiate qmsec="AH[MD5]:204800k/300s ESP[DES,SHA1]:30000k/480s"

netsh ipsec static add filteraction name=PASS action=permit

filterlist [ name = ] <string>[ [ description = ] <string> ]

add filterlist Filter1

netsh ipsec static add filterlist FLIST

filter [ filterlist = ] <string>[ srcaddr = ] (ipv4 | ipv6 | ipv4-ipv4 | ipv6-ipv6 | dns | server)[ dstaddr = ] (ipv4 | ipv6 | ipv4-ipv4 | ipv6-ipv6 | dns | server)[ [ description = ] <string> ][ [ protocol = ] (ANY | ICMP | TCP | UDP | RAW | <integer>) ][ [ mirrored = ] (yes  |  no) ][ [ srcmask = ] (mask | prefix) ][ [ dstmask = ] (mask | prefix) ][ [ srcport = ] <port> ][ [ dstport = ] <port> ]

1. add filter filterlist=Filter1 192.145.168.0 192.145.168.45 srcmask=24 dstmask=322. add filter filterlist=Filter1 srcaddr=DHCP dstaddr=0.0.0.0 protocol=ICMP srcmask=255.255.255.255 dstmask=255.255.255.2553. add filter filterlist=Filter1 srcaddr=me dstaddr=any4. add filter filterlist=Filter1 srcaddr= E3D7::51F4:9BC8:00A8:6420 dstaddr= ME5. add filter filterlist=Filter1 srcaddr= 192.168.2.1-192,168.2.10 dstaddr= ME

netsh ipsec static add filter filterlist=FLIST 172.31.0.229 172.31.0.235

rule [ name = ] <string>[ policy = ] <string>[ filterlist = ] <string>[ filteraction = ] <string>[ [ tunnel = ] (ip | dns) ][ [ conntype = ] (lan | dialup | all) ][ [ activate = ] (yes | no) ][ [ description = ] <string> ][ [ kerberos = ] (yes | no) ][ [ psk = ] <preshared key> ][ [ rootca = ] "<certificate> certmap:(yes | no) excludecaname:(yes | no)" ]

1. add rule name=Rule policy=Policy filterlist=Filterlist filteraction=FilterAction kerberos=yes psk="my key" rootca="C=US,O=MSFT,CN=Microsoft Authenticode(tm) Root Authority" rootca="C=US,O=MSFT,CN=\’Microsoft North, South, East, and West Root Authority\’ certmap:yes excludecaname:no"2. add rule name=ipsec policy=ipsec filterlist=FLIST filteraction=PASS  psk="ipsec"

netsh ipsec static>add rule name=ipsec policy=ipsec filterlist=FLIST filteraction=PASS psk="ipsec"

命令从 netsh 上下文继承:set file       - 复制控制台输出到文件。set machine    - 设置在上面操作的机器。set mode       - 设置当前模式为联机或脱机。netsh ipsec static此上下文中的命令:set batch      - 设置批更新模式。set defaultrule - 更改默认响应规则。set filteraction - 更改筛选器操作。set filterlist - 更改筛选器列表。set policy     - 更改策略。set rule       - 更改规则。set store      - 设置当前策略存储。set policy（更改策略）

policy [ name = ] <string> | [ guid = ] <guid>[ [ newname = ] <string> ][ [ description = ] <string> ][ [ mmpfs = ] (yes | no) ][ [ qmpermm = ] <integer> ][ [ mmlifetime = ] <integer> ][ [ activatedefaultrule = ] ( yes | no) ][ [ pollinginterval = ] <integer> ][ [ assign = ] (yes | no) ][ [ gponame = ] <string> ][ [ mmsecmethods = ] (sec#1 sec#2 ... sec#n) ]

1. set policy name=Policy mmpfs=y gpo=DomainPolicy assign=y2. set policy guid={11E6E97E-0031-49f5-AC7D-5F2FE99BABAF} newname=NewName gpo=DefaultDomainPolicy assign=y

netsh ipsec static>set policy name=ipsec assign=y

下列指令有效:命令从 netsh 上下文继承:show alias     - 列出所有定义的别名。show helper    - 请列出所有顶层的帮助者。show mode      - 显示当前的模式。此上下文中的命令:show all       - 显示所有策略的详细信息及相关信息。show filteraction - 显示筛选器操作详细信息。show filterlist - 显示筛选器列表详细信息。show gpoassignedpolicy - 显示组分配的策略的详细信息。show policy    - 显示策略详细信息。show rule      - 显示规则的详细信息。show store     - 显示当前策略存储。