Audit IPSec Quick Mode

  

Internet Protocol Security (IPSec) protects communications over IP networks using cryptographic security. IPSec uses a security association (SA) to track all the security parameters values such as security keys, a destination address, a unique security parameter index (SPI), and attributes like IPSec lifetime, concerning a given IPSec communication session.

The Internet Key Exchange (IKE) protocol is generally used as a method of exchanging encryption keys through unsecure mediums like the Internet as IKE provides secure encryption. It also Authenticated Internet Protocol (AuthIP) is a second authentication protocol that boosts the security and deployability of IPsec VPNs.

IPSec Quick Mode establishes IPSec SAs. When the lifetime of an IPSec SA expires, Quick Mode is used to renegotiate for a new IPSec SA. Quick Mode also derives shared secret keying material via IPSec security algorithms and negotiates a shared IPSec policy.

Audit IPsec Quick Mode is a security policy setting that enables you to audit events generated by Internet Key Exchange protocol and Authenticated Internet Protocol during Quick Mode negotiations.

The parameters in Quick Mode negotiations include:

Why enable Audit IPsec Quick Mode?

Enabling this policy setting can help troubleshoot and monitor the Quick Mode operations. For example, if a device constantly records event ID 4977, it signifies invalid negotiation packages. This could be caused by a network issue, or even a potential external attempt to modify packets. Therefore it is important to monitor such IPsec events.

How to enable Audit IPsec Quick Mode?

Expand the node and select Logon/Logoff. Click on Audit IPsec Quick Mode. Enable auditing for 'Success' and 'Failure'.

The following events are IPsec Quick Mode events, and what they indicate, along with their respective event IDs:

Viewing specific events in Event Viewer

To filter the required event IDs,

Audit IPsec with ADAudit Plus

ADAudit Plus is a real-time Active Directory auditing tool that can track all the changes across the AD network. This tool can therefore monitor audit policy changes on the network. ADAudit Plus will raise an alert if an unauthorized user manages to modify the audit policy changes. For reports on group policy modifications in ADAudit Plus:

The screenshot below from ADAudit Plus shows a sample report of changes made to Windows Settings:

This report provides the following information:

The ADAudit Plus difference

Download ManageEngine's ADAudit Plus, a real-time Active Directory auditing tool, that offers reports and instant email alerts. It is a useful tool to understand employee behavior with regards to IT, and thwart insider and outsider attacks. It can also be used to keep track of all changes to GPO settings and audit policies.