| Server IP : 180.180.241.3 / Your IP : 216.73.216.252 Web Server : Microsoft-IIS/7.5 System : Windows NT NETWORK-NHRC 6.1 build 7601 (Windows Server 2008 R2 Standard Edition Service Pack 1) i586 User : IUSR ( 0) PHP Version : 5.3.28 Disable Function : NONE MySQL : ON | cURL : ON | WGET : OFF | Perl : OFF | Python : OFF | Sudo : OFF | Pkexec : OFF Directory : /Windows/Help/Windows/en-US/ |
Upload File : |
MZ @ PE L ! @ 0
@ .rsrc @ @.its @ @ 0 H X | |4 V S _ V E R S I O N _ I N F O S t r i n g F i l e I n f o 0 4 0 9 0 4 b 0 b ! F i l e V e r s i o n 1 . 0 0 . 0 0 l " F i l e D e s c r i p t i o n C o m p i l e d M i c r o s o f t H e l p 2 . 0 T i t l e B F i l e S t a m p 7 1 8 A C 1 9 9 0 1 C A 0 4 1 F 4 J C o m p i l e r V e r s i o n 2 . 5 . 7 1 2 1 0 . 0 8 5 7 9 V C o m p i l e D a t e 2 0 0 9 - 0 7 - 1 4 T 0 1 : 0 7 : 2 2 > T o p i c C o u n t 1 6 0 0 0 0 0 0 0 0 0 0 0 0 0 A L e g a l C o p y r i g h t 2 0 0 5 M i c r o s o f t C o r p o r a t i o n . A l l r i g h t s r e s e r v e d . C C C C C C C C C C C C C D V a r F i l e I n f o $ T r a n s l a t i o n ti q *ITOLITLS ( X쌡^
V` x | CAOL P HH C ITSF # _#q OL
-Y쌡^
VY쌡^
VIFCM AOLL | IFCM AOLL` / /$FXFtiAttribute/ /$FXFtiAttribute/BTREE*/$FXFtiAttribute/DATA /$FXFtiAttribute/PROPERTYBN /$FXFtiMain/ /$FXFtiMain/BTREE /$FXFtiMain/DATA!;/$FXFtiMain/PROPERTY\N/$Index/$ATTRNAME`\/$Index/$PROPBAG /$Index/$STRINGSt /$Index/$SYSTEM l
/$Index/$TOC/ /$Index/$TOC/$authfw ~/$Index/$TOPICATTRP/$Index/$TOPICS/$Index/$URLSTR~/$Index/$URLTBL /$Index/$VTAIDX<(/$Index/AssetId/ /$Index/AssetId/$BL0d /$Index/AssetId/$LEAF_COUNTSd/$Index/AssetId/$LEAVESt /$OBJINST~ /assets/ 0/assets/05d277a3-2b83-4951-a2fc-e2ca78a24f24.xml t*0/assets/06cbaf77-aa9d-4dec-b056-3dcd2616e4fa.xml K0/assets/0ec58789-26f0-47cd-9f43-aa6e7d52db10.xml i`0/assets/101488a1-9f62-4797-9330-4937c888e371.xml I0/assets/12452b6f-dce5-4515-bfdd-455f08c77e5a.xml ZN0/assets/13da39e0-2a32-4ac4-a952-4391ae88c739.xml (b0/assets/142a13a0-f0c4-4122-95d9-ecfb6f6391c4.xml
C0/assets/14f25442-df7f-4c80-9ffc-b01781b2b246.xml M 0/assets/1826c5b4-7aa9-419a-a211-07542a5dcf1a.xml l0/assets/18ddcbbd-4939-492c-a716-f1fccc468c18.xml s0/assets/1a70e8bc-19f3-4bd5-bba9-d04c432adbc6.xml 0/assets/1a81d9c6-f39f-4835-a00b-11d994247ca9.xml /0/assets/20b3aba6-884a-4ef9-8ea7-914e4cd735d9.xml Kc0/assets/226a35ae-cf87-4bd3-b4be-fab77930e6da.xml .o0/assets/2318ec3c-e196-4a43-9d79-70ca7c52194a.xml !0/assets/2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0.xml >_0/assets/39e393da-18a6-4a1d-85d1-d9dcb46e3b93.xml J0/assets/40413516-c1ab-46b3-b62c-d165b434974b.xml g40/assets/41646515-247f-4ce4-a9fd-600bd90ae773.xml !0/assets/5147487b-bb6a-40e4-b8ee-f263c52bee24.xml <!0/assets/52a543f3-3baa-42d9-8614-25293d0e3f62.xml ]U0/assets/53d4595a-b6b0-4133-be9e-03dcecef56e6.xml 210/assets/53df2676-ea86-4670-8f48-b113383a0992.xml c50/assets/55215ddc-b9aa-4bac-9ec2-d5da5cb3932c.xml l0/assets/5886c961-2f7a-46f9-928b-2b906f2c354a.xml t0/assets/58a40682-63b1-493a-9d97-940532cbbcd8.xml xy0/assets/5918d117-66c3-4f58-8680-a5a822c40dc7.xml qn0/assets/5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da.xml _10/assets/5ca392ca-aece-4319-90c5-80544a29b8e9.xml 0/assets/60324d03-97f8-4aa5-864b-af205ebff02b.xml "@0/assets/63138fa3-9f09-4684-89cb-c44306ee3763.xml e[0/assets/66011489-1eee-4986-9373-565e557db23b.xml @l0/assets/6a710a38-a254-4a80-9a53-6ea2e0816d24.xml ,Y0/assets/70d0c763-d3a3-486d-9f91-e213831f2485.xml ]N0/assets/710fa446-c600-4691-ae28-37a9824fb95d.xml +Q0/assets/71ea19d0-e57f-4828-923a-632cdb208aad.xml |:0/assets/7e24b5a1-742d-4247-b86d-db9e097dee4e.xml 6n0/assets/8039b8d4-e87b-4aac-9c09-6a34cc73f1b6.xml $d0/assets/85c69539-f0c0-474c-9860-d220293ab2d6.xml yk0/assets/8a0b490a-db5e-420f-8990-d0e30a17bc1a.xml dS0/assets/8b29e655-9fb1-4ba5-a701-30812af59d2e.xml 7R0/assets/8c965889-6e37-4ad0-b41d-4f98bed709ad.xml t0/assets/950c636f-f858-4852-8a78-b3222cd57bff.xml }40/assets/97e94c49-45b2-4af9-bcd8-07fff5c1618f.xml 10/assets/9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99.xml CQ0/assets/98690952-0b7a-4b1f-bbee-3db1fa381f4f.xml 0/assets/99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b.xml ,!0/assets/9d81b178-5fef-4b23-9dc7-e85f20bbf5d9.xml M 0/assets/9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f.xml YY0/assets/a4c3ccd0-9ec1-4da5-982d-6e65877b5db3.xml 2c0/assets/aa9088cb-98f3-4c53-8270-09484edb997a.xml 0/assets/aaad90b0-4f52-46ca-9636-e05175e4aa78.xml /0/assets/b029858f-ef85-4cdd-a29c-06a9457f4365.xml H40/assets/b31c589e-5b17-42df-b7ad-041084dd2074.xml | 0/assets/b8b120da-821c-45f1-86ee-d7303f6b500a.xml 0/assets/ba442eea-0e40-4936-bb3a-413993267098.xml 9h0/assets/c243c092-48c6-4073-9b19-b9c98c931582.xml !l0/assets/c85aba54-dcb3-45be-b1bd-271d579da6fc.xml
0/assets/cc83aec7-e835-4b20-acbd-e40eac6764f2.xml 0/assets/ccd5048b-bdba-47b7-8658-9f8bbbcec7fb.xml 4h0/assets/cd103e5b-9da9-438d-a9b8-ed96384a17f2.xml a0/assets/d42aa5c6-4859-4f78-b001-dc067151521b.xml }0/assets/d43f0fad-14d0-4def-8440-631d6e8fe905.xml m0/assets/d857a0e4-9ae0-4ee0-84a1-13100e8e5948.xml ~0/assets/d9626188-57c8-49b1-ad44-66e75119a5f9.xml }i0/assets/dc5c6bc1-9537-456d-b168-faf78a66554f.xml fm0/assets/dd07bae3-3af0-469b-adc8-84f78f4169e8.xml S 0/assets/e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2.xml q0/assets/e98f04c7-99c8-4816-a640-da8e73a14db3.xml w{0/assets/ec590a1c-d105-4cf9-bf83-6606624c33db.xml rW0/assets/ed344be2-ee6d-4a37-ac31-4f0b9763d04b.xml IX0/assets/ee8441ab-55b4-4ce3-b658-d4e28320a010.xml !U0/assets/f19cbe6e-7235-4613-90d0-6f7a3e8a6093.xml vh0/assets/f4d3d872-6514-49fd-b8ed-1d725f74f0c1.xml ^90/assets/f637c2d4-a8aa-4e7a-b437-86b8e3accc7f.xml A0/assets/f87bdc33-14b4-4832-b190-377f16d7e671.xml X0/assets/f9172bb1-6c9e-4e09-a1cb-6e6912459aee.xml p)0/assets/ffe91987-ce8c-4caa-826a-fb26d9d3f23b.xml g /authfw.h1c
/authfw.H1F
( /authfw.H1T sU /authfw.H1V 2A/authfw_AssetId.H1K Hk/authfw_BestBet.H1K 3k/authfw_LinkTerm.H1K l/authfw_SubjectTerm.H1K
o/relatedAssets/ 7/relatedAssets/35a693e7-9134-418a-9c80-17f6d60c08e6.gif X7/relatedAssets/52c6db15-ed4e-415c-a077-ce2a57486732.gif b7/relatedAssets/64ce07a8-52a2-4d69-a392-2cae596fef27.gif q::DataSpace/NameList <(::DataSpace/Storage/MSCompressed/Content y,::DataSpace/Storage/MSCompressed/ControlData T )::DataSpace/Storage/MSCompressed/SpanInfo L/::DataSpace/Storage/MSCompressed/Transform/List <_::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/ i::DataSpace/Storage/MSCompressed/Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/InstanceData/ResetTable p3::Transform/{8CEC5846-07A1-11D9-B15E-000D56BFE6EE}/ 4Q"4!
vcP=*ES q | U n c o m p r e s s e d M S C o m p r e s s e d FX쌡^
VY LZXC HH <maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Windows Firewall with Advanced Security Properties Page</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure the basic firewall properties for each of the network profiles. You can also use the <maml:ui>IPsec Settings</maml:ui> tab to configure the default values for several IPsec configuration options.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, perform one of the following steps: </maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>In the navigation pane, right-click <maml:ui>Windows Firewall with Advanced Security</maml:ui>, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Select the top node in the navigation pane, and then in the center pane, in the <maml:ui>Overview</maml:ui> section, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Select the top node in the navigation pane, and in the <maml:ui>Actions</maml:ui> pane, click <maml:ui>Properties</maml:ui>.</maml:para></maml:listItem>
</maml:list></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Domain, Private, and Public Profile tabs</maml:title><maml:introduction>
<maml:para>You can configure any profile, even one that is not currently being applied. If you do not alter profile settings, their default values are applied whenever Windows Firewall with Advanced Security uses the profile. We recommend that you enable Windows Firewall with Advanced Security on all three profiles.</maml:para>
<maml:para>You can configure the following settings on each profile tab:</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>State</maml:title><maml:introduction>
<maml:para>State selections determine whether Windows Firewall with Advanced Security uses the profile settings and how the profile handles inbound and outbound network messages.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Firewall state</maml:title><maml:introduction>
<maml:para>Select <maml:ui>On (recommended)</maml:ui> to have Windows Firewall use the settings for this profile to filter network traffic. If you select <maml:ui>Off</maml:ui>, Windows Firewall will not use any of the firewall rules or connection security rules for this profile.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>If you use Group Policy to disable Windows Firewall, or configure Windows Firewall with a rule that allows all inbound network traffic, then Windows Security Center will alert the user that there are security issues that the user should correct. If the user tries to correct the reported problem by clicking <maml:ui>Turn on</maml:ui> in Windows Security Center, then an error will be displayed because Windows Security Center cannot enable Windows Firewall. This can generate unwanted support calls to your help desk. If you are managing the security of the computers in your organization and do not want Windows Security Center to alert the user about security issues, then you can disable the Windows Security Center by using the <maml:ui>Turn on Security Center (Domain PCs only)</maml:ui> Group Policy setting found in <maml:ui> Local Computer Policy\Computer Configuration\Administrative Templates\Windows Components\Security Center</maml:ui>.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>Inbound connections</maml:title><maml:introduction>
<maml:para>This setting determines the behavior for inbound connections that do not match an inbound firewall rule. The default behavior is to block connections unless there are firewall rules to allow the connection. You can choose the following behavior for inbound connections:</maml:para>
<maml:table>
<maml:tableHeader><maml:row>
<maml:entry><maml:para>Selection</maml:para></maml:entry>
<maml:entry><maml:para>Description</maml:para></maml:entry>
</maml:row></maml:tableHeader>
<maml:row>
<maml:entry><maml:para>Block (default)</maml:para></maml:entry>
<maml:entry><maml:para>Blocks all connections that do not have firewall rules that explicitly allow the connection.</maml:para></maml:entry>
</maml:row>
<maml:row>
<maml:entry><maml:para>Block all connections</maml:para></maml:entry>
<maml:entry><maml:para>Blocks all connections, regardless of any firewall rules that explicitly allow the connection.</maml:para></maml:entry>
</maml:row>
<maml:row>
<maml:entry><maml:para>Allow</maml:para></maml:entry>
<maml:entry><maml:para>Allows the connection unless there is a firewall rule that explicitly blocks the connection.</maml:para></maml:entry>
</maml:row>
</maml:table>
</maml:introduction></maml:section>
<maml:section><maml:title>Outbound connections</maml:title><maml:introduction>
<maml:para>This setting determines the behavior for outbound connections that do not match an outbound firewall rule. The default behavior is to allow connections unless there are firewall rules to block the connection. You can choose the following behavior for outbound connections:</maml:para>
<maml:table>
<maml:tableHeader><maml:row>
<maml:entry><maml:para>Selection</maml:para></maml:entry>
<maml:entry><maml:para>Description</maml:para></maml:entry>
</maml:row></maml:tableHeader>
<maml:row>
<maml:entry><maml:para>Block</maml:para></maml:entry>
<maml:entry><maml:para>Blocks all connections that do not have firewall rules that explicitly allow the connection.</maml:para></maml:entry>
</maml:row>
<maml:row>
<maml:entry><maml:para>Allow (default)</maml:para></maml:entry>
<maml:entry><maml:para>Allows the connection unless there is a firewall rule that explicitly blocks the connection.</maml:para></maml:entry>
</maml:row>
</maml:table>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>If you set <maml:ui>Outbound connections</maml:ui> to <maml:ui>Block</maml:ui> and then deploy the firewall policy by using a Group Policy object (GPO), computers that receive it will not receive subsequent Group Policy updates unless you first create and deploy an outbound rule that enables Group Policy to work. Predefined rules for Core Networking include outbound rules that enable Group Policy to work. Ensure that these outbound rules are active, and thoroughly test firewall profiles before deploying the policy.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>Protected network connections</maml:title><maml:introduction>
<maml:para>Use these settings to specify which network adapters are subject to the configuration of this profile. Click <maml:ui>Customize</maml:ui> to display the <maml:navigationLink><maml:linkText>Customize Protected Network Connections for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=a4c3ccd0-9ec1-4da5-982d-6e65877b5db3"></maml:uri></maml:navigationLink> dialog box.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Settings</maml:title><maml:introduction>
<maml:para>Use these settings to configure settings for notifications, unicast response to multicast or broadcast traffic, and Group Policy rule merging. Click <maml:ui>Customize</maml:ui> to display the <maml:navigationLink><maml:linkText>Customize Settings for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=55215ddc-b9aa-4bac-9ec2-d5da5cb3932c"></maml:uri></maml:navigationLink> dialog box.</maml:para></maml:introduction></maml:section>
<maml:section><maml:title>Logging</maml:title><maml:introduction>
<maml:para>Use these settings to configure how Windows Firewall with Advanced Security logs events, how big the log file can grow, and where the log file is located. Click <maml:ui>Customize</maml:ui> to display the <maml:navigationLink><maml:linkText>Customize Logging Settings for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=58a40682-63b1-493a-9d97-940532cbbcd8"></maml:uri></maml:navigationLink> dialog box.</maml:para></maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>IPsec Settings tab</maml:title><maml:introduction>
<maml:para>Use this tab to configure the IPsec default and system-wide settings.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>IPsec defaults</maml:title><maml:introduction>
<maml:para>Use these settings to configure the key exchange, data protection, and authentication methods used by IPsec to help protect network traffic. Click <maml:ui>Customize</maml:ui> to display the <maml:navigationLink><maml:linkText>Customize IPsec Settings</maml:linkText><maml:uri href="mshelp://windows/?id=66011489-1eee-4986-9373-565e557db23b"></maml:uri></maml:navigationLink> dialog box.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>IPsec exemptions</maml:title><maml:introduction>
<maml:para>Use this option to determine whether network traffic containing Internet Control Message Protocol (ICMP) messages are protected by IPsec.</maml:para>
<maml:para>ICMP is commonly used by network troubleshooting tools and procedures. Many network administrators exempt ICMP packets from IPsec protection to ensure that these messages are not blocked.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>This setting exempts ICMP from the IPsec portion of Windows Firewall with Advanced Security only. To ensure that ICMP packets are allowed through Windows Firewall, you must create and enable an inbound rule.</maml:para>
</maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>If you enable file and printer sharing in the Network and Sharing Center, Windows Firewall with Advanced Security automatically enables firewall rules that allow commonly used ICMP packet types. However, this will also enable network features that are not related to ICMP. If you want to enable ICMP only, then create and enable a rule in Windows Firewall to allow inbound ICMP network packets.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>IPsec tunnel authorization</maml:title><maml:introduction>
<maml:para>Use this option when you have a connection security rule that creates an IPsec tunnel mode connection from a remote computer to the local computer, and you want to specify the users and computers that are permitted or denied access to the local computer through the tunnel. Select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui> to display the <maml:navigationLink><maml:linkText>Customize IPsec Tunnel Authorizations</maml:linkText><maml:uri href="mshelp://windows/?id=f637c2d4-a8aa-4e7a-b437-86b8e3accc7f"></maml:uri></maml:navigationLink> dialog box.</maml:para>
<maml:para>The authorizations you specify here are in effect only for those tunnel rules on which the <maml:ui>Apply authorization</maml:ui> option has been selected on the <maml:navigationLink><maml:linkText>Customize IPsec Tunneling Settings</maml:linkText><maml:uri href="mshelp://windows/?id=cd103e5b-9da9-438d-a9b8-ed96384a17f2"></maml:uri></maml:navigationLink> dialog box.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add or Edit IP Addresses</maml:title><maml:introduction><maml:para>Use this dialog box to specify computers by IP address. You can use either Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) addresses. You can also specify an entire subnet.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a firewall rule by using the New Firewall Rule wizard, on the <maml:ui>Scope</maml:ui> page, select <maml:ui>These IP addresses</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing firewall rule, on the <maml:ui>Scope</maml:ui> tab, select <maml:ui>These IP addresses</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a connection security rule by using the Connection Security Rule wizard, on the <maml:ui>Endpoints</maml:ui> page, select <maml:ui>These IP addresses</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing connection security rule, on the <maml:ui>Computers</maml:ui> tab, select <maml:ui>These IP addresses</maml:ui>, and then click <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>This IP address or subnet</maml:title><maml:introduction>
<maml:para>You can specify a single IP address or a subnet for either IPv4 or IPv6 addresses. To specify a subnet, enter the IP address using syntax similar to the following:</maml:para>
<maml:para><maml:codeInline>192.168.1.0/24</maml:codeInline></maml:para>
<maml:para>The number following the forward slash (/) represents the number of bits in the subnet mask. 32 bits are possible. In this example, 24 means that the first three octets are the subnet address and the last octet is the host ID within the subnet. The bits representing the host ID must be 0. The example corresponds to a subnet mask of 255.255.255.0.</maml:para>
<maml:para>For an IPv6 address, use the same syntax. The number after the forward slash represents the number of bits in the subnet mask. 128 bits are possible. The bits representing the host ID must be 0. For example:</maml:para>
<maml:para><maml:codeInline>2001:8e6c:6456:1c99::/64</maml:codeInline></maml:para>
</maml:introduction></maml:section><maml:section><maml:title>This IP address range</maml:title><maml:introduction>
<maml:para>Enter two IP addresses. The lower numbered address must precede the higher numbered address in the range. The range consists of all IP addresses between the beginning and ending IP addresses. The two range endpoints must use the same IP version, either IPv4 or IPv6.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Predefined set of computers</maml:title><maml:introduction>
<maml:para>You can specify one of the following sets of predefined computers:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:ui>Default gateway</maml:ui>. Uses the IP address currently set as the default gateway of the local computer. </maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>WINS servers</maml:ui>. Uses the IP addresses for the computers currently configured to provide WINS services to the local computer.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>DHCP servers</maml:ui>. Uses the IP addresses for the computers currently configured to provide DHCP services to the local computer.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>DNS servers</maml:ui>. Uses the IP addresses for the computers currently configured to provide DNS services to the local computer.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Local subnet</maml:ui>. Uses the IP address and subnet mask of the local computer to dynamically determine addresses that are part of the computer’s local subnet.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Property Page: General Tab</maml:title><maml:introduction>
<maml:para>This tab has general information about the rule, including its name, a description, and whether the rule is enabled.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Name</maml:title><maml:introduction>
<maml:para>Each rule must have a unique name. Do not use the name “all” because that name conflicts with the <maml:phrase>all</maml:phrase> keyword used by the Netsh command-line tool.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Description</maml:title><maml:introduction>
<maml:para>We recommend that you provide a comprehensive description for your connection security rule. Include logical names of affected computers because the rule properties contain IP addresses only.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Enabled</maml:title><maml:introduction>
<maml:para>Select this option to activate the rule. If you clear this option, then the rule is disabled, but not deleted.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Properties Page</maml:title><maml:introduction>
<maml:para>This section describes the tabs that appear on the Connection Security Rule Properties page in Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>General</maml:linkText><maml:uri href="mshelp://windows/?id=0ec58789-26f0-47cd-9f43-aa6e7d52db10"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Computers</maml:linkText><maml:uri href="mshelp://windows/?id=97e94c49-45b2-4af9-bcd8-07fff5c1618f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocols and Ports</maml:linkText><maml:uri href="mshelp://windows/?id=d9626188-57c8-49b1-ad44-66e75119a5f9"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication</maml:linkText><maml:uri href="mshelp://windows/?id=13da39e0-2a32-4ac4-a952-4391ae88c739"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Advanced</maml:linkText><maml:uri href="mshelp://windows/?id=ec590a1c-d105-4cf9-bf83-6606624c33db"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Exempt Computers Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to exempt computers or computer groups from being required to authenticate, regardless of other connection security rules. This rule type is commonly used to grant access to infrastructure computers that this computer must communicate with before authentications can be performed. It is also used for other computers that cannot use the form of authentication you configure for this policy and profile.</maml:para>
<maml:para>Infrastructure computers, such as Active Directory domain controllers, certification authorities (CAs), or DHCP servers, might be allowed to communicate with this computer before authentication can be performed.</maml:para>
<maml:para>To create an authentication exemption rule, you only need to specify the computers or a group or range of IP addresses (computers) and give the rule a name and, optionally, a description.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Authentication Exemption</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, click <maml:ui>Exempt Computers</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Exempt Computers</maml:title><maml:introduction>
<maml:para>On this wizard page, you add one or more computers or computer groups to the list to exempt them from authentication requirements. Click <maml:ui>Add</maml:ui> to specify computers by Internet Protocol version 4 (IPv4) or Internet Protocol version 6 (IPv6) address, subnet, IP address range, or by using one of the predefined IP addresses: default gateway, WINS servers, DHCP servers, DNS servers, or local subnet. The local subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses.</maml:para>
<maml:para>When you click <maml:ui>Add</maml:ui> or <maml:ui>Edit</maml:ui>, the <maml:ui>IP Address</maml:ui> dialog box is displayed.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Although the computers listed on this page are exempt from authentication, they might still be blocked by Windows Firewall unless a firewall rule allows them to connect.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the computers that are exempt, click the <maml:ui>Computers</maml:ui> tab. The setting that indicates that this is an exemption rule appears on the <maml:ui>Authentication</maml:ui> tab. <maml:ui>Authentication mode</maml:ui> is set to <maml:ui>Do not authenticate</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Properties Page: Authentication Tab</maml:title><maml:introduction>
<maml:para>Use this tab of the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box to specify the authentication requirements and protocols that are used to protect network traffic that matches this rule.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click the rule that you want to modify, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Authentication</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Requirements</maml:title><maml:introduction>
<maml:para>Under <maml:ui>Authentication mode</maml:ui>, select one of the following options to indicate whether authentication of network traffic is required or requested.</maml:para>
<maml:table>
<maml:tableHeader><maml:row>
<maml:entry><maml:para>Option</maml:para></maml:entry>
<maml:entry><maml:para>Description</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row><maml:entry><maml:para>Do not authenticate</maml:para></maml:entry>
<maml:entry><maml:para>Select this option to make the rule an authentication exemption rule. Network traffic that matches this rule is not authenticated by Internet Protocol security (IPsec) on this computer. The option is also valid on tunnel mode rules that are created by using the <maml:ui>Custom Configuration</maml:ui> or <maml:ui>Client-to-Gateway</maml:ui> options.</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Request inbound and outbound</maml:para></maml:entry>
<maml:entry><maml:para>Connections are authenticated if possible, but the connections are allowed if authentication fails.</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Require inbound and request outbound</maml:para></maml:entry>
<maml:entry><maml:para>All inbound network connections must be authenticated or they fail. Outbound connections are authenticated if possible, but are allowed if authentication fails. </maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Require inbound and outbound</maml:para></maml:entry>
<maml:entry><maml:para>Only connections that are authenticated are allowed.</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Require inbound and clear outbound</maml:para></maml:entry>
<maml:entry><maml:para>All inbound network connections must be authenticated or they fail. Outbound connections are not authenticated. </maml:para>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>We recommend that you use this setting only when required on an IPsec gateway that must be able to initiate communications with computers that cannot use IPsec on the Internet.</maml:para></maml:alertSet></maml:entry></maml:row>
</maml:table>
</maml:introduction></maml:section><maml:section><maml:title>Method</maml:title><maml:introduction>
<maml:para>Use these settings to configure the type of authentication used by this connection security rule.</maml:para>
<maml:para>For more information about the authentication methods, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para>
<maml:para>If you choose <maml:ui>Advanced</maml:ui>, then you must click <maml:ui>Customize</maml:ui> and add the authentication methods by using the <maml:ui>Customize Advanced Authentication Methods</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page</maml:title><maml:introduction>
<maml:para>This section describes the tabs on the <maml:ui>Firewall Rule Properties</maml:ui> page in Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>General</maml:linkText><maml:uri href="mshelp://windows/?id=5147487b-bb6a-40e4-b8ee-f263c52bee24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Programs and Services</maml:linkText><maml:uri href="mshelp://windows/?id=ee8441ab-55b4-4ce3-b658-d4e28320a010"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocols and Ports</maml:linkText><maml:uri href="mshelp://windows/?id=14f25442-df7f-4c80-9ffc-b01781b2b246"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Scope</maml:linkText><maml:uri href="mshelp://windows/?id=950c636f-f858-4852-8a78-b3222cd57bff"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Advanced</maml:linkText><maml:uri href="mshelp://windows/?id=b8b120da-821c-45f1-86ee-d7303f6b500a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Computers</maml:linkText><maml:uri href="mshelp://windows/?id=ccd5048b-bdba-47b7-8658-9f8bbbcec7fb"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Users</maml:linkText><maml:uri href="mshelp://windows/?id=53df2676-ea86-4670-8f48-b113383a0992"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Protocols and Ports Tab</maml:title><maml:introduction>
<maml:para>Use this tab to specify which protocols and ports in a network packet match this firewall rule.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol type</maml:title><maml:introduction>
<maml:para>Select the protocol whose network traffic you want to filter with this firewall rule. If the protocol you want is not in the list, then select <maml:ui>Custom</maml:ui>, and type the protocol number in <maml:ui>Protocol number</maml:ui>. You can use any protocol number listed by the Internet Assigned Numbers Authority (IANA).</maml:para>
<maml:para>If you specify TCP or UDP in the list, then you can specify the TCP or UDP port numbers in <maml:ui>Endpoint 1 port</maml:ui> and <maml:ui>Endpoint 2 port</maml:ui>.</maml:para>
<maml:para>For a list of the protocols, their protocol numbers and a brief description, see <maml:navigationLink><maml:linkText>Firewall Rule Properties Page: Protocol and Ports Tab</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137823"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137823) in the TechNet Library.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Local port</maml:title><maml:introduction>
<maml:para>If you are using the TCP or UDP protocol type, you can specify the local port by using one of the choices from the drop-down list or by specifying a port or a list of ports. The local port is the port on the computer on which the firewall profile is applied.</maml:para>
<maml:para>The following options are available for inbound rules:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:phrase>All Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option specifies that all of the ports for the selected protocol match the rule. </maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Specific Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option enables the text box where you can type the port numbers you need. Separate port numbers with commas and include ranges by separating the low and high values with a hyphen.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>RPC Endpoint Mapper</maml:phrase>. Available for TCP on inbound rules only. Selecting this option allows the local computer to receive incoming RPC requests on TCP port 135 to the RPC Endpoint Mapper (RPC-EM). A request to the RPC-EM identifies a network service and asks for the port number on which the specified network service is listening. RPC-EM responds with the port number to which the remote computer should send further network traffic for the service. This option also enables RPC-EM to receive RPC over HTTP requests.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>RPC Dynamic Ports</maml:phrase>. Available for TCP on inbound rules only. Selecting this option allows the local computer to receive inbound network packets to ports assigned by the RPC runtime. Ports in the RPC ephemeral range are blocked by Windows Firewall unless assigned by the RPC runtime to a specific RPC network service. Only the program to which the RPC runtime assigned the port can receive inbound traffic on that port.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:alert>Creating rules to allow RPC network traffic by using the RPC Endpoint Mapper and RPC dynamic ports options allows all RPC network traffic. Windows Firewall cannot filter RPC traffic by the universally unique identifier (UUID) of the destination program.</maml:alert><maml:alert>When an application uses RPC to communicate from a client to a server, you must typically create two rules, one for RPC Endpoint Mapper and one for Dynamic RPC.</maml:alert></maml:alertSet>
</maml:listItem>
<maml:listItem><maml:para><maml:phrase>IPHTTPS</maml:phrase>. Available for TCP only. Available under <maml:ui>Local port</maml:ui> for inbound rules. Selecting this option allows the local computer to receive incoming IP over HTTPS (IPTHTTPS) packets from a remote computer. IPHTTPS is a tunneling protocol that supports the embedding of Internet Protocol version 6 (IPv6) packets in IPv4 HTTPS network packets. This allows IPv6 traffic to traverse some IP proxies that do not support IPv6 or some of the other IPv6 transition technologies, such as Teredo and 6to4.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Edge Traversal</maml:phrase>. Available for UDP on inbound rules only. Selecting this option allows the local computer to receive incoming Teredo network packets. Teredo is an IPv4-to-IPv6 transition protocol.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Remote port</maml:title><maml:introduction>
<maml:para>If you are using the TCP or UDP protocol type, you can specify the local port and remote port by using one of the choices from the drop-down list or by specifying a port or a list of ports. The remote port is the port on the computer that is attempting to communicate with the computer on which the firewall profile is applied.</maml:para>
<maml:para>The following options are available for inbound rules:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:phrase>All Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option specifies that all of the ports for the selected protocol match the rule. </maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Specific Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option enables the text box where you can type the port numbers that you need. Separate port numbers with commas and include ranges by separating the low and high values with a hyphen.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>IPHTTPS</maml:phrase>. Available for TCP only. Available under <maml:ui>Remote port</maml:ui> for outbound rules. Selecting this option allows the local computer to send outbound IPTHTTPS packets to a remote computer. IPHTTPS is a tunneling protocol that supports embedding IPv6 packets in IPv4 HTTPS network packets. This allows IPv6 traffic to traverse some IP proxies that do not support IPv6 or some of the other IPv6 transition technologies, such as Teredo and 6to4.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>ICMP Settings</maml:title><maml:introduction>
<maml:para>Click <maml:ui>Customize</maml:ui> to configure settings for Internet Control Message Protocol (ICMP). The <maml:ui>Customize</maml:ui> button is enabled only when you choose the <maml:ui>ICMPv4</maml:ui> or <maml:ui>ICMPv6</maml:ui> protocol types. For more information, see <maml:navigationLink><maml:linkText>Dialog Box: Customize ICMP Settings</maml:linkText><maml:uri href="mshelp://windows/?id=8a0b490a-db5e-420f-8990-d0e30a17bc1a"></maml:uri></maml:navigationLink>.</maml:para></maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Action Page</maml:title><maml:introduction><maml:para>Use this wizard page when creating a firewall rule to specify the action Windows Firewall with Advanced Security will take for incoming or outgoing packets that match the rule criteria.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>This page is available on all rule types. Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Action</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Allow the connection</maml:title><maml:introduction>
<maml:para>Use this option to allow network packets that match all criteria in the firewall rule.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Allow the connection if it is secure</maml:title><maml:introduction>
<maml:para>Use this option to specify that only connections that are protected by Internet Protocol security (IPsec) are allowed. IPsec settings are defined in separate connection security rules. By default, this setting requires both authentication and integrity protection. To configure the requirements, click <maml:ui>Customize</maml:ui>.</maml:para>
<maml:para>When you choose this option, the <maml:ui>Users</maml:ui> and <maml:ui>Computers</maml:ui> pages are automatically added to the wizard. You can use these pages to specify the users or computers to whom you want to grant or deny access, or leave the page blank to allow access to all users and computers. If you choose to specify users or computers, you must use an authentication method that includes user or computer information, as appropriate, because Windows Firewall with Advanced Security will use the authentication method from the connection security rule to match the users and computers you specify. For example, for computers, you can use <maml:ui>Computer (Kerberos V5)</maml:ui> or <maml:ui>Computer Certificate</maml:ui> with certificate-to-account mapping enabled. If you do not specify users or computers, you can use any authentication method.</maml:para>
<maml:para>For more information about how to customize the IPsec requirements for this option, see the <maml:navigationLink><maml:linkText>Customize Allow If Secure Settings</maml:linkText><maml:uri href="mshelp://windows/?id=1a81d9c6-f39f-4835-a00b-11d994247ca9"></maml:uri></maml:navigationLink> dialog box. For more information about restricting access to user or computers, see the <maml:navigationLink><maml:linkText>Users</maml:linkText><maml:uri href="mshelp://windows/?id=c85aba54-dcb3-45be-b1bd-271d579da6fc"></maml:uri></maml:navigationLink> and <maml:navigationLink><maml:linkText>Computers</maml:linkText><maml:uri href="mshelp://windows/?id=5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da"></maml:uri></maml:navigationLink> pages in the wizard.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Block the connection</maml:title><maml:introduction>
<maml:para>Use this option to explicitly block any network packet that matches the firewall rule criteria. The block action takes precedence over the allow action, unless the <maml:ui>Override block rules</maml:ui> option is selected when the firewall rule is created.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can adjust these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui> and <maml:ui>Outbound Rules</maml:ui>. To change these settings, select <maml:ui>Action</maml:ui> on the <maml:ui>General</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Rule Type Page</maml:title><maml:introduction>
<maml:para>You can use the New Connection Security Rule wizard to create Internet Protocol security (IPsec) rules to meet different network security goals. Use this page to select the type of rule that you want to create.</maml:para>
<maml:para>The wizard provides four predefined rule types. You can also create a custom rule. </maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>As a best practice, give each connection security rule a unique name so that you can later use the Netsh command-line tool to manage your rules. Do not name a security rule ”all” because that name conflicts with the <maml:computerOutputInline>all</maml:computerOutputInline> keyword in the <maml:computerOutputInline>netsh</maml:computerOutputInline> command.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>The <maml:ui>Rule Type</maml:ui> page is displayed.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Isolation</maml:title><maml:introduction>
<maml:para>An isolation rule restricts connections based on authentication criteria that you define. For example, you can use this rule type to isolate computers that are joined to your domain from computers that are outside your domain, such as computers on the Internet. If you select this rule type, then the following pages in addition to the <maml:ui>Name</maml:ui> page are enabled in the wizard:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Authentication exemption</maml:title><maml:introduction>
<maml:para>Use this option to create a rule that exempts specified computers from being required to authenticate, regardless of other connection security rules. This rule type is typically used to grant access to infrastructure computers, such as Active Directory domain controllers, certification authorities (CAs), or DHCP servers, that this computer must communicate with before authentication can be performed. It is also used for computers that cannot use the form of authentication you configured for this policy and profile.</maml:para>
<maml:para>If you select this rule type, then the following pages in addition to the <maml:ui>Name</maml:ui> page are enabled in the wizard:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Exempt Computers</maml:linkText><maml:uri href="mshelp://windows/?id=12452b6f-dce5-4515-bfdd-455f08c77e5a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Although the computers are exempt from authentication, network traffic from them might still be blocked by Windows Firewall unless a firewall rule allows them to connect.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Server-to-server</maml:title><maml:introduction>
<maml:para>Use this rule type to authenticate the communications between two specified computers, between two groups of computers, between two subnets, or between a specified computer and a group of computers or a subnet. You might use this rule to authenticate the traffic between a database server and a business-layer computer, or between an infrastructure computer and another server. This rule is similar to the isolation rule type, but the <maml:ui>Endpoints</maml:ui> page will be displayed so that you can identify the computers that are affected by this rule.</maml:para>
<maml:para>If you select this rule type, then the following pages in addition to the <maml:ui>Name</maml:ui> page are enabled in the wizard:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Endpoints</maml:linkText><maml:uri href="mshelp://windows/?id=8039b8d4-e87b-4aac-9c09-6a34cc73f1b6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Tunnel</maml:title><maml:introduction>
<maml:para>Use this rule type to secure communications between two computers by using tunnel mode, instead of transport mode, in IPsec. Tunnel mode embeds the entire network packet in a network packet that is routed between two defined endpoints. For each endpoint, you can specify a single computer that receives and consumes the network traffic sent through the tunnel, or you can specify a gateway computer that connects to a private network onto which the received traffic is routed after the receiving tunnel endpoint extracts it from the tunnel.</maml:para>
<maml:para>If you select this rule type, then the following pages in addition to the <maml:ui>Name</maml:ui> page are enabled in the wizard:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Type</maml:linkText><maml:uri href="mshelp://windows/?id=710fa446-c600-4691-ae28-37a9824fb95d"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Endpoints</maml:linkText><maml:uri href="mshelp://windows/?id=85c69539-f0c0-474c-9860-d220293ab2d6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Custom</maml:title><maml:introduction>
<maml:para>Use this rule type to create a rule that requires special settings. This option enables all of the wizard pages except those that are used only to create tunnel rules.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Endpoints</maml:linkText><maml:uri href="mshelp://windows/?id=8039b8d4-e87b-4aac-9c09-6a34cc73f1b6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocols and Ports</maml:linkText><maml:uri href="mshelp://windows/?id=e98f04c7-99c8-4816-a640-da8e73a14db3"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Overview of Windows Firewall with Advanced Security</maml:title><maml:introduction></maml:introduction><maml:content><maml:sections><maml:section address="bkmk_WhatisWindowsFirewallwithAdvancedSecurity"><maml:title>What is Windows Firewall with Advanced Security?</maml:title><maml:introduction>
<maml:para>Windows Firewall with Advanced Security combines a host firewall and Internet Protocol security (IPsec). Unlike a perimeter firewall, Windows Firewall with Advanced Security runs on each computer running this version of Windows and provides local protection from network attacks that might pass through your perimeter network or originate inside your organization. It also provides computer-to-computer connection security by allowing you to require authentication and data protection for communications.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>Windows Firewall with Advanced Security is designed for use by IT administrators who need to manage network security in an enterprise environment. It is not intended for use in home networks. Home users should consider using the Windows Firewall program available in Control Panel instead.</maml:para></maml:alertSet>
<maml:para>Windows Firewall with Advanced Security is a stateful firewall that inspects and filters all packets for IP version 4 (IPv4) and IP version 6 (IPv6) traffic. In this context, filter means to allow or block network traffic by processing it through administrator-defined rules. By default, incoming traffic is blocked unless it is a response to a request by the host (solicited traffic) or it is specifically allowed (that is, a firewall rule has been created to allow the traffic). You can configure Windows Firewall with Advanced Security to explicitly allow traffic by specifying a port number, application name, service name, or other criteria.</maml:para>
<maml:para>Windows Firewall with Advanced Security also allows you to request or require that computers authenticate each other before communicating, and to require the use of data integrity or data encryption when communicating.</maml:para>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>Overview of Windows Firewall with Advanced Security</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137800"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137800) in the TechNet Library.</maml:para>
</maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Allow If Secure Settings</maml:title><maml:introduction>
<maml:para>When you select <maml:ui>Allow the connection if it is secure</maml:ui> in a firewall rule, you are specifying that the network packets must be protected by Internet Protocol security (IPsec) or the packet does not match the rule. If you click <maml:ui>Customize</maml:ui> next to that option, you can configure these options that allow you to specify the type of IPsec protection that is required.</maml:para>
<maml:para>You must select one of the first three options described below. The last option, <maml:ui>Override block rules</maml:ui>, can be selected independently of the other options.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a firewall rule by using the New Firewall Rule wizard, on the <maml:ui>Action</maml:ui> page, click <maml:ui>Allow the connection if it is secure</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing firewall rule, on the <maml:ui>General</maml:ui> tab, select <maml:ui>Allow the connection if it is secure</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Allow the connection if it is authenticated and integrity-protected</maml:title><maml:introduction>
<maml:para>This is the default option. Use this option to require that all matching network packets use both IPsec authentication and integrity algorithms as defined in a separate connection security rule. If a network packet matching all other criteria is neither authenticated nor protected with an integrity algorithm, then it does not match this rule and is blocked.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This setting is supported when applied to computers running Windows Vista or later versions of Windows.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Require the connection to be encrypted</maml:title><maml:introduction>
<maml:para>Use this option to require that all matching network packets use data encryption as defined in a separate connection security rule. If a network packet matching all other criteria is not encrypted, then it does not match this rule and is blocked. When this option is enabled, Windows Firewall with Advanced Security uses the settings on the <maml:ui>Customize Data Protection Settings</maml:ui> dialog box.</maml:para>
</maml:introduction><maml:sections>
<maml:section><maml:title>Allow the computers to dynamically negotiate encryption</maml:title><maml:introduction>
<maml:para>This option is available for inbound rules only. Use this option to allow the network connection, after authentication succeeds, to send and receive unencrypted network traffic while the encryption algorithms are negotiated.</maml:para>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>While encryption is being negotiated, the network traffic is sent as clear text. Do not specify this option if the network traffic sent over the connection during this period is too sensitive for plain text transmission.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections></maml:section><maml:section><maml:title>Allow the connection to use null encapsulation</maml:title><maml:introduction>
<maml:para>Use this option to require that all matching network packets use IPsec authentication, but do not require integrity or encryption protection. We recommend that you use this option only when you have network equipment or software that is not compatible with either the Encapsulating Security Payload (ESP) or Authentication Header (AH) integrity protocols.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This setting is supported when applied to computers running Windows 7 or Windows Server 2008 R2. It does not apply to computers running earlier versions of Windows.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Override block rules</maml:title><maml:introduction>
<maml:para>Use this option to allow network packets that match this firewall rule to override any block firewall rules. This option is referred to as <maml:newTerm>authenticated bypass</maml:newTerm>. Normally, rules that explicitly block connections have priority over rules that allow connections. If you use this option, the connection is allowed even if another rule would block the connection. You are effectively stating that network traffic that matches this rule is allowed because it is authenticated as coming from an authorized and trusted user or computer. </maml:para>
<maml:para>This option is typically used to allow trusted programs, such as network vulnerability scanners and other networking tools, to run without restrictions. Although a typical firewall configuration does and should block network traffic from such devices, you can create a rule that identifies authorized computers. The <maml:ui>Override block rules</maml:ui> option allows traffic from these authorized computers only. If you do not use this option, any block firewall rules that match the same firewall rule criteria will take precedence, and the connections will be blocked. </maml:para>
<maml:para>If you select this option, you must specify at least one computer or computer group for authorization on the <maml:ui>Computers</maml:ui> page of the New Firewall Rule wizard or the <maml:ui>Computers</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> dialog box.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>If you configure the firewall operational state to <maml:ui>Block all connections</maml:ui> on the <maml:ui>Windows Firewall with Advanced Security Properties</maml:ui> dialog box, then all network traffic is blocked even if this option is set.</maml:para></maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitored Firewall Rules Properties Page</maml:title><maml:introduction>
<maml:para>This section describes the tabs on the <maml:ui>Firewall Rule Properties</maml:ui> page for rules displayed in <maml:ui>Monitoring</maml:ui> in Windows Firewall with Advanced Security. </maml:para>
<maml:procedure><maml:title>To get to this page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Firewall</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the firewall rule that you want to examine.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Only active firewall rules, those assigned to currently active network profiles, are displayed in <maml:ui>Monitoring</maml:ui>. </maml:para></maml:alertSet>
<maml:para>For a description of each tab on the property page, see the following topics:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>General</maml:linkText><maml:uri href="mshelp://windows/?id=52a543f3-3baa-42d9-8614-25293d0e3f62"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Programs and Ports</maml:linkText><maml:uri href="mshelp://windows/?id=99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Advanced</maml:linkText><maml:uri href="mshelp://windows/?id=d857a0e4-9ae0-4ee0-84a1-13100e8e5948"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add or Edit Integrity Algorithms</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure a data integrity algorithm offer that is available when negotiating quick mode security associations. You must specify both the protocol and the algorithm used to protect the integrity of the data in the network packet.</maml:para>
<maml:para>Internet Protocol security (IPsec) provides integrity by calculating a hash generated from the data in the network packet. The hash is then cryptographically signed (encrypted) and embedded in the IP packet. The receiving computer uses the same algorithm to calculate the hash and compares its result to the hash that is embedded in the received packet. If it matches, then the information received is exactly the same as the information sent, and the packet is accepted. If it does not match, then the packet is dropped.</maml:para>
<maml:para>Using an encrypted hash of the transmitted message makes it computationally infeasible to change the message without causing a mismatch of the hash. This is critical when data is exchanged over an unsecured network, such as the Internet, because it provides a way to know that the message was not changed during transit.</maml:para>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Data protection (Quick Mode)</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Data integrity</maml:ui>, select an algorithm combination from the list, and click <maml:ui>Edit</maml:ui> or <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol</maml:title><maml:introduction>
<maml:para>The following protocols are used to embed the integrity information into an IP packet.</maml:para>
</maml:introduction>
<maml:sections><maml:section><maml:title>ESP (recommended)</maml:title><maml:introduction>
<maml:para>ESP provides authentication, integrity, and anti-replay protection for the IP payload. ESP used in transport mode does not sign the entire packet. Only the IP payload, not the IP header, is protected. ESP can be used alone or in combination with AH. With ESP, the hash calculation includes the ESP header, trailer, and payload only. ESP can optionally provide data confidentiality services by encrypting the ESP payload with one of several supported encryption algorithms. Packet replay services are provided through the inclusion of a sequence number for each packet.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>AH</maml:title><maml:introduction>
<maml:para>AH provides authentication, integrity, and anti-replay for the entire packet (both the IP header and the data payload carried in the packet). It does not provide confidentiality, which means that it does not encrypt the data. The data is readable, but protected from modification. Some fields that are allowed to change in transit are excluded from the hash calculation. Packet replay services are provided through the inclusion of a sequence number for each packet.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>The AH protocol is not compatible with network address translation (NAT) because NAT devices change information in some of the packet headers that are included in the integrity hash. To allow IPsec-based traffic to pass through a NAT device, you must use ESP and ensure that NAT Traversal (NAT-T) is enabled on the IPsec peer computers.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>Null encapsulation</maml:title><maml:introduction>
<maml:para>Null encapsulation specifies that you do not want to use any integrity or encryption protection on your network traffic. Authentication is still performed as required by the connection security rules, but no other protection is provided to the network packets that are exchanged through this security association.</maml:para>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>Because this option provides no integrity or confidentiality protection of any kind, we recommend that you use it only if you must support software or network devices that are not compatible with ESP or AH.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections></maml:section><maml:section><maml:title>Algorithms</maml:title><maml:introduction>
<maml:para>The following integrity algorithms are available to computers running this version of Windows. Some of these algorithms are not available on computers running other versions of Windows. If you must establish IPsec-protected connections with a computer running an earlier version of Windows, then you must include algorithm options that are compatible with the earlier version.</maml:para>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?LinkID=129230).</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>AES-GMAC 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GMAC 192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GMAC 128</maml:para></maml:listItem>
<maml:listItem><maml:para>SHA-1</maml:para></maml:listItem>
<maml:listItem><maml:para>MD5</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>MD5 is no longer considered secure and should only be used for testing purposes or in cases in which the remote computer cannot use a more secure algorithm. It is provided for backward compatibility only.</maml:para></maml:alertSet></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Key lifetimes</maml:title><maml:introduction>
<maml:para>Lifetime settings determine when a new key is generated. Key lifetimes allow you to force the generation of a new key after a specified time interval or after a specified amount of data has been transmitted. For example, if the communication takes 100 minutes and you specify a key lifetime of 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This key regeneration is for quick mode data integrity only. These settings do not affect the key lifetime settings for main mode key exchange. </maml:para></maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Minutes</maml:title><maml:introduction>
<maml:para>Use this setting to configure how long the key used in the quick mode security association lasts, in minutes. After this interval, a new key will be generated. Subsequent communications will use the new key.</maml:para>
<maml:para>The maximum lifetime is 2,879 minutes (48 hours). The minimum lifetime is 5 minutes. We recommend that you rekey only as frequently as your risk analysis requires. Excessively frequent rekeying can impact performance.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>KB</maml:title><maml:introduction>
<maml:para>Use this setting to configure how many kilobytes (KB) of data are sent using the key. After this threshold is reached, the counter is reset, and the key is regenerated. Subsequent communications will use the new key.</maml:para>
<maml:para>The maximum lifetime is 2,147,483,647 KB. The minimum lifetime is 20,480 KB. We recommend that you rekey only as frequently as your risk analysis requires. Excessively frequent rekeying can impact performance.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard</maml:title><maml:introduction>
<maml:para>This section describes the Connection Security Rule Wizard pages in Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Rule Type</maml:linkText><maml:uri href="mshelp://windows/?id=18ddcbbd-4939-492c-a716-f1fccc468c18"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Endpoints</maml:linkText><maml:uri href="mshelp://windows/?id=8039b8d4-e87b-4aac-9c09-6a34cc73f1b6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Requirements</maml:linkText><maml:uri href="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocols and Ports</maml:linkText><maml:uri href="mshelp://windows/?id=e98f04c7-99c8-4816-a640-da8e73a14db3"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Exempt Computers</maml:linkText><maml:uri href="mshelp://windows/?id=12452b6f-dce5-4515-bfdd-455f08c77e5a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Type</maml:linkText><maml:uri href="mshelp://windows/?id=710fa446-c600-4691-ae28-37a9824fb95d"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Endpoints – Custom Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=85c69539-f0c0-474c-9860-d220293ab2d6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Endpoints – Client-to-Gateway</maml:linkText><maml:uri href="mshelp://windows/?id=63138fa3-9f09-4684-89cb-c44306ee3763"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Tunnel Endpoints – Gateway-to-Client</maml:linkText><maml:uri href="mshelp://windows/?id=70d0c763-d3a3-486d-9f91-e213831f2485"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Protocol and Ports Page - Custom Rule Type</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify which protocols and ports specified in a network packet match this firewall rule.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select either <maml:ui>Port</maml:ui> or <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Protocol and Ports</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol type</maml:title><maml:introduction>
<maml:para>Select the protocol whose network traffic you want to filter with this firewall rule. If the protocol you want is not in the list, select <maml:ui>Custom</maml:ui>, and then type the protocol number in <maml:ui>Protocol number</maml:ui>.</maml:para>
<maml:para>If you specify TCP or UDP, then you can specify the TCP or UDP port numbers in <maml:ui>Endpoint 1 port</maml:ui> and <maml:ui>Endpoint 2 port</maml:ui>.</maml:para>
<maml:para>For a list of the protocols, their protocol numbers, and a brief description, see <maml:navigationLink><maml:linkText>Firewall Rule Properties Page: Protocol and Ports Tab</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137823"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137823) in the TechNet Library.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Protocol number</maml:title><maml:introduction>
<maml:para>When you select a protocol type, the corresponding protocol identification number is automatically displayed in <maml:ui>Protocol number</maml:ui> and is read-only. If you select <maml:ui>Custom</maml:ui> for <maml:ui>Protocol type</maml:ui>, then type the protocol identification number in <maml:ui>Protocol number</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Local port</maml:title><maml:introduction>
<maml:para>If you are using the TCP or UDP protocol type, you can specify the local port by using one of the choices from the drop-down list, or by specifying a port or a list of ports. The local port is the port on the computer on which the firewall profile is applied.</maml:para>
<maml:para>The following options are available for inbound rules:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:phrase>All Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option specifies that all of the ports for the selected protocol match the rule.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Specific Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option enables the text box where you can type the port numbers that you need. Separate port numbers with commas, and include ranges by separating the low and high values with a hyphen.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>RPC Endpoint Mapper</maml:phrase>. Available for TCP on inbound rules only. Selecting this option allows the local computer to receive incoming remote procedure call (RPC) requests on TCP port 135 to the RPC Endpoint Mapper (RPC-EM). A request to the RPC-EM identifies a network service and asks for the port number on which the specified network service is listening. RPC-EM responds with the port number to which the remote computer should send future network traffic for the service. This option also enables RPC-EM to receive RPC over HTTP requests.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>RPC Dynamic Ports</maml:phrase>. Available for TCP on inbound rules only. Selecting this option allows the local computer to receive inbound network packets to ports assigned by the RPC runtime. Ports in the RPC ephemeral range are blocked by Windows Firewall unless assigned by the RPC runtime to a specific RPC network service. Only the program to which the RPC runtime assigned the port can receive inbound traffic on that port.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:alert>Creating rules to allow RPC network traffic by using the <maml:ui>RPC Endpoint Mapper</maml:ui> and <maml:ui>RPC Dynamic Ports</maml:ui> options allows all RPC network traffic. Windows Firewall cannot filter RPC traffic by the universally unique identifier (UUID) of the destination program.</maml:alert><maml:alert>When an application uses RPC to communicate from a client to a server, you must typically create two rules, one for RPC Endpoint Mapper and one for Dynamic RPC.</maml:alert></maml:alertSet>
</maml:listItem>
<maml:listItem><maml:para><maml:phrase>IPHTTPS</maml:phrase>. Available for TCP only. Available under <maml:ui>Local port</maml:ui> for inbound rules only. Selecting this option allows the local computer to receive incoming IP over HTTPS (IPTHTTPS) packets from a remote computer. IPHTTPS is a tunneling protocol that supports embedding Internet Protocol version 6 (IPv6) packets in Internet Protocol version 4 (IPv4) HTTPS network packets. This allows IPv6 traffic to traverse some IP proxies that do not support IPv6 or some of the other IPv6 transition technologies, such as Teredo and 6to4.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Edge Traversal</maml:phrase>. Available for UDP on inbound rules only. Selecting this option allows the local computer to receive incoming Teredo network packets. </maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Remote port</maml:title><maml:introduction>
<maml:para>If you are using the TCP or UDP protocol type, you can specify the local port and remote port by using one of the choices from the drop-down list, or by specifying a port or a list of ports. The remote port is the port on the computer that is attempting to communicate with the computer on which the firewall profile is applied.</maml:para>
<maml:para>The following options are available for inbound rules:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:phrase>All Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option specifies that all of the ports for the selected protocol match the rule. </maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Specific Ports</maml:phrase>. Available for both TCP and UDP on inbound and outbound rules. Selecting this option enables the text box where you can type the port numbers that you need. Separate port numbers with commas, and include ranges by separating the low and high values with a hyphen.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>IPHTTPS</maml:phrase>. Available for TCP only. Available under <maml:ui>Remote port</maml:ui> for outbound rules only. Selecting this option allows the local computer to send outbound IPTHTTPS packets to a remote computer. IPHTTPS is a tunneling protocol that supports embedding IPv6 packets in IPv4 HTTPS network packets. This allows IPv6 traffic to traverse some IP proxies that do not support IPv6 or some of the other IPv6 transition technologies, such as Teredo and 6to4.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Internet Control Message Protocol (ICMP) Settings</maml:title><maml:introduction>
<maml:para>If you want to create a rule that allows or blocks ICMP packets, in the <maml:ui>Protocol type</maml:ui> list, select <maml:ui>ICMPv4</maml:ui> or <maml:ui>ICMPv6</maml:ui>, and then click <maml:ui>Customize</maml:ui>. Use the <maml:ui>Customize ICMP Settings</maml:ui> dialog box to configure the settings.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui> and <maml:ui>Outbound Rules</maml:ui>. To change these settings, use the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitored Main Mode Security Associations</maml:title><maml:introduction>
<maml:para>Main mode negotiation establishes a secure channel between two computers by determining a set of cryptographic protection suites, exchanging keying material to establish a shared secret key, and authenticating computer and user identities. A security association (SA) is the information maintained about that secure channel on the local computer so that it can use the information for future network traffic to the remote computer. You can monitor main mode SAs for information like which peers are currently connected to this computer and which protection suite was used to form the SA.</maml:para>
<maml:procedure><maml:title>To get to this view</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, expand <maml:ui>Security Associations</maml:ui>, and then click <maml:ui>Main Mode</maml:ui>. </maml:para></maml:section></maml:sections></maml:step></maml:procedure>
<maml:para>The following information is available in the table view of all main mode SAs. To see the information for a single main mode SA, double-click the SA in the list. </maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Main mode SA information</maml:title><maml:introduction>
<maml:para>You can add, remove, reorder, and sort by these columns in the Results pane:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:ui>Local Address</maml:ui>: The local computer IP address.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Remote Address</maml:ui>: The remote computer or peer IP address.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>1st Authentication Method</maml:ui>: The authentication method used to create the SA.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>1st Authentication Local ID:</maml:ui>: The authenticated identity of the local computer used in first authentication.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>1st Authentication Remote ID</maml:ui>: The authenticated identity of the remote computer used in first authentication.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>2nd Authentication Method</maml:ui>: The authentication method used in the SA.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>2nd Authentication Local ID:</maml:ui>: The authenticated identity of the local computer used in second authentication.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>2nd Authentication Remote ID</maml:ui>: The authenticated identity of the remote computer used in second authentication.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Encryption</maml:ui>: The encryption method used by the SA to secure quick mode key exchanges.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Integrity</maml:ui>: The data integrity method used by the SA to secure quick mode key exchanges.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Key Exchange</maml:ui>: The Diffie-Hellman group used to create the main mode SA.</maml:para></maml:listItem>
</maml:list>
<maml:para>Any user account can be used to complete this procedure.</maml:para>
<maml:procedure><maml:title>To add, remove, or reorder a column</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click in a blank area in the Results pane for the Main Mode folder, select <maml:ui>View</maml:ui>, and then click <maml:ui>Add/Remove Columns</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the <maml:ui>Add/Remove Columns</maml:ui> dialog box, from the <maml:ui>Available columns</maml:ui> list, select the column you want to view, and then click <maml:ui>Add</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>You can also select columns that you do not want to view. From the <maml:ui>Displayed columns</maml:ui> list, click <maml:ui>Remove</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>To reorder the columns, from left to right, select a column in the <maml:ui>Displayed columns</maml:ui> list, and then click <maml:ui>Move Up</maml:ui> or <maml:ui>Move Down</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When you are finished, click <maml:ui>OK</maml:ui>. The view will change to reflect your preferences.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Quick Mode Security Associations</maml:linkText><maml:uri href="mshelp://windows/?id=8c965889-6e37-4ad0-b41d-4f98bed709ad"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitoring Windows Firewall with Advanced Security</maml:title><maml:introduction><maml:para>The <maml:ui>Monitoring</maml:ui> item in the Windows Firewall with Advanced Security MMC snap-in allows you to monitor the active firewall rules and connection security rules on the computer. Policies created using the IP Security Policy snap-in cannot be viewed using Windows Firewall with Advanced Security.</maml:para>
<maml:para>The overview page shows which profiles are active (domain, private, public) and the current settings for each of the active profiles.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Only rules that apply to the currently active profiles are displayed. A rule for another profile might be enabled, but if the profile to which it is assigned is not active, then neither is the rule.</maml:para></maml:alertSet>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>Monitoring Windows Firewall with Advanced Security</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137811"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137811) in the TechNet Library.</maml:para>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Default Settings for Windows Firewall with Advanced Security</maml:title><maml:introduction>
<maml:para>The following tables list the default values for Internet Protocol security (IPsec) settings. </maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Key exchange</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader><maml:row><maml:entry><maml:para>Settings</maml:para></maml:entry><maml:entry><maml:para>Value</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row><maml:entry><maml:para>Key lifetimes</maml:para></maml:entry><maml:entry><maml:para>480 minutes/0 sessions*</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Key exchange algorithm</maml:para></maml:entry><maml:entry><maml:para>Diffie-Hellman Group 2</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Security methods (integrity)</maml:para></maml:entry><maml:entry><maml:para>SHA1</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Security methods (encryption)</maml:para></maml:entry><maml:entry><maml:para>AES-128 (primary)/3-DES (secondary)</maml:para></maml:entry></maml:row>
</maml:table>
<maml:para>*A session limit of zero (0) causes rekeys to be determined only by the <maml:ui>Key lifetime (minutes)</maml:ui> setting.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Data integrity</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader><maml:row><maml:entry><maml:para>Setting</maml:para></maml:entry><maml:entry><maml:para>Value</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row><maml:entry><maml:para>Protocol</maml:para></maml:entry><maml:entry><maml:para>ESP (primary)/AH (secondary)</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Data integrity</maml:para></maml:entry><maml:entry><maml:para>SHA1</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Key lifetimes</maml:para></maml:entry><maml:entry><maml:para>60 minutes/100,000 kilobytes (KB) </maml:para></maml:entry></maml:row>
</maml:table>
</maml:introduction></maml:section><maml:section><maml:title>Data encryption</maml:title><maml:introduction>
<maml:table>
<maml:tableHeader><maml:row><maml:entry><maml:para>Setting</maml:para></maml:entry><maml:entry><maml:para>Value</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row><maml:entry><maml:para>Protocol</maml:para></maml:entry><maml:entry><maml:para>ESP</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Data integrity</maml:para></maml:entry><maml:entry><maml:para>SHA1</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Data encryption</maml:para></maml:entry><maml:entry><maml:para>AES-128 (primary)/3-DES (secondary)</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Key lifetimes</maml:para></maml:entry><maml:entry><maml:para>60 minutes/100,000 KB</maml:para></maml:entry></maml:row>
</maml:table>
</maml:introduction></maml:section><maml:section><maml:title>Authentication method</maml:title><maml:introduction>
<maml:para>Computer Kerberos version 5 authentication is the default authentication method.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How default settings work with Group Policy</maml:title><maml:introduction>
<maml:para>Policies created using the Windows Firewall with Advanced Security snap-in and distributed with Group Policy are applied in this order:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>Highest precedence Group Policy object (GPO).</maml:para></maml:listItem>
<maml:listItem><maml:para>Locally defined policy settings.</maml:para></maml:listItem>
<maml:listItem><maml:para>Service defaults, as shown in the tables in this topic.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=60324d03-97f8-4aa5-864b-af205ebff02b"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: General Tab</maml:title><maml:introduction>
<maml:para>Use Use this tab to name, enable, and specify the action of a firewall rule.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>General</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>General section</maml:title><maml:introduction>
<maml:para>This section contains identifying information about the rule and gives you the ability to enable or disable the rule.</maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Name</maml:title><maml:introduction>
<maml:para>This is the name of the firewall rule. As a best practice, give the firewall rule a unique name. If two rules have the same name, then you cannot easily manage them by using the <maml:phrase>netsh</maml:phrase> commands. Do not use the name “all” for a firewall rule because that is the name of a Netsh command-line tool keyword.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Description (optional)</maml:title><maml:introduction>
<maml:para>This is a description of the rule. Use this to provide information about the rule, such as the rule owner, the rule requester, the purpose of the rule, a version number, or the date of creation.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Enabled</maml:title><maml:introduction>
<maml:para>Select this check box to enable the rule. Enabling a rule causes Windows Firewall with Advanced Security to compare all network packets to the criteria in this rule and to perform the action specified in <maml:ui>Action</maml:ui> when a match is found. Disabling the rule does not delete it, but instead causes Windows Firewall with Advanced Security to stop comparing network packets to the rule.</maml:para>
</maml:introduction></maml:section>
</maml:sections></maml:section><maml:section><maml:title>Action section</maml:title><maml:introduction>
<maml:para>Select the action that Windows Firewall with Advanced Security will take for network packets that match the firewall rule criteria. When you have multiple firewall rules defined, the order in which they are evaluated for a match depends on the action specified in the rule. Firewall rules are evaluated in the following order:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para><maml:phrase>Allow if secure</maml:phrase> with <maml:ui>Override block rules</maml:ui> selected in the <maml:ui>Customize Allow if Secure Settings</maml:ui> dialog box.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Block the connection</maml:phrase>.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Allow the connection</maml:phrase>.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:phrase>Default profile behavior</maml:phrase> (allow or block as specified on the applicable <maml:ui>Profile</maml:ui> tab of the <maml:ui>Windows Firewall with Advanced Security Properties</maml:ui> dialog box).</maml:para>
</maml:listItem></maml:list>
<maml:para>Within each category, rules are evaluated from the most specific to the least specific. A rule that specifies four criteria is selected over a rule that specifies only three criteria. As soon as a network packet matches a rule, its action is triggered, and it is not compared to any additional rules. In other words, even if a network packet matches more than one rule, only the matching rule that is evaluated against the packet first is applied to the packet.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section>
<maml:title>Allow the connection</maml:title><maml:introduction>
<maml:para>Use this option to allow a network packet that matches all criteria in the firewall rule.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Allow the connection if it is secure</maml:title><maml:introduction>
<maml:para>Use this option to specify that only network packets that are protected by Internet Protocol security (IPsec) are allowed. IPsec settings must be defined in separate connection security rules. By default, this setting requires both authentication and integrity to be included, but it does not require encryption. To configure the requirements, click <maml:ui>Customize</maml:ui>, and then select an option on the <maml:ui>Customize Allow If Secure Settings</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Block the connection</maml:title><maml:introduction>
<maml:para>Use this option to explicitly block any network packet that matches the firewall rule criteria. The block action takes precedence over the allow action, unless the <maml:ui>Override block rules</maml:ui> option is selected when the firewall rule is created.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Firewall Rules - General</maml:title><maml:introduction>
<maml:para>This tab shows basic information about an inbound or outbound firewall rule that is being applied to the computer.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Firewall</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the firewall rule you want to examine, and then click the <maml:ui>General</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Local IP address</maml:title><maml:introduction>
<maml:para>This lists the local IP address, range of addresses, or subnet to which the rule applies, as configured on the <maml:ui>Scope</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Remote IP address</maml:title><maml:introduction>
<maml:para>This lists the remote IP address, range of addresses, or subnet to which the rule applies, as configured on the <maml:ui>Scope</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Direction</maml:title><maml:introduction>
<maml:para>This indicates whether the rule is an <maml:ui>Inbound</maml:ui> or <maml:ui>Outbound</maml:ui> rule.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Profile</maml:title><maml:introduction>
<maml:para>This lists the network location profiles, <maml:ui>Domain</maml:ui>, <maml:ui>Private</maml:ui>, <maml:ui>Public</maml:ui> or <maml:ui>All</maml:ui>, to which the rule applies, as configured on the <maml:ui>Advanced</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Firewall Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=20b3aba6-884a-4ef9-8ea7-914e4cd735d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Connection Security Rules - Authentication</maml:title><maml:introduction>
<maml:para>This tab shows basic information about authentication methods used by a connection security rule that is applied to the computer.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Connection Security Rules</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the rule you want to examine, and then select the <maml:ui>Authentication</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Requirements</maml:title><maml:introduction>
<maml:para>This refers to the authentication requirement on connections matching the rule criteria.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>First authentication</maml:title><maml:introduction>
<maml:para>The first and second authentication methods are used during the main mode phase of Internet Protocol security (IPsec) negotiations. For first authentication, you can view the way the two peer computers authenticate, such as through Kerberos version 5, NTLMv2, computer certificates, or another method.</maml:para>
<maml:para>The <maml:ui>Details</maml:ui> column displays information for certificates and preshared keys only. For certificates, it displays the issuer details, whether the certificate was issued by a root or intermediate certification authority (CA), and the certificate signing algorithm. For a preshared key, it displays the key in plain text.</maml:para>
<maml:para>The authentication information displayed can be configured on the <maml:ui>Authentication</maml:ui> tab of the <maml:ui>Connection Security Rules Properties</maml:ui> dialog box.</maml:para></maml:introduction></maml:section><maml:section><maml:title>Second authentication</maml:title><maml:introduction>
<maml:para>For second authentication, you can view the user authentication method, such as Kerberos version 5, NTLMv2, user certificates, or a computer health certificate.</maml:para>
<maml:para>The <maml:ui>Details</maml:ui> column displays information for certificates only. It displays the issuer details, whether the certificate was issued by a root or intermediate CA, and the certificate signing algorithm.</maml:para>
<maml:para>The authentication information that is displayed can be configured on the <maml:ui>Authentication</maml:ui> tab of the <maml:ui>Connection Security Rules Properties</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Connection Security Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=9d81b178-5fef-4b23-9dc7-e85f20bbf5d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Users Tab</maml:title><maml:introduction>
<maml:para>Use these settings to specify which users or user groups can connect to the local computer.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>These options are only available when the firewall rule action is set to <maml:ui>Allow the connection if it is secure</maml:ui>. To be considered secure, the network traffic must be protected by a connection security rule that requires authentication by using a method that includes user identification information, such as Kerberos version 5, NTLMv2, or a certificate with certificate-to-account mapping enabled.</maml:para></maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This tab is displayed for inbound rules only; is not available for outbound rules.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>Users</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Authorized users</maml:title><maml:introduction>
<maml:para>Use this section to identify the user or group accounts that are allowed to make the connection specified by the rule.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from these users</maml:title><maml:introduction>
<maml:para>Select <maml:ui>Only allow connections from these users</maml:ui> to specify which users can connect to this computer. Network traffic that is not authenticated as coming from a user on this list is blocked by Windows Firewall.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box.</maml:para>
<maml:para>To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify user or group accounts that might be listed in <maml:ui>Authorized users</maml:ui>, possibly because the user or group account is a member of a group, but whose network traffic must be blocked by Windows Firewall. For example, User A is a member of Group B. Group B is included in <maml:ui>Authorized users</maml:ui>, so network traffic authenticated as coming from a user that is a member of Group B is allowed. However, by placing User A in the <maml:ui>Exceptions</maml:ui> list, network traffic authenticated as being from User A is not processed by this rule, and so is blocked by the default firewall behavior unless some other rule allows the traffic.</maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Skip this rule for connections from these users</maml:title><maml:introduction>
<maml:para>Select <maml:ui>Skip this rule for connections from these users</maml:ui> to specify users or groups whose network traffic is an exception to this rule. Network traffic that is authenticated as coming from a user in this list is not processed by the rule, even if the user is also in the <maml:ui>Authorized users</maml:ui> list.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box.</maml:para>
<maml:para>To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Settings for a Firewall Profile</maml:title><maml:introduction>
<maml:para>Use these options to define who can make changes to Windows Firewall properties and profiles.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>From the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Select the tab that corresponds to the firewall profile you want to configure.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Settings</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Display a notification when a program is blocked</maml:title><maml:introduction>
<maml:para>Select this option to have Windows Firewall with Advanced Security display a notification to the user when a program is blocked from receiving inbound connections. The notification appears when all of the following conditions are true: </maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>This option is selected.</maml:para></maml:listItem>
<maml:listItem><maml:para>There is no existing block or allow rule for this program. If a block rule exists, then the program is blocked without displaying the notification to the user.</maml:para></maml:listItem>
<maml:listItem><maml:para>The program is blocked by the default behavior of Windows Firewall.</maml:para></maml:listItem>
</maml:list>
<maml:para>The user is given the option to unblock the program, as long as the user has network operator or administrator permissions. Selecting the option to unblock the program automatically creates an inbound program rule for the program that was blocked.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Allow unicast response to multicast or broadcast requests</maml:title><maml:introduction>
<maml:para>This option is useful if you need to control whether this computer receives unicast responses to its outgoing multicast or broadcast messages. If you enable this setting, and this computer sends multicast or broadcast messages to other computers, Windows Firewall with Advanced Security waits as long as 4 seconds for unicast responses from the other computers and then blocks all later responses. If you disable this setting, and this computer sends a multicast or broadcast message to other computers, Windows Firewall with Advanced Security blocks the unicast responses sent by those other computers.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Rule merging</maml:title><maml:introduction>
<maml:para>Use these options when using Group Policy to configure firewall and connection security rules on the local computer. Disabling the options prevents a local user with network operator or administrator permissions from creating firewall or connection security rules that might conflict with the rules deployed by Group Policy.</maml:para>
</maml:introduction>
<maml:sections><maml:section><maml:title>Allow local firewall rules</maml:title><maml:introduction>
<maml:para>Select this option when, in addition to firewall rules applied by Group Policy that are specific to this computer, you want to allow administrators to be able to create and apply local firewall rules on this computer. When you clear this option, administrators can still create rules, but locally defined rules are not applied. This setting is available only when you are configuring the policy through Group Policy.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Allow local connection security rules</maml:title><maml:introduction>
<maml:para>Select this option when, in addition to connection security rules applied by Group Policy that are specific to this computer, you want to allow administrators to create and apply local connection security rules on this computer. When you clear this option, administrators can still create rules, but locally defined rules are not applied. This setting is available only when configuring the policy through Group Policy.</maml:para>
</maml:introduction></maml:section>
</maml:sections></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard</maml:title><maml:introduction>
<maml:para>This section describes the pages on the Inbound and Outbound Firewall Rule Wizard in Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Rule Type</maml:linkText><maml:uri href="mshelp://windows/?id=dc5c6bc1-9537-456d-b168-faf78a66554f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Program</maml:linkText><maml:uri href="mshelp://windows/?id=ba442eea-0e40-4936-bb3a-413993267098"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocol and Ports – Port Rule</maml:linkText><maml:uri href="mshelp://windows/?id=b029858f-ef85-4cdd-a29c-06a9457f4365"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Protocol and Ports – Custom Rule</maml:linkText><maml:uri href="mshelp://windows/?id=2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Predefined Rules</maml:linkText><maml:uri href="mshelp://windows/?id=8b29e655-9fb1-4ba5-a701-30812af59d2e"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Scope</maml:linkText><maml:uri href="mshelp://windows/?id=cc83aec7-e835-4b20-acbd-e40eac6764f2"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Action</maml:linkText><maml:uri href="mshelp://windows/?id=1826c5b4-7aa9-419a-a211-07542a5dcf1a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Users</maml:linkText><maml:uri href="mshelp://windows/?id=c85aba54-dcb3-45be-b1bd-271d579da6fc"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Computers</maml:linkText><maml:uri href="mshelp://windows/?id=5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Profile</maml:linkText><maml:uri href="mshelp://windows/?id=98690952-0b7a-4b1f-bbee-3db1fa381f4f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Logging Settings for a Firewall Profile</maml:title><maml:introduction>
<maml:para>Windows Firewall with Advanced Security can be configured to log events that indicate the successes and failures of its processes. The logging settings involve two groups of settings: settings for the log file itself and settings that determine which events the file will record. The settings can be configured separately for each of the firewall profiles.</maml:para>
<maml:para>You can specify where the log file will be created, how big the file can grow, and whether you want the log file to record information about dropped packets, successful connections, or both.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>From the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Select the tab that corresponds to the firewall profile for which you want to configure logging.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Logging</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Name</maml:title><maml:introduction>
<maml:para>Enter the path and name of the file in which you want Windows Firewall to write its log information. If you are configuring a Group Policy object (GPO) for deployment to multiple computers, use the available environment variables, such as %windir%, to ensure that the location is correct for each computer on your network.</maml:para>
<maml:para>Just specifying a file location does not start logging. You must also select one of the two check boxes to log dropped packets or successful connections.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>If you are configuring the setting for a computer that is running Windows Vista or later version of Windows, and you specify a location other than the default, you must ensure that the Windows Firewall service has permissions to write to that location.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To grant write permissions for the log folder to the Windows Firewall service</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Locate the folder that you specified for the logging file, right-click it, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Security</maml:ui> tab, and then click <maml:ui>Edit</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Add</maml:ui>, in <maml:ui>Enter object names to select</maml:ui>, type <maml:userInput>NT SERVICE\mpssvc</maml:userInput>, and then click <maml:ui>OK</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the <maml:ui>Permissions</maml:ui> dialog box, verify that MpsSvc has <maml:ui>Write</maml:ui> access, and then click <maml:ui>OK</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section><maml:title>Size limit</maml:title><maml:introduction>
<maml:para>Specify the maximum size to which the file is permitted to grow. The value must be between 1 and 32,767 kilobytes (KB).</maml:para>
<maml:para>When the specified size limit is reached, Windows Firewall with Advanced Security closes the log file and renames it by adding ".old" to the end of the file name. It then creates and uses a new log file that has the original log file name. Only two files are kept at a time. If the second file reaches the maximum size, then it is renamed by adding “.old”, and the original “.old” file is discarded.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Log dropped packets</maml:title><maml:introduction>
<maml:para>Use this option to log when Windows Firewall with Advanced Security discards an inbound packet for any reason. The log records why and when the packet was dropped. Look for entries with the word <maml:ui>DROP</maml:ui> in the <maml:ui>action</maml:ui> column of the log.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Log successful connections</maml:title><maml:introduction>
<maml:para>Use this option to log when Windows Firewall with Advanced Security allows an inbound connection. The log records why and when the connection was formed. Look for entries with the word <maml:ui>ALLOW</maml:ui> in the <maml:ui>action</maml:ui> column of the log.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Event log</maml:title><maml:introduction>
<maml:para>The Windows Firewall with Advanced Security operational event log is another resource you can use to view Windows Firewall policy changes. The operational log is always on and contains events for both firewall rules and connection security rules. </maml:para>
<maml:procedure><maml:title>To view the Windows Firewall with Advanced Security event log</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Open Event Viewer. Click <maml:ui>Start</maml:ui>, click <maml:ui>Administrative Tools</maml:ui>, and then click <maml:ui>Event Viewer</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the navigation pane, expand <maml:ui>Applications and Services Logs</maml:ui>, expand <maml:ui>Microsoft</maml:ui>, expand <maml:ui>Windows</maml:ui>, and then expand <maml:ui>Windows Firewall with Advanced Security</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click either <maml:ui>ConnectionSecurity</maml:ui>, <maml:ui>ConnectionSecurityVerbose</maml:ui>, <maml:ui>Firewall</maml:ui>, or <maml:ui>FirewallVerbose</maml:ui>. The logs marked “verbose” are not enabled by default. To enable them, in <maml:ui>Actions</maml:ui>, click <maml:ui>Enable Log</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Interface Types</maml:title><maml:introduction>
<maml:para>Use this dialog box to specify to which interface types the rule is applied. You can specify the local area network (that is, wired network adapters), wireless network adapters, remote access connections, or all network connection types.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, double-click the firewall rule you want to modify, and then click the <maml:ui>Advanced</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Interface types</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>All interface types</maml:title><maml:introduction>
<maml:para>The rule applies to communications sent through any of the network connections that you have configured on the computer.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>These interface types</maml:title><maml:introduction>
<maml:para>The rule applies to communications sent through only the network connections types selected in the box. You can select one or a combination of the types.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Local area network</maml:title><maml:introduction>
<maml:para>The rule applies only to communications sent through wired local area network (LAN) connections that you have configured on the computer.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Remote access</maml:title><maml:introduction>
<maml:para>The rule applies only to communications sent through remote access, such as a virtual private network (VPN) connection or dial-up connection that you have configured on the computer.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Wireless</maml:title><maml:introduction>
<maml:para>The rule applies only to communications sent through wireless network adapters that you have configured on the computer.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Computers Page</maml:title><maml:introduction>
<maml:para>For inbound rules, use these settings to specify which computers or computer groups can connect to the local computer. For outbound rules, use these settings to specify the computers or computer groups to which this computer can connect.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>To use these options, the firewall rule action must be set to <maml:ui>Allow the connection if it is secure</maml:ui>. To be considered secure, the network traffic must be protected by a connection security rule that requires authentication by using a method that includes computer identification information, such as Kerberos version 5, NTLMv2, or a certificate with certificate-to-account mapping enabled.</maml:para>
</maml:alertSet>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>From the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Action</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Action</maml:ui> page, select <maml:ui>Allow the connection if it is secure</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Computers</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Authorized computers</maml:title><maml:introduction>
<maml:para>Use this section to identify the computer or group accounts that are allowed to make the connection specified by the rule.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from/to these computers</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para>For inbound rules, select <maml:ui>Only allow connections from these computers</maml:ui> to specify which computers can connect to this computer. Network traffic that is not authenticated as coming from a computer on this list is blocked by Windows Firewall.</maml:para></maml:listItem>
<maml:listItem><maml:para>For outbound rules, select <maml:ui>Only allow connections to these computers</maml:ui> to specify the computers to which this computer is allowed to connect. Outbound network traffic sent to computers that cannot be authenticated as a computer on the list is blocked by Windows Firewall.</maml:para></maml:listItem>
</maml:list>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in the <maml:ui>Select Users, Computers and Groups</maml:ui> dialog box. To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify computer or group accounts that might be listed in <maml:ui>Authorized computers</maml:ui>, possibly because the computer or group account is a member of a group, but whose network traffic must be blocked by Windows Firewall. For example, Computer A is a member of Group B. Group B is included in <maml:ui>Authorized computers</maml:ui>, so network traffic authenticated as coming from a computer in the group is allowed. By placing Computer A in the <maml:ui>Exceptions</maml:ui> list, network traffic authenticated as coming from Computer A is not processed by this rule, and so is blocked by the default firewall behavior unless some other rule allows the traffic.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Skip this rule for connections from/to these computers</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para>For inbound rules, select <maml:ui>Skip this rule for connections from these computers</maml:ui> to specify which remote computers are exceptions to this rule.</maml:para></maml:listItem>
<maml:listItem><maml:para>For outbound rules, select <maml:ui>Skip this rule for connections to these computers</maml:ui> to specify the remote computers that are exceptions to this rule.</maml:para></maml:listItem>
</maml:list>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in <maml:ui>Select Users, Computers and Groups</maml:ui> dialog box. To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>. To change these settings, select the <maml:ui>Computers</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Connection Security Rules - General</maml:title><maml:introduction>
<maml:para>This tab shows basic information about a connection security rule that is being applied to the computer.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Connection Security Rules</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the rule you want to examine, and then click the <maml:ui>General</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Endpoint 1 IP Address</maml:title><maml:introduction>
<maml:para>This is the IP address or range of IP addresses of the first endpoint as configured on the <maml:ui>Computers</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page. If no endpoint is specified, <maml:ui>Any</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 1 port</maml:title><maml:introduction>
<maml:para>This is the TCP or UDP port number of the first endpoint computer or group of computers as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page. If no port is specified, <maml:ui>Any</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 2 IP Address</maml:title><maml:introduction>
<maml:para>This is the IP address or range of IP addresses of the second endpoint as configured on the <maml:ui>Computers</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page. If no endpoint is specified, <maml:ui>Any</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 2 port</maml:title><maml:introduction>
<maml:para>This is the TCP or UDP port number of the second endpoint computer or group of computers as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page. If no port is specified, <maml:ui>Any</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Protocol</maml:title><maml:introduction>
<maml:para>This is the protocol as configured by using the <maml:ui>Protocol type</maml:ui> option on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page. If no protocol is specified, <maml:ui>Any</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Profile</maml:title><maml:introduction>
<maml:para>This lists the network location profiles, domain, private or public, to which the rule applies, as configured on the <maml:ui>Advanced</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Connection Security Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=9d81b178-5fef-4b23-9dc7-e85f20bbf5d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Windows Firewall with Advanced Security</maml:title><maml:introduction><maml:para>You can use Windows Firewall with Advanced Security to help you protect the computers on your network. Windows Firewall with Advanced Security includes a stateful firewall that allows you to determine which network traffic is permitted to pass between your computer and the network. It also includes connection security rules that use Internet Protocol security (IPsec) to protect traffic as it travels across the network.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>Windows Firewall with Advanced Security is designed for administrators of a managed network to secure network traffic in an enterprise environment. Home users should use the Windows Firewall program in Control Panel instead. To start the Windows Firewall program, click <maml:ui>Start</maml:ui>, click <maml:ui>Control Panel</maml:ui>, click <maml:ui>System and Security</maml:ui>, and then click <maml:ui>Windows Firewall</maml:ui>. You can access Help for the Windows Firewall program either by pressing the F1 key on the main Windows Firewall page, or by clicking the links found on many of the Windows Firewall dialog boxes.</maml:para></maml:alertSet>
<maml:para>For more information about Windows Firewall with Advanced Security, see <maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security Content Roadmap</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=64342"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=64342) in the Windows Server TechCenter.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Overview of Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=1a70e8bc-19f3-4bd5-bba9-d04c432adbc6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding Firewall Rules</maml:linkText><maml:uri href="mshelp://windows/?id=9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding Connection Security Rules</maml:linkText><maml:uri href="mshelp://windows/?id=e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding Firewall Profiles</maml:linkText><maml:uri href="mshelp://windows/?id=aa9088cb-98f3-4c53-8270-09484edb997a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitoring Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=40413516-c1ab-46b3-b62c-d165b434974b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Default Settings for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=41646515-247f-4ce4-a9fd-600bd90ae773"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configuring Firewall Rules</maml:linkText><maml:uri href="mshelp://windows/?id=f87bdc33-14b4-4832-b190-377f16d7e671"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Resources for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=ffe91987-ce8c-4caa-826a-fb26d9d3f23b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual>GIF89am p , m $ $a$$$,,, 0$0<488< <<@<<<@0@P DDD@@@DHq0L L8La L U$L P U00PPP(U iDYq8<0Y e,]4]8a8am<aDL4eLe}aaa@e }Pi@i8mPmHm Lm yYi@uPqiqyYuPuUu uuuUyUy ey0yyyLaP}}}aaeUeu@ii ]Hqq(Pyʙqiy8}Ε}ay҅qLΉҍҡmҍ֑ҁډU}a֙yڝ֝ډ杶qډꥺލޥޕƶή H*T#JHŋ3jȱǏ4Iɓ(S\Ȗ0cʜIM/oɳϟ!G Jѣ8"]ʴӞ9JJjǨ= @ ]e +1KhӪ x n<X&r]˷_X X#0ٹ= /ycXÕHb̹ 0r!B,8hn da칶QM.XthcG(ݷ++3EYg`|b
,t{ &`\lŏNj }X tՀǝ~u߂ _bktB?dsƴ@$`(ԉ*"M,((=F4!<ZwFG(R } IЍq@E\BV@]N$d.EIzqB\E@^Y^!] rY_eIi(Ry ]1 Ie V=Нq܌ )c1Q表؍j
@IP o%bJ\wZ)P]婩Ӫ\j)rzi묯v{V1(J B*k5-_u+
eu8m5Yr g)^
ˑ TbkJATrLїm|)Ƚ$\߃\O4<s0LU.+G3>/tBBt$O_d.P~Ƭa1uǬk\^c)Ȱhmvi $6R]5duEl@=@ĝc8zy76eYGf^v{k5BAioVtvjLr8}<11Nݹԧw9YKm+S+^ڪڻAQuZPe3|)zߝxJ}cyR|srt;k9ȼ\* ܀^<O {S.I <\dA=H hb] /$M gJ$1Cp@
# сCYp
)B@FfGd2
!34x"dQUI
AZ5\pBY<50cG؏n.KCExo\Q E"B` )SAo,Z{(6@~yPH5Ћ)O~ʙEQ>=W v9G*k)%T&-Y$*$@$$S;%+H5) Zt7-f^t"4QM3P^HilN$,9ď=A&*JJCZcqHaBdV51e2 m%Od\Y B ň^D GK
~bӍT#k)H*RtxrGb ̅0y " q U6zInh P55$Y{[: R0bTOsDZlY jbE#704
Y 4zO`" Țv/1a5O.{!OYX礦\Fc?,h 8Z|s;<pZVn# 6f[o6IoQh#]lj:UqbN`lZv뷿͍6>ahDT߁p# -K(yz։ $ |k"j \,F,)bN4LVOR4P AM?hʯvPF_Ǝ59t{2<]d/l >XE-<?WbKA' 4f`J@exWsBY*._i1 2PrA
2 9"q2 ,m RgIbRŭtcPpLtQsf o3A2|Ӡ6? Wr2FSN.TVMGDK]l(<tA80@ Qlc_TЎ] Sh4J
RV:mnO([r)[t*C 4lhZeOxF~<aֻ@cI3Z%+dSHU&i 9
.-ozgzG\D@Q^+J]1Xةɼ`>Kj*8-p.l GG&V13Bt" NЉN0< Hҕm[D-)#ix<jz@2{E8l}ۉo̽nV Sw\;
(qE [
y!Y `GC9 r O
A^ ^A
hCw?r^*@<իks" 3~Eo !}w+ F2Y&}c8j9+9p'>g w3F7G}gcGB\(kr*v;sR
KuS~
Gwwv>5 v F,$k>8!hg,D+rڳ+F+-c$47
lІU p(m{x?1qg.GI $JR>&.J8t9ppfXXlmfofRxxO*\g6hc8$DU'|wjG# >f(`3(ilX_d
ʨpSG$b/f
p `\70QGfS
0ӐhxPp ϸ 7QQ{T/Ӎ
̠ (``,s`o6Yـt*+
@ l`4 qgi
ۀ
))oG0#0g
+! "i
@
,\ nf8:<ٓA9DɒVD# O{0@lF
]٘)
P{ iyk yp
ېuyow|˰U`iUf-p\)o dg)F
ɖ&C 0\@S"p@ 9
@n(9wi
nv)
@t9A 4)l}
`
( *I
,1k )iP! +f- ٘ P $ڣ0odi J`V9 w = _f} I@ >*Ef@Y1`G0w$ VJ0S P꣤ #ZI
@
)Qpf8p
`75ʜPĐ'nPʨ*P hZ A>p
w:jP&P e~@
P& G9lPp-&phil
ЋfE W\yI @ E n&> ,)I4 E
l 2Y6
dzXz +irp&
l
d mg+
pp \ [pL
\{ @Jе \K`+Y0_y: -Ko' mp 2ɉs
EZ ; fkj"Y0 @
U{=p
Lp 0c K d 0nf {@
`
ޠ P
0w>)
R`9
Z @+*2` HyV
`$ mY`
۰
*Y `{
izCJߛ@4&Pw `;
P ˨po P}a P X r \g$[h+`˒5l -
rz,CL@8P
@wJ
{? r` }{`t\w &$ɜ*/<)@˜@] fR 1 юf*@*=,
P
}sL
Zp˹\` vdfì֊ppZ{pڶ\˭Μ m ׳ܦ5 R PL @|
R 1
УdiMπ̜aݨȍ
zK|ש Qp
YY]` UBM\ p טԷ SY=vk _-ؚ0ō9
@8
?fE
6` n؛ݒ`P@ٓ]P Ĝ̝] pP
FԱx:m-
QmlP\Y}ɍT
rIy=խ`݄gxPۀ=
Qp
A
m} n3lt
P
3vi@N( ) p!
a0}pv@M%S {p
o7@]@ _p! {ՀNNQ>(nx L\rxl}}
}zi> t _~
f| Rn T.蛍
@+0.pZpmJ|wP .
İ|lp m& PЮD]nFQp-n ~g 9N
pd" pܮ K0>p * nP
_*^l0~EY s Z ]0
PF=
ԝ |
>-%(N)
S)i
Ԫ_9Gp _XO .J_ O Xo.'W 1_ (Ӱg<k o?nFՓ
d@ 9 lo+]oK TΒiP/ @dٽ@{O
n(з K1@OD`wZp
O
B &*XQV̸Cʈ4`2@GF =~RHQ5R`@-]SL5mn0-!ɏ]&p ]'(G ETQ'5` AH<^[$E^>yb&
9#UU
"H꙾%PQZ}gj>
π}*Rʔ>:j_k3`kX/, lVg|z x1ck#ciSxōf?]Y:SPRc0mG߇c m]b@>"IM %Efl 9ɢˬ>ަiŀ+-ղa}&-ޫmڰ7R %
/1y3[03R Bd0
}DIe bN\2;[XIad&6jQ 'Q|,K2" ;^ܼ8١J}X)G l!d7<[K 3җ$ D0ͤzEAjgӦ:$P^X,
vFA 5s0`PRe.!4=
1ԲpBAxh أTN'AD4haoA Mqp5 gG4LqqĉdjʝOp2lUg1`0 UvC0@%0$
]P,lft}]G7 ^eY9 2BwߥN;`JX,2vd( TiHy63wW LY UYf9)u^ k7C hj
+h @p
{EIƻYYLNK \,zL(g1a1ue6ۦURR@ J(θ
j4 2 o>0:[iƁYaNHIx"~=jX p4Zy?uF1JcZEntN0Z ba=@xw(G<9s=I=["V)dFT&ATL*["ζAyQE= YF)aXw]Av.4Z."d90X9ë p 8S"O,XEѹ}B=(
RPXÉ@ zX%Pb> FTl*<EEly:aoHak{ 6RrdM!цHtpF6 }b1
VM,i1Yn1RPbTRwR\ P)a _YH/Җt'E }C<@i2L ;!Z`b `tTؕ3ysGl4Y2lf7H:y-'HH}h)cNwn:J|*<ck0 m(dk C|DEn$68=<iG^Ax =S ط (G!7/H ӘBuPCCBԐHCG/R3l PN4 ?:,MbdT{hCJVb ;+M x|㍬F+ZTlh Zc " JPU\դ#E;ltl)gAbGC0U \ ZX C
}}|%67 bLB*ruKA QXq?u͊iQK^KF=ٛX ك/OK_8Gw
apH0Hؠq DopV+Wd lH Q`v- =b>l! g\C
XMDw|c 1{c֧u]k*( PrHbw!2r yZjUy&8'rܙ3>E櫘ɂ9$ {a
L1 +
9=ىXbڙ3Rh;o
~t%mgfI(Ec BF5FHS' b 48d"[kwO Z wZ͆w=4 ], ( <ZVF=X @ẳuB߁8jl1N}wCx[LjG(>ppD|Ui<1bӀ/b x?y >w*c ?mghn}:92yr0 sQ2qz}D>!FEQ rT X:Ix&` Kw BnBC ] ~rt5{OJ x %&XF7I}p!)ofn/isN%EH|- /D _9SoӋe : L6 r@e6p S
U`<ӹАzp8C
>>[ 2 $쀄A/Ӝ~ ,8? o*h?@UXE` dE .)迱bhisZ@o>PPЅ7IP߱:p@,`6tC,"99t (xxA -;Ȅg@>@ L[9hq@P;b/!6:/ 8HZlx,Q@@@>=r_ya$a<S0#>ԧj
P08dH؇CDDAF Z?IDE(` /$s x@ł`1@ +-X LˠŎ#h
kp;i p4ڈDH>|k "Ql<
m\nƐ {X?r,ǹ9JPG6z zLE3It2 ́ H@4TGЃdJII`ʥ4 GH>츀i+H# dĐ䈭4 !dJAu2 ,OxI`C=s GX@G@L(
+ pJQX=clHQH@@ k.8KIhpKKh^B,*P8 Hh#Lxd=̎x;d.+gҤ#Y+QDoQD|MGڌ۴"*? 3s0 TTHɜNΪL76#ȁ#eK$HlOה6G\ ܣ}X9qO!pUCNLtȏ70 P~CXK@pUƴMTP } 0e@QL -0V{">P0E &zF@0hR<S/
0%/
&(34LLPH8J#J>|@ R5SES =m >S\H({O݈ 2 cTq I#L1LL!ŧPij`UWu >LU+UQXX^U4iQ00V4=fe<܈|+L T
UmU# 6oE5[U $tmTu}P 80cLp{VH;<]oՀ;TÑ&u %Ԓ0|X Wʍ(V㈩LُXYpY! 8זPXFUqU u hXl[X'#X m|֒]ӽ!u z-a[%[X2"u[ۘۻE4=N10fTOuOpZنƅϜ5U[Ŷ=
0W|Z|%%ӝV@s Ω"ɵ]]lݍOxLݎ`u:UCE:L9 *^(Wm}[Iިp 2`Wp>ӄݳ$|SM^M85 _ __rB >Mx@` } Ҫ}`܀S؇Qp]!`QHU0x5x%^ɂ`$=Ep ; hʥ|bJv&oH
bUP?XxȂ<~b ()* acZ.^2$ThP hb; =n OX?&Rn D0 $chYPbȃ0 x ZS~'㘠bb5,2@u\0[ђfMf*9 er, T&hQan@n >gXhbDdX Df$veOHXf(c }-[ 2yXn捨q`^bnPbOp ,Ȃs? {|i} cVi>^BVC}D &XVfꤦAx
P$1h&c}n5`g@>hi8fcXn 2\OH;RO h@]50NinkǾe̦l\0Y/P_@F x'.v~`gc >~itS& ~k,0Nm#!cʦgvyv XȃxOXnf㖠gzoaF1 s<&no5Q(^ p?1sHXXňӰMH(2HoDNI=0I Ǎ6? sHS8O8T8p /1qr/VrI ' "oKFar'83? & 4?s? 8
:os Er 0t, 3> 4s8 8 ώD"OH R1G
pQx7 0 G6׀> W]u<?8 ` _tfw `:v9s9׀]Iite?tSwK(lpt8KsV{ F vI&Htt&w>߂V`Ws3OKwuVovDwIwVK'HK vIgVu3vxhwyXZ&pt6 x80tw 0QU'vux h K<wPW{oX@k8Gu gs6{ |zut7GWO':7{G{_{:kWbŐwPuF@t5O`?@{uwtKV|3u{{swzPGY6 {Kpt|thO $}zMGtG?yGthoIGzz zts& :@T @#B h"ƌ0`ܿ"G,i$ʔ*Wl%̘2Cs` 5:w!4eɧ >EabϢ ў=G z@ckEFU EHvR^2i7#1> P/.Iio^w3n1O'SXK7s3"{Ol4jnQ6@m6nLPP,KZr3o66 *jcuݺj2}n<z
F
N
@Jx cp@? ]h) ' f@ռGEfHFTqT@F! @$RQ/wUD1ʨ { ̈́+pp(bPB'0 t L )9
8&Ia#]
N<}Am1`Z^ e A11:!%{(i9揅XeEPrꩀ)jdD xh*ؤE^}zPꫩbE*:,L5Rz
*~c*J#`I,4hww⌋B;/+
B=w$2 DGWג pmA$хKR5[/ 4^B |~|XQaK`-t5sMu$9
J 1\6+]2PD7Y*R),u %i_80`M8p57 =8C4$pl>5 8e݊tt ϺH*D~W0Lj I~{ ::"%;Kы7k_&<_d)+=Txǽ=b3
\=j9nJG*wu~+
7<{Vn 8 T =pL`okuL-q=m,!W^كQMB%F
S]^uD
5t@1*E@"yahZX)r1sh
Pd nH=6q Y>qL#. ^,
~ NK F>RRV DVHQ fT ŸC&/,|6$
0G'+R(7Q;̒`b^Lhɂ
^ ި4QZ 1/DmA
5.G( Z22(B 5 '@)l6xA6|A 4VPJƝ26 ƴ B*|
iH QȀ HEc
6xbl &ѝԣ 氊ʴ*2"%SULrp ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Tunnel Endpoints Page - Client-to-Gateway</maml:title><maml:introduction>
<maml:para>Select <maml:ui>Client-to-gateway</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page if the connection security rule is for a client computer that must communicate with a remote gateway and the computers behind the gateway on a private network. You can use this page to configure the IP address of the remote tunnel endpoint (the gateway) and the computers that are behind the remote tunnel endpoint on a private network.</maml:para>
<maml:para>The following figure shows the components that you can configure by using this wizard page.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=52c6db15-ed4e-415c-a077-ce2a57486732" mimeType="image/gif"><maml:summary></maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Tunnel</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, click <maml:ui>Tunnel Type</maml:ui>, and then select <maml:ui>Client-to-gateway</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Tunnel Endpoints</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Client</maml:title><maml:introduction>
<maml:para>This option is set to <maml:ui>My IP address</maml:ui> and cannot be changed. </maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>In this scenario, the client computer is serving as the only computer in Endpoint 1 and is also the local tunnel endpoint.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Gateway</maml:title><maml:introduction>
<maml:para>The gateway is the computer to which the client sends packets that are addressed to a computer in the remote endpoint. The gateway receives a network packet from the client, decapsulates the original packet, and then routes it to the destination computer that is in Endpoint 2. You can specify an Internet Protocol version 4 (IPv4) address, an Internet Protocol version 6 (IPv6) address, or both.</maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>The IP version of the address at each end of the tunnel must match. For example, if you specify an IPv4 address at one end, then the other end must also have an IPv4 address. You can specify both and IPv4 and an IPv6 address, but if you do so at one end, then you must also do so at the other end. Also, you must specify the same version of IP for both the remote tunnel endpoint (the gateway) and the remote endpoints behind the gateway.</maml:alert><maml:alert>The gateway computer is referred to as the remote tunnel endpoint on the <maml:ui>IPsec Tunneling Settings</maml:ui> dialog box, in the Netsh command-line tool, and if you select <maml:ui>Custom configuration</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page.</maml:alert></maml:alertSet>
</maml:introduction>
</maml:section><maml:section><maml:title>What are the remote endpoints?</maml:title><maml:introduction>
<maml:para>The remote endpoints are the computers at the remote end of the tunnel on the other side of the gateway that must be able to send and receive data from the client. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Address</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>The gateway computer is referred to as the remote tunnel endpoint on the <maml:ui>IPsec Tunneling Settings</maml:ui> dialog box, in the Netsh command-line tool, and if you select <maml:ui>Custom configuration</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the computers that are accessible behind the remote tunnel endpoint, use the <maml:ui>Computers</maml:ui> tab and configure the settings for <maml:ui>Endpoint 2</maml:ui>. To change the remote tunnel endpoint (the gateway), from the <maml:ui>Advanced</maml:ui> tab, under <maml:ui>IPsec Tunneling</maml:ui>, click <maml:ui>Customize</maml:ui>, and then modify the <maml:ui>Remote tunnel endpoint</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize IPsec Settings</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure the Internet Protocol security (IPsec) main mode key exchange and quick mode data protection settings used for all IPsec negotiations. You can also configure the default authentication settings used whenever a connection security rule uses the <maml:ui>Default</maml:ui> settings.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:alert>If you are configuring Windows Firewall with Advanced Security on the local computer and you select <maml:ui>Default</maml:ui> for any of the settings, any Group Policy objects (GPOs) that apply to this computer can specify the settings.</maml:alert><maml:alert>If you are configuring a GPO and you select <maml:ui>Default</maml:ui> for any of the settings, any GPOs of higher precedence that apply to this computer can specify the settings.</maml:alert></maml:alertSet>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Key exchange (Main Mode)</maml:title><maml:introduction>
<maml:para>Key exchange settings you select here apply to all connection security rules. To ensure successful and secure communication, IPsec performs a two-phase operation to establish a secured connection between the two computers. Confidentiality and authentication are ensured during each phase by the use of integrity, encryption, and authentication algorithms that are agreed upon by the two computers during security negotiations. With the duties split between two phases, key creation can be accomplished quickly.</maml:para>
<maml:para>During the first phase, the two computers establish a secure, authenticated channel, called the main mode security association (SA). The main mode SA is then used during the second phase to allow secure negotiation of the quick mode SA. The quick mode SA specifies the protection settings for matching TCP/IP data transferred between the two computers.</maml:para>
</maml:introduction>
<maml:sections><maml:section><maml:title>Default</maml:title><maml:introduction>
<maml:para>Select this option to use the key exchange settings that are installed by default or configured as defaults through Group Policy. This setting is used for all key exchanges. For more information, see <maml:navigationLink><maml:linkText>Default Settings for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=41646515-247f-4ce4-a9fd-600bd90ae773"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Advanced</maml:title><maml:introduction>
<maml:para>Select this option to specify the key exchange settings that are applied to all key exchanges. This setting overrides the installed defaults. After selecting this option, click <maml:ui>Customize</maml:ui> and use the <maml:ui>Customize Advanced Key Exchange Settings</maml:ui> dialog box to select the settings to use.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Data protection (Quick Mode)</maml:title><maml:introduction>
<maml:para>Data protection settings you select here apply to all connection security rules created using the Windows Firewall with Advanced Security MMC snap-in. If you need to create a connection security rule with custom data protection settings, then you must create the rule by using the <maml:ui>netsh advfirewall consec</maml:ui> context. For more information, see <maml:navigationLink><maml:linkText>Netsh Commands for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=111237"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=111237).</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Default</maml:title><maml:introduction>
<maml:para>Select this option to use the data integrity and encryption settings that are installed by default or configured as defaults through Group Policy. For more information, see <maml:navigationLink><maml:linkText>Default Settings for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=41646515-247f-4ce4-a9fd-600bd90ae773"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Advanced</maml:title><maml:introduction>
<maml:para>Use this option to specify data integrity and encryption settings that are available for negotiating the quick mode SA. This setting overrides the installed defaults. After selecting this option, click <maml:ui>Customize</maml:ui> and use the <maml:ui>Customize Data Protection Settings</maml:ui> dialog box to select the data protection settings to use.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Authentication method</maml:title><maml:introduction>
<maml:para>Authentication method settings you select here apply only to connection security rules that have <maml:ui>Default</maml:ui> selected as the authentication method.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Default</maml:title><maml:introduction>
<maml:para>Select this option to use the authentication settings that are installed by default or configured as defaults by using Group Policy. For more information, see <maml:navigationLink><maml:linkText>Default Settings for Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=41646515-247f-4ce4-a9fd-600bd90ae773"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Computer and User (Kerberos V5)</maml:title><maml:introduction>
<maml:para>Select this option to use both computer and user authentication with the Kerberos version 5 protocol. The use of this option is equivalent to selecting <maml:ui>Advanced</maml:ui>, choosing <maml:ui>Computer (Kerberos V5)</maml:ui> for first authentication and <maml:ui>User (Kerberos V5)</maml:ui> for second authentication, and then clearing both <maml:ui>First authentication is optional</maml:ui> and <maml:ui>Second authentication is optional</maml:ui>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Computer (Kerberos V5)</maml:title><maml:introduction>
<maml:para>Select this option to use computer authentication with the Kerberos version 5 protocol. The use of this option is equivalent to selecting <maml:ui>Advanced</maml:ui>, choosing <maml:ui>Computer (Kerberos V5)</maml:ui> for first authentication, and then selecting <maml:ui>Second authentication is optional</maml:ui>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>User (Kerberos V5)</maml:title><maml:introduction>
<maml:para>Select this option to use user authentication with the Kerberos version 5 protocol. The use of this option is equivalent to selecting <maml:ui>Advanced</maml:ui>, choosing <maml:ui>User (Kerberos V5)</maml:ui> for second authentication, and then selecting <maml:ui>First authentication is optional</maml:ui>.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Advanced</maml:title><maml:introduction>
<maml:para>You can use this option to create a method that is specific to your needs. If you select this option, you must click <maml:ui>Customize</maml:ui> to use the <maml:ui>Customize Advanced Authentication Methods</maml:ui> dialog box to specify the authentication methods to use. </maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Requirements Page</maml:title><maml:introduction>
<maml:para>Use the settings on this wizard page to specify how authentication is applied to inbound and outbound connections that match this connection security rule. If you request authentication, then the connection is allowed even if authentication fails. If you require authentication, then the connection is dropped if authentication fails.</maml:para>
<maml:para>Use the <maml:ui>Authentication Method</maml:ui> page of the wizard to configure the credentials used for authentication.</maml:para>
<maml:para>Some of the following options appear only when you are configuring certain rule types.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Requirements</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Request authentication for inbound and outbound connections</maml:title><maml:introduction>
<maml:para>Select this option to specify that all inbound and outbound traffic is authenticated if possible, but that the connection is allowed if authentication fails. This option is typically used in either a low-security environment or an environment with computers that must be able to connect, but cannot perform the types of authentication available with Windows Firewall with Advanced Security. In a server and domain isolation environment, this option is typically used for computers that are in the boundary zone.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Require authentication for inbound connections and request authentication for outbound connections</maml:title><maml:introduction>
<maml:para>Select this option to require that all inbound traffic is authenticated. If inbound traffic fails authentication, then the connection is blocked. Outbound traffic is authenticated if possible, but the traffic is allowed if authentication fails. This option is used most in IT environments in which the computers that must be able to connect can perform the types of authentication available with Windows Firewall with Advanced Security. In a server and domain isolation environment, this option is typically used for client computers that are part of the main isolation zone in the domain.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Require authentication for inbound and outbound connections</maml:title><maml:introduction>
<maml:para>Use this option to require that all inbound and outbound traffic is authenticated. If any network traffic fails authentication, then it is blocked. This option is typically used in higher-security IT environments where traffic flow must be secured and controlled and where the computers that must be able to connect can perform the types of authentication available with Windows Firewall with Advanced Security. In a server and domain isolation environment, this option is typically used for servers in the main isolation zone in the domain.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Require authentication for inbound connections. Do not establish tunnels for outbound connections</maml:title><maml:introduction>
<maml:para>Use this option when creating a tunnel mode rule on a computer that serves as a tunnel endpoint for remote clients, to specify that the tunnel only applies to inbound network traffic from the clients. The server can make outbound connections that are not affected by this rule.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This option appears only when you select <maml:ui>Tunnel</maml:ui> on the <maml:ui>Rule Type</maml:ui> page and either <maml:ui>Custom configuration</maml:ui> or <maml:ui>Gateway-to-client</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Do not authenticate</maml:title><maml:introduction>
<maml:para>Use this option to create an authentication exemption rule for connections to computers that do not require Internet Protocol security (IPsec) protection.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This option appears when you select <maml:ui>Custom</maml:ui> on the <maml:ui>Rule Type</maml:ui> page or when you select <maml:ui>Tunnel</maml:ui> on the <maml:ui>Rule Type</maml:ui> page, and then select either <maml:ui>Custom</maml:ui> or <maml:ui>Client-to-gateway</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the authentication requirements for this rule, click the <maml:ui>Authentication</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual>GIF89ad p , d $ $$$(i 0$0<000488< <<@<<<@0@P DDHD@@@DH H LP L8La L<Le(P00$U]PPP(U,U i0Y8< eD]u0]i0aU]m4a u8a<aDL4eLe}aaa@eq8iPiDiPm iii uHm<qLmYePqYuPu(}Uu uuuUy YyL}qy}Y}i}]}a }}}aaeUe@i
yYii $qqʍUy0equ4iޕ}@}]y΅q杝ҍҡ}PqҙΑ}aօ殮֝ڑ慺ډyޥޕΥ H*\ȰÇ#JLfŋ3jȱǏ C ɓ(S\2$ɖ0cʜI&͗6sɳN>
JhCF*]ʴ%ҦPJ( p C(<O KVa7 0)A B b-K] p K`A& 3s%֮FʍE+0`۫ a= #x+SΠ+) Z {í
W* q7X
"_ξ=Krź0ǎڭn9ũ qi][ނ GZF, I rYZ@|u?x\,(h֖s bvh Zzp5H^
hu3 '?
$qliq WupT
+"iDqA,Ar%BmiNᩧ]^f$&9P{Z Drj Q,iMAiP7M@B&iA3|rFJ!
jA A%Ȋl@xa6 rUA
i6+T Ɖ1'rf}4@*z||pDz:NJ;b:' iABn. f'' #˻ss^sZ n0z(, @0cګQ+~aK/eT.},.dY<hFtAڂc,b/u XǶl-a v e3kQOBfQDlbcͦހ+t Q}wex7 ҧ m<gP 9Z` Dk1O
1`z,'pu# $;m .;}nj[{q%cz'*<i[_D|0[
.H]ꘆ8(=җo@cV+뛡{¨ucJ wqdWq E-)cCX?گHH^<c^^ DG?y~ʊ<. J-a#l1[ E{7 . pmQ6oZ cLE1!d<Q5%`h6B
WcQ.<d ıyl @'$'II F 㞴 :!L*W`
rh$QXC uC)xAL^p#!(&/ZL! A
~.%! 9p.։W+؉Z3?RAd
֠
)<X [5Etp&,@s)B xq{SHGJҒ5~b_@$`?<c*IydNr A$g! (/1j@0T=!S-(p j 7',|*9Ƀ5DZ `@v"Q
=` B'1k"}g "&4яVᯒd8s,XBjZSz $gn*d0B$ [ p%:tKhW/~.Xn$Csc,.d` }cp ^"Ը#d BMnC$oQ7?A
'(
q7nK<P| @3BZݲ =+_` &(s x:Љ u` nȺh $xk7 6@;;8`"9CYp:^F2 Irr6J`r]D-2YlI8 82UNG:~!xl ] H_Axȁ&vbXCZҝx!GJZT" ~)$]B $@t ]F?
(qH gI۳jhϑA)ޱ (k'zHpmc o<F5{(8SЊp 69@ Fo1e> l Db (x\a dkxA HgV gqDԩ
<E@ wC )z<k1H\Ph(#Za=2(XC$pvJ?Nm('xwByJ<[EݝH6۴
2uTA4,yK_'-0;j4s_/QpqϼB}%-sɪ/`B#0[IAumk"RG]i! O=d-(@>KȆ%xVHԚ" R#@ oe\Q"z|'Ig ߷[q hNp};@H܇tr Iw? P+A zSΡ?x/h2T b&Q0 } hRm@
0
vHW P'~ &#wB }a1$.1+.h2"|+w"ǃ^GgI P
R%c~p0k$
NN P E0 ~聲e 3P~ Y2@ g$ri 7#::53r($/Uby:2@~OP}<wրyQ#"a Zh
0b( +%% 'a+3Kt Y5 cY+yPh؋d` ¸f
P"Ps G EQxfQawd RE=poO
OsPZ pQBf4z G&E9@p0
Y%
Iz s"0ȁ
:Y5W>h@i )
@R叅K9UpƐ^p4 Ss RpfnmvѲe jNn LIw I 4%u (
; r Qc+|9Uu*bjpC R3Ɂ@ q 9)OJI0
I p C a`a7 J,A5R:S%r7a;:%*C8 hS3Z;O2Sq YYq M P\*JA0<` Z{;1z,#^=9 BB3B-)=(
A ț#[%z}d
)F2'pݑ:Sb3?c/L)85&8 z^zϐdgcjReD[(}Ԁi6`00r!2+J p )j: I
VU 6 Ɍ t
H ՈF1!4)ª"|B~*ss y z Z3z
M Ix#dH@=Ab#G j21nxj4z yh 0*YYv@ _iw<Cz?Q;ve zYB$jD!uqQh0[U)˪q OY>@KD@
E،J
hIPkE61ބ@\;
*H {ƥ
QqUeZ4q O1j[
q$Z;e/I
ZHf }@2:A9'{334}`kR` M^[ymvkay+ µ _p;;E#RBDv
K;R$Р_T~ht{mKN뼑tJw3N'r%<$ W;=1 MB
KRmꊈpw@v2Fx\Fо
˥i<1$ *ԽճJ ÷ W*9E~
0" &lpI~ȟlФej
*b>Z4a9:~ sͰ i R%
'ȗ~O# OhhKVǬB$$ڻA,|W YŐl@R ` ِ@EPՀ $5 x9@B ;ɣg &%
`+ <:"p X`#
ՙy(rWU=hH#K%=T̷ ˿|^LU`+Pr-a[HK
.4z<G-ka%b:ܳ<==N=k
Mp@i
`@5m"`%%
Br j0H SP qW
F
`Ѐy@
:0נ}9 2y-Um` Y
ڇP K_iл#` Vpم
@F
-ڽ KRb` @ ` Ը`=w$ A M + P 1mM @ u@s0I# x p ^߆- \kaKmN``.s pl VpP,^Hn]{ 3` [
(ne? ͵{
)pS^pءA ?W @ R>Vnt[ sA
`x+I
PJtJIt@MUpK 0a Op(^YaLB^yn懝lPQJJ qAF أn@ V.ދ.Ru$
N~函J!- Y둤gp
N~cXt@ 0!\k`
nN
O]
ծ P 50p$
@5=
2?tc2altP
ִ@NF?O0n,IE6I_V@ ڂN] ~ =d_fh?П`v"%NlP@Ozz ` l@^%
@ O\4ٓ=Fy
RHrmӰU`@ f@_ ?*06v`!a,TnxaiP
۬,ΚPq e@ ް
o^zNOfؐ' -5 B@ @R3PPxOD-^837H%M<8?n48>/L5%q#PTP
9hO[ (tхT'VʸS5+ ~Ȕ9?@f$~83m^Cp* GY C6/S* :k0x98'UXΠ#UMƉQ::mѤNaթy5gr(͈['lRec늽}
*#K
͟O"U~ psZ?hj6*fxs·߶@ BK
Pp►x\Gtj3 5iE3сjp(Q%g?#'Ϣ $&F@AJ,,<d0D"/S$컌4У{$'Ooɓ}EN gj}(m42Ɋ8D4p1 2R ./K*j2$N Xs b02e5N( qFpqF !GR [8SHMJY)a2@a& rAVC hToR
(U2$0$ ݤl'Ɵm,}͙?]a,҆$x2( M<]5q,D"{?w0 3 ~۴ Ǟ`Ŝ y`(2)[T1`~ N8Qu{vy$ԙA89À1 I@nO[5 J$ i_1VBTnP##z>1w,m
H;6j~7PKq09!l41fPg[z *w( ǚ.+z {a58 }aۃG|]!5Q^ l,x7C~pQ/A&}
L""Au
J0H
$ g"DC R62e!Vq V%ǛUH] %v p
P p78( " J !<" X 2`#XQ0r>Ml;d 0dQ:>A De$CxD4uŁ8":<? x cB%P y ( x#IiF x#0)=c#rwo!<. D m n Jɝ6 f0ePBX`{(@AtD3Q7HOzC" aps1xv&.D<(aw XBkfS5
R}e,ňR fWvwW7z_c$2r B4k~muk<@~rjVJqة;0
$MFK B BذrՄ
6(ZnnH:xQ&E0r뒚Xā@ D-Dأ ]!hvUđj`ߨhGU``S+Qs/[{
y((ꛇ3d J0hk6\l$-4 `>@ Ht^^tgXg.r
^=c<*19B b86,,b
A^;p)z s<1cZ( {ANjc- O/] O|RgB0AhF7i?`v8-3{ܫeC>ۈ
mbd]U}>L@0uqLҗv!Q
l¢Wj9p$^{0y&=, \_:/ m!H
hȩ%wexpDʆG1D]q{$8M21xĻ .`5E( giAIKJ ݨM0'&9QttAТw wI^py# 3r1zg т[uN :GJn'dDⱤN<-o+ɘF/?Hu_gP .>1h 턐
7^(3iT!'C g ؉j\ԃ#G鎇Hn K;=~!H$=<~&%vrc?YT}}T%<yc5o>MKɲ@EMrB+D_ {h؉06: >?У!U]@S0$tP %A8 п -oy@HO :< ,4S`$qX3hD<2D&),3 <HԿ3LC-$3 4Ԟ3B/-883>=ؼs@'( 2qXb`.B-A[ 8A\M,D 0A WCܢ)E DAPH&@ X6+ElFtD HY Đ'B(Aő_0\(1 D&4 \?bb0t !F 8F[ALAP8<HǃTyb2H1"E1DH hC % F|D
K&K')GcT|̠N(07Vt/4c|D ZAyCB@ *Ɋ4JI<V'YF0
(C !oS 2`GrG;zʢI0 WʻUH+ʿ4AܨʾJ<EeȌ~𫰤F$>;FI:pI7INE 3ʩLE$NL*<J2D`̓tͨEzdLZMPNdA f9DKFt@MH˚DķɂA"JfHlH 2*&#Ic?LLbZt2<ǂt̆D#}/2rcMI7 !|,L =I ϕ4
F`#aE$& WYA|D/Ŀ=HeEÇtE& ]?N @PD@pX'8 LNPL2A O4* txKB8 =@HF(S"A7=6d 3
5
E\ӜaX1¹̲%<
ф 4DT/UT`TkH:bFKɱҲ)]!iDL.<ό1884 Ne"5BӰ RUF'db c4AZVThUa d5)V`:6Hnq%F3W5 DDb01
@Eh##;IҩJ#Q)B\m5npWrg(XZp-2CC 3 5YP% d3
3ۛ!d0YȀ {wP)+mӈX% 02"##:9*H b#/T# J"c2" Sx@q[Zƒ- {Qȏ=
mԬ 2Jdg:/% y/ A/9wj5=\qMqp\D]jMP%jVɨC0%"JZY;jAVf,'^mD}5^ 9?\8: e^o^/ʃ]¨_-*_* ͘ȺŒ}5 CJ &NE*E Y5ǪQ8#'̬M=߰03QѐUhܚUF[_*06F Sg/ڍ V8Z]) Hbu@mb
C8 0; `&Ņ!C3r R `u[؈1 ʑ䑐d }pa˹0?AK[J"aFbH@]YML.YeRW^ݡYF68a Gb]6 I^`h+amJNfG&nwѱ=}(ۥbhp ~gf
aon.pP[k 6xtjgGNnYwW$X%V~9p*h%f=++96{ ^8X&Z 朔; $hZ
1 mV@Nw& Niw biHXX& 1Rg
DZ顰ek4tFX(x+WYH.k)~\j胗sڻk⣄}As(xr嫐Nxޏ0j0FZ8F4Y^:hZ f HF
hþmQ@qȁp QVX0妈OhSp꓀jTPK0(l;@:
o.{1>븞0nG3 6
m`{Xpΐn;Q
% =@m
pr()3 sv
o q8}QlgrȬP0haj~P/ @f
gHq' a8G=߮؆r j @ܪxВ3OoXsAahy:s?wj?Z@IB7x1,h]fA 0t@vJxX \t M uS?BWјq0QW YV@A]sYHbКPHUsh*Rk/xXNVȆ-lSjHg!r7A]uΘe:B*ԘjOwj ;rmQj`hEf@666ta\XowzR
" 1x{3؇ZLldywvr[Hg,phj83Hk ԡ/iF_уV k\P׃+h-~(\ ~czP >[wQL3jy?u_Nx>^ Bx5oEhrz8]Q/ E(Z'= ,Xx9satöԯ}Fx;Tpw`,h
'R>d4ӇsE2 ʔ*WlҔ~4H L |V'F[_2N A@m DU rE_s%ڴjײmRԲp`QzUI+xA~9'q _ܺD匞a+x3'U}2u
U*UX
hk;3k9n)o)*{rP|"6N[51/PHdYW 3>DG-Ě>2jK9T LDUWe5 D305W 5t
%xbB EJh=C7x#c9(AQhm
saQ9 krPAl
҆tQDFt8Ԣ!M8emW<CGDp&蹧gWODV\.ly*Y&Q
gO6Π&* 5GY:)'A!Dٺ_k=>R֨ F*t<qDB RM?X̧
5s#F0kă,"AȬ9nOA&$ޖ&"X3qBgE p#35-͂ 4ԄO5ԑp'<,'LL;%ɶD "844.XcK XJO0"dUk]rH2?նis kBX1:o7/EOvWT-Q D_g6x~[<D
jѡ
Փ*gn@\sx⿸e7
Ar ٣KWt f3=V'ɓ.x\OciB.D-`ָOZ |Q+ կ8CL5> (H+#e ^J^?5`j0$,m `. }A>-Rn?_sC\B.<._!t;|"ClE0Dw$@D0EfdRſiB=pvcҨ5AAAzL 'G`W|$ IyC`!tr/H,Q,R`t JT#(O]e7j &9J`Lr@8A &A 5!d C,pMĤ/ Ƀ$ /S)` CG7 X( $"aG@!@? rʒph:N 5c< Jp6t L`B,bX!&`Y4gJqӌ
dGÐJLP(,!SI <KST 5 H-Ej @*ֱu S*Z҃3'%HK:˃&?o)^
+`\<"X@JqO ⌅<V 0UkcP군%%)YYyȡL g7P0,$Y9dڄY:Lgז=.r2(Zs+]@wֽBrWt 2W=i͋
8n@ ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Tunnel Endpoints Page - Gateway-to-Client</maml:title><maml:introduction>
<maml:para>Select <maml:ui>Gateway-to-client</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page if the connection security rule is for a computer that will be the local tunnel endpoint (gateway) to the computers on a private network. You can use this page to configure the IP addresses of the remote clients that can establish a tunnel to this gateway, and the computers that are behind the gateway on the private network.</maml:para>
<maml:para>The following figure shows the components that you can configure by using this wizard page.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=35a693e7-9134-418a-9c80-17f6d60c08e6" mimeType="image/gif"><maml:summary></maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Tunnel</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, click <maml:ui>Tunnel Type</maml:ui>, and then select <maml:ui>Gateway-to-client</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Tunnel Endpoints</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>What are the local endpoints? </maml:title><maml:introduction>
<maml:para>The local endpoints are computers on the private network behind the gateway that must be able to send data to and receive data from the remote client through the tunnel. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Addresses</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>The local endpoints are referred to as Endpoint 1 on the <maml:ui>IPsec Tunneling Settings</maml:ui> dialog box, in the Netsh command-line tool, and if you select <maml:ui>Custom configuration</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Gateway</maml:title><maml:introduction>
<maml:para>The local tunnel endpoint is the computer to which the remote client sends packets that are addressed to a computer in Endpoint 1. The local tunnel computer receives a network packet from the remote client, decapsulates the original packet, and then routes it to the destination computer that is in Endpoint 1. You can specify an Internet Protocol version 4 (IPv4) address, an Internet Protocol version 6 (IPv6) address, or both.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>The IP version of the address at each end of the tunnel must match. For example, if you specify an IPv4 address at one end, then the other end must also have an IPv4 address. You can specify both an IPv4 and an IPv6 address, but if you do so at one end, then you must also do so at the other end. Also, you must specify the same version of IP for both the remote tunnel endpoint (the gateway) and the remote endpoints behind the gateway.</maml:para></maml:alertSet>
</maml:introduction>
</maml:section><maml:section><maml:title>Client</maml:title><maml:introduction>
<maml:para>This option is set to <maml:ui>Any IP address</maml:ui> and cannot be changed. The client computer in this scenario is both the remote tunnel endpoint and the only computer in Endpoint 2.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the computers that are accessible behind the local tunnel endpoint, use the <maml:ui>Computers</maml:ui> tab and configure the settings for <maml:ui>Endpoint 1</maml:ui>. To change the local tunnel endpoint (the gateway), from the <maml:ui>Advanced</maml:ui> tab, under <maml:ui>IPsec Tunneling</maml:ui>, click <maml:ui>Customize</maml:ui>, and then change <maml:ui>Local tunnel endpoint</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Tunnel Type Page</maml:title><maml:introduction>
<maml:para>IPsec tunnel mode is used primarily for interoperability with routers, gateways, or end systems that do not support Layer Two Tunneling Protocol (L2TP)/Internet Protocol security (IPsec) or Point-to-Point Tunneling Protocol (PPTP) VPN tunneling. IPsec tunnel mode is supported only in gateway-to-gateway tunneling scenarios and for certain server-to-server or server-to-gateway configurations. IPsec tunnel mode is not supported for remote access VPN scenarios. L2TP/IPsec or PPTP should be used for remote access VPN connections.</maml:para>
<maml:para>An IPsec tunnel must be defined at both ends of the connection. At each end, the entries for the local tunnel computer and remote tunnel computer must be swapped (because the local computer at one end of the tunnel is the remote computer at the other end, and vice versa).</maml:para>
<maml:para>Use Windows Firewall with Advanced Security to perform Layer 3 tunneling for scenarios in which L2TP cannot be used. If you are using L2TP for remote communications, no IPsec tunnel configuration is required because the client and server VPN components of this version of Windows create the rules to secure L2TP traffic automatically.</maml:para>
<maml:para>Use this wizard page to configure the type of IPsec tunnel that you want to create. An IPsec tunnel is typically used to connect a private network behind a gateway to either a remote client or a remote gateway with another private network. IPsec tunnel mode protects a data packet by encapsulating the entire data packet inside an IPsec-protected packet and then routing the IPsec-protected packet between the tunnel endpoints. When it arrives at the destination endpoint, the data packet is extracted and then routed to its final destination.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Tunnel</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, select <maml:ui>Tunnel Type</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Custom configuration</maml:title><maml:introduction>
<maml:para>Select this option to enable all of the endpoint configuration options on the <maml:ui>Tunnel Endpoints – Custom Configuration</maml:ui> page. You can specify the IP addresses of the computers that serve as the tunnel endpoints and the computers that are located on private networks behind each tunnel endpoint. For more information, see <maml:navigationLink><maml:linkText>Connection Security Rule Wizard: Tunnel Endpoints Page - Custom Configuration</maml:linkText><maml:uri href="mshelp://windows/?id=85c69539-f0c0-474c-9860-d220293ab2d6"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Client-to-gateway</maml:title><maml:introduction>
<maml:para>Select this option if you want to create a rule for a client computer that must connect to a remote gateway and the computers behind the gateway on a private network. </maml:para>
<maml:para>When the client sends a network packet to a computer on the remote private network, IPsec embeds the data packet inside an IPsec packet that is addressed to the remote gateway address. The gateway extracts the packet and then routes it on the private network to the destination computer.</maml:para>
<maml:para>If you select this option, then only the public IP address of the gateway computer and the IP addresses of the computers on the private network can be configured. For more information, see <maml:navigationLink><maml:linkText>Connection Security Rule Wizard: Tunnel Endpoints Page - Client-to-Gateway</maml:linkText><maml:uri href="mshelp://windows/?id=63138fa3-9f09-4684-89cb-c44306ee3763"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Gateway-to-client</maml:title><maml:introduction>
<maml:para>Select this option if you want to create a rule for a gateway computer that is attached to both a private network and a public network from which it receives network traffic from remote clients.</maml:para>
<maml:para>When the client sends a network packet to a computer on the private network, IPsec embeds the data packet inside an IPsec packet that is addressed to the public IP address of this gateway computer. When the gateway computer receives the packet, it extracts the packet and then routes it on the private network to the destination computer.</maml:para>
<maml:para>When a computer on the remote private network needs to reply to the client computer, the data packet is routed to the gateway computer. The gateway computer embeds the data packet inside an IPsec packet that is addressed to the remote client computer, and then routes the IPsec packet over the public network to the remote client computer.</maml:para>
<maml:para>If you select this option, then only the addresses of computers on the private network and the public IP address of the gateway computer can be configured. For more information, see <maml:navigationLink><maml:linkText>Connection Security Rule Wizard: Tunnel Endpoints Page - Gateway-to-Client</maml:linkText><maml:uri href="mshelp://windows/?id=70d0c763-d3a3-486d-9f91-e213831f2485"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Exempt IPsec-protected connections</maml:title><maml:introduction>
<maml:para>Sometimes a network packet might match more than one connection security rule. If one of the rules establishes an IPsec tunnel, you can choose whether to use the tunnel or send the packet outside of the tunnel protected by the other rule.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Yes</maml:title><maml:introduction>
<maml:para>Select this option if the connection is already protected by another connection security rule and you do not want the network packet to go through the IPsec tunnel. Any network traffic that is protected by the Encapsulating Security Payload (ESP) protocol, including ESP Null, is prevented from traversing the tunnel.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>No</maml:title><maml:introduction>
<maml:para>Select this option if you want all network packets that match the tunnel rule to go through the tunnel even when they are protected by another connection security rule.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Boxes</maml:title><maml:introduction>
<maml:para>This section describes the user interface options on the Windows Firewall with Advanced Security dialog boxes. Instructions for locating the dialog box are included in each topic.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Integrity Algorithms</maml:linkText><maml:uri href="mshelp://windows/?id=226a35ae-cf87-4bd3-b4be-fab77930e6da"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Integrity and Encryption Algorithms</maml:linkText><maml:uri href="mshelp://windows/?id=b31c589e-5b17-42df-b7ad-041084dd2074"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit IP Addresses</maml:linkText><maml:uri href="mshelp://windows/?id=06cbaf77-aa9d-4dec-b056-3dcd2616e4fa"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add Security Method</maml:linkText><maml:uri href="mshelp://windows/?id=d42aa5c6-4859-4f78-b001-dc067151521b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Advanced Authentication Methods</maml:linkText><maml:uri href="mshelp://windows/?id=f19cbe6e-7235-4613-90d0-6f7a3e8a6093"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Advanced Key Exchange Settings</maml:linkText><maml:uri href="mshelp://windows/?id=aaad90b0-4f52-46ca-9636-e05175e4aa78"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Allow If Secure Settings</maml:linkText><maml:uri href="mshelp://windows/?id=1a81d9c6-f39f-4835-a00b-11d994247ca9"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Data Protection Settings</maml:linkText><maml:uri href="mshelp://windows/?id=f4d3d872-6514-49fd-b8ed-1d725f74f0c1"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize ICMP Settings</maml:linkText><maml:uri href="mshelp://windows/?id=8a0b490a-db5e-420f-8990-d0e30a17bc1a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Interface Types</maml:linkText><maml:uri href="mshelp://windows/?id=5918d117-66c3-4f58-8680-a5a822c40dc7"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Settings</maml:linkText><maml:uri href="mshelp://windows/?id=66011489-1eee-4986-9373-565e557db23b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Tunnel Authorization</maml:linkText><maml:uri href="mshelp://windows/?id=f637c2d4-a8aa-4e7a-b437-86b8e3accc7f"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Tunneling Settings</maml:linkText><maml:uri href="mshelp://windows/?id=cd103e5b-9da9-438d-a9b8-ed96384a17f2"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Logging Settings for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=58a40682-63b1-493a-9d97-940532cbbcd8"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Protected Network Connections for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=a4c3ccd0-9ec1-4da5-982d-6e65877b5db3"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Service Settings</maml:linkText><maml:uri href="mshelp://windows/?id=7e24b5a1-742d-4247-b86d-db9e097dee4e"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Settings for a Firewall Profile</maml:linkText><maml:uri href="mshelp://windows/?id=55215ddc-b9aa-4bac-9ec2-d5da5cb3932c"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit First Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=f9172bb1-6c9e-4e09-a1cb-6e6912459aee"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Second Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=dd07bae3-3af0-469b-adc8-84f78f4169e8"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Service Settings</maml:title><maml:introduction>
<maml:para>Use these options to configure the way in which Windows Firewall with Advanced Security responds to connection requests from or to services.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a firewall rule by using the New Firewall Rule wizard, follow these steps. </maml:para></maml:section></maml:sections><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, click <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Program</maml:ui> page, next to <maml:ui>Services</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing firewall rule, on the <maml:ui>Programs and Services</maml:ui> tab, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>You can specify both a program and a service in the same firewall rule. Both conditions must be met for the rule to apply to the requested connection. </maml:alert><maml:alert>When you select the <maml:ui>Apply to services only</maml:ui> option, any service running as the LocalSystem or NetworkService accounts have appropriate access. When you select an option where you specify one or more services, the security identifier (SID) for the specified service is given access.</maml:alert></maml:alertSet>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Apply to all programs and services</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule to all processes within the program specified in the <maml:ui>Programs</maml:ui> entry.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Apply to services only</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule only to services, not to other processes.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Apply to this service</maml:title><maml:introduction>
<maml:para>From the list, select the service to which you want the rule to be applied.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Apply to service with this service short name</maml:title><maml:introduction>
<maml:para>Specify the short name of the service to which you want the rule to be applied. You can specify any short name even if it is not in the list. Misspelled short names and short names that do not specify a service will be ignored. This option is useful when defining a rule for a Group Policy object (GPO) and the service referenced in the rule is not installed or running on the computer on which you are modifying the rule.</maml:para>
</maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Endpoints Page</maml:title><maml:introduction>
<maml:para>Use the settings on this wizard page to specify the computers that can participate in connections created by this connection security rule. The connection security rule applies to communications between any computer in <maml:ui>Endpoint 1</maml:ui> and any computer in <maml:ui>Endpoint 2</maml:ui>. If the local computer has an IP address that is included in one of the endpoint definitions, then it can send and receive network packets through this connection to computers that are listed in the other endpoint. An endpoint can be a single computer or a group of computers, defined by an IP address, an IP subnet address, an IP address range, or a predefined set of computers identified by role: default gateway, WINS servers, DHCP servers, DNS servers, or local subnet. The local subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select either <maml:ui>Server-to-server</maml:ui> or <maml:ui>Custom</maml:ui>, and then click <maml:ui>Next</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure></maml:introduction><maml:content><maml:sections><maml:section><maml:title>Which computers are in Endpoint 1?</maml:title><maml:introduction>
<maml:para>Use this section to define the computers that are part of Endpoint 1 and can use this rule to communicate with the computers that are part of Endpoint 2.</maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that Endpoint 1 consists of any computer that needs to communicate with a computer in Endpoint 2. Any network traffic to or from a computer in Endpoint 2 matches this rule and is subject to its authentication requirements.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify the IP addresses of the computers that make up Endpoint 1. Click <maml:ui>Add</maml:ui> or <maml:ui>Edit</maml:ui> to display the <maml:ui>IP Addresses</maml:ui> dialog box to create or modify your entries.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Customize the interface types to which this rule applies</maml:title><maml:introduction>
<maml:para>Click <maml:ui>Customize</maml:ui> to display the <maml:ui>Customize Interface Types</maml:ui> dialog box to select the network adapter types to which this rule applies. The default is to apply this rule to all network adapters of any type.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Which computers are in Endpoint 2?</maml:title><maml:introduction>
<maml:para>Use this section to define the computers that are part of Endpoint 2 and can use this rule to communicate with the computers that are part of Endpoint 1.</maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that Endpoint 2 consists of any computer that needs to communicate with a computer in Endpoint 1. Any network traffic to or from a computer in Endpoint 1 matches this rule and is subject to its authentication requirements.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify the IP addresses of the computers that make up Endpoint 2. Click <maml:ui>Add</maml:ui> or <maml:ui>Edit</maml:ui> to display the <maml:ui>IP Addresses</maml:ui> dialog box to create or modify your entries.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the computers that are in Endpoint 1 or Endpoint 2, click the <maml:ui>Computers</maml:ui> tab. To change the interface types to which this rule applies, click the <maml:ui>Advanced</maml:ui> tab, and then under <maml:ui>Interface types</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual>GIF89a p , H $ $$$((( 0$0< 48< <@@<<<@0@PD@@@ HDa0UHHHHP8La LHLUY(P00$U8UyPPP e,U480Y e m0]4]@D0ai8a8a<aDP4eaaa@ePi@iDi8mu HmUaHq yYq@uPq }qqqPuUuaq , ]}Y}L]}P]} 4eq@i<e
Y m]qL(muʕy0ui4}ʕ}@}ya΅ҕq杝Lҡ}ڍҍq֙Y֕}aҕa殮}֝څmڡڕ找}ޥޙޮ⾾ƶΥ H*\ȰÇ#J8$ċ3jȱǏ C Iɇ\ɲ˗0cʜIScʚ8sɳϟ(U JѣHLʴӧP.\*իX
<^ K,B"
X @"Dl֬ݻxr} `mZ
eQ`-,P!
$lm˘3ۗ` </-lj>=#"BZ?>f,Wȓ8Zl ȍ= 6
zqÌ} w 3esٟOZ%2 x.nܞ=axY%o|e]~Vh? `{ 4 Cu
!_ 6Xhcf
Ŏ= tg 0ׄ1J{Y q+ZbXˎHިcؗh# j%
4\3gZwm &[jvrgRn` jn@K.qeDDH62)*Pb
,ꪬ A<xY:ꭸT/z4ưo̱"[k;Q
]
~CHjB ?M6f.5Z38) $^Ъ f/,<A bTb`$s5а) w |.dC/8AC*C l8猰FAt@TIz*c3P<1&L j!ЄGkhvIX4Q<d3Qw\3N?xA@OL_cdw=4!ژw +@c1mQK6cF(2/% v"~Gz;ٟI?Vfc fgD<;T5P <46
dD\16<桧 l,s#{ b-q^u %kÇ=EU>&HA Ý|V[Z&()hGA 8" Q!HÂT2A%U@<*1e,PQpFPe<
9"h!`B`E`ALco
uXazpIo;r[SP8<C(`Z" 00G<@]2`Aɨ 7P1(i Iϼ%N1y47liIjpq\Elpcy b lY+,,) "6`SLI΅@ X84 G h8v',q#l&r!'a >
y7CQ#e@%2o v gh+&
.8p TҢzD Gt 'C4 I.Q24$6:ꁏbD
Q\ ;(T [ >fB`%ǯ
}D%`!r(|j2@nk Lܕh2WJ `Gk/pPkMlDH x
wl'o
"(]_CH*8CBB HAުvm'QzTqa s ͘vsNSs!ZwPfqq+ַpFpb N"x
f| [HXQf1bhXWہ'x !/vPw'>@_1d$p$A#@ @` XAL4y
)dqɕ>ؑ'qP|`DeEe4j9@-8<y;rk;`
z3 С@B#{@l#[ԣj4
D` ! B@p"梦z胢A .b?zT P5}=` ;-1=ܸ F
E-iqm;mH4K ҍ^TBQVHHO:o#[&Gz+t 1Q
kljccdP! h Wt 8^F&#y4 |PQDV-<uЗM ya\S U8T]8 V
8! zvnT
֨Cf:9OZ+ D_ %<#qiF?\ &p 0cp8ĭ1
0 0
uΠ{Ȏ C Xg̎@S"g0T&#)$2bU W%hf<C
G76*|W.=;{ت7YA"RГ5`wKgWȆ_
xNN$toa;ww h;
}nw}C ClFnw
Pӣ}n1 >3q%B?
6nr?/ R O? >E}
w t A
0琁ܗFp
7 4@taw;#-4"ZD6 Q B,"yxBwXBPHҦ |UWX( M)r-r]
p
P JbG<@EQdB{}H 1{'$(%z$!1Rx ^@
V ($p
9 `tZ 6
N lX
πh`X
ysJR%#T $" )boxHHшcw wYuix` Ns
@-HxJSkA'6ozrBK 'J$ H(8 |ׁidwjwU
1
p7 aR*3N
!zg"j} HlŔO 9 4`r8x+A
#ȍU,A'M Cvy'z|` nN`P
uݖ 8 DlgIp 7RYyyIC@ IZt 7zi Z p 1dr rt
OI944
X'K[+f``.0P
1p FֈetNvp2uCIiY{
cgw
@4 w` 8
5wҠPpkPIːlPl;q Ns A9QRОу= ǹn h HP09w
S;
2Ψ(d PP pH<ڤ!j_>g&&1<%)q T`1tjvXŖf+ cB p
U
z@z7 DX $ b1H $ ; $-^Wl&vw䙫4zYlZn1dXXiڬJ
LJ hB,A Z_ u H1h 2ݠʰ
[Y* 0d3 tA@8TnU>1qsAhdOXxʱGh `YeL Nv(utٲ
U w
p u4;ƬzQv{U
(1&+
=!칙 :2 ' ҭ`% "wfIb(NUlKP.۰r LWV ж:{l[
mưQp؛pҽrp n }pVú ` X o!d!C ! +;dx}[_fҀC{y*wP`0F`geo Iл*{
; Uj` aU
0 ct R ..bP 0@LH Lj+XunipP9V/2|y n{9|
|s1} <-!(I!
`v TUW|4%zEM91`pj!tn< [q; :1Q@PpVRPP3 @ 0E%|O1ƫʺp,+0]qP@|
1 9=\ И;ߐ* ʧ°(t0R"; Ma'
`|
N
KΫw,, #Vwl- -ļA\41 D5ņ<;:Vdv yj (jLXz q : 0<4mӧ¼C"\\Ao(}RFQ} S
U@ A ?? ٜٚٞVbM(*'9rm}!n6; aʰ o.Y}P=(VBZ1N m圫Xf =m,=O ڻs'
-PہpV$ ٰ c
pMp܊W-
u}YR
,SpI@]}M(*,. l10nGeu T<|
O( p
1
`MA
3
P\]wu
%qT
|Y`41 nPv= C
!Y
ōY&$
_F>gVLs;NE x
2.ۂ1Q 5C`寷]D
] ݤrpY x [ݳ 3E qD`#hw [^hOъq Оm tҀP1ޘ0
ؐ
B
O`b^hliO #yAg@ǻ]ӱ}
7 !#bD@1π
";?fcy e.n.#h.,OZ & -t( 3 OS5Dv @+ Kod
w=@ROVި^ ~Ҁy nM c VA4 GOs 2t
|!0 |0 Jp
! pb51ď b0
+I ] n`;8,)ДTxYLQH$/4 0 ԗOtJ)L9 J7L p6h ٨B%MP(gS!"QCa
# ASI?T
Q=fÚUV[VXef mݾ
3`śW/O 3X`§8 <VTtH/[=\Gu ZSp4 +^ʹ
1G4ݶP#H HByJQGc*D"fɑάh@</oW[ !ް_ٿ_) ₤Aod0 {Êo ( y8 ;,17i,2*, dBW, 8`Xo %:vxCFKnKj%9i%t }\IR =0j>3z˃ %pg k3_v3<ƚ8G`Vy#zO!Q 8`aXd 4>LD$x@RSOa =_Uc&s;BB+9#(! <(0TR/!Q0qͶE&cvԅ^el9 e@yc2 d=/QW4c QӇ 5X)`U '. 7xcH@c\s
Ι }%41SN >:'YzXZ|` =d̰-ren9&oQ{ދ*Gk N,w&Ѡ*q^u㜸/B80F nL~oT(S"C&_V"b9ZD 1!ZYAOcb<0qo o+֓, wCNɣ/1dǟ瞰E {p|?*qFoؓ H= u~,91 `+X〠qB ؋nHwAHLB
}/<C2j`^࠽O*@ B FJ`Hy4@( aVy%ċpg _D7г}/c g+ɡ8 H &RqhT苧qc( VH^,
$ s P匚,!* J
(C
IG%@ %R h1?!.B< . 7^iE$3 E
09J&C ,6 }@=}.Y% x<Ëhz@# .Cz 3ח`h
Q!=V8
Jr qeDM2vx'䉟`#'38v< I@Wt n`48[.Mڜ%{ (bQӨnLPK٩ j`z N&` Ӂ@H1ԡWū&ZAyjT7Ut^&KJ H E) t0! P+N@o#H
5TiմBh u`4N`}DX\3EzܐX[:*hr %!ֈFv* epztc@]Ctfׇֻ,
&Y Ti[vc䭣a< ȫq8$PD>lTUF]6nIӌSvL `آw21 zo]$Cio
4y hiy(? P @1~$x\[8AVD`]jbx)vį Ї(6/Aܫ8+pB" X] 2k
(!<h"`0|>F,ʯ
l)]`+ߡ6(LH_dь{YE\g]1D@Є& @R 2}(ɣ9,Uҙ9d9^,, +^uv u Sy)[/@d;p cb 6c{َ|= d؎"㈱@V8?mI8>-*qЕL I"l,ޖw
Y{Af(4 qF*u@ 8 ۈ +LQj_DuA 6y1e<F., \Pۻ7Ϩ4OPY]ȍjͽ pYKF%0,Ibz-H!TXɏyK) dh41 TTCAljw wK- 5 0 [0'M߁f )$C qQ<%O Av`=6 _IKl(AWhP P+^>ꃾ(@>ML
MPbQ1X1
M 髾۳
H4`4 ^8y:lB@r˫L3=Mcii8^~ᓎ Ѐ>2 C @4ۜK2#H[;~iA A=f<9,n02A `i%d T*Q, >{c C3TC C8]D{C9#F[B<DyKEM;Nk y k2 8 gЅ{3V| zg? o@E,^3d;$5E0/`ȓ0=Cdd>JqFJSɭ1ıP \8BH0`}{#!>
Gf1@a+HPC1`C\E^ }4a$btL Ԗ塺SHDHi g:RB P 28M}p7hIb@12'(]kyT2,> a<34d kC5E H% {L<c n$DCȬHJY Ȱ`D 7Ӳ#(S8B@ wpK`I! _9 x:s@ @8C
k@
l.ęSP` b!M4Hx0i 'HqkM@522(0K( ͶTjx$o@N!&%H {o8"!~0TD ʦY80 49VOPk, pr8 @ 5*U$
-Y* >X@zq I0/JQE` V: (1G ˼J\;.(
Hv8uԩWڅ` 'Ж
#lp8XA S(>ͨ?@ T!=TЈ5!o:'҄)M0ȠY &:H*GAqPU+kH,2[S\|FbUB5T/H
P|%uPQpUֈҸDmslPUs3B$ U[
\z{҆
V1{8VA2JЂ`a>#y K&XAfPzEP`Y ]5,CV@wxĀڼ]xX4X2H04}+2좁ru(ӎEVeZz-͓T@lUٰ [Ж|;JKj()`5[PF!xKݚqXSZ=U{zp\̈́ՙ\Sm~{ɩդ2Xe*a⩄5{xnP\z@A
õ݆3A(e 4>
U2!Y/
%[Ē y{1`ЌWu9
_H0r%
UĕdP_yc_ߍ(21|c/j[۴9 ]We[u5* ֊|ݒ & |^.DžPp } S \ CQ A\ zjqQDbhЃw'c)^M,bbUav(aDIM {-
iu@)O
yh &Z\rc0i Yx{U)EFN,dIDh|hBIDK &P[wX+ P XX@(0p8g@;ne
i0;~b;bmf]PIHbDhOرhKpVیV&Xȅz EXL>J {No{ Vcg;b~ @#PxhbCB6 ,˃wnr
]/~hɾY}CX
ڀRN \P@y RXy+Pn_V8ke*~y/5]'>akPbbnޮ8%Y`vhOpͰy(Ե| 8~#&
x ?\. A ych/l8y & &~ׂ{@S8S/~lURȌT0Ŋ}=l̸jiI"t^M<{H90Zk0uO(^& yXn^]x?Yr>xd冏>
/w ~<ޣ@d sx(lmSigʄ ͖N 8o<Jxv"yAui]nx`+*
>pj X s{Vx}h"|J n8z$X)ɣb^ ό6j Di檶`TB 2pq8 >X>`7(
$3P U v{Ȇk1]wl LW3 s t@ i2@M~GH_=˜]|[i|XPN
Touȅ>x\y pXoHr)_{(
{!"` afl(Rh s Vmoh~dЛKnΕmmu%˄;{w{`qNg~@k#1u."E>+ x p= h~iم{ \Cy> I9 rHCzt wz7/?4V;Uٔ/$k'|g6Xȏ 7X`֗8
TƊups0l@c{
ʕ
qЅHvb+ vȟɧX8 g 6)I8@?zGs&g
2l!Ĉ'Rh"ƃm8%!2F^dϟ9hPjԮk+2 a<d 3(j P#$$ʉUr:G b bXk,ܸrҭ4ͅMʱcFԪU;jhcؕ;N'Sl2xfLD3^=ZwRy,-=$HS3[|uMT/ 덫n=/",Vm2Ǔ/
Kwx>l?b/5?
8 eU V^`mPDACEEJ/t 3p@!pŵؒs _6ol ߩ)#\$xY
V}؎QJ9%x7m!`D pÈ% 8}bҒ$})1x
"%ب<:cT\QA I$ Y:*])? tefB4b
DE
;XB(pȝ%=zmy]9D-D}n:eA.C
frЭp4 +mJ2wF! :%1Um jl!JUO7@UR'p#< 1<B Q
.\QQI o4m&7祼l:3l7=66PbTJ#$ )H'=1wpYRP}VpP+@?P [kڵy3Ҿg[~yfco:'tv
-bwV'(S{[߱x8A8c&8$H:m~<i~|}pX,Q QQꇺ
M?>>tR5u `B 6/ djZD7S|n;LZ2/FX3
r Ԡ:w@Q JYQG n?{! @̱(DOtq{S h>ei- V 1Ndbu@N;
"^ /TFpP0 |
r#JFAWc$""AC0t0z:}p4<ȣ ' 'Da 6) "/'78I8B%(MtE7P%D2RL<
U&H(+I U0"#,ky\bV$N<E&xBt3Te 6
o3 6PwH
3J $t,f!@0)Ӟ ӌD
i(ЕZɠsAiP\C9ntQ"tFV~b3!dB?ҩjL=TAt9Xьr8BbtO:z5I_HjOpp c#URobՕT P{h<:D9=+Z:. TQOo"4@*^S!\ 2C4ċ$?HTO%d#+ġ >U $8y C DEH(h$tVDp
@+PD2$PdFHt ]~
)CF^n7/ed 1u3\GP 6@2YBf<,`:]z3`w1 - vT+^ H !` ŒEWl82
=,à]è
( e&2 0D|PBUf`@Y={BSgQ8A8@-nA=$2\Σ Yvr(b%@AN Yx@~# ^9fS!rh)FR^t@EcK#A0#i.@8 p5CDdRoԠ=<jx5+5r( Q$-pdC820ZVkm{ Fr-^ 83_| 6?\s(&*aML㕑2h!6C
j
,'vyDrQjOːxA~bTSC(g , o8oO]2)=wG.;eAp' o6w- 671ecV~; =C/zy(hNI= \{ƃ}se?{b?Sn ?
9 G~w|1>췯U j@ a b8K
<}
B @' ͅ < yE
@
E
DӭB: 48 9 B @K_h@ K\ M/tH8 jEH8 _"x,@P`F@
!@
h F@<& j\(>
*xC%Tr^H@9\ߣ!B_ N`n)D " N &j`\ 8܂:^B#R4.R?|8,൸Kb'v)+Ο(2#+bN+nYA2@/#AB}8%X '@<ր!!< @=6c+b+bcS| 7H+x}9>$E `1y8 M2¢ J^# @^czf\B3.V@$N^09~<Z)h%!(A3:aQ "P bT.BTPv~8$Z]%(5`$(ӡB3`5^"<H<:<\N%ɡ3" ^>傂T !`b <8V B&h #eZ`bfyhZ^hǩfeB&y &<TB.&p7#:XP\̂5$ffpN'
M(@(9 i&* 8c4"ug}xބ T>pw*) CsV]'z'!Lz(g|wr?BeBсc',u
{BCr-@7(2'D(N:BOd 67\C-\b yO Hg($h(ց28XJt'"4d82AfAB&OҀ B0\8dC6.x ^C6x<C0 @Qj)7@ (hT
C0
V5>Z쀗D)^z<½*(XXj.$t*!iu Ѐk*$2BJEA,' ;<maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Tunnel Endpoints Page - Custom Configuration</maml:title><maml:introduction>
<maml:para>Use this wizard page to configure the endpoint options for an IPsec tunnel rule. </maml:para>
<maml:para>If you select <maml:ui>Custom configuration</maml:ui> on the <maml:ui>Tunnel Type</maml:ui> page, you can configure all of the details of the tunnel on the <maml:ui>Tunnel Endpoints</maml:ui> page. </maml:para>
<maml:para>The following diagram shows the components that you can configure by using this wizard page.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=64ce07a8-52a2-4d69-a392-2cae596fef27" mimeType="image/gif"><maml:summary></maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Tunnel</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, click <maml:ui>Tunnel Type</maml:ui>, and then select <maml:ui>Custom configuration</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Tunnel Endpoints</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Which computers are in Endpoint 1?</maml:title><maml:introduction>
<maml:para>Endpoint 1 is the collection of computers at the local end of the tunnel that must be able to send data to and receive data from the computers that are part of Endpoint 2. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Address</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>What is the local tunnel endpoint (closest to the computers in Endpoint 1)?</maml:title><maml:introduction>
<maml:para>The local tunnel endpoint is the gateway to which a computer in Endpoint 1 sends network packets that are addressed to a computer in Endpoint 2. The local tunnel endpoint accepts a network packet from a computer in Endpoint 1, and then encapsulates it in a new network packet that is addressed and routed to the remote tunnel endpoint. The remote tunnel endpoint extracts the encapsulated original packet, places it on the network connected to the computers in Endpoint 2, and then routes the packet to its final destination. </maml:para>
<maml:para>You can specify an Internet Protocol version 4 (IPv4) address, an Internet Protocol version 6 (IPv6) address, or both. To add an address, click <maml:ui>Edit</maml:ui>, and provide the information required in the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>If you specify <maml:ui>Any</maml:ui>, then the computer in Endpoint 1 is also the local tunnel endpoint for the connection. The Endpoint 1 computer encapsulates and routes its own network packets to the remote tunnel endpoint, which extracts and routes the data to the destination computer in Endpoint 2.</maml:para></maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>The IP version of the address at each end of the tunnel must match. For example, if you specify an IPv4 address at one end, then the other end must also have an IPv4 address. You can specify both an IPv4 and an IPv6 address, but if you do so at one end, then you must also do so at the other end.</maml:para></maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Apply IPsec tunnel authorization</maml:title><maml:introduction>
<maml:para>Select this option to specify that the computer or user in Endpoint 1 must authenticate with the local tunnel endpoint before any packets can be sent through the tunnel. To specify the computers or users that are authorized to send traffic through the tunnel, follow these steps:</maml:para>
<maml:para>Membership in the local <maml:phrase>Administrators</maml:phrase> group, or equivalent, is the minimum required to complete this procedure.</maml:para>
<maml:procedure><maml:title>To specify users and computers that are authorized or denied permission to send network traffic through the tunnel</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, select <maml:ui>Windows Firewall with Advanced Security</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Select the <maml:ui>IPsec Settings</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>IPsec tunnel authorization</maml:ui>, click <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Add users and computers to the lists, as appropriate for your design. For more information, see <maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Tunnel Authorization</maml:linkText><maml:uri href="mshelp://windows/?id=f637c2d4-a8aa-4e7a-b437-86b8e3accc7f"></maml:uri></maml:navigationLink>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>What is the remote tunnel endpoint (closest to the computers in Endpoint 2)?</maml:title><maml:introduction>
<maml:para>The remote tunnel endpoint is the gateway to which the local tunnel endpoint sends network packets that are addressed to a computer in Endpoint 2. The remote tunnel endpoint receives a network packet from the local tunnel computer, extracts the encapsulated original packet, and then routes it to the destination computer in Endpoint 2.</maml:para>
<maml:para>You can specify an IPv4 address, an IPv6 address, or both. To add an address, click <maml:ui>Edit</maml:ui> and provide the information required in the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>If you specify <maml:ui>Any</maml:ui>, then the computer in Endpoint 2 that is receiving the data also serves as the remote tunnel endpoint. The Endpoint 2 computer then extracts and processes the original packet.</maml:para></maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>The IP version of the address at each end of the tunnel must match. For example, if you specify an IPv4 address at one end, then the other end must also have an IPv4 address. You can specify both and IPv4 and an IPv6 address, but if you do so at one end, then you must also do so at the other end.</maml:para></maml:alertSet>
</maml:introduction>
</maml:section><maml:section><maml:title>Which computers are in Endpoint 2?</maml:title><maml:introduction>
<maml:para>Endpoint 2 is the collection of computers at the remote end of the tunnel that must be able to send and receive data from the computers that are part of Endpoint 1. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Address</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the computers that are in Endpoint 1 and Endpoint 2, select the <maml:ui>Computers</maml:ui> tab. To change the authorization setting or the computers that serve as tunnel endpoints, select the <maml:ui>Advanced</maml:ui> tab, and then under <maml:ui>IPsec tunneling</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize ICMP Settings</maml:title><maml:introduction>
<maml:para>Use this dialog box when creating or modifying a firewall rule to configure criteria based on Internet Control Message Protocol (ICMP).</maml:para>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a new firewall rule using the wizard, follow these steps:</maml:para></maml:section></maml:sections><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Protocol and Ports</maml:ui> page, in <maml:ui>Protocol type</maml:ui>, select either <maml:ui>ICMPv4</maml:ui> or <maml:ui>ICMPv6</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing firewall rule using the <maml:ui>Firewall Rule Properties</maml:ui> dialog box, follow these steps:</maml:para></maml:section></maml:sections><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Protocol type</maml:ui>, select either <maml:ui>ICMPv4</maml:ui> or <maml:ui>ICMPv6</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>All ICMP types</maml:title><maml:introduction>
<maml:para>Select this option to specify that any message using ICMP matches the rule.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Specific ICMP types</maml:title><maml:introduction>
<maml:para>Select this option to select one or more ICMP message types. Select the message types to which you want to apply the rule.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>This ICMP type</maml:title><maml:introduction>
<maml:para>Use this option to specify an ICMP message type that is not provided in <maml:ui>Specific ICMP types</maml:ui>. This option is enabled only if you select <maml:ui>Specific ICMP types</maml:ui>. Click <maml:ui>Add</maml:ui> to add the type to the list. </maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Type</maml:title><maml:introduction>
<maml:para>This is a number that correlates to an ICMP message type. For example, 3 is the number for the "Destination Unreachable" message. The message type is an integer from 0 to 255.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Code</maml:title><maml:introduction>
<maml:para>This is a number that correlates to a code for an ICMP message type. These codes are details that are useful for troubleshooting and understanding the circumstances that prompted the sending of the message. The same code number can mean different things for different message types. For example, 3 is the code for "Port Unreachable" for the "Destination Unreachable" message, but it is also the code for "Redirect Datagram for the Type of Service and Host" for the "Redirect" message type.</maml:para>
<maml:para>The code can be an integer from 0 to 255, or the value <maml:ui>Any</maml:ui>.</maml:para>
<maml:para>By combining the message type and code, you can specify very detailed criteria for the exception. This can be useful when you need to make sure specified ICMP messages pass through Windows Firewall with Advanced Security for remote troubleshooting, while other ICMP messages are blocked.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Predefined Rules Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to enable or disable rules that are part of a predefined rule group. Predefined rules provide network connectivity for Microsoft Windows programs and services. The rules displayed on this page are determined by the group you select in the list on the <maml:ui>Rule Type</maml:ui> page.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Predefined</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>From the list, select the group that contains the predefined rules that you want to manage, and then click <maml:ui>Next</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Which rules would you like to create?</maml:title><maml:introduction>
<maml:para>Select each rule that you want to create or, if the rule already exists, enable.</maml:para>
<maml:para>The list on the <maml:ui>Predefined Rules</maml:ui> wizard page shows the rules in the selected group and the properties of each of the rules. Most of the well-known Windows services and programs available on computers running this version of Windows appear in this list.</maml:para>
<maml:para>By default, when you use this page to configure a Group Policy object (GPO), all of the check boxes for rules in a group are selected. By default, when you use this page to edit the local computer’s active configuration, all of the check boxes for rules in a group are cleared.</maml:para>
<maml:para>If you select a rule where <maml:ui>No</maml:ui> appears in the <maml:ui>Rule Exists</maml:ui> column, and then complete the steps in the wizard, the rule is created with the properties shown in the list, and enabled.</maml:para>
<maml:para>If you select a rule where <maml:ui>Already exists</maml:ui> appears in the <maml:ui>Rule Exists</maml:ui> column, and then complete the steps in the wizard, the new settings overwrite the existing settings, and the rule is enabled.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitored Quick Mode Security Associations</maml:title><maml:introduction>
<maml:para>A quick mode negotiation establishes a secure channel between two computers to protect user data exchanged between them. During quick mode negotiation, keying material is refreshed or, if necessary, new keys are generated. A protection suite that protects the IP data traffic is also selected. The exchange of information required to negotiate a quick mode SA is performed within the context of the main mode SA. After the quick mode SA is established, then the two computers can exchange network packets within the context of the quick mode SA. There is only one main mode SA between a pair of computers, but there can be many quick mode SAs. Monitoring quick mode SAs can provide information about which peers are currently connected to this computer, and which protection suite is protecting the data exchanged between them. Separate SAs are created for Internet Protocol version 4 (IPv4) and Internet Protocol version 6 (IPv6) connections.</maml:para>
<maml:procedure><maml:title>To get to this view</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, expand <maml:ui>Security Associations</maml:ui>, and then click <maml:ui>Quick Mode</maml:ui>. </maml:para></maml:section></maml:sections></maml:step></maml:procedure>
<maml:para>The following information is available in the table view of all quick mode SAs. To see the information for single quick mode SA, double-click the item in the list. </maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Quick mode SA information</maml:title><maml:introduction>
<maml:para>You can add, remove, reorder, and sort by these columns in the Results pane:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:ui>Local IP address</maml:ui>: The local IP address.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Local port</maml:ui>: The TCP or UDP port of the local computer used in the filter.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Remote IP address</maml:ui>: The IP address of the remote computer or peer.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Remote port</maml:ui>: The TCP or UDP port of the remote computer used in the filter.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>Protocol</maml:ui>: The protocol specified in the filter.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>AH integrity</maml:ui>: The AH protocol-specific data integrity method used for peer communications.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>ESP integrity</maml:ui>: The ESP protocol-specific encryption method used for peer communications.</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:ui>ESP confidentiality</maml:ui>: The ESP protocol-specific encryption method used for peer communications.</maml:para></maml:listItem>
</maml:list>
<maml:para>Any user account can be used to complete this procedure.</maml:para>
<maml:procedure><maml:title>To add, remove, or reorder a column</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click in a blank area in the Results pane for the Quick Mode folder, select <maml:ui>View</maml:ui>, and then click <maml:ui>Add/Remove Columns</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the <maml:ui>Add/Remove Columns</maml:ui> dialog box, from the <maml:ui>Available columns</maml:ui> list, select the column you want to view, and then click <maml:ui>Add</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>You can also select columns that you do not want to view. From the <maml:ui>Displayed columns</maml:ui> list, click <maml:ui>Remove</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>To reorder the columns, from left to right, select a column in the <maml:ui>Displayed columns</maml:ui> list, and then click <maml:ui>Move Up</maml:ui> or <maml:ui>Move Down</maml:ui>. You can select only one column name at a time.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When you are finished, click <maml:ui>OK</maml:ui>. The view will change to reflect your preferences.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Main Mode Security Associations</maml:linkText><maml:uri href="mshelp://windows/?id=39e393da-18a6-4a1d-85d1-d9dcb46e3b93"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Scope Tab</maml:title><maml:introduction>
<maml:para>Use this tab to specify the local and remote IP addresses whose network traffic matches this rule. If the local computer is listed in the local IP addresses, then all network traffic going to or from any of the remote IP addresses matches this rule.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>Scope</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Local IP address</maml:title><maml:introduction>
<maml:para>The local IP address is used by the local computer to determine if the rule applies. The rule applies only to network traffic that goes through a network adapter that is configured to use one of the specified local IP addresses.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches a network packet with any address specified as the local IP address. The local computer always matches the rule when this option is selected.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches network traffic that has one of the addresses specified in <maml:ui>Local IP address</maml:ui>. If the local computer does not have a network adapter configured with one of the specified IP addresses, then the rule does not apply. On the <maml:ui>IP Address</maml:ui> dialog box, click <maml:ui>Add</maml:ui> to create a new entry in the list or <maml:ui>Edit</maml:ui> to change an existing entry in the list. You can also delete an entry from the list by selecting the item and then clicking <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Remote IP address</maml:title><maml:introduction>
<maml:para>Specify the remote IP addresses to which the rule applies. Network traffic matches the rule if the destination IP address is one of the addresses in the list.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches network packets that are addressed from (for inbound rules) or addressed to (for outbound rules) any IP address included in the list.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches only network traffic that has one of the addresses specified in <maml:ui>Remote IP address</maml:ui>. On the <maml:ui>IP Address</maml:ui> dialog box, click <maml:ui>Add</maml:ui> to create a new entry in the list or <maml:ui>Edit</maml:ui> to change an existing entry in the list. You can also delete an entry from the list by selecting the item and then clicking <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Properties Page: Computers Tab</maml:title><maml:introduction>
<maml:para>Use the settings on this tab of the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box to specify the computers that can participate in connections protected by this connection security rule. The connection security rule applies to communications between any computer in <maml:ui>Endpoint 1</maml:ui> and any computer in <maml:ui>Endpoint 2</maml:ui>. If the local computer has an IP address that is included in one of the endpoint definitions, then it can send and receive network packets through this connection to computers that are listed as part of the other endpoint. An endpoint can consist of a single computer or a group of computers, defined by an IP address, an IP subnet address, an IP address range, or a predefined set of computers identified by role: default gateway, WINS servers, DHCP servers, DNS servers, or local subnet. The local subnet is the collection of all computers available to this computer, except for any public IP addresses (interfaces). This includes both local area network (LAN) and wireless addresses.</maml:para>
<maml:para>The following figure shows the components that you can configure by using this tab.</maml:para>
<maml:para><maml:embedObject><maml:objectUri href="mshelp://windows/?id=64ce07a8-52a2-4d69-a392-2cae596fef27" mimeType="image/gif"><maml:summary></maml:summary></maml:objectUri></maml:embedObject></maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, click <maml:ui>Connection Security Rules</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click the rule you want to modify, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Computers</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure></maml:introduction><maml:content><maml:sections><maml:section><maml:title>Endpoint 1</maml:title><maml:introduction>
<maml:para>Endpoint 1 is the collection of computers at the local end of the tunnel that must be able to send data to and receive data from the computers that are part of Endpoint 2. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Address</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
<maml:para>If you created this rule by using the Client-to-Gateway tunnel rule type, then Endpoint 1 is set to <maml:ui>Any IP address</maml:ui>. If you created this rule by using the Gateway-to-Client tunnel rule type, then Endpoint 1 consists of the IP addresses of the computers on the private network behind the local tunnel endpoint (the gateway).</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that Endpoint 1 includes any computer that needs to communicate with a computer that is in Endpoint 2. Any network traffic to or from a computer in Endpoint 2 matches this rule and is subject to its authentication requirements.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify the IP addresses of the computers that make up Endpoint 1. Click <maml:ui>Add</maml:ui> or <maml:ui>Edit</maml:ui> to display the <maml:ui>IP Address</maml:ui> dialog box where you can create or change your entries.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Endpoint 2</maml:title><maml:introduction>
<maml:para>Endpoint 2 is the collection of computers at the remote end of the tunnel that must be able to send and receive data from the computers that are part of Endpoint 1. Click <maml:ui>Add</maml:ui> to add an individual IP address, an IP subnet address, an IP address range, or a predefined set of computers by using the <maml:ui>IP Address</maml:ui> dialog box. To change an entry in the list, select the item, and then click <maml:ui>Edit</maml:ui>. To remove an entry, select the item, and then click <maml:ui>Remove</maml:ui>.</maml:para>
<maml:para>If you created this rule by using the Client-to-Gateway tunnel rule type, then Endpoint 2 consists of the IP addresses of the computers on the private network behind the remote tunnel endpoint (the gateway). If you created this rule by using the Gateway-to-Client tunnel rule type, then Endpoint 2 is set to <maml:ui>Any IP address</maml:ui>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that Endpoint 2 includes any computer that needs to communicate with a computer in Endpoint 1. Any network traffic to or from a computer in Endpoint 1 matches this rule and is subject to its authentication requirements.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify the IP addresses of the computers that make up Endpoint 2. Click <maml:ui>Add</maml:ui> or <maml:ui>Edit</maml:ui> to display the <maml:ui>IP Address</maml:ui> dialog box where you can create or change your entries.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Firewall Rules</maml:title><maml:introduction>
<maml:para>You create firewall rules to allow this computer to send traffic to, or receive traffic from, programs, system services, computers, or users. Firewall rules can be created to take one of three actions for all connections that match the rule's criteria:</maml:para><maml:list class="unordered">
<maml:listItem><maml:para>Allow the connection.</maml:para></maml:listItem>
<maml:listItem><maml:para>Allow a connection only if it is secured through the use of Internet Protocol security (IPsec).</maml:para></maml:listItem>
<maml:listItem><maml:para>Block the connection.</maml:para></maml:listItem>
</maml:list>
<maml:para>Rules can be created for either inbound traffic or outbound traffic. The rule can be configured to specify the computers or users, program, service, or port and protocol. You can specify which type of network adapter the rule will be applied to: local area network (LAN), wireless, remote access, such as a virtual private network (VPN) connection, or all types. You can also configure the rule to be applied when any profile is being used or only when a specified profile is being used.</maml:para>
<maml:para>As your IT environment changes, you might have to change, create, disable, or delete rules.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding Firewall Rules</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137808"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137808)</maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Configuring Firewall Rules</maml:linkText><maml:uri href="mshelp://windows/?id=f87bdc33-14b4-4832-b190-377f16d7e671"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Profile Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify the profiles to which this rule is applied. Select any combination of profiles that meet your security goals.</maml:para>
<maml:para>This version of Windows supports multiple simultaneously active profiles. Each network adapter card attached to a network is assigned one of the following profiles based on what is detected on the attached network. This means that different firewall and connection security rules can affect network traffic, depending on which network adapter receives the traffic.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Profile</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Domain</maml:title><maml:introduction>
<maml:para>The domain profile applies to a network when a domain controller is detected for the domain to which the local computer is joined. If you select this box, then the rule applies to network traffic passing through a network adapter connected to this network.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Private</maml:title><maml:introduction>
<maml:para>The private profile applies to a network when it is marked private by the computer administrator and it is not a domain network. Newly detected networks are not marked private by default. A network should be marked private only when there is some kind of security device, such as a network address translator or perimeter firewall, between the computer and the Internet. The private profile settings should be more restrictive than the domain profile settings.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Public</maml:title><maml:introduction>
<maml:para>The public profile applies to a network when the computer is connected directly to a public network, such as one available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as it is in an IT environment.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>. To change the profiles to which the rule applies, select the <maml:ui>Advanced</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Firewall Rules - Programs and Ports Page</maml:title><maml:introduction>
<maml:para>This tab shows information about the protocols and ports that are used to match network packets to an inbound or outbound firewall rule that is being applied to the computer.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Firewall</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the firewall rule you want to examine, and then click the <maml:ui>Programs and Ports</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol</maml:title><maml:introduction>
<maml:para>This indicates the IP protocol type to which the rule applies, as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Local port</maml:title><maml:introduction>
<maml:para>If you are using the UDP or TCP protocol type, this indicates the UDP or TCP port to which the rule applies, on the computer where the firewall rule is applied, as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Remote port</maml:title><maml:introduction>
<maml:para>If the rule applies to the UDP or TCP protocol, this indicates the UDP or TCP port to which the rule applies, on the remote computer that is attempting to communicate with the computer where the firewall rule is applied, as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>ICMP settings</maml:title><maml:introduction>
<maml:para>If the rule applies to the Internet Control Message Protocol (ICMP) version 4 or ICMP version 6 protocol, this indicates the ICMP types and codes that are included, as configured on the <maml:ui>Protocols and Ports</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Program</maml:title><maml:introduction>
<maml:para>This indicates the program file name and path of the application to which the rule applies, as configured on the <maml:ui>Programs and Services</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Service</maml:title><maml:introduction>
<maml:para>If the program item is a service container, this indicates the service within the container to which the rule applies, as configured on the <maml:ui>Programs and Services</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Firewall Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=20b3aba6-884a-4ef9-8ea7-914e4cd735d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitored Connection Security Rules Properties Page</maml:title><maml:introduction>
<maml:para>This section describes the tabs on the <maml:ui>Connection Security Rule Properties</maml:ui> page for rules displayed in <maml:ui>Monitoring</maml:ui> in Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>General</maml:linkText><maml:uri href="mshelp://windows/?id=5ca392ca-aece-4319-90c5-80544a29b8e9"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Authentication</maml:linkText><maml:uri href="mshelp://windows/?id=53d4595a-b6b0-4133-be9e-03dcecef56e6"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Advanced</maml:linkText><maml:uri href="mshelp://windows/?id=ed344be2-ee6d-4a37-ac31-4f0b9763d04b"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Profile Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify the profiles to which this rule is applied. Select any combination of profiles that meet your security goals.</maml:para>
<maml:para>This version of Windows supports multiple simultaneously active profiles. Each network adapter card attached to a network is assigned one of the following profiles based on what is detected on the attached network. This means that different firewall and connection security rules can affect network traffic, depending on which network adapter receives the traffic.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Profile</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Domain</maml:title><maml:introduction>
<maml:para>The domain profile applies to a network when a domain controller for local computer’s domain is detected. If you select this box, then the rule applies to network traffic passing through the network adapter connected to this network.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Private</maml:title><maml:introduction>
<maml:para>The private profile applies to a network when it is marked private by the computer administrator and it is not a domain network. Newly detected networks are not marked private by default. A network should be marked private only when there is some kind of security device, such as a network address translator or perimeter firewall, between the computer and the Internet. The private profile settings should be more restrictive than the domain profile settings.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Public</maml:title><maml:introduction>
<maml:para>The public profile applies to a network when the computer is connected directly to a public network, such as one available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where security cannot be as tightly controlled as it is in an IT environment.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the profiles to which the rule applies, select the <maml:ui>Advanced</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Protected Network Connections for a Firewall Profile</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure the network connections that are protected by the rules associated with a specified network profile.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>From the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Select the tab that corresponds to the firewall profile you want to configure.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>State</maml:ui>, next to <maml:ui>Protected network connections</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
<maml:para>The list contains the network connections that are currently configured on the computer. By default, all network connections are selected and therefore protected. </maml:para>
<maml:para>You typically see one connection for each wired network adapter, each wireless network adapter, and each configured remote network connection (such as a VPN). Select the box next to the entry for each connection that you want protected by the rules that are assigned to the currently selected profile (the currently selected tab). Each entry is shown by its descriptive name.</maml:para>
<maml:para>If you clear the check box, then that network connection is not subject to the rules in the current profile when that network connection is connected to a network that matches the profile.</maml:para>
<maml:para>For more information about a particular network connection, use the Network and Sharing Center. To open the Network and Sharing Center, click <maml:ui>Start</maml:ui>, click <maml:ui>Control Panel</maml:ui>, click <maml:ui>Network and Internet</maml:ui>, and then click <maml:ui>Network and Sharing Center</maml:ui>. To rename a network connection, click <maml:ui>Change adapter settings</maml:ui>, right-click the adapter, click <maml:ui>Rename</maml:ui>, and then type a descriptive name for the network connection. The Network and Sharing Center also allows you to reclassify a public network to private, and vice versa. You cannot reclassify a network to or from the domain type.</maml:para>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Firewall Profiles</maml:title><maml:introduction>
<maml:para>A firewall profile is a way of grouping settings, such as firewall rules and connection security rules, that are applied to the computer depending on where the computer is connected. On computers running this version of Windows, there are three profiles for Windows Firewall with Advanced Security:</maml:para>
<maml:table>
<maml:tableHeader><maml:row><maml:entry><maml:para>Profile</maml:para></maml:entry><maml:entry><maml:para>Description</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row>
<maml:entry><maml:para>Domain</maml:para></maml:entry>
<maml:entry><maml:para>Applied to a network adapter when it is connected to a network on which it can detect a domain controller of the domain to which the computer is joined.</maml:para></maml:entry>
</maml:row>
<maml:row>
<maml:entry><maml:para>Private</maml:para></maml:entry>
<maml:entry><maml:para>Applied to a network adapter when it is connected to a network that is identified by the administrator as a private network. A private network is one that is not connected directly to the Internet, but is behind some kind of security device, such as a network address translation (NAT) router or hardware firewall. The private profile settings should be more restrictive than the domain profile settings.</maml:para></maml:entry>
</maml:row>
<maml:row>
<maml:entry><maml:para>Public</maml:para></maml:entry>
<maml:entry><maml:para>Applied to a network adapter when it is connected to a public network such as those available in airports and coffee shops. A public network is one that has no security devices between the computer and the Internet. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be controlled.</maml:para></maml:entry>
</maml:row>
</maml:table>
<maml:para>Each network adapter is assigned the firewall profile that matches the detected network type. For example, if a network adapter is connected to a public network, then all traffic going to or from that network is filtered by the firewall rules associated with the public profile.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>Windows Server 2008 R2 and Windows 7 provide support for multiple active per-network adapter profiles. In Windows Vista and Windows Server 2008, only one profile can be active on the computer at a time. If there are multiple network adapters connected to different networks, then the profile with the most restrictive profile settings is applied to all adapters on the computer. The public profile is considered to be the most restrictive, followed by the private profile; the domain profile is considered to be the least restrictive.</maml:para></maml:alertSet>
<maml:para>If you do not alter the settings for a profile, then its default values are applied whenever Windows Firewall with Advanced Security uses the profile. We recommend that you enable Windows Firewall with Advanced Security for all three profiles.</maml:para>
<maml:para>To configure these profiles, in the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Windows Firewall with Advanced Security</maml:ui>, and then click <maml:ui>Properties</maml:ui>. You can also access the properties from the <maml:ui>Action</maml:ui> menu, the <maml:ui>Action</maml:ui> pane, or the center pane, when Windows Firewall with Advanced Security is highlighted.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=05d277a3-2b83-4951-a2fc-e2ca78a24f24"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Advanced Key Exchange Settings</maml:title><maml:introduction>
<maml:para>Use this dialog box to add, edit, change priority, or remove the algorithm combinations that are available for key exchange during main mode negotiations. You can specify more than one algorithm combination and you can assign the order in which the combinations are tried. The first combination in the list that is compatible with both peers will be used.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>A best practice is to list the algorithm combinations in order of highest security at the top to lowest security at the bottom. This way, the most secure algorithm in common between the two negotiating computers is used. The less secure algorithms can be used for backward compatibility.</maml:para></maml:alertSet>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Key exchange (Main Mode)</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Security methods</maml:title><maml:introduction>
<maml:para>Security methods are combinations of integrity algorithms and encryption algorithms that protect the key exchange. You can have as many combinations as you need and you can arrange them in preferred order in the list. The combinations are attempted in the order in which they are displayed. The first set to be agreed upon by both peer computers is used. If the peer computer cannot use any of the combinations you define, the connection attempt fails.</maml:para>
<maml:para>Some algorithms are supported only by computers running this version of Windows. For more information, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Protocols Supported by Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?LinkID=129230).</maml:para>
<maml:para>To add a combination to the list, click <maml:ui>Add</maml:ui> to use the <maml:ui>Add or Edit Security Method</maml:ui> dialog box.</maml:para>
<maml:para>To reorder the list, select a combination, and then click the up or down arrows.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>As a best practice, order the combinations from highest security at the top of the list to lowest security at the bottom. This ensures that the most secure method that both peers can support is used.</maml:para>
</maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Key lifetimes</maml:title><maml:introduction>
<maml:para>Lifetime settings determine when a new key is generated. Key lifetimes allow you to force the generation of a new key after a specified time interval or after a specified number of sessions have been protected by using the current key. Using multiple keys ensures that if an attacker manages to gain access to one key, only a small amount of information is exposed before a new key is generated and the network traffic is protected once again. You can specify the lifetime in both minutes and number of sessions. The first threshold reached is used and the key is regenerated.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This key regeneration is for main mode key exchange only. These settings do not affect the key lifetime settings for quick mode data protection. </maml:para></maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Minutes</maml:title><maml:introduction>
<maml:para>Use this setting to configure how long the key used in main mode security association lasts, in minutes. After this interval, a new key is generated. Subsequent main mode sessions use the new key.</maml:para>
<maml:para>The maximum lifetime is 2,879 minutes (48 hours). The minimum lifetime is 1 minute. We recommend that you rekey only as frequently as your risk analysis requires. Excessively frequent rekeying can impact performance.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Sessions</maml:title><maml:introduction>
<maml:para>A session is a distinct message or set of messages protected by a quick mode SA. This setting specifies how many quick mode key generating sessions can be protected using the same main mode key information. After this threshold is reached, the counter is reset, and a new key is generated. Subsequent communications will use the new key. The maximum value is 2,147,483,647 sessions. The minimum value is 0 sessions.</maml:para>
<maml:para>A session limit of zero (0) causes the generation of a new key to be determined only by the <maml:ui>Key lifetime (in minutes)</maml:ui> setting.</maml:para>
<maml:para>Use caution when setting very different key lifetimes for main mode and quick mode keys. For example, setting a main mode key lifetime of 8 hours and a quick mode key lifetime of 2 hours might leave a quick mode SA in place for almost 2 hours after the main mode SA has expired. This occurs when the quick mode SA is generated shortly before main mode SA expiration.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>The higher the number of sessions allowed per main mode key, the greater the chance of the main mode key being discovered. If you want to limit the number of times this reuse occurs, you can specify a quick mode key limit.</maml:para></maml:alertSet>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>To configure main mode perfect forward secrecy (PFS), set <maml:ui>Key lifetime in sessions</maml:ui> to 1. Although this configuration provides significant additional protection, it also carries a significant computational and network performance penalty. Every new quick mode session regenerates the main mode keying material, which in turn causes the two computers to reauthenticate. We recommend that you enable PFS only in environments where IPsec traffic might be exposed to sophisticated attackers who might try to compromise the strong cryptographic protection provided by IPsec.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section>
<maml:title>Key exchange options</maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title>Use Diffie-Hellman for enhanced security</maml:title><maml:introduction>
<maml:para>Windows Vista and later versions of Windows support Authenticated IP (AuthIP) in addition to Internet Key Exchange (IKE) for establishing the initial secure connection in which the rest of the IPsec parameters are negotiated. IKE uses Diffie-Hellman exchanges only. When AuthIP is used, no Diffie-Hellman key exchange protocol is required. Instead, when Kerberos version 5 authentication is requested, the Kerberos version 5 service ticket secret is used in place of a Diffie-Hellman value. When either certificate authentication or NTLM authentication is requested, a transport level security (TLS) session is established, and its secret is used in place of the Diffie-Hellman value.</maml:para>
<maml:para>If you select this check box, then a Diffie-Hellman exchange takes place regardless of the authentication type selected, and the Diffie-Hellman secret is used to secure the rest of the IPsec negotiations. Use this when regulatory requirements specify that a Diffie-Hellman exchange must be used.</maml:para>
</maml:introduction></maml:section>
</maml:sections></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Protocol and Ports Page - Port Rule Type</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify which protocol and which port or ports specified in a network packet match this firewall rule. Only network traffic that matches the criteria on this page matches the rule and is subject to its action setting.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui> , and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Port</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Protocol and Ports</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Does this rule apply to TCP or UDP?</maml:title><maml:introduction>
<maml:para>Select the protocol whose network traffic you want to filter with this firewall rule. If you need to filter based on a protocol other than TCP or UDP, then you must use the <maml:ui>Custom</maml:ui> rule type on the <maml:ui>Rule Type</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Inbound rules: Does this rule apply to all local ports or specific local ports?</maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title>All local ports</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule to inbound network traffic that matches any local port number.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Specific local ports</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule only to inbound network traffic that matches a local port number listed in the text box. You can specify multiple port numbers, separated by commas. You can also include a range of port numbers by separating the low and high values with a hyphen.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Outbound rules: Does this rule apply to all remote ports or specific remote ports?</maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title>All remote ports</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule to outbound network traffic that matches any destination port number.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Specific remote ports</maml:title><maml:introduction>
<maml:para>Use this option to apply the rule only to network traffic that matches a destination port number listed in the text box. You can specify multiple port numbers, separated by commas. You can also include a range of port numbers by separating the low and high values with a hyphen.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui> and <maml:ui>Outbound Rules</maml:ui>. To change the protocols and port numbers for this rule, select the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add or Edit Integrity and Encryption Algorithms</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure an algorithm offer that includes both data integrity and data confidentiality (encryption) and that is available when negotiating quick mode security associations. You must specify both the protocol and the algorithm used to protect the integrity of the data in the network packet.</maml:para>
<maml:para>Internet Protocol security (IPsec) provides integrity by calculating a hash generated from the data in the network packet. The hash is then cryptographically signed (encrypted) and embedded in the IP packet. The receiving computer uses the same algorithm to calculate the hash, and compares the result to the hash that is embedded in the received packet. If it matches, then the information received is exactly the same as the information sent, and the packet is accepted. If it does not match, then the packet is dropped.</maml:para>
<maml:para>Using an encrypted hash of the transmitted message makes it computationally infeasible to change the message without a resulting mismatch with the hash. This is critical when data is exchanged over an unsecured network such as the Internet and provides a way to know that the message was not changed during transit.</maml:para>
<maml:para>In addition to integrity protection, this dialog box allows you to specify an encryption algorithm that helps prevent the data from being read if the network packet is intercepted while in transit.</maml:para>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in page, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Data protection (Quick Mode)</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Data integrity and encryption</maml:ui>, select an algorithm combination from the list, and click <maml:ui>Edit</maml:ui> or <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure></maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol</maml:title><maml:introduction>
<maml:para>The following protocols are used to embed the integrity and encryption information into an IP packet.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>ESP (recommended)</maml:title><maml:introduction>
<maml:para>Encapsulating Security Payload (ESP) provides confidentiality (in addition to authentication, integrity, and anti-replay) for the IP payload. ESP in transport mode does not sign the entire packet. Only the IP data payload, not the IP header, is protected. ESP can be used alone or in combination with Authentication Header (AH). With ESP, the hash calculation includes the ESP header, trailer, and payload only. ESP provides data confidentiality services by encrypting the ESP payload with one of the supported encryption algorithms. Packet replay services are provided through the inclusion of a sequence number for each packet.</maml:para>
</maml:introduction></maml:section>
<maml:section>
<maml:title>ESP and AH</maml:title><maml:introduction>
<maml:para>This option combines the security of the ESP protocol with the AH protocol. AH provides authentication, integrity, and anti-replay for the entire packet (both the IP header and the data payload carried in the packet).</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>The AH protocol is not compatible with network address translation (NAT) because NAT devices need to change information in the packet headers. To allow IPsec-based traffic to pass through a NAT device, you must ensure that NAT Traversal (NAT-T) is supported on your IPsec peer computers.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Algorithms</maml:title><maml:introduction><maml:para> </maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Encryption algorithm</maml:title><maml:introduction>
<maml:para>The following encryption algorithms are available to computers running this version of Windows. Some of these algorithms are not available on computers running earlier versions of Windows. If you must establish IPsec-protected connections with a computer running an earlier version of Windows, then you must include algorithm options that are compatible with the earlier version.</maml:para>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?LinkID=129230).</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>AES-GCM 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GCM 192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GCM 128</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-CBC 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-CBC 192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-CBC 128</maml:para></maml:listItem>
<maml:listItem><maml:para>3DES</maml:para></maml:listItem>
<maml:listItem><maml:para>DES</maml:para></maml:listItem>
</maml:list>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>We recommend that you do not use DES. It is provided for backward compatibility only.</maml:para></maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>If you specify an AES-GCM algorithm for encryption, then you must specify the same algorithm for integrity.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>Integrity algorithm</maml:title><maml:introduction>
<maml:para>The following integrity algorithms are available to computers running this version of Windows. Some of these algorithms are not available on computers running other versions of Windows. If you must establish IPsec-protected connections with a computer running an earlier version of Windows, then you must include algorithm options that are compatible with the earlier version.</maml:para>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?LinkID=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?LinkID=129230).</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>AES-GCM 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GCM 192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GCM 128</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GMAC 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GMAC 192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-GMAC 128</maml:para></maml:listItem>
<maml:listItem><maml:para>SHA-1</maml:para></maml:listItem>
<maml:listItem><maml:para>MD5</maml:para></maml:listItem>
</maml:list>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>We recommend that you do not use MD5. It is provided for backward compatibility only.</maml:para></maml:alertSet>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>If you specify an AES-GCM algorithm for integrity, then you must specify the same algorithm for encryption.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Key lifetimes</maml:title><maml:introduction>
<maml:para>Lifetime settings determine when a new key is generated. Key lifetimes allow you to force the generation of a new key after a specified time interval or after a specified amount of data has been transmitted. For example, if the communication takes 100 minutes and you specify a key lifetime of 10 minutes, 10 keys will be generated (one every 10 minutes) during the exchange. Using multiple keys ensures that if an attacker manages to gain the key to one part of a communication, the entire communication is not compromised.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This key regeneration is for quick mode data integrity and encryption and does not affect the key lifetime settings for main mode key exchange.</maml:para></maml:alertSet>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Minutes</maml:title><maml:introduction>
<maml:para>Use this setting to configure how long the key used in the quick mode security association lasts, in minutes. After this interval, the key will be regenerated. Subsequent communications will use the new key.</maml:para>
<maml:para>The maximum lifetime is 2,879 minutes (48 hours). The minimum lifetime is 5 minutes. We recommend that you rekey only as frequently as your risk analysis requires. Excessively frequent rekeying can impact performance.</maml:para></maml:introduction></maml:section>
<maml:section><maml:title>KB</maml:title><maml:introduction>
<maml:para>Use this setting to configure how many kilobytes (KB) of data are sent using the key. After this threshold is reached, the counter is reset, and the key is regenerated. Subsequent communications will use the new key.</maml:para>
<maml:para>The maximum lifetime is 2,147,483,647 KB. The minimum lifetime is 20,480 KB. We recommend that you rekey only as frequently as your risk analysis requires. Excessively frequent rekeying can impact performance.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Advanced Tab</maml:title><maml:introduction>
<maml:para>Use this tab to configure the profiles and interface types to which this firewall rule will be applied.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>Advanced</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Profiles</maml:title><maml:introduction>
<maml:para>A profile is a way of grouping settings, such as firewall rules and connection security rules, that are applied to the computer depending on where the computer is connected. Windows determines a network location type for each network adapter, and then applies the corresponding profile to that network adapter. On computers running this version of Windows, there are three profiles recognized by Windows Firewall with Advanced Security.</maml:para>
<maml:table>
<maml:tableHeader><maml:row><maml:entry><maml:para>Profile</maml:para></maml:entry><maml:entry><maml:para>Description</maml:para></maml:entry></maml:row></maml:tableHeader>
<maml:row><maml:entry><maml:para>Domain</maml:para></maml:entry><maml:entry><maml:para>Applies when a computer is connected to a network that contains an Active Directory domain controller in which the computer's domain account resides.</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Private</maml:para></maml:entry><maml:entry><maml:para>Applies when a computer is connected to a network in which the computer's domain account does not reside, such as a home network. The private profile settings should be more restrictive than the domain profile settings. A network is assigned the private type by a local administrator.</maml:para></maml:entry></maml:row>
<maml:row><maml:entry><maml:para>Public</maml:para></maml:entry><maml:entry><maml:para>Applies when a computer is connected to a domain through a public network, such as one available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as it is in an IT environment. By default, newly discovered networks are assigned the public type.</maml:para></maml:entry></maml:row>
</maml:table>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>Computers running Windows Server 2008 and Windows Vista support only a single profile at a time. If the computer is connected to more than one network, the most restrictive profile is applied to all network adapters.</maml:alert><maml:alert>Computers running Windows XP and Windows Server 2003 support only two profiles: standard, which maps to both public and private, and domain. If the computer is connected to more than one network, the profile that is most restrictive is applied to all network adapters. For this purpose, the public profile is considered the most restrictive, followed by the private profile, and then the domain profile.</maml:alert></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Interface types</maml:title><maml:introduction>
<maml:para>Click <maml:ui>Customize</maml:ui> to specify the interface types to which the connection security rule applies. The <maml:ui>Customize Interface Types</maml:ui> dialog box allows you to select <maml:ui>All interface types</maml:ui> or any combination of <maml:ui>Local area network</maml:ui>, <maml:ui>Remote access</maml:ui>, or <maml:ui>Wireless</maml:ui> types.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Edge traversal</maml:title><maml:introduction>
<maml:para>Edge traversal allows the computer to accept unsolicited inbound packets that have passed through an edge device, such as a network address translation (NAT) router or firewall. </maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>This option cannot be configured by using the New Inbound Firewall Rule wizard. To configure this setting, you must create the rule by using the wizard and then change it by using this tab.</maml:alert><maml:alert>This option applies to inbound rules only; it does not appear on the <maml:ui>Advanced</maml:ui> tab for an outbound rule.</maml:alert></maml:alertSet>
<maml:para>Select one of the following options from the list:</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Block edge traversal (default)</maml:title><maml:introduction>
<maml:para>Prevent applications from receiving unsolicited traffic from the Internet through a NAT edge device.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Allow edge traversal</maml:title><maml:introduction>
<maml:para>Allow applications to receive unsolicited traffic directly from the Internet through a NAT edge device.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Defer to user</maml:title><maml:introduction>
<maml:para>Let the user decide whether to allow unsolicited traffic from the Internet through a NAT edge device when an application requests it.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Defer to application</maml:title><maml:introduction>
<maml:para>Let each application determine whether to allow unsolicited traffic from the Internet through a NAT edge device.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Program Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify one of the ways in which Windows Firewall with Advanced Security matches network packets. If this and all other criteria are matched, Windows Firewall with Advanced Security will take the action that you specify on the <maml:ui>Action</maml:ui> page.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>To specify a service by using the wizard, choose the <maml:ui>Custom</maml:ui> option on the <maml:ui>Rule Type</maml:ui> page of the wizard.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui> , and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select either <maml:ui>Program</maml:ui> or <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Program</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>All programs</maml:title><maml:introduction>
<maml:para>Use this option to match network packets sent or received by any program running on the local computer.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>This program path</maml:title><maml:introduction>
<maml:para>Use this option to match network packets going to or from a specified program. You can select the program in one of two ways: </maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>Type the complete path to the program. You can include environment variables, where appropriate.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>We recommend that you do not use environment variable strings that resolve only in the context of a certain user (for example, %USERPROFILE%). When these strings are evaluated by the service at runtime, the service is not running in the context of the user. The use of these strings can produce unexpected results.</maml:para></maml:alertSet></maml:listItem>
<maml:listItem><maml:para>Click <maml:ui>Browse</maml:ui> and find the program in the directory.</maml:para></maml:listItem>
</maml:list>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>To specify a service in a firewall rule, use the <maml:ui>All programs</maml:ui> option, and then select the <maml:ui>Programs and Services</maml:ui> tab on the <maml:ui>Firewall Rule Properties</maml:ui> dialog box.</maml:para></maml:alertSet></maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui> and <maml:ui>Outbound Rules</maml:ui>. To change the program path, use the <maml:ui>Programs and Services</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>User Interface: Windows Firewall with Advanced Security</maml:title><maml:introduction>
<maml:para>This section describes each of the pages in the user interface for Windows Firewall with Advanced Security.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=05d277a3-2b83-4951-a2fc-e2ca78a24f24"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Firewall Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=20b3aba6-884a-4ef9-8ea7-914e4cd735d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Connection Security Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=9d81b178-5fef-4b23-9dc7-e85f20bbf5d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Main Mode Security Associations</maml:linkText><maml:uri href="mshelp://windows/?id=39e393da-18a6-4a1d-85d1-d9dcb46e3b93"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Quick Mode Security Associations</maml:linkText><maml:uri href="mshelp://windows/?id=8c965889-6e37-4ad0-b41d-4f98bed709ad"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Boxes</maml:linkText><maml:uri href="mshelp://windows/?id=71ea19d0-e57f-4828-923a-632cdb208aad"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Users Page</maml:title><maml:introduction>
<maml:para>Use these settings to specify which users or user groups can connect to the local computer.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>To use these options, the firewall rule action must be set to <maml:ui>Allow the connection if it is secure</maml:ui>. To be considered secure, the network traffic must be protected by a connection security rule that requires authentication by using a method that includes user identification information, such as Kerberos version 5, NTLMv2, or a certificate with certificate-to-account mapping enabled.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Inbound Rules</maml:ui>, and then click <maml:ui>New rule</maml:ui>.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>This page is displayed for inbound rules only; it is not available for outbound rules.</maml:para></maml:alertSet></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Action</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Action</maml:ui> page, select <maml:ui>Allow the connection if it is secure</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Users</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Authorized users</maml:title><maml:introduction>
<maml:para>Use this section to identify the user or group accounts that are allowed to make the connection specified by the rule.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from these users</maml:title><maml:introduction>
<maml:para>Select this option to specify which users can connect to this computer. Network traffic that is not authenticated as coming from a user on this list is blocked by Windows Firewall.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box. To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify user or group accounts that might be listed in <maml:ui>Authorized users</maml:ui>, possibly because the user or group account is a member of a group, but whose network traffic must be blocked by Windows Firewall. For example, User A is a member of Group B. Group B is included in <maml:ui>Authorized users</maml:ui>, so network traffic authenticated as coming from a user who is a member of Group B is allowed. However, by placing User A in the <maml:ui>Exceptions</maml:ui> list, network traffic authenticated as being from User A is not processed by this rule, and so is blocked by the default firewall behavior unless some other rule allows the traffic.</maml:para></maml:introduction>
<maml:sections>
<maml:section><maml:title>Skip this rule for connections from these users</maml:title><maml:introduction>
<maml:para>Select this option to specify users or groups whose network traffic is an exception to this rule. Network traffic that is authenticated as coming from a user in this list is not processed by the rule, even if the user is also in <maml:ui>Authorized users</maml:ui>.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box. To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui>. To change these settings, select the <maml:ui>Users</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Scope Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify the local and remote IP addresses whose network traffic matches this rule. If the local computer is listed in the local IP addresses, then all network traffic going to or from any of the remote IP addresses matches this rule. </maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Scope</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Which local IP addresses does this rule apply to?</maml:title><maml:introduction>
<maml:para>The local IP address is used by the local computer to determine if the rule applies. The rule only applies to network traffic that goes through a network adapter that is configured to use one of the specified addresses.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches a network packet with any address specified as the local IP address. The local computer always matches the rule when this option is selected.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches only network traffic that has one of the specified addresses in the local IP address field. If the local computer does not have a network adapter configured with one of the specified IP addresses, then the rule does not apply. On the <maml:ui>IP Address</maml:ui> dialog box, click <maml:ui>Add</maml:ui> to create a new entry in the list, or <maml:ui>Edit</maml:ui> to change an existing entry in the list.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Customize the interface types to which this rule applies</maml:title><maml:introduction>
<maml:para>Click <maml:ui>Customize</maml:ui> to display the <maml:ui>Customize Interface Types</maml:ui> dialog box. Use this dialog box to configure which network interface types match the rule. By default, all network interface types are included.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Which remote IP addresses does this rule apply to?</maml:title><maml:introduction>
<maml:para>Specify the remote IP addresses to which the rule applies. Network traffic matches the rule if the destination IP address is one of the addresses in the list.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Any IP address</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule matches network packets that are addressed from (for inbound rules) or addressed to (for outbound rules) any IP address included in the list.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>These IP addresses</maml:title><maml:introduction>
<maml:para>Select this option to specify that the rule only matches network traffic that has one of the addresses specified in the <maml:ui>Remote IP address</maml:ui> field. On the <maml:ui>IP Address</maml:ui> dialog box, click <maml:ui>Add</maml:ui> to create a new entry in the list, or <maml:ui>Edit</maml:ui> to modify an existing entry in the list.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the firewall rule, you can change these settings in the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. This dialog box appears when you double-click a rule in <maml:ui>Inbound Rules</maml:ui> and <maml:ui>Outbound Rules</maml:ui>. To change these settings, use the <maml:ui>Scope</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Computers Tab</maml:title><maml:introduction><maml:para>Use these settings to specify which computers or computer groups can connect to the local computer. This tab is available on both inbound and outbound firewall rules.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>To use these options, the firewall rule action must be set to <maml:ui>Allow the connection if it is secure</maml:ui> on the <maml:ui>General</maml:ui> tab. To be considered secure, the network traffic must be protected by a connection security rule that requires authentication by using a method that includes computer identification information, such as Kerberos version 5, NTLMv2, or a certificate with certificate-to-account mapping enabled.</maml:para>
</maml:alertSet>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, right-click the firewall rule you want to modify, and then click the <maml:ui>Computers</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Authorized computers</maml:title><maml:introduction>
<maml:para>Use this section to identify the computer or group accounts that are allowed to make the connection specified by the rule.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from/to these computers</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para>For inbound rules, select <maml:ui>Only allow connections from these computers</maml:ui> to specify which computers can connect to this computer. Network traffic that is not authenticated as coming from a computer on this list is blocked by Windows Firewall.</maml:para></maml:listItem>
<maml:listItem><maml:para>For outbound rules, select <maml:ui>Only allow connections to these computers</maml:ui> to specify the computers to which this computer is allowed to connect. Outbound network traffic sent to computers that cannot be authenticated as a computer on the list is blocked by Windows Firewall.</maml:para></maml:listItem>
</maml:list>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box.</maml:para>
<maml:para>To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify computer or group accounts that might be listed in <maml:ui>Authorized computers</maml:ui>, possibly because the computer or group account is a member of a group, but whose network traffic must be blocked by Windows Firewall. For example, Computer A is a member of Group B. Group B is included in <maml:ui>Authorized computers</maml:ui>, so network traffic authenticated as coming from a computer in the group is allowed. By placing Computer A in the <maml:ui>Exceptions</maml:ui> list, network traffic authenticated as being from Computer A is not processed by this rule, and so is blocked by the default firewall behavior unless some other rule allows the traffic.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Skip this rule for connections from/to these computers</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para>For inbound rules, select <maml:ui>Skip this rule for connections from these computers</maml:ui> to specify the remote computers are exceptions to this rule.</maml:para></maml:listItem>
<maml:listItem><maml:para>For outbound rules, select <maml:ui>Skip this rule for connections to these computers</maml:ui> to specify the remote computers that are exceptions to this rule.</maml:para></maml:listItem>
</maml:list>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in the <maml:ui>Select Users, Computers, or Groups</maml:ui> dialog box.</maml:para>
<maml:para>To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize IPsec Tunneling Settings</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure a connection security rule to use tunnel mode rather than transport mode.</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, select <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the tunnel rule that you want to modify.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Advanced</maml:ui> tab, and then under <maml:ui>IPsec Tunneling</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Use IPsec tunneling</maml:title><maml:introduction>
<maml:para>Select this option to specify that the network traffic that matches this rule travels from Endpoint 1 to Endpoint 2 through an Internet Protocol security (IPsec) tunnel. Selecting this option enables the rest of the controls in this dialog box.</maml:para>
</maml:introduction><maml:sections>
<maml:section><maml:title>Apply authorization</maml:title><maml:introduction>
<maml:para>Select this option to specify that the computer or user in Endpoint 1 must authenticate with the local tunnel endpoint before any packets can be sent through the tunnel. To specify the computers or users that are authorized to send traffic through the tunnel, follow these steps:</maml:para>
<maml:procedure><maml:title>To specify users and computers authorized to send network traffic through the tunnel</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, select <maml:ui>Windows Firewall with Advanced Security</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Select the <maml:ui>IPsec Settings</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>IPsec tunnel authorization</maml:ui>, click <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Add users and computers to the lists according to your design. For more information, see <maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Tunnel Authorization</maml:linkText><maml:uri href="mshelp://windows/?id=f637c2d4-a8aa-4e7a-b437-86b8e3accc7f"></maml:uri></maml:navigationLink>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction></maml:section>
<maml:section><maml:title>Exempt IPsec protected connections</maml:title><maml:introduction>
<maml:para>Sometimes a network packet might match more than one connection security rule. If one of the rules establishes an IPsec tunnel, you can choose whether to use the tunnel or send the packet outside of the tunnel protected by the other rule. Select the option to specify that network traffic that matches another IPsec connection security rule does not go through the IPsec tunnel.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Local tunnel endpoint (closest to Endpoint 1)</maml:title><maml:introduction>
<maml:para>Use this option to identify the computer that terminates the tunnel at the end closest to the computers in Endpoint 1. Click <maml:ui>Edit</maml:ui> to enter an Internet Protocol version 4 (IPv4) address, Internet Protocol version 6 (IPv6) address, or both.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>You must be consistent in the version of IP you specify for the addresses in a tunnel. If you specify IPv4 addresses, then do so for both tunnel endpoints and Endpoint1 and Endpoint 2. You can specify both IPv4 and IPv6, but you must then specify both for both tunnel endpoints and Endpoint 1 and Endpoint 2.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
<maml:section><maml:title>Remote tunnel endpoint (closest to Endpoint 2)</maml:title><maml:introduction>
<maml:para>Use this option to identify the computer that terminates the tunnel at the end closest to the computers in Endpoint 2. Click <maml:ui>Edit</maml:ui> to enter an IPv4 address, IPv6 address, or both.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>You must be consistent in the version of IP you specify for the addresses in a tunnel. If you specify IPv4 addresses, then do so for both tunnel endpoints and Endpoint1 and Endpoint 2. You can specify both IPv4 and IPv6, but you must then specify both for both tunnel endpoints and Endpoint 1 and Endpoint 2.</maml:para></maml:alertSet>
<maml:para>For information about IPsec tunneling, see <maml:navigationLink><maml:linkText>Connection Security Rule Wizard: Tunnel Type Page</maml:linkText><maml:uri href="mshelp://windows/?id=710fa446-c600-4691-ae28-37a9824fb95d"></maml:uri></maml:navigationLink>.</maml:para></maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add Security Method</maml:title><maml:introduction>
<maml:para>Use this dialog box to configure a security method offer that is available when negotiating main mode security associations. You must specify the integrity, encryption, and key exchange algorithm.</maml:para>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Key exchange (Main Mode)</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Security methods</maml:ui>, select an algorithm combination from the list, and click <maml:ui>Edit</maml:ui> or <maml:ui>Add</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Integrity algorithm</maml:title><maml:introduction>
<maml:para>Select one of the following integrity algorithms from the list.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>SHA-384</maml:para></maml:listItem>
<maml:listItem><maml:para>SHA-256</maml:para></maml:listItem>
<maml:listItem><maml:para>SHA-1</maml:para></maml:listItem>
<maml:listItem><maml:para>MD5</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>MD5 is no longer considered secure and should only be used for testing purposes or in cases in which the remote computer cannot use a more secure algorithm. It is included for backward compatibility only.</maml:para></maml:alertSet></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Encryption algorithm</maml:title><maml:introduction>
<maml:para>Select one of the following encryption algorithms from the list.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>AES-CBC 256</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-CBC-192</maml:para></maml:listItem>
<maml:listItem><maml:para>AES-CBC-128</maml:para></maml:listItem>
<maml:listItem><maml:para>3DES</maml:para></maml:listItem>
<maml:listItem><maml:para>DES</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>DES is no longer considered secure and should only be used for testing purposes or in cases in which the remote computer cannot use a more secure algorithm. It is included for backward compatibility only.</maml:para></maml:alertSet></maml:listItem>
</maml:list>
</maml:introduction></maml:section><maml:section><maml:title>Key exchange algorithm</maml:title><maml:introduction>
<maml:para>Select one of the following key exchange algorithms from the list.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>Elliptic Curve Diffie-Hellman P-384</maml:para></maml:listItem>
<maml:listItem><maml:para>Elliptic Curve Diffie-Hellman P-256</maml:para></maml:listItem>
<maml:listItem><maml:para>Diffie-Hellman Group 14</maml:para></maml:listItem>
<maml:listItem><maml:para>Diffie-Hellman Group 2</maml:para></maml:listItem>
<maml:listItem><maml:para>Diffie-Hellman Group 1</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>DH1 is no longer considered secure and should only be used for testing purposes or in cases in which the remote computer cannot use a more secure algorithm. It is included for backward compatibility only.</maml:para></maml:alertSet></maml:listItem>
</maml:list>
<maml:para>For more information about any of these algorithms, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para></maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Authentication Method Page</maml:title><maml:introduction>
<maml:para>Use these settings to configure the type of authentication used by this connection security rule. </maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Not all of the authentication methods listed here are available for all connection security rule types. The authentication methods available for the rule type are displayed on the <maml:ui>Authentication Method</maml:ui> page of the New Connection Security Rule Wizard and on the <maml:ui>Authentication</maml:ui> tab on the <maml:ui>Connection Security Rule Properties</maml:ui> page.</maml:para></maml:alertSet>
<maml:para>For more information about the authentication methods, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click <maml:ui>Next</maml:ui> until you reach the <maml:ui>Authentication Method</maml:ui> page.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Default</maml:title><maml:introduction>
<maml:para>This option is available only when you specify an <maml:ui>Isolation</maml:ui> or <maml:ui>Custom</maml:ui> rule type.</maml:para>
<maml:para>Select this option to use the authentication method currently displayed on the <maml:ui>Windows Firewall with Advanced Security Properties</maml:ui> dialog box, on the <maml:ui>IPsec Settings</maml:ui> tab, under <maml:ui>Authentication Method</maml:ui>. For more information about customizing the default options, see <maml:navigationLink><maml:linkText>Dialog Box: Customize IPsec Settings</maml:linkText><maml:uri href="mshelp://windows/?id=66011489-1eee-4986-9373-565e557db23b"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Computer and user (Kerberos V5)</maml:title><maml:introduction>
<maml:para>This option is available only when you specify an <maml:ui>Isolation</maml:ui> or <maml:ui>Custom</maml:ui> rule type.</maml:para>
<maml:para>Select this option to use both computer and user authentication with the Kerberos version 5 protocol. It is equivalent to selecting <maml:ui>Advanced</maml:ui>, adding <maml:ui>Computer (Kerberos V5)</maml:ui> for first authentication and <maml:ui>User (Kerberos V5)</maml:ui> for second authentication, and then clearing both <maml:ui>First authentication is optional</maml:ui> and <maml:ui>Second authentication is optional</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Computer (Kerberos V5)</maml:title><maml:introduction>
<maml:para>This option is available only when you specify an <maml:ui>Isolation</maml:ui> or <maml:ui>Custom</maml:ui> rule type.</maml:para>
<maml:para>Select this option to use computer authentication with the Kerberos version 5 protocol. It is equivalent to selecting <maml:ui>Advanced</maml:ui>, adding <maml:ui>Computer (Kerberos V5)</maml:ui> for first authentication, and then selecting <maml:ui>Second authentication is optional</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Computer certificate</maml:title><maml:introduction>
<maml:para>This option is available only when you specify a <maml:ui>Server-to-server</maml:ui> or <maml:ui>Tunnel</maml:ui> rule type.</maml:para>
<maml:para>Select this option to use computer authentication based on a computer certificate. It is equivalent to selecting <maml:ui>Advanced</maml:ui>, adding <maml:ui>Computer certificate</maml:ui> for first authentication, and then selecting <maml:ui>Second authentication is optional</maml:ui>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Signing algorithm</maml:title><maml:introduction>
<maml:para>Specify the signing algorithm used to cryptographically secure the certificate.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>RSA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the RSA public-key cryptography algorithm.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P256</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the Elliptic Curve Digital Signature Algorithm (ECDSA) with 256-bit key strength.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P384</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using ECDSA with 384-bit key strength.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Certificate store type</maml:title><maml:introduction>
<maml:para>Specify the type of certificate by identifying the store in which the certificate is located.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Root CA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by a root certification authority (CA) and is stored in the local computer’s Trusted Root Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Intermediate CA</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by an intermediate CA and is stored in the local computer’s Intermediate Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Accept only health certificates</maml:title><maml:introduction>
<maml:para>This option restricts the use of computer certificates to those that are marked as heath certificates. Health certificates are published by a CA in support of a Network Access Protection (NAP) deployment. NAP lets you define and enforce health policies so that computers that do not comply with network requirements, such as computers without antivirus software or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. NAP Client Management, a Microsoft Management Console (MMC) snap-in, helps you configure NAP settings on your client computers. For more information, see the NAP MMC snap-in Help. To use this option, you must have a NAP server set up in the domain.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Advanced</maml:title><maml:introduction>
<maml:para>This option is available when you specify any rule type.</maml:para>
<maml:para>Select this option to configure any available authentication method. You must then click <maml:ui>Customize</maml:ui> and specify a list of methods for both first authentication and second authentication. For more information, see <maml:navigationLink><maml:linkText>Dialog Box: Customize Advanced Authentication Methods</maml:linkText><maml:uri href="mshelp://windows/?id=f19cbe6e-7235-4613-90d0-6f7a3e8a6093"></maml:uri></maml:navigationLink>, <maml:navigationLink><maml:linkText>Dialog Box: Add or Edit First Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=f9172bb1-6c9e-4e09-a1cb-6e6912459aee"></maml:uri></maml:navigationLink>, and <maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Second Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=dd07bae3-3af0-469b-adc8-84f78f4169e8"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the authentication methods used by this rule, select the <maml:ui>Authentication</maml:ui> tab. </maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Firewall Rules - Advanced</maml:title><maml:introduction>
<maml:para>This tab displays information about authenticated users and computers whose network traffic is affected by this rule. This tab should be used only when the action for the rule is set to <maml:ui>Allow if secure</maml:ui>.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Firewall</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the firewall rule you want to examine, and then click the <maml:ui>Advanced</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Authorized users and computers</maml:title><maml:introduction>
<maml:para>This is a list of the users or groups of users authorized by this rule, as configured on the <maml:ui>Users</maml:ui> and <maml:ui>Computers</maml:ui> tabs of the <maml:ui>Firewall Rule Properties</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Excepted users and computers</maml:title><maml:introduction>
<maml:para>This is a list of the users or groups of users who are not subject to this rule, as configured on the <maml:ui>Users</maml:ui> and <maml:ui>Computers</maml:ui> tabs of the <maml:ui>Firewall Rule Properties</maml:ui> dialog box. If a user or computer appears under both <maml:ui>Authorized</maml:ui> and <maml:ui>Excepted</maml:ui>, the exception takes priority, and the network traffic from that user or computer is not subject to this rule.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Interface types</maml:title><maml:introduction>
<maml:para>This is a list of the network interface types to which this rule applies (<maml:ui>Local area network</maml:ui>, <maml:ui>Remote access</maml:ui>, <maml:ui>Wireless</maml:ui>, or <maml:ui>All interface types</maml:ui>), as configured on the <maml:ui>Advanced</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Edge traversal</maml:title><maml:introduction>
<maml:para>This indicates whether edge traversal is enabled (<maml:ui>Allow edge traversal</maml:ui>) or disabled (<maml:ui>Block edge traversal</maml:ui>). The <maml:ui>Defer to user</maml:ui> and <maml:ui>Defer to application</maml:ui> options are used to indicate that the user or application must make the decision to allow unsolicited traffic from the Internet through a network address translation (NAT) edge device. When edge traversal is enabled, the application, service, or port to which the rule applies is globally addressable and accessible from outside a NAT edge device. This setting is configured on the <maml:ui>Advanced</maml:ui> tab of the <maml:ui>Firewall Rule Properties</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Firewall Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=20b3aba6-884a-4ef9-8ea7-914e4cd735d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Properties Page: Protocols and Ports Tab</maml:title><maml:introduction>
<maml:para>Use this tab of the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box to specify which protocols and ports in a network packet match this connection security rule. Only network traffic that matches the criteria on both this tab and the endpoints on the <maml:ui>Computers</maml:ui> tab match the rule and are subject to its authentication requirements.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click the rule that you want to modify, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol type</maml:title><maml:introduction>
<maml:para>Select the protocol whose network traffic will be protected by this connection security rule. If the protocol you want is not in the list, select <maml:ui>Custom</maml:ui>, and type the protocol number in <maml:ui>Protocol number</maml:ui>.</maml:para>
<maml:para>If you choose TCP or UDP in the list, then you can specify the TCP or UDP port numbers in <maml:ui>Endpoint 1 port</maml:ui> and <maml:ui>Endpoint 2 port</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Protocol number</maml:title><maml:introduction>
<maml:para>When you select a protocol type, the corresponding protocol identification number is automatically displayed in <maml:ui>Protocol number</maml:ui> and is read-only. If you select <maml:ui>Custom</maml:ui> for <maml:ui>Protocol type</maml:ui>, then type the protocol identification number in <maml:ui>Protocol number</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 1 port</maml:title><maml:introduction>
<maml:para>This option is available only if the protocol is set to TCP or UDP. Use this option to specify the port number used by the computer that is part of Endpoint 1. If you select <maml:ui>All ports</maml:ui>, then all network traffic for the protocol you selected matches this connection security rule. If you select <maml:ui>Specific Ports</maml:ui>, then you can type the port numbers in the box under the list. Separate port numbers with commas.</maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>If this rule has <maml:ui>Do not authenticate</maml:ui> on the <maml:ui>Authentication</maml:ui> tab, then you can type port numbers in a range by separating the low and high values with a hyphen, as shown:</maml:alert><maml:alert><maml:userInput>80, 445, 5000-5010</maml:userInput></maml:alert></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 2 port</maml:title><maml:introduction>
<maml:para>This option is available only if the protocol is set to TCP or UDP. Use this option to specify the port number used by the computer that is part of Endpoint 2. If you select <maml:ui>All ports</maml:ui>, then all network traffic for the protocol you selected matches this connection security rule. If you select <maml:ui>Specific Ports</maml:ui>, then you can type the port numbers in the box under the list. Separate port numbers with commas.</maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>If this rule has <maml:ui>Do not authenticate</maml:ui> on the <maml:ui>Authentication</maml:ui> tab, then you can type port numbers in a range by separating the low and high values with a hyphen, as shown:</maml:alert><maml:alert><maml:userInput>80, 445, 5000-5010</maml:userInput></maml:alert></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Wizard: Rule Type Page</maml:title><maml:introduction>
<maml:para>Windows Firewall with Advanced Security provides four basic types of firewall rules. By using one of these firewall rule types, you can create exceptions to explicitly allow or explicitly deny a connection through Windows Firewall. The same wizard and property pages are used to create both inbound and outbound rules. The choice you make on this page determines which pages are displayed by the Firewall Rule Wizard.</maml:para>
<maml:para>You can change the settings for any firewall rule after you create it. To make these changes, right-click the firewall rule in the results pane, and then select <maml:ui>Properties</maml:ui>.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>The <maml:ui>Rule Type</maml:ui> page is displayed.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Program</maml:title><maml:introduction>
<maml:para>Use this type of firewall rule to allow a connection based on the program that is trying to connect. This is an easy way to allow connections for Microsoft Outlook or other programs. It is also useful if you are not sure of the port or other settings required to allow access. You only need to specify the path to the program executable (.exe) file. </maml:para>
<maml:para>By default, the program is allowed to accept connections on any port. To restrict a program rule to allow traffic on specified port numbers only, after you create the rule, use the <maml:ui>Protocols and Ports</maml:ui> tab to change the rule properties.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Port</maml:title><maml:introduction>
<maml:para>Use this type of firewall rule to allow a connection based on the TCP or UDP port number over which the computer is trying to connect. You can specify the protocol (either TCP or UDP) and the local ports. You can specify more than one port number.</maml:para>
<maml:para>By default, any program currently running on the computer can accept network traffic on a port opened with this type of rule. To restrict the open port to a specified program only, after you create the rule, use the <maml:ui>Programs and Services</maml:ui> tab to change the rule properties.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Predefined</maml:title><maml:introduction>
<maml:para>Use this type of firewall rule to allow a connection by selecting one of the programs or services from the list. Most of the well known services and programs available on computers running this version of Windows appear in this list. Network programs that you install typically add their own entries to this list so that you can enable and disable them as a group.</maml:para>
</maml:introduction></maml:section><maml:section>
<maml:title>Custom</maml:title><maml:introduction>
<maml:para>Use this type of firewall rule to create a firewall rule that you can configure to allow a connection based on criteria not covered by the other types of firewall rules.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add or Edit Second Authentication Method</maml:title><maml:introduction>
<maml:para>Use these settings to specify the way in which the user account on the peer computer is authenticated. You can also specify that the computer must have a computer health certificate. The second authentication method is performed by Authenticated IP (AuthIP) in an extended mode of the main mode phase of Internet Protocol security (IPsec) negotiations. </maml:para>
<maml:para>You can specify multiple methods to use for this authentication. The methods are attempted in the order you specify. The first successful method is used.</maml:para>
<maml:para>For more information about the authentication methods available in this dialog box, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying the system-wide default settings:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, click <maml:ui>Windows Firewall with Advanced Security</maml:ui>, and then in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab, and then under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Authentication Method</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Second authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a new connection security rule:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select any type except <maml:ui>Authentication exemption</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>On the <maml:ui>Authentication Method</maml:ui> page, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Second authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing security rule:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Double-click the connection security rule that you want to modify.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>Authentication</maml:ui> tab.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Method</maml:ui>, click <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Second authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>User (Kerberos V5)</maml:title><maml:introduction>
<maml:para>You can use this method to authenticate a user logged on to a remote computer that is part of the same domain or in separate domains that have a trust relationship. The logged-on user must have a domain account and the computer must be joined to a domain in the same forest.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>User (NTLMv2)</maml:title><maml:introduction>
<maml:para>NTLMv2 is an alternative way to authenticate a user logged on to a remote computer that is part of the same domain or in a domain that has a trust relationship to the domain of the local computer. The user account and the computer must be joined to domains that are part of the same forest.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>User certificate</maml:title><maml:introduction>
<maml:para>Use a public key certificate in situations that include external business partner communications or computers that do not run the Kerberos version 5 authentication protocol. This requires that at least one trusted root certification authority (CA) is configured on or accessible through your network and that client computers have an associated computer certificate. This method is useful when the users are not in the same domain or are in separate domains without a two-way trust relationship, and Kerberos version 5 cannot be used.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Signing algorithm</maml:title><maml:introduction>
<maml:para>Specify the signing algorithm used to cryptographically secure the certificate.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>RSA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the RSA public-key cryptography algorithm.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P256</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the Elliptic Curve Digital Signature Algorithm (ECDSA) with 256-bit key strength.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P384</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using ECDSA with 256-bit key strength.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Certificate store type</maml:title><maml:introduction>
<maml:para>Specify the type of certificate by identifying the store in which the certificate is located.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Root CA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by a root CA and is stored in the local computer’s Trusted Root Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Intermediate CA</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by an intermediate CA and is stored in the local computer’s Intermediate Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Enable certificate to account mapping</maml:title><maml:introduction>
<maml:para>When you enable IPsec certificate-to-account mapping, the Internet Key Exchange (IKE) and AuthIP protocols associate (map) a user certificate to a user account in an Active Directory domain or forest, and then retrieve an access token, which includes the list of user security groups. This process ensures that the certificate offered by the IPsec peer corresponds to an active user account in the domain, and that the certificate is one that should be used by that user.</maml:para>
<maml:para>Certificate-to-account mapping can only be used for user accounts that are in the same forest as the computer performing the mapping. This provides much stronger authentication than simply accepting any valid certificate chain. For example, you can use this capability to restrict access to users who are within the same forest. Certificate-to-account mapping, however, does not ensure that a specific trusted user is being allowed IPsec access.</maml:para>
<maml:para>Certificate-to-account mapping is especially useful if the certificates come from a public key infrastructure (PKI) that is not integrated with your Active Directory Domain Services (AD DS) deployment, such as if business partners obtain their certificates from non-Microsoft providers. You can configure the IPsec policy authentication method to map certificates to a domain user account for a specific root CA. You can also map all certificates from an issuing CA to one user account. This allows certificate authentication to be used to limit which forests are allowed IPsec access in an environment where many forests exist and each performs autoenrollment under a single internal root CA. If the certificate-to-account mapping process is not completed properly, authentication will fail and IPsec-protected connections will be blocked.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Computer health certificate</maml:title><maml:introduction>
<maml:para>Use this option to specify that only a computer that presents a certificate from the specified CA and that is marked as a Network Access Protection (NAP) health certificate can authenticate by using this connection security rule. NAP lets you define and enforce health policies so that computers that do not comply with network policies, such as computers without antivirus software or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. For more information, see the NAP MMC snap-in Help. To use this method, you must have a NAP server set up in the domain.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Signing algorithm</maml:title><maml:introduction>
<maml:para>Specify the signing algorithm used to cryptographically secure the certificate.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>RSA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the RSA public-key cryptography algorithm.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P256</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the Elliptic Curve Digital Signature Algorithm (ECDSA) with 256-bit key strength.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P384</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using ECDSA with 384-bit key strength.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Certificate store type</maml:title><maml:introduction>
<maml:para>Specify the type of certificate by identifying the store in which the certificate is located.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Root CA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by a root CA and is stored in the local computer’s Trusted Root Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Intermediate CA</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by an intermediate CA and is stored in the local computer’s Intermediate Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Enable certificate to account mapping</maml:title><maml:introduction>
<maml:para>When you enable IPsec certificate-to-account mapping, the IKE and AuthIP protocols associate (map) a certificate to a user or computer account in an Active Directory domain or forest, and then retrieve an access token, which includes the list of security groups. This process ensures that the certificate offered by the IPsec peer corresponds to an active computer or user account in the domain, and that the certificate is one that should be used by that account.</maml:para>
<maml:para>Certificate-to-account mapping can only be used for accounts that are in the same forest as the computer performing the mapping. This provides much stronger authentication than simply accepting any valid certificate chain. For example, you can use this capability to restrict access to accounts that are within the same forest. Certificate-to-account mapping, however, does not ensure that a specific trusted account is being allowed IPsec access.</maml:para>
<maml:para>Certificate-to-account mapping is especially useful if the certificates come from a PKI that is not integrated with your AD DS deployment, such as if business partners obtain their certificates from non-Microsoft certificate providers. You can configure the IPsec policy authentication method to map certificates to a domain account for a specific root CA. You can also map all certificates from an issuing CA to one computer or user account. This allows IKE certificate authentication to be used to limit which forests are allowed IPsec access in an environment where many forests exist and each performs autoenrollment under a single internal root CA. If the certificate-to-account mapping process is not completed properly, authentication will fail and IPsec-protected connections will be blocked.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Understanding Connection Security Rules</maml:title><maml:introduction><maml:para>Connection security involves the authentication of two computers before they begin communications and the securing of information sent between two computers. Windows Firewall with Advanced Security uses Internet Protocol security (IPsec) to achieve connection security by using key exchange, authentication, data integrity, and, optionally, data encryption. </maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>Unlike firewall rules, which operate unilaterally, connection security rules require that both communicating computers have a policy with connection security rules or another compatible IPsec policy.</maml:para></maml:alertSet>
<maml:para>Connection security rules use IPsec to secure traffic while it crosses the network. You use connection security rules to specify that connections between two computers must be authenticated or encrypted. You might still have to create a firewall rule to allow network traffic protected by a connection security rule.</maml:para>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>Understanding Connection Security Rules</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137809"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137809) in the TechNet Library.</maml:para>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Wizard: Protocols and Ports Page</maml:title><maml:introduction>
<maml:para>Use this wizard page to specify which protocol and which port or ports specified in a network packet match this connection security rule. Only network traffic that matches the criteria on this page and the <maml:ui>Endpoints</maml:ui> page match the rule and are subject to its authentication requirements.</maml:para>
<maml:procedure><maml:title>To get to this wizard page</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select <maml:ui>Custom</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In <maml:ui>Steps</maml:ui>, click <maml:ui>Protocol and Ports</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Protocol type</maml:title><maml:introduction>
<maml:para>Select the protocol whose network traffic you want protected by this connection security rule. If the protocol you want is not in the list, select <maml:ui>Custom</maml:ui>, and then type the protocol number in <maml:ui>Protocol number</maml:ui>.</maml:para>
<maml:para>If you choose TCP or UDP from the list, then you can type the TCP or UDP port numbers in <maml:ui>Endpoint 1 port</maml:ui> and <maml:ui>Endpoint 2 port</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Protocol number</maml:title><maml:introduction>
<maml:para>When you select a protocol type, the corresponding protocol identification number is automatically displayed in <maml:ui>Protocol number</maml:ui> and is read-only. If you select <maml:ui>Custom</maml:ui> for protocol type, then you must type the protocol identification number in <maml:ui>Protocol number</maml:ui>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 1 port</maml:title><maml:introduction>
<maml:para>This option is available only if the protocol is set to TCP or UDP. Use this option to specify the port number used by the computer that is part of Endpoint 1. If you select <maml:ui>All ports</maml:ui>, then all network traffic for the protocol you selected matches this connection security rule. If you select <maml:ui>Specific Ports</maml:ui>, then you can type the port numbers in the box under the list. Separate port numbers with commas.</maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>If the <maml:ui>Do not authenticate</maml:ui> option on the <maml:ui>Requirements</maml:ui> page has been selected for this rule, then you can type port numbers in a range by separating the low and high values with a hyphen, as shown:</maml:alert><maml:alert><maml:userInput>80, 445, 5000-5010</maml:userInput></maml:alert></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Endpoint 2 port</maml:title><maml:introduction>
<maml:para>This option is available only if the protocol is set to TCP or UDP. Use this option to specify the port number used by the computer that is part of Endpoint 2. If you select <maml:ui>All ports</maml:ui>, then all network traffic for the protocol you selected matches this connection security rule. If you select <maml:ui>Specific Ports</maml:ui>, then you can type the port numbers in the box under the list. Separate port numbers with commas.</maml:para>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>If the <maml:ui>Do not authenticate</maml:ui> option on the <maml:ui>Requirements</maml:ui> page has been selected for this rule, then you can type port numbers in a range by separating the low and high values with a hyphen, as shown:</maml:alert><maml:alert><maml:userInput>80, 445, 5000-5010</maml:userInput></maml:alert></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>How to change these settings</maml:title><maml:introduction>
<maml:para>After you create the connection security rule, you can change these settings in the <maml:ui>Connection Security Rule Properties</maml:ui> dialog box. This dialog box opens when you double-click a rule in <maml:ui>Connection Security Rules</maml:ui>. To change the protocols and port numbers, click the <maml:ui>Protocols and Ports</maml:ui> tab.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Wizard</maml:linkText><maml:uri href="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Connection Security Rule Properties Page: Advanced Tab</maml:title><maml:introduction>
<maml:para>Use the settings on this tab to select the network profile and interface types to which the connection security rule applies. You can also configure an IPsec tunnel between the endpoints.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Right-click the rule that you want to modify, and then click <maml:ui>Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>Advanced</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Profile</maml:title><maml:introduction>
<maml:para>Use these options to specify the profiles to which this rule is applied. Select any combination of profiles that meet your security goals. This version of Windows supports multiple simultaneously active profiles. Each network adapter card attached to a network is assigned one of the following profiles based on what is detected on the attached network. This means that different firewall and connection security rules can affect network traffic, depending on which network adapter receives the traffic.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Domain</maml:title><maml:introduction>
<maml:para>The domain profile applies to a network when a domain controller for the local computer’s domain is detected. If you select this check box, then the rule applies to network traffic passing through the network adapter connected to this network.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Private</maml:title><maml:introduction>
<maml:para>The private profile applies to a network when it is marked private by the computer administrator and it is not a domain network. Newly detected networks are not marked private by default. A network should be marked private only when there is some kind of security device, such as a network address translator or perimeter firewall, between the computer and the Internet. The private profile settings should be more restrictive than the domain profile settings.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Public</maml:title><maml:introduction>
<maml:para>The public profile applies to a network when the computer is connected directly to a public network, such as one available in airports and coffee shops. The public profile settings should be the most restrictive because the computer is connected to a public network where the security cannot be as tightly controlled as it is in an IT environment.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Interface types</maml:title><maml:introduction>
<maml:para>You can use this setting to specify to which interface type this rule applies. You can create rules that apply to certain interface types only. For example, if you specify only the wireless interface type for this rule, then Windows Firewall with Advanced Security will take the action specified by the rule for wireless traffic. The default setting is <maml:ui>All interface types</maml:ui>.</maml:para>
<maml:para>Click <maml:ui>Customize</maml:ui> to select either all interface types or specific interface types.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>IPsec tunneling</maml:title><maml:introduction>
<maml:para>You can use this setting to create a rule that uses IPsec tunnel mode to establish a connection between two tunnel endpoints.</maml:para>
<maml:para>Use Windows Firewall with Advanced Security to perform Layer 3 tunneling for scenarios in which Layer Two Tunneling Protocol (L2TP) cannot be used. If you are using L2TP for remote communications, no tunnel configuration is required because the client and server virtual private network (VPN) components of this version of Windows create the rules to secure L2TP traffic automatically.</maml:para>
<maml:para>To configure the tunnel endpoints, click <maml:ui>Customize</maml:ui>, and then provide the required information in the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Connection Security Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Monitor Connection Security Rules - Advanced</maml:title><maml:introduction>
<maml:para>If the rule specifies an Internet Protocol security (IPsec) tunnel, this tab shows information about the tunnel endpoints and whether computer or user authorization is required. </maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, expand <maml:ui>Monitoring</maml:ui>, and then expand <maml:ui>Connection Security Rules</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Double-click the rule you want to examine, and then click the <maml:ui>Advanced</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Local tunnel endpoint</maml:title><maml:introduction>
<maml:para>If the connection security rule is a tunnel rule, then this indicates the address of the tunnel endpoint that is closest to the local computer, as configured on the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
<maml:para>If the connection security rule is not a tunnel rule, then <maml:ui>None</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Remote tunnel endpoint</maml:title><maml:introduction>
<maml:para>If the connection security rule is a tunnel rule, then this indicates the address of the tunnel endpoint that is farthest from the local computer, as configured on the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
<maml:para>If the connection security rule is not a tunnel rule, then <maml:ui>None</maml:ui> is displayed.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Interface types</maml:title><maml:introduction>
<maml:para>This indicates the network interface types to which the rule applies, as configured on the <maml:ui>Advanced</maml:ui> tab of the <maml:ui>Connection Security Rule Properties</maml:ui> page.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Apply authorization</maml:title><maml:introduction>
<maml:para>This indicates whether the use of the tunnel is restricted to only authorized users and computers, as configured on the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box. The list of authorized users and computers is configured on the <maml:ui>Customize IPsec Tunnel Authorizations</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Exempt IPsec protected connections</maml:title><maml:introduction>
<maml:para>This indicates whether network packets addressed to a computer in Endpoint 2 that are already protected by IPsec are sent through the tunnel. This includes any network packet with an ESP header, including ESP NULL. This setting is configured on the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Monitored Connection Security Rules Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=9d81b178-5fef-4b23-9dc7-e85f20bbf5d9"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Firewall Rule Properties Page: Programs and Services Tab</maml:title><maml:introduction>
<maml:para>Use this tab to specify the way in which Windows Firewall with Advanced Security matches criteria based on which program or service on the local computer is sending the packets to the peer computer. If this and all other criteria are matched, Windows Firewall with Advanced Security will take the action that you specify in <maml:ui>Action</maml:ui> on the <maml:ui>General</maml:ui> tab.</maml:para>
<maml:procedure><maml:title>To get to this tab</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in either <maml:ui>Inbound Rules</maml:ui> or <maml:ui>Outbound Rules</maml:ui>, double-click the firewall rule you want to modify, and then click the <maml:ui>Programs and Services</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Programs</maml:title><maml:introduction>
<maml:para>This section contains information about how network packets from a program will be matched.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>All programs that meet the specified conditions</maml:title><maml:introduction>
<maml:para>Use this option to match network packets being sent or received by any program.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>This program</maml:title><maml:introduction>
<maml:para>Use this option to match network packets going to or from a specified program. If the program is not running, then no packets match the rule. You can select the program in one of two ways: </maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>Type the complete path to the program. You can include environment variables, where appropriate.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>Do not use environment variable strings that resolve only in the context of a certain user (for example, %USERPROFILE%). When these strings are evaluated by the service at runtime, the service is not running in the context of the user. The use of these strings can produce unexpected results.</maml:para></maml:alertSet></maml:listItem>
<maml:listItem><maml:para>Click <maml:ui>Browse</maml:ui> and find the program in the directory.</maml:para></maml:listItem>
</maml:list>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Services</maml:title><maml:introduction>
<maml:para>Click <maml:ui>Settings</maml:ui> to match packets from all program and services on the computer (the default), services only, or a specified service.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>More about program and service settings</maml:title><maml:introduction>
<maml:para>To add a program to the rule, you must specify the executable (.exe) file used by the program. A system service that runs within its own unique .exe file and is not hosted by a service container is considered to be a program and can be added to the rule. In the same way, a program that behaves like a system service and runs whether or not a user is logged on to the computer is also considered a program as long as it runs within its own unique .exe file.</maml:para>
<maml:alertSet class="security"><maml:title>Security Note </maml:title><maml:para>Do not add service containers or programs that host services, such as Svchost.exe, Dllhost.exe, and Inetinfo.exe, to the rules list without specifying the individual service that is to be allowed or blocked. Specifying only the service container as a program might compromise the security of the computer.</maml:para></maml:alertSet>
<maml:para>When you add a program to the rule, Windows Firewall with Advanced Security dynamically opens (unblocks) and closes (blocks) the ports required by the program. When the program is running and listening for incoming traffic, Windows Firewall with Advanced Security opens the required ports; when the program is not running or is not listening for incoming traffic, Windows Firewall with Advanced Security closes the ports. Because of this dynamic behavior, adding programs to a rule is the recommended method for allowing unsolicited incoming traffic through Windows Firewall with Advanced Security.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>You can use program rules to allow unsolicited incoming traffic through Windows Firewall with Advanced Security only if the program uses the Windows Sockets (Winsock) application programming interface (API) to create port assignments. If a program does not use Winsock to assign ports, you must determine which ports the program uses and add those ports to the rules list.</maml:para></maml:alertSet>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Firewall Rule Properties Page</maml:linkText><maml:uri href="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Customize Service Settings</maml:linkText><maml:uri href="mshelp://windows/?id=7e24b5a1-742d-4247-b86d-db9e097dee4e"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Advanced Authentication Methods</maml:title><maml:introduction>
<maml:para>Use these settings to configure the authentication required in your environment. You can configure advanced authentication on a rule-by-rule basis or to apply by default to all connection security rules.</maml:para>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>To get to this dialog box to configure the default settings for the computer, perform the following steps. These settings apply to any connection security rule in which <maml:ui>Default</maml:ui> is selected as the authentication method.</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Authentication method</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>To get to this dialog box when creating a new connection security rule, perform the following steps. These settings apply only to the connection security rule whose properties you are editing.</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in the navigation pane, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Select any rule type except <maml:ui>Authentication exemption</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click <maml:ui>Next</maml:ui> through the wizard until you reach the <maml:ui>Authentication Method</maml:ui> page.</maml:para></maml:listItem>
<maml:listItem><maml:para>Select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>To get to this dialog box to configure the settings for an existing connection security rule, perform the following steps. These settings apply only to the connection security rule whose properties you are editing.</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>On the Windows Firewall with Advanced Security MMC snap-in page, in the navigation pane, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Double-click the rule that you want to modify.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>Authentication</maml:ui> tab.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Method</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>First authentication</maml:title><maml:introduction>
<maml:para>The first authentication method is performed during the main mode phase of Internet Protocol security (IPsec) negotiations. In this authentication, you can specify the way in which the peer computer is authenticated.</maml:para>
<maml:para>You can specify multiple methods to use for this authentication. The methods are attempted in the order you specify; the first successful method is used.</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>To add a method to the list, click <maml:ui>Add</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To modify a method already in the list, select the method, and then click <maml:ui>Edit</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To remove a method from the list, select the method, and then click <maml:ui>Remove</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To reorder the list, select a method, and then click the up and down arrows.</maml:para></maml:listItem>
</maml:list>
<maml:para>For more information about the available first authentication methods, see <maml:navigationLink><maml:linkText>Dialog Box: Add or Edit First Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=f9172bb1-6c9e-4e09-a1cb-6e6912459aee"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>First authentication is optional</maml:title><maml:introduction>
<maml:para>You can select this option to have the first authentication performed with anonymous credentials. This is useful when the second authentication provides the primary, required means of authentication, and the first authentication is to be performed only when both peers support it. For example, if you want to require user-based Kerberos version 5 authentication, which is available only as a second authentication, you can select <maml:ui>First authentication is optional</maml:ui>, and then select <maml:ui>User (Kerberos V5)</maml:ui> in <maml:ui>Second authentication method</maml:ui>.</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>Do not configure both the first authentication and second authentication to be optional. This is equivalent to turning authentication off.</maml:para></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Second authentication</maml:title><maml:introduction>
<maml:para>With second authentication, you can specify the way in which the user logged on to the peer computer is authenticated. You can also specify a computer health certificate from a specified certification authority (CA).</maml:para>
<maml:para>The methods are attempted in the order you specify; the first successful method is used.</maml:para>
<maml:para>You can specify multiple methods to use for this authentication. </maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para>To add a method to the list, click <maml:ui>Add</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To modify a method already in the list, select the method, and then click <maml:ui>Edit</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To remove a method from the list, select the method, and then click <maml:ui>Remove</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>To reorder the list, select a method and then click the up and down arrows.</maml:para></maml:listItem>
</maml:list>
<maml:alertSet class="note"><maml:title>Notes </maml:title><maml:alert>You must use either all user-based authentication methods or all computer-based authentication methods.</maml:alert><maml:alert>No matter where it appears in the list, you cannot use the second authentication method if you are using a preshared key for the first authentication method. </maml:alert></maml:alertSet>
<maml:para>For more information about the available second authentication methods, see <maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Second Authentication Method</maml:linkText><maml:uri href="mshelp://windows/?id=dd07bae3-3af0-469b-adc8-84f78f4169e8"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Second authentication is optional</maml:title><maml:introduction>
<maml:para>You can select this option to indicate the second authentication should be performed if possible, but that the connection should not be blocked should the second authentication fail. This is useful when the first authentication provides the primary, required means of authentication, and the second authentication is optional, but preferred, when both peers support it. For example, if you want to require computer-based Kerberos version 5 authentication and you would like to use user-based Kerberos version 5 authentication when possible, you can select <maml:ui>Computer (Kerberos V5) </maml:ui>as the first authentication, and then select <maml:ui>User (Kerberos V5)</maml:ui> as the second authentication with <maml:ui>Second authentication is optional</maml:ui> selected.</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:para>Do not configure both the first authentication and second authentication to be optional. This is equivalent to turning authentication off.</maml:para></maml:alertSet>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:alert>In a tunnel mode rule, if you select <maml:ui>Second authentication is optional</maml:ui>, then the resulting IPsec policy is implemented as IKE only and does not use Authenticated Internet Protocol (AuthIP). Any authentication methods specified in <maml:ui>Second authentication</maml:ui> are ignored. </maml:alert><maml:alert>In a transport mode rule, the second authentication methods are still used, as expected.</maml:alert></maml:alertSet>
</maml:introduction></maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize Data Protection Settings</maml:title><maml:introduction>
<maml:para>Use this dialog box to add, edit, change priority, or remove data integrity or data encryption algorithms. You can use more than one algorithm in each list and you can assign the order in which the algorithms are attempted. The first algorithm in the list that is compatible with both peers will be used.</maml:para>
<maml:para>You must specify algorithms that are also specified in the rules on the computers to which you want to communicate. For more information, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Protocols Supported by Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>A best practice is to list the algorithms in order of greatest security at the top to least security at the bottom. This way, the most secure algorithm in common between the two negotiating computers is used. The less secure algorithms can be used for backward compatibility.</maml:para></maml:alertSet>
<maml:procedure><maml:title>How to get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>On the Windows Firewall with Advanced Security MMC snap-in, in the navigation pane, click <maml:ui>Windows Firewall with Advanced Security</maml:ui>, and then in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>. </maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>Data protection (Quick Mode)</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Performance considerations for encryption</maml:title><maml:introduction>
<maml:para>The encryption algorithms that provide the best security for your data are those that make it computationally infeasible for the data to be decrypted without the key. The mathematical algorithms that perform the encryption are themselves mathematically intense and can degrade performance. As you switch to higher security algorithms, the computing power required to perform the calculations increases.</maml:para>
<maml:para>Windows supports the use of network adapters that have cryptographic processors that can perform most of the IPsec encryption calculations. This frees up your main processors to do other things and reduces the performance overhead of IPsec. For more information, see <maml:navigationLink><maml:linkText>Improving Network Performance by Using IPsec Task Offload</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129229"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129229).</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Require encryption for all connection security rules that use these settings</maml:title><maml:introduction>
<maml:para>Select this check box to require all connection security rules to require encryption. If you select this check box, the <maml:ui>Data integrity</maml:ui> section is disabled, and you can only specify algorithm combinations in the <maml:ui>Data integrity and encryption</maml:ui> section.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Data integrity</maml:title><maml:introduction>
<maml:para>This list shows the currently configured data integrity algorithms. When negotiating the details of the quick mode SA with another computer, the algorithms are proposed in the order shown. Use the up and down arrows to arrange the algorithms into the preferred order. You should place the algorithms with stronger protection at the top of the list, and those with weaker protection at the bottom of the list. Include weaker algorithms only if required to support computers that cannot use the stronger algorithms.</maml:para>
<maml:para>If you select <maml:ui>Require encryption for all connection security rules that use these settings</maml:ui>, then this section is disabled.</maml:para>
<maml:para>To add an algorithm to the list, click <maml:ui>Add</maml:ui>. To modify an algorithm that is already in the list, select the algorithm, and then click <maml:ui>Edit</maml:ui>. To remove an algorithm from the list, select the algorithm, and then click <maml:ui>Remove</maml:ui>. </maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Data integrity and encryption</maml:title><maml:introduction>
<maml:para>This list shows the currently configured algorithm combinations that include both encryption and data integrity. When negotiating the details of the quick mode SA with another computer, the algorithm combinations are proposed in the order shown. Use the up and down arrows to arrange the algorithm combinations into the preferred order. You should place the algorithm combinations with stronger protection at the top of the list and those with weaker protection at the bottom of the list. Include weaker algorithm combinations only if required to support computers that cannot use the stronger algorithm combinations.</maml:para>
<maml:para>To add an algorithm combination to the list, click <maml:ui>Add</maml:ui>. To modify an algorithm combination that is already in the list, select the algorithm combination, and then click <maml:ui>Edit</maml:ui>. To remove an algorithm combination from the list, select the algorithm combination, and then click <maml:ui>Remove</maml:ui>. For more information, see <maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Integrity and Encryption Algorithms</maml:linkText><maml:uri href="mshelp://windows/?id=b31c589e-5b17-42df-b7ad-041084dd2074"></maml:uri></maml:navigationLink>.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Dialog Box: Add or Edit Integrity Algorithms</maml:linkText><maml:uri href="mshelp://windows/?id=226a35ae-cf87-4bd3-b4be-fab77930e6da"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Customize IPsec Tunnel Authorization</maml:title><maml:introduction>
<maml:para>Use these settings to specify which users or computers are authorized to initiate a tunnel connection to the local computer. These settings only apply to inbound connections. Tunnel connections initiated by the local computer are not subject to these authorization settings.</maml:para>
<maml:alertSet class="note"><maml:title>Note </maml:title><maml:para>These settings only apply to tunnel mode rules that have the <maml:ui>Apply authorization</maml:ui> option enabled on the <maml:ui>Customize IPsec Tunneling Settings</maml:ui> dialog box.</maml:para></maml:alertSet>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab.</maml:para></maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>Under <maml:ui>IPsec tunnel authorization</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Computers tab</maml:title><maml:introduction>
<maml:para>Use this tab to identify computers or computer groups that are authorized to create tunnel mode connections to the local computer.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Authorized computers</maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from these computers</maml:title><maml:introduction>
<maml:para>Select this option to specify which computers can create a tunnel mode connection to the local computer.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in the <maml:ui>Active Directory Object Picker</maml:ui> dialog box.</maml:para>
<maml:para>To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify computer or group accounts that are denied permissions to create tunnel mode connections to the local computer. If a computer attempting a connection is listed in both the <maml:ui>Authorized computers</maml:ui> and <maml:ui>Exceptions</maml:ui> boxes, either directly or as a member of a group, the exception takes priority and the connection is blocked.
</maml:para></maml:introduction>
<maml:sections><maml:section><maml:title>Deny connections from these computers</maml:title><maml:introduction>
<maml:para>Select this option to specify which computers are prohibited from creating a tunnel mode connection to this computer.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the computer or group accounts in the <maml:ui>Active Directory Object Picker</maml:ui> dialog box.</maml:para>
<maml:para>To remove a computer or group from the list, select the computer or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section></maml:sections>
</maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Users tab</maml:title><maml:introduction>
<maml:para>Use this tab to identify users or user groups that are authorized to create tunnel mode connections to the local computer.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Authorized users</maml:title><maml:introduction></maml:introduction>
<maml:sections>
<maml:section><maml:title>Only allow connections from these users</maml:title><maml:introduction>
<maml:para>Select this option to specify which users can create a tunnel mode connection to this computer.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Active Directory Object Picker</maml:ui> dialog box.</maml:para>
<maml:para>To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Exceptions</maml:title><maml:introduction>
<maml:para>Use this section to identify user or group accounts that are denied permissions to create tunnel mode connections to the local computer. If a user attempting a connection is listed in both the <maml:ui>Authorized users</maml:ui> and <maml:ui>Exceptions</maml:ui> boxes, either directly or as a member of a group, the exception takes priority and the connection is blocked.</maml:para></maml:introduction>
<maml:sections><maml:section><maml:title>Deny connections from these computers</maml:title><maml:introduction>
<maml:para>Select this option to specify which users are prohibited from creating a tunnel mode connection to this computer.</maml:para>
<maml:para>If you select the check box, then <maml:ui>Add</maml:ui> is enabled. Click <maml:ui>Add</maml:ui>, and then specify the user or group accounts in the <maml:ui>Active Directory Object Picker</maml:ui> dialog box.</maml:para>
<maml:para>To remove a user or group from the list, select the user or group, and then click <maml:ui>Remove</maml:ui>.</maml:para>
</maml:introduction></maml:section></maml:sections>
</maml:section>
</maml:sections>
</maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Configuring Firewall Rules</maml:title><maml:introduction>
<maml:para>Because Windows Firewall with Advanced Security blocks all incoming unsolicited network traffic by default, you need to configure program, port, or system service rules for programs or services that are acting as servers, listeners, or peers. Program, port, and system service rules are managed on an ongoing basis as your server roles or configurations change. The roles and features that you can install by using Server Manager typically create and enable firewall rules for you when the role or feature is installed. They also remove or disable the rules when the role or feature is removed. A growing number of other, non-Microsoft programs and services also automatically configure Windows Firewall with a set of rules to permit their operation.</maml:para>
<maml:alertSet class="important"><maml:title>Important </maml:title><maml:para>Each filtering criteria that you add to a firewall rule adds increasing levels of restriction. For example, if you do not specify a program or service on the <maml:ui>Program and Services</maml:ui> tab, all programs and services will be allowed to connect, if their network traffic matches the other criteria in the rule. Adding more detailed criteria makes the rule progressively more restrictive and less likely to be matched.</maml:para></maml:alertSet>
<maml:para>For more information, see <maml:navigationLink><maml:linkText>Configuring Firewall Rules</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137813"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137813) in the TechNet Library.</maml:para>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Additional references</maml:title><maml:introduction><maml:list class="unordered"><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=60324d03-97f8-4aa5-864b-af205ebff02b"></maml:uri></maml:navigationLink></maml:para></maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Understanding Firewall Rules</maml:linkText><maml:uri href="mshelp://windows/?id=9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99"></maml:uri></maml:navigationLink></maml:para></maml:listItem></maml:list></maml:introduction></maml:section></maml:sections></maml:content></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Dialog Box: Add or Edit First Authentication Method</maml:title><maml:introduction>
<maml:para>Use these settings to specify the way in which the peer computer is authenticated. The first authentication method is performed during the main mode phase of Internet Protocol security (IPsec) negotiations.</maml:para>
<maml:para>You can specify multiple methods to use for first authentication. The methods are attempted in the order you specify. The first successful method is used.</maml:para>
<maml:para>For more information about the authentication methods available in this dialog box, see <maml:navigationLink><maml:linkText>IPsec Algorithms and Methods Supported in Windows</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=129230"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=129230).</maml:para>
<maml:procedure><maml:title>To get to this dialog box</maml:title><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying the system-wide default settings:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, in <maml:ui>Overview</maml:ui>, click <maml:ui>Windows Firewall Properties</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>IPsec Settings</maml:ui> tab, and then under <maml:ui>IPsec defaults</maml:ui>, click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Authentication Method</maml:ui>, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>First authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When creating a new connection security rule:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, right-click <maml:ui>Connection Security Rules</maml:ui>, and then click <maml:ui>New Rule</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>On the <maml:ui>Rule Type</maml:ui> page, select any type except <maml:ui>Authentication exemption</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>On the <maml:ui>Authentication Method</maml:ui> page, select <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>First authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step><maml:step><maml:sections><maml:section><maml:title></maml:title><maml:para>When modifying an existing connection security rule:</maml:para>
<maml:list class="ordered">
<maml:listItem><maml:para>In the Windows Firewall with Advanced Security MMC snap-in, click <maml:ui>Connection Security Rules</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Double-click the connection security rule that you want to modify.</maml:para></maml:listItem>
<maml:listItem><maml:para>Click the <maml:ui>Authentication</maml:ui> tab.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>Method</maml:ui>, click <maml:ui>Advanced</maml:ui>, and then click <maml:ui>Customize</maml:ui>.</maml:para></maml:listItem>
<maml:listItem><maml:para>Under <maml:ui>First authentication</maml:ui>, select a method, and then click <maml:ui>Edit</maml:ui> or <maml:ui>Add.</maml:ui></maml:para></maml:listItem>
</maml:list>
</maml:section></maml:sections></maml:step></maml:procedure>
</maml:introduction><maml:content><maml:sections><maml:section><maml:title>Computer (Kerberos V5)</maml:title><maml:introduction>
<maml:para>You can use this method to authenticate peer computers that have computer accounts in the same domain or in separate domains that have a trust relationship.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Computer (NTLMv2)</maml:title><maml:introduction>
<maml:para>NTLMv2 is an alternative way to authenticate peer computers that have computer accounts in the same domain or in separate domains that have a trust relationship.</maml:para>
</maml:introduction></maml:section><maml:section><maml:title>Computer certificate from this certification authority (CA)</maml:title><maml:introduction>
<maml:para>Use a public key certificate in situations that include external business partner communications or computers that do not run the Kerberos version 5 authentication protocol. This requires that at least one trusted root CA is configured on or accessible through your network and that client computers have an associated computer certificate.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Signing algorithm</maml:title><maml:introduction>
<maml:para>Specify the signing algorithm used to cryptographically secure the certificate.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>RSA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the RSA public-key cryptography algorithm.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P256</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using the Elliptic Curve Digital Signature Algorithm (ECDSA) with 256-bit key strength.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>ECDSA-P384</maml:title><maml:introduction>
<maml:para>Select this option if the certificate is signed by using ECDSA with 384-bit key strength.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Certificate store type</maml:title><maml:introduction>
<maml:para>Specify the type of certificate by identifying the store in which the certificate is located.</maml:para>
</maml:introduction>
<maml:sections>
<maml:section><maml:title>Root CA (default)</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by a root CA and is stored in the local computer’s Trusted Root Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Intermediate CA</maml:title><maml:introduction>
<maml:para>Select this option if the certificate was issued by an intermediate CA and is stored in the local computer’s Intermediate Certification Authorities certificate store.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section>
<maml:section><maml:title>Accept only health certificates</maml:title><maml:introduction>
<maml:para>This option restricts the use of computer certificates to those that are marked as heath certificates. Health certificates are published by a CA in support of a Network Access Protection (NAP) deployment. NAP lets you define and enforce health policies so that computers that do not comply with network policies, such as computers without antivirus software or those that do not have the latest software updates, are less likely to access your network. To implement NAP, you need to configure NAP settings on both server and client computers. NAP Client Management, a Microsoft Management Console (MMC) snap-in, helps you configure NAP settings on your client computers. For more information, see the NAP MMC snap-in Help. To use this method, you must have a NAP server set up in the domain.</maml:para>
</maml:introduction></maml:section>
<maml:section><maml:title>Enable certificate to account mapping</maml:title><maml:introduction>
<maml:para>When you enable IPsec certificate-to-account mapping, the Internet Key Exchange (IKE) and Authenticated IP (AuthIP) protocols associate (map) a computer certificate to a computer account in an Active Directory domain or forest, and then retrieve an access token, which includes the list of computer security groups. This process ensures that the certificate offered by the IPsec peer corresponds to an active computer account in the domain, and that the certificate is one that should be used by that computer.</maml:para>
<maml:para>Certificate-to-account mapping can only be used for computer accounts that are in the same forest as the computer performing the mapping. This provides much stronger authentication than simply accepting any valid certificate chain. For example, you can use this capability to restrict access to computers that are within the same forest. Certificate-to-account mapping, however, does not ensure that a specific trusted computer is being allowed IPsec access.</maml:para>
<maml:para>Certificate-to-account mapping is especially useful if the certificates come from a public key infrastructure (PKI) that is not integrated with your Active Directory Domain Services (AD DS) deployment, such as if business partners obtain their certificates from non-Microsoft providers. You can configure the IPsec policy authentication method to map certificates to a domain computer account for a specific root CA. You can also map all certificates from an issuing CA to one computer account. This allows IKE certificate authentication to be used to limit which forests are allowed IPsec access in an environment where many forests exist and each performs autoenrollment under a single internal root CA. If the certificate-to-account mapping process is not completed properly, authentication will fail and IPsec-protected connections will be blocked.</maml:para>
</maml:introduction></maml:section>
</maml:sections>
</maml:section><maml:section><maml:title>Preshared key (not recommended)</maml:title><maml:introduction>
<maml:para>You can use preshared keys for authentication. This is a shared, secret key that is previously agreed on by two users. Both parties must manually configure IPsec to use this preshared key. During security negotiation, information is encrypted by using the shared key before transmission and decrypted by using the same key on the receiving end. If the receiver can decrypt the information, identities are considered to be authenticated.</maml:para>
<maml:alertSet class="caution"><maml:title>Caution </maml:title><maml:alert>Preshared key methodology is provided for interoperability purposes and to adhere to IPsec standards. You should use the preshared key for testing purposes only. Regular use of preshared key authentication is not recommended because the authentication key is stored in an unprotected state in the IPsec policy.</maml:alert><maml:alert>If a preshared key is used for the main mode authentication, second authentication cannot be used.</maml:alert></maml:alertSet>
</maml:introduction></maml:section></maml:sections></maml:content><maml:relatedLinks type="seeAlso"><maml:title>See Also</maml:title><maml:navigationLink><maml:linkText>User Interface: Windows Firewall with Advanced Security</maml:linkText><maml:uri href="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582"></maml:uri></maml:navigationLink></maml:relatedLinks></maml:conceptual><maml:conceptual contentType="conceptual" xmlns:maml="http://schemas.microsoft.com/maml/2004/10" xmlns:dev="http://schemas.microsoft.com/maml/dev/2004/10"><maml:title>Resources for Windows Firewall with Advanced Security</maml:title><maml:introduction>
<maml:para>For more information about Windows Firewall with Advanced Security, see the following resources on the Microsoft Web site:</maml:para>
<maml:list class="unordered">
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security and IPsec</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=96525"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=96525)</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall with Advanced Security Deployment Guide</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=98308"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=98308)</maml:para>
</maml:listItem><maml:listItem><maml:para><maml:navigationLink><maml:linkText>Server and Domain Isolation</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=95395"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=95395)</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>IPsec</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=95394"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=95394)</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=95393"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=95393)</maml:para></maml:listItem>
<maml:listItem><maml:para><maml:navigationLink><maml:linkText>Windows Firewall Errors and Events for Windows 7 and Windows Server 2008 R2</maml:linkText><maml:uri href="http://go.microsoft.com/fwlink/?linkid=137360"></maml:uri></maml:navigationLink> (http://go.microsoft.com/fwlink/?linkid=137360)</maml:para></maml:listItem>
</maml:list>
</maml:introduction><maml:content><maml:sections></maml:sections></maml:content></maml:conceptual><?xml version="1.0" encoding="utf-8"?>
<HelpCollection Id="authfw" DTDVersion="1.0" FileVersion="" LangId="1033" Copyright="© 2005 Microsoft Corporation. All rights reserved." Title="Windows Firewall with Advanced Security" xmlns="http://schemas.microsoft.com/help/collection/2004/11">
<CompilerOptions CompileResult="H1S" CreateFullTextIndex="Yes" BreakerId="Microsoft.NLG.en.WordBreaker">
<IncludeFile File="authfw.H1F" />
</CompilerOptions>
<TOCDef File="authfw.H1T" Id="authfw_TOC" />
<VTopicDef File="authfw.H1V" />
<KeywordIndexDef File="authfw_AssetId.H1K" />
<KeywordIndexDef File="authfw_BestBet.H1K" />
<KeywordIndexDef File="authfw_LinkTerm.H1K" />
<KeywordIndexDef File="authfw_SubjectTerm.H1K" />
<ItemMoniker Name="!DefaultTOC" ProgId="HxDs.HxHierarchy" InitData="AnyString" />
<ItemMoniker Name="!DefaultFullTextSearch" ProgId="HxDs.HxFullTextSearch" InitData="AnyString" />
<ItemMoniker Name="!DefaultAssetIdIndex" ProgId="HxDs.HxIndex" InitData="AssetId" />
<ItemMoniker Name="!DefaultBestBetIndex" ProgId="HxDs.HxIndex" InitData="BestBet" />
<ItemMoniker Name="!DefaultAssociativeIndex" ProgId="HxDs.HxIndex" InitData="LinkTerm" />
<ItemMoniker Name="!DefaultKeywordIndex" ProgId="HxDs.HxIndex" InitData="SubjectTerm" />
</HelpCollection><?xml version="1.0" encoding="utf-8"?>
<HelpFileList xmlns="http://schemas.microsoft.com/help/filelist/2004/11">
<File Url="assets\05d277a3-2b83-4951-a2fc-e2ca78a24f24.xml" />
<File Url="assets\06cbaf77-aa9d-4dec-b056-3dcd2616e4fa.xml" />
<File Url="assets\0ec58789-26f0-47cd-9f43-aa6e7d52db10.xml" />
<File Url="assets\101488a1-9f62-4797-9330-4937c888e371.xml" />
<File Url="assets\12452b6f-dce5-4515-bfdd-455f08c77e5a.xml" />
<File Url="assets\13da39e0-2a32-4ac4-a952-4391ae88c739.xml" />
<File Url="assets\142a13a0-f0c4-4122-95d9-ecfb6f6391c4.xml" />
<File Url="assets\14f25442-df7f-4c80-9ffc-b01781b2b246.xml" />
<File Url="assets\1826c5b4-7aa9-419a-a211-07542a5dcf1a.xml" />
<File Url="assets\18ddcbbd-4939-492c-a716-f1fccc468c18.xml" />
<File Url="assets\1a70e8bc-19f3-4bd5-bba9-d04c432adbc6.xml" />
<File Url="assets\1a81d9c6-f39f-4835-a00b-11d994247ca9.xml" />
<File Url="assets\20b3aba6-884a-4ef9-8ea7-914e4cd735d9.xml" />
<File Url="assets\226a35ae-cf87-4bd3-b4be-fab77930e6da.xml" />
<File Url="assets\2318ec3c-e196-4a43-9d79-70ca7c52194a.xml" />
<File Url="assets\2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0.xml" />
<File Url="assets\39e393da-18a6-4a1d-85d1-d9dcb46e3b93.xml" />
<File Url="assets\40413516-c1ab-46b3-b62c-d165b434974b.xml" />
<File Url="assets\41646515-247f-4ce4-a9fd-600bd90ae773.xml" />
<File Url="assets\5147487b-bb6a-40e4-b8ee-f263c52bee24.xml" />
<File Url="assets\52a543f3-3baa-42d9-8614-25293d0e3f62.xml" />
<File Url="assets\53d4595a-b6b0-4133-be9e-03dcecef56e6.xml" />
<File Url="assets\53df2676-ea86-4670-8f48-b113383a0992.xml" />
<File Url="assets\55215ddc-b9aa-4bac-9ec2-d5da5cb3932c.xml" />
<File Url="assets\5886c961-2f7a-46f9-928b-2b906f2c354a.xml" />
<File Url="assets\58a40682-63b1-493a-9d97-940532cbbcd8.xml" />
<File Url="assets\5918d117-66c3-4f58-8680-a5a822c40dc7.xml" />
<File Url="assets\5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da.xml" />
<File Url="assets\5ca392ca-aece-4319-90c5-80544a29b8e9.xml" />
<File Url="assets\60324d03-97f8-4aa5-864b-af205ebff02b.xml" />
<File Url="relatedAssets\52c6db15-ed4e-415c-a077-ce2a57486732.gif" />
<File Url="assets\63138fa3-9f09-4684-89cb-c44306ee3763.xml" />
<File Url="assets\66011489-1eee-4986-9373-565e557db23b.xml" />
<File Url="assets\6a710a38-a254-4a80-9a53-6ea2e0816d24.xml" />
<File Url="relatedAssets\35a693e7-9134-418a-9c80-17f6d60c08e6.gif" />
<File Url="assets\70d0c763-d3a3-486d-9f91-e213831f2485.xml" />
<File Url="assets\710fa446-c600-4691-ae28-37a9824fb95d.xml" />
<File Url="assets\71ea19d0-e57f-4828-923a-632cdb208aad.xml" />
<File Url="assets\7e24b5a1-742d-4247-b86d-db9e097dee4e.xml" />
<File Url="assets\8039b8d4-e87b-4aac-9c09-6a34cc73f1b6.xml" />
<File Url="relatedAssets\64ce07a8-52a2-4d69-a392-2cae596fef27.gif" />
<File Url="assets\85c69539-f0c0-474c-9860-d220293ab2d6.xml" />
<File Url="assets\8a0b490a-db5e-420f-8990-d0e30a17bc1a.xml" />
<File Url="assets\8b29e655-9fb1-4ba5-a701-30812af59d2e.xml" />
<File Url="assets\8c965889-6e37-4ad0-b41d-4f98bed709ad.xml" />
<File Url="assets\950c636f-f858-4852-8a78-b3222cd57bff.xml" />
<File Url="assets\97e94c49-45b2-4af9-bcd8-07fff5c1618f.xml" />
<File Url="assets\9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99.xml" />
<File Url="assets\98690952-0b7a-4b1f-bbee-3db1fa381f4f.xml" />
<File Url="assets\99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b.xml" />
<File Url="assets\9d81b178-5fef-4b23-9dc7-e85f20bbf5d9.xml" />
<File Url="assets\9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f.xml" />
<File Url="assets\a4c3ccd0-9ec1-4da5-982d-6e65877b5db3.xml" />
<File Url="assets\aa9088cb-98f3-4c53-8270-09484edb997a.xml" />
<File Url="assets\aaad90b0-4f52-46ca-9636-e05175e4aa78.xml" />
<File Url="assets\b029858f-ef85-4cdd-a29c-06a9457f4365.xml" />
<File Url="assets\b31c589e-5b17-42df-b7ad-041084dd2074.xml" />
<File Url="assets\b8b120da-821c-45f1-86ee-d7303f6b500a.xml" />
<File Url="assets\ba442eea-0e40-4936-bb3a-413993267098.xml" />
<File Url="assets\c243c092-48c6-4073-9b19-b9c98c931582.xml" />
<File Url="assets\c85aba54-dcb3-45be-b1bd-271d579da6fc.xml" />
<File Url="assets\cc83aec7-e835-4b20-acbd-e40eac6764f2.xml" />
<File Url="assets\ccd5048b-bdba-47b7-8658-9f8bbbcec7fb.xml" />
<File Url="assets\cd103e5b-9da9-438d-a9b8-ed96384a17f2.xml" />
<File Url="assets\d42aa5c6-4859-4f78-b001-dc067151521b.xml" />
<File Url="assets\d43f0fad-14d0-4def-8440-631d6e8fe905.xml" />
<File Url="assets\d857a0e4-9ae0-4ee0-84a1-13100e8e5948.xml" />
<File Url="assets\d9626188-57c8-49b1-ad44-66e75119a5f9.xml" />
<File Url="assets\dc5c6bc1-9537-456d-b168-faf78a66554f.xml" />
<File Url="assets\dd07bae3-3af0-469b-adc8-84f78f4169e8.xml" />
<File Url="assets\e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2.xml" />
<File Url="assets\e98f04c7-99c8-4816-a640-da8e73a14db3.xml" />
<File Url="assets\ec590a1c-d105-4cf9-bf83-6606624c33db.xml" />
<File Url="assets\ed344be2-ee6d-4a37-ac31-4f0b9763d04b.xml" />
<File Url="assets\ee8441ab-55b4-4ce3-b658-d4e28320a010.xml" />
<File Url="assets\f19cbe6e-7235-4613-90d0-6f7a3e8a6093.xml" />
<File Url="assets\f4d3d872-6514-49fd-b8ed-1d725f74f0c1.xml" />
<File Url="assets\f637c2d4-a8aa-4e7a-b437-86b8e3accc7f.xml" />
<File Url="assets\f87bdc33-14b4-4832-b190-377f16d7e671.xml" />
<File Url="assets\f9172bb1-6c9e-4e09-a1cb-6e6912459aee.xml" />
<File Url="assets\ffe91987-ce8c-4caa-826a-fb26d9d3f23b.xml" />
</HelpFileList><?xml version="1.0" encoding="utf-8"?>
<VTopicSet DTDVersion="1.0" xmlns="http://schemas.microsoft.com/help/vtopic/2004/11">
<Vtopic Url="assets\05d277a3-2b83-4951-a2fc-e2ca78a24f24.xml" RLTitle="Windows Firewall with Advanced Security Properties Page">
<Attr Name="assetid" Value="05d277a3-2b83-4951-a2fc-e2ca78a24f24" />
<Keyword Index="AssetId" Term="05d277a3-2b83-4951-a2fc-e2ca78a24f24" />
<Keyword Index="AssetId" Term="05d277a3-2b83-4951-a2fc-e2ca78a24f241033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="05d277a3-2b83-4951-a2fc-e2ca78a24f24" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\06cbaf77-aa9d-4dec-b056-3dcd2616e4fa.xml" RLTitle="Dialog Box: Add or Edit IP Addresses">
<Attr Name="assetid" Value="06cbaf77-aa9d-4dec-b056-3dcd2616e4fa" />
<Keyword Index="AssetId" Term="06cbaf77-aa9d-4dec-b056-3dcd2616e4fa" />
<Keyword Index="AssetId" Term="06cbaf77-aa9d-4dec-b056-3dcd2616e4fa1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="06cbaf77-aa9d-4dec-b056-3dcd2616e4fa" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\0ec58789-26f0-47cd-9f43-aa6e7d52db10.xml" RLTitle="Connection Security Rule Property Page: General Tab">
<Attr Name="assetid" Value="0ec58789-26f0-47cd-9f43-aa6e7d52db10" />
<Keyword Index="AssetId" Term="0ec58789-26f0-47cd-9f43-aa6e7d52db10" />
<Keyword Index="AssetId" Term="0ec58789-26f0-47cd-9f43-aa6e7d52db101033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="0ec58789-26f0-47cd-9f43-aa6e7d52db10" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\101488a1-9f62-4797-9330-4937c888e371.xml" RLTitle="Connection Security Rule Properties Page">
<Attr Name="assetid" Value="101488a1-9f62-4797-9330-4937c888e371" />
<Keyword Index="AssetId" Term="101488a1-9f62-4797-9330-4937c888e371" />
<Keyword Index="AssetId" Term="101488a1-9f62-4797-9330-4937c888e3711033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="101488a1-9f62-4797-9330-4937c888e371" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\12452b6f-dce5-4515-bfdd-455f08c77e5a.xml" RLTitle="Connection Security Rule Wizard: Exempt Computers Page">
<Attr Name="assetid" Value="12452b6f-dce5-4515-bfdd-455f08c77e5a" />
<Keyword Index="AssetId" Term="12452b6f-dce5-4515-bfdd-455f08c77e5a" />
<Keyword Index="AssetId" Term="12452b6f-dce5-4515-bfdd-455f08c77e5a1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="12452b6f-dce5-4515-bfdd-455f08c77e5a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\13da39e0-2a32-4ac4-a952-4391ae88c739.xml" RLTitle="Connection Security Rule Properties Page: Authentication Tab">
<Attr Name="assetid" Value="13da39e0-2a32-4ac4-a952-4391ae88c739" />
<Keyword Index="AssetId" Term="13da39e0-2a32-4ac4-a952-4391ae88c739" />
<Keyword Index="AssetId" Term="13da39e0-2a32-4ac4-a952-4391ae88c7391033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="13da39e0-2a32-4ac4-a952-4391ae88c739" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\142a13a0-f0c4-4122-95d9-ecfb6f6391c4.xml" RLTitle="Firewall Rule Properties Page">
<Attr Name="assetid" Value="142a13a0-f0c4-4122-95d9-ecfb6f6391c4" />
<Keyword Index="AssetId" Term="142a13a0-f0c4-4122-95d9-ecfb6f6391c4" />
<Keyword Index="AssetId" Term="142a13a0-f0c4-4122-95d9-ecfb6f6391c41033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="142a13a0-f0c4-4122-95d9-ecfb6f6391c4" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\14f25442-df7f-4c80-9ffc-b01781b2b246.xml" RLTitle="Firewall Rule Properties Page: Protocols and Ports Tab">
<Attr Name="assetid" Value="14f25442-df7f-4c80-9ffc-b01781b2b246" />
<Keyword Index="AssetId" Term="14f25442-df7f-4c80-9ffc-b01781b2b246" />
<Keyword Index="AssetId" Term="14f25442-df7f-4c80-9ffc-b01781b2b2461033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="14f25442-df7f-4c80-9ffc-b01781b2b246" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\1826c5b4-7aa9-419a-a211-07542a5dcf1a.xml" RLTitle="Firewall Rule Wizard: Action Page">
<Attr Name="assetid" Value="1826c5b4-7aa9-419a-a211-07542a5dcf1a" />
<Keyword Index="AssetId" Term="1826c5b4-7aa9-419a-a211-07542a5dcf1a" />
<Keyword Index="AssetId" Term="1826c5b4-7aa9-419a-a211-07542a5dcf1a1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="1826c5b4-7aa9-419a-a211-07542a5dcf1a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\18ddcbbd-4939-492c-a716-f1fccc468c18.xml" RLTitle="Connection Security Rule Wizard: Rule Type Page">
<Attr Name="assetid" Value="18ddcbbd-4939-492c-a716-f1fccc468c18" />
<Keyword Index="AssetId" Term="18ddcbbd-4939-492c-a716-f1fccc468c18" />
<Keyword Index="AssetId" Term="18ddcbbd-4939-492c-a716-f1fccc468c181033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="18ddcbbd-4939-492c-a716-f1fccc468c18" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\1a70e8bc-19f3-4bd5-bba9-d04c432adbc6.xml" RLTitle="Overview of Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="1a70e8bc-19f3-4bd5-bba9-d04c432adbc6" />
<Keyword Index="AssetId" Term="1a70e8bc-19f3-4bd5-bba9-d04c432adbc6" />
<Keyword Index="AssetId" Term="1a70e8bc-19f3-4bd5-bba9-d04c432adbc61033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="1a70e8bc-19f3-4bd5-bba9-d04c432adbc6" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\1a81d9c6-f39f-4835-a00b-11d994247ca9.xml" RLTitle="Dialog Box: Customize Allow If Secure Settings">
<Attr Name="assetid" Value="1a81d9c6-f39f-4835-a00b-11d994247ca9" />
<Keyword Index="AssetId" Term="1a81d9c6-f39f-4835-a00b-11d994247ca9" />
<Keyword Index="AssetId" Term="1a81d9c6-f39f-4835-a00b-11d994247ca91033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="1a81d9c6-f39f-4835-a00b-11d994247ca9" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\20b3aba6-884a-4ef9-8ea7-914e4cd735d9.xml" RLTitle="Monitored Firewall Rules Properties Page">
<Attr Name="assetid" Value="20b3aba6-884a-4ef9-8ea7-914e4cd735d9" />
<Keyword Index="AssetId" Term="20b3aba6-884a-4ef9-8ea7-914e4cd735d9" />
<Keyword Index="AssetId" Term="20b3aba6-884a-4ef9-8ea7-914e4cd735d91033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="20b3aba6-884a-4ef9-8ea7-914e4cd735d9" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\226a35ae-cf87-4bd3-b4be-fab77930e6da.xml" RLTitle="Dialog Box: Add or Edit Integrity Algorithms">
<Attr Name="assetid" Value="226a35ae-cf87-4bd3-b4be-fab77930e6da" />
<Keyword Index="AssetId" Term="226a35ae-cf87-4bd3-b4be-fab77930e6da" />
<Keyword Index="AssetId" Term="226a35ae-cf87-4bd3-b4be-fab77930e6da1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="226a35ae-cf87-4bd3-b4be-fab77930e6da" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\2318ec3c-e196-4a43-9d79-70ca7c52194a.xml" RLTitle="Connection Security Rule Wizard">
<Attr Name="assetid" Value="2318ec3c-e196-4a43-9d79-70ca7c52194a" />
<Keyword Index="AssetId" Term="2318ec3c-e196-4a43-9d79-70ca7c52194a" />
<Keyword Index="AssetId" Term="2318ec3c-e196-4a43-9d79-70ca7c52194a1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="2318ec3c-e196-4a43-9d79-70ca7c52194a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0.xml" RLTitle="Firewall Rule Wizard: Protocol and Ports Page - Custom Rule Type">
<Attr Name="assetid" Value="2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0" />
<Keyword Index="AssetId" Term="2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0" />
<Keyword Index="AssetId" Term="2adf4b4a-fbdb-4bfa-8e09-8648c986f4f01033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\39e393da-18a6-4a1d-85d1-d9dcb46e3b93.xml" RLTitle="Monitored Main Mode Security Associations">
<Attr Name="assetid" Value="39e393da-18a6-4a1d-85d1-d9dcb46e3b93" />
<Keyword Index="AssetId" Term="39e393da-18a6-4a1d-85d1-d9dcb46e3b93" />
<Keyword Index="AssetId" Term="39e393da-18a6-4a1d-85d1-d9dcb46e3b931033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="39e393da-18a6-4a1d-85d1-d9dcb46e3b93" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\40413516-c1ab-46b3-b62c-d165b434974b.xml" RLTitle="Monitoring Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="40413516-c1ab-46b3-b62c-d165b434974b" />
<Keyword Index="AssetId" Term="40413516-c1ab-46b3-b62c-d165b434974b" />
<Keyword Index="AssetId" Term="40413516-c1ab-46b3-b62c-d165b434974b1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="40413516-c1ab-46b3-b62c-d165b434974b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\41646515-247f-4ce4-a9fd-600bd90ae773.xml" RLTitle="Default Settings for Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="41646515-247f-4ce4-a9fd-600bd90ae773" />
<Keyword Index="AssetId" Term="41646515-247f-4ce4-a9fd-600bd90ae773" />
<Keyword Index="AssetId" Term="41646515-247f-4ce4-a9fd-600bd90ae7731033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="41646515-247f-4ce4-a9fd-600bd90ae773" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5147487b-bb6a-40e4-b8ee-f263c52bee24.xml" RLTitle="Firewall Rule Properties Page: General Tab">
<Attr Name="assetid" Value="5147487b-bb6a-40e4-b8ee-f263c52bee24" />
<Keyword Index="AssetId" Term="5147487b-bb6a-40e4-b8ee-f263c52bee24" />
<Keyword Index="AssetId" Term="5147487b-bb6a-40e4-b8ee-f263c52bee241033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5147487b-bb6a-40e4-b8ee-f263c52bee24" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\52a543f3-3baa-42d9-8614-25293d0e3f62.xml" RLTitle="Monitor Firewall Rules - General">
<Attr Name="assetid" Value="52a543f3-3baa-42d9-8614-25293d0e3f62" />
<Keyword Index="AssetId" Term="52a543f3-3baa-42d9-8614-25293d0e3f62" />
<Keyword Index="AssetId" Term="52a543f3-3baa-42d9-8614-25293d0e3f621033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="52a543f3-3baa-42d9-8614-25293d0e3f62" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\53d4595a-b6b0-4133-be9e-03dcecef56e6.xml" RLTitle="Monitor Connection Security Rules - Authentication">
<Attr Name="assetid" Value="53d4595a-b6b0-4133-be9e-03dcecef56e6" />
<Keyword Index="AssetId" Term="53d4595a-b6b0-4133-be9e-03dcecef56e6" />
<Keyword Index="AssetId" Term="53d4595a-b6b0-4133-be9e-03dcecef56e61033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="53d4595a-b6b0-4133-be9e-03dcecef56e6" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\53df2676-ea86-4670-8f48-b113383a0992.xml" RLTitle="Firewall Rule Properties Page: Users Tab">
<Attr Name="assetid" Value="53df2676-ea86-4670-8f48-b113383a0992" />
<Keyword Index="AssetId" Term="53df2676-ea86-4670-8f48-b113383a0992" />
<Keyword Index="AssetId" Term="53df2676-ea86-4670-8f48-b113383a09921033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="53df2676-ea86-4670-8f48-b113383a0992" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\55215ddc-b9aa-4bac-9ec2-d5da5cb3932c.xml" RLTitle="Dialog Box: Customize Settings for a Firewall Profile">
<Attr Name="assetid" Value="55215ddc-b9aa-4bac-9ec2-d5da5cb3932c" />
<Keyword Index="AssetId" Term="55215ddc-b9aa-4bac-9ec2-d5da5cb3932c" />
<Keyword Index="AssetId" Term="55215ddc-b9aa-4bac-9ec2-d5da5cb3932c1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="55215ddc-b9aa-4bac-9ec2-d5da5cb3932c" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5886c961-2f7a-46f9-928b-2b906f2c354a.xml" RLTitle="Firewall Rule Wizard">
<Attr Name="assetid" Value="5886c961-2f7a-46f9-928b-2b906f2c354a" />
<Keyword Index="AssetId" Term="5886c961-2f7a-46f9-928b-2b906f2c354a" />
<Keyword Index="AssetId" Term="5886c961-2f7a-46f9-928b-2b906f2c354a1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5886c961-2f7a-46f9-928b-2b906f2c354a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\58a40682-63b1-493a-9d97-940532cbbcd8.xml" RLTitle="Dialog Box: Customize Logging Settings for a Firewall Profile">
<Attr Name="assetid" Value="58a40682-63b1-493a-9d97-940532cbbcd8" />
<Keyword Index="AssetId" Term="58a40682-63b1-493a-9d97-940532cbbcd8" />
<Keyword Index="AssetId" Term="58a40682-63b1-493a-9d97-940532cbbcd81033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="58a40682-63b1-493a-9d97-940532cbbcd8" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5918d117-66c3-4f58-8680-a5a822c40dc7.xml" RLTitle="Dialog Box: Customize Interface Types">
<Attr Name="assetid" Value="5918d117-66c3-4f58-8680-a5a822c40dc7" />
<Keyword Index="AssetId" Term="5918d117-66c3-4f58-8680-a5a822c40dc7" />
<Keyword Index="AssetId" Term="5918d117-66c3-4f58-8680-a5a822c40dc71033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5918d117-66c3-4f58-8680-a5a822c40dc7" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da.xml" RLTitle="Firewall Rule Wizard: Computers Page">
<Attr Name="assetid" Value="5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da" />
<Keyword Index="AssetId" Term="5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da" />
<Keyword Index="AssetId" Term="5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\5ca392ca-aece-4319-90c5-80544a29b8e9.xml" RLTitle="Monitor Connection Security Rules - General">
<Attr Name="assetid" Value="5ca392ca-aece-4319-90c5-80544a29b8e9" />
<Keyword Index="AssetId" Term="5ca392ca-aece-4319-90c5-80544a29b8e9" />
<Keyword Index="AssetId" Term="5ca392ca-aece-4319-90c5-80544a29b8e91033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="5ca392ca-aece-4319-90c5-80544a29b8e9" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\60324d03-97f8-4aa5-864b-af205ebff02b.xml" RLTitle="Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="60324d03-97f8-4aa5-864b-af205ebff02b" />
<Keyword Index="AssetId" Term="60324d03-97f8-4aa5-864b-af205ebff02b" />
<Keyword Index="AssetId" Term="60324d03-97f8-4aa5-864b-af205ebff02b1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="60324d03-97f8-4aa5-864b-af205ebff02b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\52c6db15-ed4e-415c-a077-ce2a57486732.gif">
<Keyword Index="AssetId" Term="52c6db15-ed4e-415c-a077-ce2a57486732" />
</Vtopic>
<Vtopic Url="assets\63138fa3-9f09-4684-89cb-c44306ee3763.xml" RLTitle="Connection Security Rule Wizard: Tunnel Endpoints Page - Client-to-Gateway">
<Attr Name="assetid" Value="63138fa3-9f09-4684-89cb-c44306ee3763" />
<Keyword Index="AssetId" Term="63138fa3-9f09-4684-89cb-c44306ee3763" />
<Keyword Index="AssetId" Term="63138fa3-9f09-4684-89cb-c44306ee37631033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="63138fa3-9f09-4684-89cb-c44306ee3763" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\66011489-1eee-4986-9373-565e557db23b.xml" RLTitle="Dialog Box: Customize IPsec Settings">
<Attr Name="assetid" Value="66011489-1eee-4986-9373-565e557db23b" />
<Keyword Index="AssetId" Term="66011489-1eee-4986-9373-565e557db23b" />
<Keyword Index="AssetId" Term="66011489-1eee-4986-9373-565e557db23b1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="66011489-1eee-4986-9373-565e557db23b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\6a710a38-a254-4a80-9a53-6ea2e0816d24.xml" RLTitle="Connection Security Rule Wizard: Requirements Page">
<Attr Name="assetid" Value="6a710a38-a254-4a80-9a53-6ea2e0816d24" />
<Keyword Index="AssetId" Term="6a710a38-a254-4a80-9a53-6ea2e0816d24" />
<Keyword Index="AssetId" Term="6a710a38-a254-4a80-9a53-6ea2e0816d241033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="6a710a38-a254-4a80-9a53-6ea2e0816d24" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\35a693e7-9134-418a-9c80-17f6d60c08e6.gif">
<Keyword Index="AssetId" Term="35a693e7-9134-418a-9c80-17f6d60c08e6" />
</Vtopic>
<Vtopic Url="assets\70d0c763-d3a3-486d-9f91-e213831f2485.xml" RLTitle="Connection Security Rule Wizard: Tunnel Endpoints Page - Gateway-to-Client">
<Attr Name="assetid" Value="70d0c763-d3a3-486d-9f91-e213831f2485" />
<Keyword Index="AssetId" Term="70d0c763-d3a3-486d-9f91-e213831f2485" />
<Keyword Index="AssetId" Term="70d0c763-d3a3-486d-9f91-e213831f24851033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="70d0c763-d3a3-486d-9f91-e213831f2485" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\710fa446-c600-4691-ae28-37a9824fb95d.xml" RLTitle="Connection Security Rule Wizard: Tunnel Type Page">
<Attr Name="assetid" Value="710fa446-c600-4691-ae28-37a9824fb95d" />
<Keyword Index="AssetId" Term="710fa446-c600-4691-ae28-37a9824fb95d" />
<Keyword Index="AssetId" Term="710fa446-c600-4691-ae28-37a9824fb95d1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="710fa446-c600-4691-ae28-37a9824fb95d" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\71ea19d0-e57f-4828-923a-632cdb208aad.xml" RLTitle="Dialog Boxes">
<Attr Name="assetid" Value="71ea19d0-e57f-4828-923a-632cdb208aad" />
<Keyword Index="AssetId" Term="71ea19d0-e57f-4828-923a-632cdb208aad" />
<Keyword Index="AssetId" Term="71ea19d0-e57f-4828-923a-632cdb208aad1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="71ea19d0-e57f-4828-923a-632cdb208aad" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\7e24b5a1-742d-4247-b86d-db9e097dee4e.xml" RLTitle="Dialog Box: Customize Service Settings">
<Attr Name="assetid" Value="7e24b5a1-742d-4247-b86d-db9e097dee4e" />
<Keyword Index="AssetId" Term="7e24b5a1-742d-4247-b86d-db9e097dee4e" />
<Keyword Index="AssetId" Term="7e24b5a1-742d-4247-b86d-db9e097dee4e1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="7e24b5a1-742d-4247-b86d-db9e097dee4e" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\8039b8d4-e87b-4aac-9c09-6a34cc73f1b6.xml" RLTitle="Connection Security Rule Wizard: Endpoints Page">
<Attr Name="assetid" Value="8039b8d4-e87b-4aac-9c09-6a34cc73f1b6" />
<Keyword Index="AssetId" Term="8039b8d4-e87b-4aac-9c09-6a34cc73f1b6" />
<Keyword Index="AssetId" Term="8039b8d4-e87b-4aac-9c09-6a34cc73f1b61033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="8039b8d4-e87b-4aac-9c09-6a34cc73f1b6" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="relatedAssets\64ce07a8-52a2-4d69-a392-2cae596fef27.gif">
<Keyword Index="AssetId" Term="64ce07a8-52a2-4d69-a392-2cae596fef27" />
</Vtopic>
<Vtopic Url="assets\85c69539-f0c0-474c-9860-d220293ab2d6.xml" RLTitle="Connection Security Rule Wizard: Tunnel Endpoints Page - Custom Configuration">
<Attr Name="assetid" Value="85c69539-f0c0-474c-9860-d220293ab2d6" />
<Keyword Index="AssetId" Term="85c69539-f0c0-474c-9860-d220293ab2d6" />
<Keyword Index="AssetId" Term="85c69539-f0c0-474c-9860-d220293ab2d61033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="85c69539-f0c0-474c-9860-d220293ab2d6" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\8a0b490a-db5e-420f-8990-d0e30a17bc1a.xml" RLTitle="Dialog Box: Customize ICMP Settings">
<Attr Name="assetid" Value="8a0b490a-db5e-420f-8990-d0e30a17bc1a" />
<Keyword Index="AssetId" Term="8a0b490a-db5e-420f-8990-d0e30a17bc1a" />
<Keyword Index="AssetId" Term="8a0b490a-db5e-420f-8990-d0e30a17bc1a1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="8a0b490a-db5e-420f-8990-d0e30a17bc1a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\8b29e655-9fb1-4ba5-a701-30812af59d2e.xml" RLTitle="Firewall Rule Wizard: Predefined Rules Page">
<Attr Name="assetid" Value="8b29e655-9fb1-4ba5-a701-30812af59d2e" />
<Keyword Index="AssetId" Term="8b29e655-9fb1-4ba5-a701-30812af59d2e" />
<Keyword Index="AssetId" Term="8b29e655-9fb1-4ba5-a701-30812af59d2e1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="8b29e655-9fb1-4ba5-a701-30812af59d2e" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\8c965889-6e37-4ad0-b41d-4f98bed709ad.xml" RLTitle="Monitored Quick Mode Security Associations">
<Attr Name="assetid" Value="8c965889-6e37-4ad0-b41d-4f98bed709ad" />
<Keyword Index="AssetId" Term="8c965889-6e37-4ad0-b41d-4f98bed709ad" />
<Keyword Index="AssetId" Term="8c965889-6e37-4ad0-b41d-4f98bed709ad1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="8c965889-6e37-4ad0-b41d-4f98bed709ad" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\950c636f-f858-4852-8a78-b3222cd57bff.xml" RLTitle="Firewall Rule Properties Page: Scope Tab">
<Attr Name="assetid" Value="950c636f-f858-4852-8a78-b3222cd57bff" />
<Keyword Index="AssetId" Term="950c636f-f858-4852-8a78-b3222cd57bff" />
<Keyword Index="AssetId" Term="950c636f-f858-4852-8a78-b3222cd57bff1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="950c636f-f858-4852-8a78-b3222cd57bff" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\97e94c49-45b2-4af9-bcd8-07fff5c1618f.xml" RLTitle="Connection Security Rule Properties Page: Computers Tab">
<Attr Name="assetid" Value="97e94c49-45b2-4af9-bcd8-07fff5c1618f" />
<Keyword Index="AssetId" Term="97e94c49-45b2-4af9-bcd8-07fff5c1618f" />
<Keyword Index="AssetId" Term="97e94c49-45b2-4af9-bcd8-07fff5c1618f1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="97e94c49-45b2-4af9-bcd8-07fff5c1618f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99.xml" RLTitle="Understanding Firewall Rules">
<Attr Name="assetid" Value="9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99" />
<Keyword Index="AssetId" Term="9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99" />
<Keyword Index="AssetId" Term="9868a02b-2d5f-4a8d-a1f7-f6f1a64cec991033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\98690952-0b7a-4b1f-bbee-3db1fa381f4f.xml" RLTitle="Firewall Rule Wizard: Profile Page">
<Attr Name="assetid" Value="98690952-0b7a-4b1f-bbee-3db1fa381f4f" />
<Keyword Index="AssetId" Term="98690952-0b7a-4b1f-bbee-3db1fa381f4f" />
<Keyword Index="AssetId" Term="98690952-0b7a-4b1f-bbee-3db1fa381f4f1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="98690952-0b7a-4b1f-bbee-3db1fa381f4f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b.xml" RLTitle="Monitor Firewall Rules - Programs and Ports Page">
<Attr Name="assetid" Value="99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b" />
<Keyword Index="AssetId" Term="99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b" />
<Keyword Index="AssetId" Term="99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\9d81b178-5fef-4b23-9dc7-e85f20bbf5d9.xml" RLTitle="Monitored Connection Security Rules Properties Page">
<Attr Name="assetid" Value="9d81b178-5fef-4b23-9dc7-e85f20bbf5d9" />
<Keyword Index="AssetId" Term="9d81b178-5fef-4b23-9dc7-e85f20bbf5d9" />
<Keyword Index="AssetId" Term="9d81b178-5fef-4b23-9dc7-e85f20bbf5d91033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="9d81b178-5fef-4b23-9dc7-e85f20bbf5d9" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f.xml" RLTitle="Connection Security Rule Wizard: Profile Page">
<Attr Name="assetid" Value="9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f" />
<Keyword Index="AssetId" Term="9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f" />
<Keyword Index="AssetId" Term="9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\a4c3ccd0-9ec1-4da5-982d-6e65877b5db3.xml" RLTitle="Dialog Box: Customize Protected Network Connections for a Firewall Profile">
<Attr Name="assetid" Value="a4c3ccd0-9ec1-4da5-982d-6e65877b5db3" />
<Keyword Index="AssetId" Term="a4c3ccd0-9ec1-4da5-982d-6e65877b5db3" />
<Keyword Index="AssetId" Term="a4c3ccd0-9ec1-4da5-982d-6e65877b5db31033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="a4c3ccd0-9ec1-4da5-982d-6e65877b5db3" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\aa9088cb-98f3-4c53-8270-09484edb997a.xml" RLTitle="Understanding Firewall Profiles">
<Attr Name="assetid" Value="aa9088cb-98f3-4c53-8270-09484edb997a" />
<Keyword Index="AssetId" Term="aa9088cb-98f3-4c53-8270-09484edb997a" />
<Keyword Index="AssetId" Term="aa9088cb-98f3-4c53-8270-09484edb997a1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="aa9088cb-98f3-4c53-8270-09484edb997a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\aaad90b0-4f52-46ca-9636-e05175e4aa78.xml" RLTitle="Dialog Box: Customize Advanced Key Exchange Settings">
<Attr Name="assetid" Value="aaad90b0-4f52-46ca-9636-e05175e4aa78" />
<Keyword Index="AssetId" Term="aaad90b0-4f52-46ca-9636-e05175e4aa78" />
<Keyword Index="AssetId" Term="aaad90b0-4f52-46ca-9636-e05175e4aa781033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="aaad90b0-4f52-46ca-9636-e05175e4aa78" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\b029858f-ef85-4cdd-a29c-06a9457f4365.xml" RLTitle="Firewall Rule Wizard: Protocol and Ports Page - Port Rule Type">
<Attr Name="assetid" Value="b029858f-ef85-4cdd-a29c-06a9457f4365" />
<Keyword Index="AssetId" Term="b029858f-ef85-4cdd-a29c-06a9457f4365" />
<Keyword Index="AssetId" Term="b029858f-ef85-4cdd-a29c-06a9457f43651033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="b029858f-ef85-4cdd-a29c-06a9457f4365" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\b31c589e-5b17-42df-b7ad-041084dd2074.xml" RLTitle="Dialog Box: Add or Edit Integrity and Encryption Algorithms">
<Attr Name="assetid" Value="b31c589e-5b17-42df-b7ad-041084dd2074" />
<Keyword Index="AssetId" Term="b31c589e-5b17-42df-b7ad-041084dd2074" />
<Keyword Index="AssetId" Term="b31c589e-5b17-42df-b7ad-041084dd20741033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="b31c589e-5b17-42df-b7ad-041084dd2074" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\b8b120da-821c-45f1-86ee-d7303f6b500a.xml" RLTitle="Firewall Rule Properties Page: Advanced Tab">
<Attr Name="assetid" Value="b8b120da-821c-45f1-86ee-d7303f6b500a" />
<Keyword Index="AssetId" Term="b8b120da-821c-45f1-86ee-d7303f6b500a" />
<Keyword Index="AssetId" Term="b8b120da-821c-45f1-86ee-d7303f6b500a1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="b8b120da-821c-45f1-86ee-d7303f6b500a" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ba442eea-0e40-4936-bb3a-413993267098.xml" RLTitle="Firewall Rule Wizard: Program Page">
<Attr Name="assetid" Value="ba442eea-0e40-4936-bb3a-413993267098" />
<Keyword Index="AssetId" Term="ba442eea-0e40-4936-bb3a-413993267098" />
<Keyword Index="AssetId" Term="ba442eea-0e40-4936-bb3a-4139932670981033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ba442eea-0e40-4936-bb3a-413993267098" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\c243c092-48c6-4073-9b19-b9c98c931582.xml" RLTitle="User Interface: Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="c243c092-48c6-4073-9b19-b9c98c931582" />
<Keyword Index="AssetId" Term="c243c092-48c6-4073-9b19-b9c98c931582" />
<Keyword Index="AssetId" Term="c243c092-48c6-4073-9b19-b9c98c9315821033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="c243c092-48c6-4073-9b19-b9c98c931582" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\c85aba54-dcb3-45be-b1bd-271d579da6fc.xml" RLTitle="Firewall Rule Wizard: Users Page">
<Attr Name="assetid" Value="c85aba54-dcb3-45be-b1bd-271d579da6fc" />
<Keyword Index="AssetId" Term="c85aba54-dcb3-45be-b1bd-271d579da6fc" />
<Keyword Index="AssetId" Term="c85aba54-dcb3-45be-b1bd-271d579da6fc1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="c85aba54-dcb3-45be-b1bd-271d579da6fc" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\cc83aec7-e835-4b20-acbd-e40eac6764f2.xml" RLTitle="Firewall Rule Wizard: Scope Page">
<Attr Name="assetid" Value="cc83aec7-e835-4b20-acbd-e40eac6764f2" />
<Keyword Index="AssetId" Term="cc83aec7-e835-4b20-acbd-e40eac6764f2" />
<Keyword Index="AssetId" Term="cc83aec7-e835-4b20-acbd-e40eac6764f21033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="cc83aec7-e835-4b20-acbd-e40eac6764f2" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ccd5048b-bdba-47b7-8658-9f8bbbcec7fb.xml" RLTitle="Firewall Rule Properties Page: Computers Tab">
<Attr Name="assetid" Value="ccd5048b-bdba-47b7-8658-9f8bbbcec7fb" />
<Keyword Index="AssetId" Term="ccd5048b-bdba-47b7-8658-9f8bbbcec7fb" />
<Keyword Index="AssetId" Term="ccd5048b-bdba-47b7-8658-9f8bbbcec7fb1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ccd5048b-bdba-47b7-8658-9f8bbbcec7fb" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\cd103e5b-9da9-438d-a9b8-ed96384a17f2.xml" RLTitle="Dialog Box: Customize IPsec Tunneling Settings">
<Attr Name="assetid" Value="cd103e5b-9da9-438d-a9b8-ed96384a17f2" />
<Keyword Index="AssetId" Term="cd103e5b-9da9-438d-a9b8-ed96384a17f2" />
<Keyword Index="AssetId" Term="cd103e5b-9da9-438d-a9b8-ed96384a17f21033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="cd103e5b-9da9-438d-a9b8-ed96384a17f2" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\d42aa5c6-4859-4f78-b001-dc067151521b.xml" RLTitle="Dialog Box: Add Security Method">
<Attr Name="assetid" Value="d42aa5c6-4859-4f78-b001-dc067151521b" />
<Keyword Index="AssetId" Term="d42aa5c6-4859-4f78-b001-dc067151521b" />
<Keyword Index="AssetId" Term="d42aa5c6-4859-4f78-b001-dc067151521b1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="d42aa5c6-4859-4f78-b001-dc067151521b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\d43f0fad-14d0-4def-8440-631d6e8fe905.xml" RLTitle="Connection Security Rule Wizard: Authentication Method Page">
<Attr Name="assetid" Value="d43f0fad-14d0-4def-8440-631d6e8fe905" />
<Keyword Index="AssetId" Term="d43f0fad-14d0-4def-8440-631d6e8fe905" />
<Keyword Index="AssetId" Term="d43f0fad-14d0-4def-8440-631d6e8fe9051033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="d43f0fad-14d0-4def-8440-631d6e8fe905" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\d857a0e4-9ae0-4ee0-84a1-13100e8e5948.xml" RLTitle="Monitor Firewall Rules - Advanced">
<Attr Name="assetid" Value="d857a0e4-9ae0-4ee0-84a1-13100e8e5948" />
<Keyword Index="AssetId" Term="d857a0e4-9ae0-4ee0-84a1-13100e8e5948" />
<Keyword Index="AssetId" Term="d857a0e4-9ae0-4ee0-84a1-13100e8e59481033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="d857a0e4-9ae0-4ee0-84a1-13100e8e5948" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\d9626188-57c8-49b1-ad44-66e75119a5f9.xml" RLTitle="Connection Security Rule Properties Page: Protocols and Ports Tab">
<Attr Name="assetid" Value="d9626188-57c8-49b1-ad44-66e75119a5f9" />
<Keyword Index="AssetId" Term="d9626188-57c8-49b1-ad44-66e75119a5f9" />
<Keyword Index="AssetId" Term="d9626188-57c8-49b1-ad44-66e75119a5f91033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="d9626188-57c8-49b1-ad44-66e75119a5f9" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\dc5c6bc1-9537-456d-b168-faf78a66554f.xml" RLTitle="Firewall Rule Wizard: Rule Type Page">
<Attr Name="assetid" Value="dc5c6bc1-9537-456d-b168-faf78a66554f" />
<Keyword Index="AssetId" Term="dc5c6bc1-9537-456d-b168-faf78a66554f" />
<Keyword Index="AssetId" Term="dc5c6bc1-9537-456d-b168-faf78a66554f1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="dc5c6bc1-9537-456d-b168-faf78a66554f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\dd07bae3-3af0-469b-adc8-84f78f4169e8.xml" RLTitle="Dialog Box: Add or Edit Second Authentication Method">
<Attr Name="assetid" Value="dd07bae3-3af0-469b-adc8-84f78f4169e8" />
<Keyword Index="AssetId" Term="dd07bae3-3af0-469b-adc8-84f78f4169e8" />
<Keyword Index="AssetId" Term="dd07bae3-3af0-469b-adc8-84f78f4169e81033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="dd07bae3-3af0-469b-adc8-84f78f4169e8" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2.xml" RLTitle="Understanding Connection Security Rules">
<Attr Name="assetid" Value="e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2" />
<Keyword Index="AssetId" Term="e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2" />
<Keyword Index="AssetId" Term="e3c300ca-1c4c-43a3-82d1-7e4b0860b7e21033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\e98f04c7-99c8-4816-a640-da8e73a14db3.xml" RLTitle="Connection Security Rule Wizard: Protocols and Ports Page">
<Attr Name="assetid" Value="e98f04c7-99c8-4816-a640-da8e73a14db3" />
<Keyword Index="AssetId" Term="e98f04c7-99c8-4816-a640-da8e73a14db3" />
<Keyword Index="AssetId" Term="e98f04c7-99c8-4816-a640-da8e73a14db31033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="e98f04c7-99c8-4816-a640-da8e73a14db3" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ec590a1c-d105-4cf9-bf83-6606624c33db.xml" RLTitle="Connection Security Rule Properties Page: Advanced Tab">
<Attr Name="assetid" Value="ec590a1c-d105-4cf9-bf83-6606624c33db" />
<Keyword Index="AssetId" Term="ec590a1c-d105-4cf9-bf83-6606624c33db" />
<Keyword Index="AssetId" Term="ec590a1c-d105-4cf9-bf83-6606624c33db1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ec590a1c-d105-4cf9-bf83-6606624c33db" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ed344be2-ee6d-4a37-ac31-4f0b9763d04b.xml" RLTitle="Monitor Connection Security Rules - Advanced">
<Attr Name="assetid" Value="ed344be2-ee6d-4a37-ac31-4f0b9763d04b" />
<Keyword Index="AssetId" Term="ed344be2-ee6d-4a37-ac31-4f0b9763d04b" />
<Keyword Index="AssetId" Term="ed344be2-ee6d-4a37-ac31-4f0b9763d04b1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ed344be2-ee6d-4a37-ac31-4f0b9763d04b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ee8441ab-55b4-4ce3-b658-d4e28320a010.xml" RLTitle="Firewall Rule Properties Page: Programs and Services Tab">
<Attr Name="assetid" Value="ee8441ab-55b4-4ce3-b658-d4e28320a010" />
<Keyword Index="AssetId" Term="ee8441ab-55b4-4ce3-b658-d4e28320a010" />
<Keyword Index="AssetId" Term="ee8441ab-55b4-4ce3-b658-d4e28320a0101033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ee8441ab-55b4-4ce3-b658-d4e28320a010" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\f19cbe6e-7235-4613-90d0-6f7a3e8a6093.xml" RLTitle="Dialog Box: Customize Advanced Authentication Methods">
<Attr Name="assetid" Value="f19cbe6e-7235-4613-90d0-6f7a3e8a6093" />
<Keyword Index="AssetId" Term="f19cbe6e-7235-4613-90d0-6f7a3e8a6093" />
<Keyword Index="AssetId" Term="f19cbe6e-7235-4613-90d0-6f7a3e8a60931033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="f19cbe6e-7235-4613-90d0-6f7a3e8a6093" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\f4d3d872-6514-49fd-b8ed-1d725f74f0c1.xml" RLTitle="Dialog Box: Customize Data Protection Settings">
<Attr Name="assetid" Value="f4d3d872-6514-49fd-b8ed-1d725f74f0c1" />
<Keyword Index="AssetId" Term="f4d3d872-6514-49fd-b8ed-1d725f74f0c1" />
<Keyword Index="AssetId" Term="f4d3d872-6514-49fd-b8ed-1d725f74f0c11033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="f4d3d872-6514-49fd-b8ed-1d725f74f0c1" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\f637c2d4-a8aa-4e7a-b437-86b8e3accc7f.xml" RLTitle="Dialog Box: Customize IPsec Tunnel Authorization">
<Attr Name="assetid" Value="f637c2d4-a8aa-4e7a-b437-86b8e3accc7f" />
<Keyword Index="AssetId" Term="f637c2d4-a8aa-4e7a-b437-86b8e3accc7f" />
<Keyword Index="AssetId" Term="f637c2d4-a8aa-4e7a-b437-86b8e3accc7f1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="f637c2d4-a8aa-4e7a-b437-86b8e3accc7f" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\f87bdc33-14b4-4832-b190-377f16d7e671.xml" RLTitle="Configuring Firewall Rules">
<Attr Name="assetid" Value="f87bdc33-14b4-4832-b190-377f16d7e671" />
<Keyword Index="AssetId" Term="f87bdc33-14b4-4832-b190-377f16d7e671" />
<Keyword Index="AssetId" Term="f87bdc33-14b4-4832-b190-377f16d7e6711033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="f87bdc33-14b4-4832-b190-377f16d7e671" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\f9172bb1-6c9e-4e09-a1cb-6e6912459aee.xml" RLTitle="Dialog Box: Add or Edit First Authentication Method">
<Attr Name="assetid" Value="f9172bb1-6c9e-4e09-a1cb-6e6912459aee" />
<Keyword Index="AssetId" Term="f9172bb1-6c9e-4e09-a1cb-6e6912459aee" />
<Keyword Index="AssetId" Term="f9172bb1-6c9e-4e09-a1cb-6e6912459aee1033" />
<Attr Name="appliesToProduct" Value="Windows 7" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="appliesToSite" Value="BWCOnly" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="f9172bb1-6c9e-4e09-a1cb-6e6912459aee" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
<Vtopic Url="assets\ffe91987-ce8c-4caa-826a-fb26d9d3f23b.xml" RLTitle="Resources for Windows Firewall with Advanced Security">
<Attr Name="assetid" Value="ffe91987-ce8c-4caa-826a-fb26d9d3f23b" />
<Keyword Index="AssetId" Term="ffe91987-ce8c-4caa-826a-fb26d9d3f23b" />
<Keyword Index="AssetId" Term="ffe91987-ce8c-4caa-826a-fb26d9d3f23b1033" />
<Attr Name="appliesToProduct" Value="Windows Server 2008 R2" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2DATACENTERSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISEIA64SERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2ENTERPRISESERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2STANDARDSERVER" />
<Attr Name="APPLIESTOPRODUCTSPECIFIC" Value="WS08R2WEBSERVER" />
<Attr Name="CommunityContent" Value="1" />
<Attr Name="WillHaveMamlFeed" Value="True" />
<Attr Name="zzpub_assetBug" Value="1782" />
<Attr Name="zzpub_MtpsProductFamily" Value="WS" />
<Attr Name="zzpub_MTPSVersion" Value="11" />
<Attr Name="Locale" Value="kbEnglish" />
<Attr Name="AssetID" Value="ffe91987-ce8c-4caa-826a-fb26d9d3f23b" />
<Attr Name="TopicType" Value="kbArticle" />
</Vtopic>
</VTopicSet><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpTOC>
<HelpTOC xmlns="http://schemas.microsoft.com/help/toc/2004/11" DTDVersion="1.0" Id="authfw_TOC" FileVersion="" LangId="1033" ParentNodeIcon="Book" PluginStyle="Hierarchical">
<HelpTOCNode Url="mshelp://windows/?tocid=88bf7139-6cc1-4c1d-8634-4d454fffa043" Title="">
<HelpTOCNode Url="mshelp://windows/?id=60324d03-97f8-4aa5-864b-af205ebff02b" Title="Windows Firewall with Advanced Security">
<HelpTOCNode Url="mshelp://windows/?id=1a70e8bc-19f3-4bd5-bba9-d04c432adbc6" Title="Overview of Windows Firewall with Advanced Security" />
<HelpTOCNode Url="mshelp://windows/?id=9868a02b-2d5f-4a8d-a1f7-f6f1a64cec99" Title="Understanding Firewall Rules" />
<HelpTOCNode Url="mshelp://windows/?id=e3c300ca-1c4c-43a3-82d1-7e4b0860b7e2" Title="Understanding Connection Security Rules" />
<HelpTOCNode Url="mshelp://windows/?id=aa9088cb-98f3-4c53-8270-09484edb997a" Title="Understanding Firewall Profiles" />
<HelpTOCNode Url="mshelp://windows/?id=40413516-c1ab-46b3-b62c-d165b434974b" Title="Monitoring Windows Firewall with Advanced Security" />
<HelpTOCNode Url="mshelp://windows/?id=41646515-247f-4ce4-a9fd-600bd90ae773" Title="Default Settings for Windows Firewall with Advanced Security" />
<HelpTOCNode Url="mshelp://windows/?id=f87bdc33-14b4-4832-b190-377f16d7e671" Title="Configuring Firewall Rules" />
<HelpTOCNode Url="mshelp://windows/?id=ffe91987-ce8c-4caa-826a-fb26d9d3f23b" Title="Resources for Windows Firewall with Advanced Security" />
<HelpTOCNode Url="mshelp://windows/?id=c243c092-48c6-4073-9b19-b9c98c931582" Title="User Interface: Windows Firewall with Advanced Security">
<HelpTOCNode Url="mshelp://windows/?id=05d277a3-2b83-4951-a2fc-e2ca78a24f24" Title="Windows Firewall with Advanced Security Properties Page" />
<HelpTOCNode Url="mshelp://windows/?id=2318ec3c-e196-4a43-9d79-70ca7c52194a" Title="Connection Security Rule Wizard">
<HelpTOCNode Url="mshelp://windows/?id=18ddcbbd-4939-492c-a716-f1fccc468c18" Title="Connection Security Rule Wizard: Rule Type Page" />
<HelpTOCNode Url="mshelp://windows/?id=8039b8d4-e87b-4aac-9c09-6a34cc73f1b6" Title="Connection Security Rule Wizard: Endpoints Page" />
<HelpTOCNode Url="mshelp://windows/?id=6a710a38-a254-4a80-9a53-6ea2e0816d24" Title="Connection Security Rule Wizard: Requirements Page" />
<HelpTOCNode Url="mshelp://windows/?id=d43f0fad-14d0-4def-8440-631d6e8fe905" Title="Connection Security Rule Wizard: Authentication Method Page" />
<HelpTOCNode Url="mshelp://windows/?id=e98f04c7-99c8-4816-a640-da8e73a14db3" Title="Connection Security Rule Wizard: Protocols and Ports Page" />
<HelpTOCNode Url="mshelp://windows/?id=12452b6f-dce5-4515-bfdd-455f08c77e5a" Title="Connection Security Rule Wizard: Exempt Computers Page" />
<HelpTOCNode Url="mshelp://windows/?id=710fa446-c600-4691-ae28-37a9824fb95d" Title="Connection Security Rule Wizard: Tunnel Type Page" />
<HelpTOCNode Url="mshelp://windows/?id=85c69539-f0c0-474c-9860-d220293ab2d6" Title="Connection Security Rule Wizard: Tunnel Endpoints Page - Custom Configuration" />
<HelpTOCNode Url="mshelp://windows/?id=63138fa3-9f09-4684-89cb-c44306ee3763" Title="Connection Security Rule Wizard: Tunnel Endpoints Page - Client-to-Gateway" />
<HelpTOCNode Url="mshelp://windows/?id=70d0c763-d3a3-486d-9f91-e213831f2485" Title="Connection Security Rule Wizard: Tunnel Endpoints Page - Gateway-to-Client" />
<HelpTOCNode Url="mshelp://windows/?id=9fcdfb8b-6e47-4c72-b6f3-cb6e5fdb529f" Title="Connection Security Rule Wizard: Profile Page" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=101488a1-9f62-4797-9330-4937c888e371" Title="Connection Security Rule Properties Page">
<HelpTOCNode Url="mshelp://windows/?id=0ec58789-26f0-47cd-9f43-aa6e7d52db10" Title="Connection Security Rule Property Page: General Tab" />
<HelpTOCNode Url="mshelp://windows/?id=97e94c49-45b2-4af9-bcd8-07fff5c1618f" Title="Connection Security Rule Properties Page: Computers Tab" />
<HelpTOCNode Url="mshelp://windows/?id=d9626188-57c8-49b1-ad44-66e75119a5f9" Title="Connection Security Rule Properties Page: Protocols and Ports Tab" />
<HelpTOCNode Url="mshelp://windows/?id=13da39e0-2a32-4ac4-a952-4391ae88c739" Title="Connection Security Rule Properties Page: Authentication Tab" />
<HelpTOCNode Url="mshelp://windows/?id=ec590a1c-d105-4cf9-bf83-6606624c33db" Title="Connection Security Rule Properties Page: Advanced Tab" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=5886c961-2f7a-46f9-928b-2b906f2c354a" Title="Firewall Rule Wizard">
<HelpTOCNode Url="mshelp://windows/?id=dc5c6bc1-9537-456d-b168-faf78a66554f" Title="Firewall Rule Wizard: Rule Type Page" />
<HelpTOCNode Url="mshelp://windows/?id=ba442eea-0e40-4936-bb3a-413993267098" Title="Firewall Rule Wizard: Program Page" />
<HelpTOCNode Url="mshelp://windows/?id=b029858f-ef85-4cdd-a29c-06a9457f4365" Title="Firewall Rule Wizard: Protocol and Ports Page - Port Rule Type" />
<HelpTOCNode Url="mshelp://windows/?id=2adf4b4a-fbdb-4bfa-8e09-8648c986f4f0" Title="Firewall Rule Wizard: Protocol and Ports Page - Custom Rule Type" />
<HelpTOCNode Url="mshelp://windows/?id=8b29e655-9fb1-4ba5-a701-30812af59d2e" Title="Firewall Rule Wizard: Predefined Rules Page" />
<HelpTOCNode Url="mshelp://windows/?id=cc83aec7-e835-4b20-acbd-e40eac6764f2" Title="Firewall Rule Wizard: Scope Page" />
<HelpTOCNode Url="mshelp://windows/?id=1826c5b4-7aa9-419a-a211-07542a5dcf1a" Title="Firewall Rule Wizard: Action Page" />
<HelpTOCNode Url="mshelp://windows/?id=c85aba54-dcb3-45be-b1bd-271d579da6fc" Title="Firewall Rule Wizard: Users Page" />
<HelpTOCNode Url="mshelp://windows/?id=5aaa1ce1-0a0e-4686-a4cf-d63cb0a351da" Title="Firewall Rule Wizard: Computers Page" />
<HelpTOCNode Url="mshelp://windows/?id=98690952-0b7a-4b1f-bbee-3db1fa381f4f" Title="Firewall Rule Wizard: Profile Page" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=142a13a0-f0c4-4122-95d9-ecfb6f6391c4" Title="Firewall Rule Properties Page">
<HelpTOCNode Url="mshelp://windows/?id=5147487b-bb6a-40e4-b8ee-f263c52bee24" Title="Firewall Rule Properties Page: General Tab" />
<HelpTOCNode Url="mshelp://windows/?id=ee8441ab-55b4-4ce3-b658-d4e28320a010" Title="Firewall Rule Properties Page: Programs and Services Tab" />
<HelpTOCNode Url="mshelp://windows/?id=14f25442-df7f-4c80-9ffc-b01781b2b246" Title="Firewall Rule Properties Page: Protocols and Ports Tab" />
<HelpTOCNode Url="mshelp://windows/?id=950c636f-f858-4852-8a78-b3222cd57bff" Title="Firewall Rule Properties Page: Scope Tab" />
<HelpTOCNode Url="mshelp://windows/?id=b8b120da-821c-45f1-86ee-d7303f6b500a" Title="Firewall Rule Properties Page: Advanced Tab" />
<HelpTOCNode Url="mshelp://windows/?id=ccd5048b-bdba-47b7-8658-9f8bbbcec7fb" Title="Firewall Rule Properties Page: Computers Tab" />
<HelpTOCNode Url="mshelp://windows/?id=53df2676-ea86-4670-8f48-b113383a0992" Title="Firewall Rule Properties Page: Users Tab" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=20b3aba6-884a-4ef9-8ea7-914e4cd735d9" Title="Monitored Firewall Rules Properties Page">
<HelpTOCNode Url="mshelp://windows/?id=52a543f3-3baa-42d9-8614-25293d0e3f62" Title="Monitor Firewall Rules - General" />
<HelpTOCNode Url="mshelp://windows/?id=99ae4ae7-1d65-4020-b26c-bfaf2df8ba6b" Title="Monitor Firewall Rules - Programs and Ports Page" />
<HelpTOCNode Url="mshelp://windows/?id=d857a0e4-9ae0-4ee0-84a1-13100e8e5948" Title="Monitor Firewall Rules - Advanced" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=9d81b178-5fef-4b23-9dc7-e85f20bbf5d9" Title="Monitored Connection Security Rules Properties Page">
<HelpTOCNode Url="mshelp://windows/?id=5ca392ca-aece-4319-90c5-80544a29b8e9" Title="Monitor Connection Security Rules - General" />
<HelpTOCNode Url="mshelp://windows/?id=53d4595a-b6b0-4133-be9e-03dcecef56e6" Title="Monitor Connection Security Rules - Authentication" />
<HelpTOCNode Url="mshelp://windows/?id=ed344be2-ee6d-4a37-ac31-4f0b9763d04b" Title="Monitor Connection Security Rules - Advanced" />
</HelpTOCNode>
<HelpTOCNode Url="mshelp://windows/?id=39e393da-18a6-4a1d-85d1-d9dcb46e3b93" Title="Monitored Main Mode Security Associations" />
<HelpTOCNode Url="mshelp://windows/?id=8c965889-6e37-4ad0-b41d-4f98bed709ad" Title="Monitored Quick Mode Security Associations" />
<HelpTOCNode Url="mshelp://windows/?id=71ea19d0-e57f-4828-923a-632cdb208aad" Title="Dialog Boxes">
<HelpTOCNode Url="mshelp://windows/?id=226a35ae-cf87-4bd3-b4be-fab77930e6da" Title="Dialog Box: Add or Edit Integrity Algorithms" />
<HelpTOCNode Url="mshelp://windows/?id=b31c589e-5b17-42df-b7ad-041084dd2074" Title="Dialog Box: Add or Edit Integrity and Encryption Algorithms" />
<HelpTOCNode Url="mshelp://windows/?id=06cbaf77-aa9d-4dec-b056-3dcd2616e4fa" Title="Dialog Box: Add or Edit IP Addresses" />
<HelpTOCNode Url="mshelp://windows/?id=d42aa5c6-4859-4f78-b001-dc067151521b" Title="Dialog Box: Add Security Method" />
<HelpTOCNode Url="mshelp://windows/?id=f19cbe6e-7235-4613-90d0-6f7a3e8a6093" Title="Dialog Box: Customize Advanced Authentication Methods" />
<HelpTOCNode Url="mshelp://windows/?id=aaad90b0-4f52-46ca-9636-e05175e4aa78" Title="Dialog Box: Customize Advanced Key Exchange Settings" />
<HelpTOCNode Url="mshelp://windows/?id=1a81d9c6-f39f-4835-a00b-11d994247ca9" Title="Dialog Box: Customize Allow If Secure Settings" />
<HelpTOCNode Url="mshelp://windows/?id=f4d3d872-6514-49fd-b8ed-1d725f74f0c1" Title="Dialog Box: Customize Data Protection Settings" />
<HelpTOCNode Url="mshelp://windows/?id=8a0b490a-db5e-420f-8990-d0e30a17bc1a" Title="Dialog Box: Customize ICMP Settings" />
<HelpTOCNode Url="mshelp://windows/?id=5918d117-66c3-4f58-8680-a5a822c40dc7" Title="Dialog Box: Customize Interface Types" />
<HelpTOCNode Url="mshelp://windows/?id=66011489-1eee-4986-9373-565e557db23b" Title="Dialog Box: Customize IPsec Settings" />
<HelpTOCNode Url="mshelp://windows/?id=f637c2d4-a8aa-4e7a-b437-86b8e3accc7f" Title="Dialog Box: Customize IPsec Tunnel Authorization" />
<HelpTOCNode Url="mshelp://windows/?id=cd103e5b-9da9-438d-a9b8-ed96384a17f2" Title="Dialog Box: Customize IPsec Tunneling Settings" />
<HelpTOCNode Url="mshelp://windows/?id=58a40682-63b1-493a-9d97-940532cbbcd8" Title="Dialog Box: Customize Logging Settings for a Firewall Profile" />
<HelpTOCNode Url="mshelp://windows/?id=a4c3ccd0-9ec1-4da5-982d-6e65877b5db3" Title="Dialog Box: Customize Protected Network Connections for a Firewall Profile" />
<HelpTOCNode Url="mshelp://windows/?id=7e24b5a1-742d-4247-b86d-db9e097dee4e" Title="Dialog Box: Customize Service Settings" />
<HelpTOCNode Url="mshelp://windows/?id=55215ddc-b9aa-4bac-9ec2-d5da5cb3932c" Title="Dialog Box: Customize Settings for a Firewall Profile" />
<HelpTOCNode Url="mshelp://windows/?id=f9172bb1-6c9e-4e09-a1cb-6e6912459aee" Title="Dialog Box: Add or Edit First Authentication Method" />
<HelpTOCNode Url="mshelp://windows/?id=dd07bae3-3af0-469b-adc8-84f78f4169e8" Title="Dialog Box: Add or Edit Second Authentication Method" />
</HelpTOCNode>
</HelpTOCNode>
</HelpTOCNode>
</HelpTOCNode>
</HelpTOC><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="AssetId" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="BestBet" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="LinkTerm" /><?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE HelpIndex>
<HelpIndex DTDVersion="1.0" Name="SubjectTerm" /> 5 uU P!7 V O6tdBFƨ t '!$TRJI*Xt*5îo} ȞΠ ~wg^~y- E%蹛RbƙuB,HDKR
%dh;9A\ hE/ , R 4Dd`@dLX : #b i9KbMU5~s\{~nW[lyuː̛\{&2湗Ï7Ohg!7e\O=lU*~k5ylk է~Zgכ'F.Svtlltz] 8[]Ư `|_qU簻=wٮmss=̳> ͈g>[zO._ kmuYo ߛў5 re|.nr Fo}7zy.zvp="\_.E |.嶻͛g\^爳n.[ߍj=Pn;zv% .轿&>ͷ o^ _x_H(G_cGay)ü4h~x j]g|.nnsweq|0x9\ge76<s3\o<sx沼=k9ws ex{svrc|WWZsӋ~ꪆ_ڪ詮 no^a.sWEn骮mInqtӹ}VJg/ Of>uw7{ >_CGVǫWU<oN*a^Mj4)8V_l Fh0v?6Γm 7l6o7ïnq,= y5g nq/l kƹz3fg{n9
O7W f㑈\ 7<7z7} {f>.korsS4"Gy>r3XOspmortGk:Ȅ= tNz K _[_I ɍ _5tO~VSvͧm X~7C)^넹9=^7s,|*>f=]ZriBxy/~Kg
s= c Ү<Ki{2.g>4\z\I1{z+]qK]zK/i-.ͥ|
;Nz?]KwOj4ֹ۞
ϭk ԥm<&Kis=K{韮]\OCVi}uv/? =~S豍O;F'=. }+ b.+b#]]q+3]]q;^݊]1CqK]]Sq[]^[1?ΛCc{sS躚ߝG;>S螺Gx{ SM-G_Xߓߏ ShO]7<|Fѝ:ZFZdnĩ7Ōqd==!ݹO ?ݎ|+cr7c rǑ%?5{;NCxyc rǕ䟫= =! x 2Tc~ >ΐw=!~!6C,qn?=i~ ~Ȃ!C8cyc y~ |,Cytn ;}n /N.\}w0̝_ͭxR '<x n;\곾OjYӾ]vg, p7 74Ñ$L <Py5yL.uzg%s]#zi tbJ+tNo7Ou_
ݼ>מ# "\}Z 7KN)}o:SVSJ_{uO|fS_{J[N})+O N})7zS:J vO龄7 )}}))}WSJ]|_|JmdN})>>S߳vJ鋐OO龒7')}}+)Z>Sߵ|JlO龙髛O}9)ҷS>~S/};wJ O7}G);tҷڝSwJ鋤Oo;z[N})S߾wJOSJE}O)}/<-O})/>S/>vS7*SJn2xSMSJWo:SJ yO}#)<ҷZSyJ3O)}<ݜ-.^{+VXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVaVXXaVoD_d
``pW !!alplY CXq`0^\. 1 Cڂ!F-;. !L{^0 Ðpd{\0G. $ aۂ!{0t^ &m ÓC!ۂ`0L\. W, ÖCs`0\/q !{[00\. o 8 0s`8`w. ú!s`ڽ/w !t` ]0
y/ á!t`h. H äpt`l]0 : @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ @ yx{F4 ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,, ,>?eD"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DB!D"!B"DC~_W=in;O^W_oӣNIgSɫfM9l)<i5FwWvxӞ צ(oSfSp})};ݺnh5ZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZZhhZ$H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ A $H AH$ Ag/a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL& a0&L 0aL&p +. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 5n ]eCN'nu'|*̂
**
**
**
Pu:T*
**
*P=*
**
яAPPTATPPATATP g`
**
*QP.AzP]*
**
**
**
*@݇xӤ;wPa~ <@} xzu(|`x>v;( X<n4f ;yx &<Py`9a{B 1AP*
QEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQET<L -EQEYQA((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((+2{&|vvvvvvvvvvvvvvvvvvvvvvvv}jP;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;>;~="(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((/?ZϬ5YAP>
**lllyC=;[(((((((((((((((((((((((/ցfK"(((((((((((((((((((((((((((((((((((((((H((((((((((((((((((((((((((((EQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEIR2TEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQQEEQk ϻ"(I*;ؿv} ڳ:#>Ys8Mvui[n n'5d˹~݇O[<|'\ӛ{%G3?ٕ_.~5~{B]|Cr3e|J/ Wn5ahlBF[^vg l r5A(7mqy^ 8?=*>oR hO vvAUuS}oiOJ"[\lc K
i݆1w4Z OݺJVxь]U"X{s4y^k za~==SQ]BjM0]2p mZ284"'8%HS\PMEk9
++fX C͆ !A( )*9憷Ư
I=EQD!IgLۨp#6ݘ8gv 'z8kAн231A1zPJYp6ELt0'8OfW@>:#.~R##(
ѨToEZϻ71ֿ",eS&i&ٳf| ڥR{͏WȂ^R &35Ae6,j:)W;G^3tԓ !Wk2Hdn^(k:3ߝL~Z 8ӿ\G ܍5U:E jp A8ء>î/2Vf NzIbyF/fDnIQ.]i2/)2w4tc0:PG MJ_G?ʆG8ǴMouɀcN= }tB N+v[=VzlDZ ;db; !ݖx{h?5ݢFV0 u6 gu@z7&ykϢ5̈́Po a`GVENH&>n=L>kҤo'k >QN_l:U;O5T3p?DV Y+cC0v.QawW o1pPNUrr: YaqT$v
w
%$9O>Dzc .F9ot!<G1\bYXtҏީ4Vv2l^g,* L6w-V+1K )8~ŁkTHqH9US3vPx1g,u#_Ek.4[w/`Fd-0=~G<h5숄/^{tKC[\D#0zcuC ;A{ItkWh *~ D_JK?q 1 W)OyP)RuXWAv#FR?m:(@ÂHK.s߯_
ڍ(`%%ա2 LY#"^_+a5S ^Ƶ{Љk%;+>} lazcG]F ӣBxٽU) æZ&w!D]L67PNsXW{f+8m!p+~ B$Tl,T,AZUWi7+E=Vm'َDP{!&@E<81s:Xյx~3
=Gg76/biaʴVf[ a7k WZG%=PcOތm1%kMQ:ݓ,GͅH9HUWA2rަ iK Q1 _l37!Ü:34#t)Cs^j+ޣ@kjfY1w`(߭o6 h^?~aθ~t]ffwz=cF:D>A(t2+493|E0Q9V4c^J
?Q}#FQWV.U"Cl(˛(ͬy};[e6namWsұ$N_٠rשF|,`(o(ʞ2,&;x"4+
2Ɣgm3
H]I 4 Y&
442h+_^>S[uq?ܪ71lel$eli$!7TM=BE+[⠌L:#h! БZm$plSI
JXExĄ_dr{ ^d%@*{`'8_T@tx+9 G:ҁΞ+[2t >'8DP,2Ѷɹf6^j֝9KȒR 3aT
HYE"z+3./ g4Nd8X# ÃJeIYK8 $ qH4Sx,鮝^3"D^L})PrSu |nr`s $\WA!{2BZ(H]i4OyuhdjL j"=ׁ=WopEM K\0LYl#d ![S6PfݘqbWZie1і_G]&-ڠZ⭒ ^zgwH\/ /4GcH&a:hҹg[O+J2\LOƈ?{]dq z{N_mШOv4Mk`cD%%Oq7fvl]mcS-`v;XEfvYhit$U} pE*gS#롔ft85T|Є| Yb>yH@K}c3p' Wn$ uqr9;kI ˚`J;fMq8' &*pI YWOvľw jPa~9 pX/ux
@<UƯ
@ɾf.eRNbnBG o ;IN`g) #*~qf-jְnr4v |-LɨC' Ir+
wޑbrSS]E
{p[zPG Aϒ0$k0-h>>O*4Rnj{{l vӒ#:8ވk 4^e1RE6coR+*{rV;OXKӞ":[8#;.B+[Sc#gi n:w:8z.j7nqkP)EŖ Zr
qO +ypseInIU5pW{57]0ɪQo {~
U y\ yypveppYh=%J+Ke5R&Nv{[CK(ozҬ(8Q^jt/Kke/u{v]0/! n4Pq-QbϙT!d3b33zQ! u!OۍzB"rx )1]*~M,mwK`n 1KZdvљ歲ܩ7 |I.So̽D+w"dx"vmoGlw _B\??#H /ۣ>: E8CPpBlJ4.i|\6d&ɞcԝ4+W T D֊~.OwcsNLMM٣1S[gFI\\`=Dpҟv=hpXJV"cpBW`* -<+<KMchSNC(̰%||]U 缺u0T %- ("n"m G2f0E" 32RJcq}YH7!Wvvr-AҌQ, ' _Z7-ڔE?aM@ uRXK%spB%WǢ*'R )cv ,e8U ƿ Gpc! _/2pJ[.foǓ K&;ʕmmm |Pr{}KπbNCduws6$}fJGTW1mj>Y0ʾpK7x' UrL*u7ZGi~ꓠ3n aC~ʕ=C⽱s[mM+^$nbpYěH2p CNa)yhx?%L;ZإD/.IXݛ&sFO81*s> 9p<Vo<!m`hBNmy\{꒡R7^x|L)Ծ Hl-YC%VaW:V2
vx3b"u$s:{*̠ _`$[:)}x;R!#7"7M/0}zev kS3 iOMc;|ir\Wk]1-# | `VIYql ARXW~kG_;
z
WmN F$Jw+0+;Gطo&ЄLfwvr+_nY]UnH
b !<R[m>Mhw16|Я0Gq+6X\:n92lm@}q{a˸{e>t|qz% 8xjݩdcK UA;bKfE/&
$~|
h (|?BJ5" HNWw7̨f2P(?z!Òzw.qH3fWYxu:3Tz3EJ}yrx@ o/3$&2"AloFgҀ֒:$S%<"5k6Ccޘu]
ڣeP/)OnӞ=&Wf51s
WvB|u*ő{0fY>TvGl `{FvLe>>Rk;iqՎ@8i6T۸kݟ`a'Ja8))
eS|jwFkȪ$m6ϼFAJ *vc~aME`Pa8r" V_ÅN;̲ ǟz iB ܡrT`c ˛?VU֭/#)v$ X<!%/3dY.>=2nܣ-,~ +{tBpJ Hބ6Y7w0 o'fy?:PEz+r *I*peP wos@@A^"I$-R'\uYB6uz[9Ւ=
ʰa A/(A. - x!w<Zy逗>ErF]N[q˜>mE_z^|u;p#I@Om7b:.Ա{;j]7|:giqv%zbL vnf;s[0R~?|=2
QyJlp VWqq#,ti72s F |2jE$ MnpݖٚN':Iz<#۫:C=]B g7{j+& .cE'kV SB:(jK\agZ Eia<Bcr}ͺ|
Sŵ~7@KLB+q5{tIU{+ۉ/^M-C;teP,!l
'aq\iv:A\ 1kDӱXM`Y[2hT<\*U>fݵ5+ɠ#s_9g+sJ7\C<ÅX} Mdb>B27)T hM _!2c-HbSH%R=`yOr
#N `C!l9*
/r`?=+;Mw
>m q\,bA 1z09Da<mqzށ^@;&nzIYlx SmEjL0 ߫' w? #hP
oB HK%D2k?- KJ,;>l%%'X$T
0Tw8j
.C~
čFYFr " ?W>51v
FFLo@@ _=Nǿx 1A!䁐;G~erM ? wk]vݵkw]vwk]vݵkw]v} '51z^
(,W u
oyȱ]|~ݤbҫ Qrԣtv;< l ++Ma:9P5=t
Ǐպa-
-uwbuÀcQ_6g8C 4sZ2iwprMG*r1ɓtwY3l9&^QBrQB.s}̶!s4i80E2e@ ,8VoAt@ck#/]I1"Wۢs9VYb=bPjܼGx\i{#ޑ{v1>Y;PRMݴ$W Q,LH
1CVqA6oՇ]tY:FDav4뭰}Id8& $<"?o%˯F^ƨwmM`j L $hmpwʀurA w}"S_Q;=V&gi{2cw:LlBjA
NP<tbc<1rAco0k&;{X/ VA݃u@,ӔYq!oSTnv˺e7-jT
m,ȧ <UBS` EfNCkb|+ɔ0+ >Zg#F;8U.]Fy;i{] UE ˒C8L8S֗AIr-.{AX0$'1#!nc~k#A] L>t!}1@Qⵎwxl \mKߓxUxrOzeo.fg)v}[K
p3 6uJeP.,>~syӳqO;
aR5QHx
f=_{& = ZUNV89?ӔCc1\Mbq,AbopNb +Ygg>0{$t}A+d1t<LQZ#Cy^T Zy;d`!t]r*AEk薪 fCAceBGf.i\PzH2\-Q~Ƒ;EBwUq$7??=X9mka
[dK1|7dTϰ[P21\Č@q çE p?
dlNaLM9ӽGz+V,hD%K dsM-^f)ꘀ3YֈH Iː f79)+li`OD9C= 2ieTx:?)[gmā+ZQ :Ai.KXe}&$\B+.c5ӳ}M\| *o 0hbg[۪"!`PmȈE ]M]stfΡq'&Y2oxeN}hY)&GvM E撿#"1̋=! rN!)3"uC$ښ>J?"*-W"! J3 ?ݧ4? v"py^GU(߱oʈ-=:g1<%{ i ֝|g b ^G^tqqm1m5y}T4 !}:A$sB^ w`c :pQPC ɿr#Tk(d2U\eZAQVKIQVԶ % d,yrB:*+Npؑ<Q kN.|ߑ=u5Лj2^`yUqz/~\Qi<㸺.X#qX2z˙z)ӣ%c1ɻ#*yiY3D*'(6YLj7K r@Vh|b'uZk"`*ITO?#O%ȝ#Ǻxo fn?qhO)Ìp*Oy#1 Oϻqڱ=+z)9>n. cPARxz_}VV
^~H)k Ab&+ <u8 V= .
+b (Ԍo_; WL,ӫq{.^
fB S G$t Wp R^^Qv.mgM&KVGf4Ѻm8K{i$~ghi% v=WBI{F%Hh?JxƜBzյ3?&F?W;Xj'o 8V {Wu?X{]B ʡӟ3;u
|ZT,c84ot$S\uk>̐W>P5<"I:&鬷rmerSmTLCBziXZ A9 Klҡlp;>fsl#I:`E@*k-hkY (%jE8.<gʴH hU KKɵ=-R8É7gIIIt/Q{$ =E/H{-~zZɰZ D3AFUU'\:G|` *vw })FzuIJ٤
2 ;;>BB_-}hͭ(ڄ7J =8d._G1Wq&iʮb?lfk&kowVV I1ovۂ ~]s%3qӞJ[7Z 4hTC:}B \Gu!2^v]^k!]]Q5Vf}DCcchv'}!4\*n5n;{0=P };RnRd}
jǠ%IP#$ʩ[k6{\L ]v J e 5U)H"Pr2lInERlͤ2BOQ3Dv"1ˤ('7y&,@I1@/Y' Gʅ
o V=-B 5fK;k1: ^=b8t'V^-ԯpw͡ uK2\pʿ5]&n;q3<(; ٧QgF >}6?>}N ̊jy(ZLD,%hv3d;k|YŰ7CpWyw nP<d;D[7 `)S㶩j=7Fe4gGN!w <f`y;)6&)A Cj>/!_^&{ m<fJF >!uFWQ:GO.~&%) JY0 99
_dS)֗*/@v:A꯶ ?@5$ď۠ a il!*9=?~k-sYsݧ$b};y [ith[{,B`9/!V&0uThrS;n{%<< pQ %1JFqB '_ dA{@KQ ,|[j BЖLT|* 箞r֯09AԒ1Mc{**cBl,LntڋS<K EBq /e?<@<$rC絣 k$L&5Z",uÜFϦrHR.T S.ӌ
<ZW
i uc{`3K"cOn(~daXiJl3v8xzAK]N7T<hO!'&.KhK$5yNs8pyKUQ?'HE;]&msM .~jo?ߚaF=CY
|#oZY7/E@)6a#OPzৱ$A8Fwg
V5r9 Nx5l k!;vR!>UbRȈ-3{*l!wyJz2O+ٙ? ?NMs(l(O k1
Wr2kYu1 #c dNG 3 x#p gꆻ"d±,hK-2ۆ/H+
+ry0+Ɠ#1٭b 2Η*L5g>Z9KxO51ƃ
خ.Rv@}BT\S@/E/,͟DqW%W a)8 .|J;w^C. uR֔hU<5Q$ePM!J"{Əzn{ [rD D sw-rzfb4Ŗ)]o\3]X)Z=&W5EpT.XY={=t?
) U!>
~~`6WCL<)Mt1i@[/hƶjnf B]hlg,*OE:Hʆ咧,@j q;T/">vQm8[ܤ؎z7e WGa$[=thl G`i啷C> fe ? El;6H?t5t^jAn`&o2U۠M҉LYҎ@N YAۢIS)$=&e֍50ʶyճL "[\6$ze&?'TT=%P}oͣt1(!m4Veu2)ˢae5ҿG 0/ŀEQB]Eò6PhBAI[˨mI4+A3Go;LFw\,O.N-ku}ԓ$.S鵺?=VRC;^4=p> d d[QPpD/2D)vAnuI5뒏8Tkq8gNlH,?^V;c1?O"*~4 (Ů`sooC(|:Vkz#pWެGk Rh14@
os$!3p!+ka{뗗 =H;0>?,.,SAS'_}V 'gP]ը'_"=3
.mZznLE䗕|/a^r <2@jBCj*WYƬŕ
BV#[MID1<Q6&K$HcCR%q,,2?J > H! T AqO Lk4oblvȘ \I(-6@Il1.gʽ UN<BsG c ("{ 5x6{3yu跨Dixe}*=XuEm_3d] Ce=՚ݝƊ Hr}Ue\T
C <&Q*jB8B" IN;&M wA#
Ykq9aҞ4D@EU"g_-r@ҹ?oݷtHg, QÔxH܂WI ).^ӏW7u3adH'(~|]x|?) lPZIy}7@QNW~'x@K+ K_ź-"أ}4X&gMYڿvk W"^Pt2L\m[-LnԒ|w`4B2/R ֥v,$9Ek 61}`-F9q/6{{>Q>qhXLJ4:kZA!āO.|${ 0~9L2 >Gӗ%*=՟ Hu@1Y ⩉dDkV] |dPM>yJ G{_;rTEw<Гj b{GG2lT;
rfk\OqKa%m8
vT Oj-\m WL tt|Pt{ 0H.MI8dH*5Տ7Օ_&(&y`B0 ר}~4BȫZlZVȒ]`:GkW}%P៘sƝ|&ΝdW 84zCgKQ~RG-֞`j-f FT#|o2 {q~- ff^KC ϥxq<b m^BaF=-v[; tXX >AVjtIBj7a^kvu?43* /ȕ_hJgֽ+ނX$_
Jʍ[dt ֕>z`B9kkY<!Z}nJh_u4SMrc`i=h`dg2w,2)!
Wo#fg|?<0!ڤc)
6$Luz)6V ADr=EҔZ \+G>[?rhH$yT^$kD = y ,R!K#vD bߌK?wCG<--y0uv >STnC͆m+d5p%e.WJ]"ދ ܙ1Rzsn}+Sy){Ɩ = [D ꎺ UViF ;7?^ H.g[uB\=QP 06 -W +oX(LLu
sY7akcvoH+{gdTYg lHӍ`?
tgkMRw'lJ
_3Rl+GtI[7auOFxz yäxZMcw%ہJ,>No9öB4||ɂ錆М'6Qd݁ MW25wԛ<9 ì` X__`:˽R=CQ
sނwFF mΫ̎ 36RT#L|z 58YpǭX\d'kr| |iYY&ܖ:fnї\*O [o
XŜ(z&͔͜ʲMH^fMr^ЬN0.UJ<Uj~1{Y[Li C
}c۽
f֣Sg7;rI0˜+A%.(XJJ\_Ť٤`NjY Fk
w?dg= ~7sJE'BPd3M#iԲeIP9I:4(.T wMhq-El "= d-'ryl -`ˮJ82k˫g`Ǥq-` R3jOSJj۱9e
h܃gX {|sR nSD{&ӕO~b 1 peEQ:`>B 50sDS8' b3,=nq+1KS y.gM͞CK6D-@8{mGp4Kl>qp.7 OFoT=y
oj iwuϚfl[B` aqh h%FB*hy`ƁnW@N&
[CBaX~1" 'U ?[1p1lI1ɥTV#R+h+X- [+DMUokdjSDOZ˲ҞxQu97薶K 3R(N $W K5x둸s'^>,YB˵>~NM4Zxy@]սvi g3 [b4s$r I}N~].j7Vеd̈^Lw aLNZʀI:b3N3۠' n;Iֽk8`c U^KHQZuS /f%Y9%{x *\"la
6RxR
3Y?VLcd9i\ W n8D%&=QGD*t`[}YyTm &FpțSVY~/fi-TM8vK~kNn ^w!J48); KY9Qwr]V!3fk+m=F_Z7"XW=%"X\oAk2kߪ8As-ѷi>A!4 վX3")Pl - Q jmA2Qt}!nDXh[ɩGkG'hjvl祷(rrG{?o6326Tk 壓cϦ ^͈wop` ,JF-N!:E`^# Gp4]!-2X cnLJY b7,º9_s P6Y@*W M倐Mj2,˸Qfgw16ՙf;RFqSvu:2[ko!HfEZ-Yߎ3*#nmg1ZZ Z} .Dz# f|ٺvz8p뜲RF<Ge8&0iPNohW]ѰZ .:Hfi䬲}.FU:P84sC.PkoiGSYTlA,3A՝,H;Řz2l} y;A@hs0(9kGdp¹BC 2 9dIRf3 *]{~ z c| ;Ϊo8Dy5fY d$ MvbZJoe,тD8F)eD&fg#a_r76P0ܫ KYݔus @(A EYkdG&+82H@W iKtnXdBхOo\>B`7+ìU s26vS&|(;9b$ RE$J*Eb=( GIaiz[1QMJK\Eo ,VXعz-v32-cs GG+90`Ș!jL
T27C }(AL,#A }
&Ն h?Unefi.]^ 1bWmKI{s^H0; {0x 1`jp$<+墯&A, A`?i''Hd rY|!6Tw'I9p!#10pRӑXrɺy
tZM'5A:{`P [rѷ8ʡ|#Et~$ _ta |-Rv@h@Yn:9k^jl;̃
*=Z^ۺ36[ 0i_^HFdcZ%5NS)̺o k,sPh [Vf Y|Vs1=Pܞq8$Y70'IJ qGccwtkʤD?÷*Ae]r];פ<1
Hخv
9䜬ˌs 㕾h)orHa֥@ LOND7\]HN`OlM{VZ /-Qv=$n8Q @ඁICs)G#dIO-\;0= pU[wǃ{2.rS<.Qu~X'@&g]: ]ns/#*TP2}!oJ]ά
}%!ofR/R2m2IVگag,zQV34F ޯu1]zl~Q^as~j}QX A]7,;+ZCݓzQdU|BAB%iY$Kv+W ^(m"pl 1/l_7y?ϔ&<Xv v`9Xvʟ'zO{ƻ>\-Bk
>
C!J/` Hl<"7@. i ZyO@Qf92ᠩ))<F;gbIK(<d3>hJcd h<nlp-ddFؓdt춤]iY~{;90 b I
p h
0rc[A/W } 5]-u9XSj9ݥ$ց4ٝ4ӌZ?4p^zdE˷cjRג Q|s|VHndzk/zX
dN}:ţfvүr<r
J_~v<`H$ZX֙g vBLI6'29O "RB M\e#}2szۥl}Cs@=- ݹTv
q-d` X]
I^p= k>?zkG%*t1| Ykn*Mx[*Cݙ [TJPݸ _ ~-3Z@'1}h@(G1VIͱȅ vT9 Z@#ݏ!LE2p^Ź
=^*y-,hӳC,*DykLCtq3.'^{ȳbL;<im^2M =ƣK56ծ?4`
SL[.4oC [S9Pu1Uif)Y}Īu{W[ZhM
t.H0<ˠ{ΰz@ 䴂@&fZlML/tv&m,[[Kؑt(< |v3. !L Gard[nK҃&,vivk|«3I{DYidCSUtZ%ZF!q:{1r+!wx j{? j "sLUvJ_F#t} }%5wƝs?[4ez
~.)}̛ _ȣR1[Vσn|d(up\迆+髀9 YöL7}CMf&uqkt % 8+v _LyU8b)--%Uk`[B_Ҽ7^dQ| y*{ǂ<IGMgr$@<米FnM_čĆ\
w>KvL 卄;R7 x l$4Cgoջx9
ڂ@M{gn 8|LY\{J8|Rf6qCǒ3lj9jl[d Ƿ?+Oi@zGDe=m,Ã3-эuڹB #ćwl2!|# SȶAD7DMN 1Ol
2U
_knkޢS
DP&5N!3cN<Q|<sf-xh",='X~/_0w>QL'+{I^:Y65"ݭiT1ݶ;siG5ķxH%ʴ# rLB _ECRLY.n%4qI}RD{:g*8d<(*[
!^X8I"}~ F)ɾE-q V2ps=2*0 :< ܖR
Y( ༂~QRzGYu Xಝ5x8h(y |6!c֭9G?~s
V, - .?ײB3̏-n!e;5uv&
{'蝫`
[o4zR2= qN.p*KN kGH_BԈ\9 dz!Uz kB/R -%/vx|7[l$?Gz HݖqCvOkdxIJ찃Μ$ ;v"$;:>]f1yjZrS1k}5.4Ή^"إY_?7 xųEi1M *9U;7?w = l
)X5SV?ϼeIux)?<)}'e PZ'%̙~MSdiz
sSC|7Ptu<w|?~xx$ 6{}̙k ȶ/|xc]hk+g9ud\IJ$s8kעd =Yɡx4ɻ7+ W]0+ Z!ѕ+ƎǏv
r4`? v6N CUdfr$[:G29'B @æ与}R=ak ceݧ^IZ$B ]˜[,Q0gf.M-~b;8I}Rv)/4}t} Da#q8P]Fg@ᬨ X|&Y~dn# d1oLT 7-C1UkE!;l8Y)'__=S3 ?w,˸X)co :_-.(jkAKN, ~Jbe=>Αg&X40ّ;6T6~uf\GIWةzP%4bQybզXT,3-F1ҏK
fg=!woZ ˺2NL;Ƃ,o780l!ZuunȔp@0Gڰ-0n}[N8HV\@YMd> A\J oHu4a͞k?ӤqBdT36?
& ZV<"_&: Vjk'Ӵ+*Sܳɐv{9_fdH!0aK8LC,Y @'oa Y1@u=bPm#p̞; +ZK={NvV7;|)G6QizsGe?:֕PqJsBmH
Zc(8 ~#/ZG. Ϥ⛯+m)Ӵ}IG.Q,t:w`
jszZ
g-vy L is@>|>~rӚFǘ)'9>h5y5>5$SP^q+? w"\QsP.?i)|,3d#2D?%&WZ"Y^\Ӳ _l.p;=<v?%N9 0[ >]/1iH{
czK:@<!5gW {9llK-{ok>qXkN|= /3RTQpna7,mzE1 R3mi
OK9("Z~4ЈfMb#;33q(;ZDRh:F(fQ^ x Ù1k<odž^F?%P ,~I(O|'g3+;wlԑBtyM&-+ET1$l9J9
|JκRh:wWm.9C%
M&Lۺon6^:_95&Y!"|y Mxo`mZB7K]ٲ?,_[%Bt(.qp@Ξ&p `V 粥\"
:\5J fno>9&t/
R/G8}@b_W]^ЖIw/;X]Ͽ_&5-i@We\+rZ)fL?Ϣ5ry_G9N!W X~u+6 .$)d[f/ۙY>#JC2
0Ξ>Hn%ASZW=F(ׂhX^\xr7++A{ç
2~ydLl~:m6|5< 5ӲL
[076]? l ɮn ;U8Ӆ|*ӓD@4H,KB| tqN kW0,Ȍ6$y~U4k9$ =/
@X)q#N~ V FQ:EVJ9W9Xr$\<[լxKv%ص cz ,zJsWNr2 "EJnzژT :R.<ZZFjE,="1`kdĄ*}$0]ld$R
SC %RKsUNlU7 d<u[m1%:]eDFb6\3
4Z-vxΚ/ۈlҺo~Zw9tmqWPޜh0O4yȷIf\SEM<R#6Q_ww 3 tM!(Z8w] - ȍQgzpdU|+6ŮVv9 -7`zgzP?lZhZLW*tٻ
_ ,lɁ4evI`
upV AaEM52J3}tDuyZI52Ѣ4nn`cZF] pZN.Iw1l2NͦH- 5#ʦOݧVy}vr'Ό\RaJ-ħȥç'DZ-re A".1u(r 7}C*K= ksǢUWM|9 ^;4|w)Ro ̝Q"m
KvOÎr͔G_0Ʉ&&~7\x}7JTrfvz><<k[(yJNprWL|[Ka[;>r*>se_hۧvn*ZGlD6o7YBl~ 7X \ا0gXAUΣ䬉#ddv4zĹ'`9W fVV<O*#: 3{:ÀmN '! zl bA#6 c{p Jӧ]@lk ar2J !1hztGl a5
;Cf'X1is@ix&eb!B]sVL] !ocrڰ `
=ijm]SY f;$i6N/M3* F}2R*鉯GI]LO lGlCmͶJUu/T.s!U-}> x.f-+EZIVYyxڣ?XS,i_nQ*$(a_BXf 53!Y/@oR=y}(To|v,}\"!n-:S32m/Y/ "fii US`Qѻ額z3?ܣB-2Ӗj b q o ^|[= C+hS{Z~>ЄxV c]tG +=DX6ANVl,xv>:&ZuOLpԥ[4cyj\B?×٫.GZFQh dVu{F #!O2.- u:F99lV6-st4Aj֔ --;8UF"4ф0qIqP(dܫ.4 1 7ɥ` ӱAR)hH"f,v("27DkU&Xܬhʛ bUYx
?pK$* uKVIO ]]sSzCE1
yKvgx&3'j{z\9.98'Y|Xd%<-L#1NwсW(NeJhel BEmi AqK
"ˎ+],gS^o,I*]!pk$kĞmEHl^ݙ͗"-ܧ4꺂 ` 'J5mJt hHFQY] i 2gͨN;<P^8`x[݃8I-F?&%:W{g#:pC(,px R^&lDI.wվ``S*Yk;Ϧ#Pqsl?(9}W4c? ś5w j(8ra֛ <I ·/ Č{Ȭ E@Mz,1L.lxMe(f0T^?)1 f!?F{3R$ʄ"g1۴k9T1 Xbh%7*qv7^;I@h0A_슀 /`@0;~/r#9IBoh;(]vY,f G?iSB!>J,7%r K1;$ׁGϑ %G`+L?tBJq&"b_n %4-AO2%9 P .tIBjmGgZ~䐵7WFMji&E[2>-q,i;ra `=0 lthQ7PN!R+ FtzJ@>tOϕ0 %etS[ c{.9&;(e1a+D yGep,-ǶcYxlRI7 *O>F|TlH s4#A63zFV8FQ]h|2{ȘD#{QQIHG e AvQ%&͌]n]:S;=[ROaΩ<==F-|3&%v]`\pz_gU X}sSǯ4IyjuӝѥzX FpwZ7xo3~#6Lb,czvw[91` ? W=ĩ];YRk/?M&]?1)Jm*GVnj V-f N<Ƥ
M裦 }Z`m*zCZ hx?p|CT `4e;D>8ԙjB Ԙف 1]P$Z5a¦~[>"vKq5Rm-z݇^ DpE E39(-Su|0c&H st2͍&M$R,oܳR!1=lǚblJ $ ȏigK/+ZKܸQFk$ _%ؖ} 99W ÐɋܲeNLr*$gxgMpuXwU nܪm : B,xpP^?\'qvy[HI-wSIHom캪\ f#;5XXd4D-Æb?ǖhȧ=wCȄ&b&\iaz\{6rv(q1N0fKkӸ*qǨeZƟa* QwZ(o]^O4<W& )!m2$-sPO 軰 AxBPV !B`Ú FiPQǖQ)jkl} i.wfKĕpf9 9cB$>oe =*㦼2dE&=(xb\V
0]<[20}G1A ލH=.!-"e \>XYbBPF1gyx&-}:iFoKDZwCR;&V1?3x,W;J(` ]Y!Y}w3 kzXs=-]hC TLXu662:W5X8Mҭ[eO0Y [C9ɝ[D~%⸎]Hb "@ C]Za(l|BȔҵwlb
zQ9)6ìH7gWRhD6a9EVrd=GI6$ڸ{}F?XRofuKkV qDrU T1҂N֤ ,M$,
:9*+ i
9ljڏPēK2XJ!! I΅-m .jlt-[F
&i5Qﵻ=Xy['8JyD(S*ZJMnߵTP QCbg ^R.-f^x8vļ+ :Tryfal;ڔk AR`K$=ԊѦ
zn^ dh~>pSy/ĩsIx(!vY*$+vVn+R# Yx/9VvH ,T~Z#o:d;N;«*Mе Ұu
sԕAf|p2l:,g2C`7UL"͜XB5h 6Hjá}1XLzn4Yio4q܆\:~8J`:^딀~amR]<9ᑵ5<su XVΚL3X vϧW!ywΜvHtR{"dW[-%!-f˧˫
'eyM4v'{Xe*>5HA{3xgG"+U9x | Y){՞p(}L~ /JndV?=a2c '(ךLFR AO?pXw9"
@xus NNuE G7sG_ /.,98K0
L\^*(>aA_EҎ`N̛,.; m/*LAJ~`z1zzO
)0ϬMON*muSnFUB9,:V= JGT ѠNq߹$ e rm=76AS!m6'NW{.v"i.nG}U/;Oe4_>LJrw*<l"FEOIF(vEY!{mu#_#ʴ9PEvC,g˩8 jS])vt&.N Yr/=9kZ@σZ!R {Y W=ZW{t
V:͞c)݃ϱt8Ꙟkr *2 OycDH[-b+$>նr [} O=P8z?{>i-j ;=᷂k |RЩ;oZ?CV\@+VH`98Gr1j:/5^6
_yK|F~`s]= +ֺV;~??
jk n n~$sd 8ly&ط=y8ӭ uҳ GRpU4BهN[teU{B(V1kdP )̾Js#}9ܿi8}Aϟ6{g 8baKxxb~ }s">Vxy ^L{!o R si] ϊZƳy fs*]߂Yuz Cs&6[k tRD3L-? ?h"2%&Ms.[ Cq ZG(4fxtɷ(0JU- qrN>A~REEB?S4Y9`Ls;xF頻C_XrL]Αd2]m
u>$Cig7&ʃse2%*]ʹN5`n 3ȉ)0~@2,k@i${譸Fa?Kc/%gEnELJrxb2i]!"Y h0`r>l>= H `h 1ܐԴGf . DzsuXu h4}aYr_AQ-Uj(:rlfܦvܽ
\^bC%r#sI93f%hk[!b)TIpqerMwdk%K,F?6~v*lopK73evu`푙Z$ʎ4{h!g*C5!^1* gAo4oI,\,iʝJLg|n ߡa*sbzƻ{O+0R/`fxt;ŏ<xV\-L7}]xbeoFH :_Q^^|~0;f
tY_M53 Og ?[Tj=s(Fђ,ZNԂqAKY\0/4&rJUvipH @xV"aH{.Q*vZlh'g,ϹZlk;3#tͩzziT?49<L ALAaW6>a # Sz{)HdlX2mjB*ܮnop0>&ObakBC5D Ὺ[bAJvd%\త'IS"Yj{k3h8A䂃zs+^dtQ,ߝ^Θ&⭄)`0+ǻ F*Y SS&%Z'q;ƚmPC\:(-3I4XLV͟l2X ]!96ZA8UӱBOK{99L\t{J? $ZKFjnY*/$pz/|.O4!kan6ĎXؔ|zrp, " ƍg ip#'/RQ+J+6bHȻ aD4he/t`DͥjqC(rpJ`{i1@~Di. 4g2 %DL5łmo.}%|]Ѻ/2Seǚ&m-Z I,"dh*Mx B6=H{GI3 A mv8 ϡ\VJt"B*Ymmb:lJ1bk"9217AK8> sd͈*6d0_+&h +jTh9t I5b% Lfp\] ۛ6$5-ʍn@7>m6 w9 nZU Yϒ;Nja[GT=_3`9 P[>nQni s->yy~a2h4
H=}{n VF B<U<P˾I&AH\ qNksӚ$ `#rH^_bytjC(RPW@O Gdu ,b;e1#ьxtQJC!!{h.
G.h {r@ܷw&<2z
! m7/ : -Uq4Q 8}&jF#ZT㊃\kD2 N<{k& f։2x:68[(~. v$T,|F;>Bn#%qulc|pjjw~y"e<}
_UaG]T,}h
0S P͡BD=X EI5Y7mJ9ELť1A:a }?nYkDa* Ӫ^1? ߲Yl9qӅTR^=F>̘
5-bx0Ƣ:8Vs߳Rbm UIdFe4 S_MNIsD8ag>
k|>=^o:6zx0S>4[: D
Zd!c[EKw3)dF,i7{$˾lNl/T {E[֚2:!kt$ 1 O}+Qp,ݥ\^drM;BlE,rfəGwI ')(mm(n l7qyS`1 b~7~ ֑Zbd%?=3!w{]-,҂BjFڻ.Эy>%.IzUY_81F2U>``GUBjF
3)xfRqVzZl.3-u;E 9 Ğx2Yu N{6{WAC/<
֏Ц=$YQp1CIfZ{|!(wXV^<> ` V|E*th2+a|wۯC~ʖFyd]=)/ӲFg +_hLN@L4aR7`ltErm\ R҇s1Rm'[Em&R
kش-nt>9 Kmwr O@V-iJ| c 231|"=H mdyJI> yѥ5lp+ʌ H:j$VĪz?5QQ»%l`[1`,!4b} bGO֙T :_ r\o\q "L<?FW` f^Ͻ9io @vy1 `O&) >`3:>Lk28V-pꟳKx<ʓŝBg]փ]S)WѤLA郚SRH ^]LbcfVh^D6wUHXr8
0+}2a OangªK2g<HS:Ih 7l9-Uh\yKX l%^RzzIEDJбB^UK(Տ(D!YSrjsӻ#]ѥ*}Axtm!3p<"Z' ` ;/ b=eӏcfR1$nt lbE;^D^Q]}4f5 lwTA+&0MY06M-ڈ٣Z[ϑm$F:<܄!u
մA~;e0 %gskZl U ۉ Yc'ͺ|hK1][â#pQY hn|G!|u<mYytǓL 3VqTW}m%VdaޜvYOḛ
e7. kbU2NƁN1U.ɀE(n0^N??Y|!@f u^V[اuVX&Xxa|/'-/Щm8~-g2^[`]N q`|WbneO `hx :ԪV۳p/㝿G[-w} ZbG@_> ^ZpuJ螰 %w=l0@tk"'ER ah7dGaFP:E!^>$_ ox+sGl: z>w,rw r qqbQcL n- Zi;RF&2nP
L|5g6τ^m7*?EEBd!{r3\J̋y[?ƺ
`,wn:M`{]g&pvl:ˍamW z~csO fŮD-PlLv 殷n{ u'# w1Zp-&F)j}czLˣ 01v\1%$dI8>һ yĂkqH!\2 EpY|9Ѣ >3G'dG_\ac-Bt#YϪhСauuB!>a(,CH(I#F s,gbJ!ΝXga*}Q/Cs\~gU; qbї< 83n `9>Qgfج
E;rr/[wtAbQ*d &wڑ)^m ˎQ" 2=7AY6Q/Z;<P[J<^~Muj2{|9<E+MqһjvºC։j WËSy,nmlv(4xDT,R$;S8prF*);N@K Zn_(fuoTym r#D ,H3F3'XބrMq:[^[L&16݃ڒgJ F ?7 ُoR8l=p*1hʶr,gذq FȉokcL%=Ɏ\mQSCc|zoosJurfG
45+g >/f5g!ᴞ
Wⷬ?M 6mꈁ Ijv
?=% 9|Y>8t/`wE6M`>{t%s{o o; kE !veaOXk{XoOQm6hm$Na`8ba-9 rhSNwO(=Gɦ `5 -ٱ:H)nӅ_QDF4;n
ΐ6 eB O{
E8!Uߏ&~<d!4 UK@k'mP?Dd?RC,nXϞ]b 3ex" F;Hāv0 XhtLBq [D5h3q|ʻ-U˄SBj_7B3փ ;{Eh-YYTݪId. {mBP.--$,g$C}2v;L^Rb*XSsS[hb.+L+;A;`cf38v$\_U $N"cӴ2W
#aY2[V+!3eA !tȈp |eܼ / to_#j dt rXp{;|Ϊiۣi?4:Υm%M6]`Y|ޭ#;ܦ}1]-M* WJ$[+.!&tbg"E !!) U @ rނB܄Ă, 452H3%}p@
sKؑ
`Aߗpa68>-}rY>F /I ~~˸10'` E~8(v t 4Nw2 $Eo+;?@آsji;SI%POgeǨT)1V6%B@DZ,w, P8z mgumX>D_ ʹj[]cIWq'BĵERx?t V|E4KJFQ8XȮGa
bܛϧ@w̔ p)x-F
Qf^A@jͱl{Q_}*xw 1 "`\uiGDh2I̱n;@P+}|e ~Uv>UX }z݀o fG;I)T_♿d7S; 7_mZTX$>{ a\Gd ,pI,UnUtrf^9,gy?\=j&\姴#j
l %5Q|c/|M{kW>? bEHݏRB4n1W.p|ׁ-՚'BKG.K"աnQ϶4].u&Hz|VvOj,@= 6z)7%d L5k/
V^s{/H" e[Z"70,`ږWgD9Ynƃ!5Ǿu" %tЈgq* v[4 V e1pΆ6"NQ)Ѐ 7oH>`d}~ݬta!K|g\V 逛l#o,=NĜ
[ s7z]{Av~>Uˎ`r?cA<w{l JF UXD)o C/w<,?6 bН#Ds_<Wq,88-:F+1ѧd0uu>
3qK6mdls.EM+3= Sy|u!BbJix<;1<l:Mh"P ӯn؉R%^f"oS5<5Xzt߿Pi Mah ">1lx>>7ᩈ$IwBoFϞ~C^7sѧXBWy/g9 J3?4C "yz_o9l h9AZ`dž ?b,D} ݶ7\u.+֫"frOn5^X,!˜4U1]I> s\elDQ֬ӵ0\v hҪ>R w:~$t7k^ ˕'vjS$n* ͧȹ^ɤw0So :KMHkUtSeDLp0N}EM6M6ߊ9)pˠ5(@ui{ɉj>!S WdАϙ `2 P篢 7gI̹X;2n6X NOOuߩ=>x>=ׇȘSBf Yz ü`u4< UVkcaY%`wlo:iU ncu
<`HHPA(z4,#P~ixT DZ{R V1~4zd,ڋz). `FHIJw[|-]v~t:{ )g3_#pg:A1
nch4x\b((,PaEps8YcL0辥 G89Fjl In44¨m8AvO8Ria1 qsǻ߷9:~1wuG"kbn ۔,m($-).SbȔSˡEQ"O7:!c:`.aZsIa=4F
>2oL'V`$fE'LJN;>͢N39 da~-kVQ]\RJi<h$̌,e`0\[}ѓÙf~<ȅtڝ}rr^>-q&xYRD՜tiUEUz9#qL]5/ZCz^
=fp~WvИ_z`
6 dg;RuK6A.XaѮ9i\aW-3DiER2^ U#^´*]v'ڙ^ >YSM5;Tg3ޙ+Y&k * W!$.=LMPR
.͞'A?pRLV%`y%cF7
"jNـ9+9Dp,R+JC`.jx\0YlJuI&r0hc7z#Z$u߰OYi0
aX<>n4rhէ& %
=
/u"0Ħ7g?6'b@Ҟj
Qzc݃HCU @^0xHWx#s[E!sM!;O+O1YKove{<9^*[eBoA /0N4# bo#NpIģ-,r qe -"CrvX{j ;C»ea yOg>D@o k3U8nc5x! D'F} rdNlh;:vn f[^ӣfR?b:aM.*Y5̹&ügq![XOaWn?;~ '>ykxօVVHvf+OU ƚot `-
sM3j Rkx%
DU1y}3iǍw3ܭ
PTٌ bGˆ/`8ɡӠ !~Q179#A ]6y7BLޱ^c {Lz\kÐ?'u˔ !H3t\Zq4ִ쎀&-:J V ˟?Bkm2p+g8`3ǫF<1Mm탬˨^$F<L ,闼2 Tk=kPsnST HUɋ*m~2oE_j
g_hIp#<Y#(ec`]XȏI+9JrxK9HCx-g6UJFƩ?JTsZCAUz0.z 'ae4dJMc5-ۤܘ^[f:FZɇ \ qH#a+T3J'NjtIMÎɜ1-rLv4Qk|۱L Ln|fEY fBufPθDˡRfM䘺5c;TMx MctAg[h: LV5VmT[+ m O"tiQ:tdO[
f $ \m.mWB6uEKIf!kd"q&8ٍ# d v $N-I!jZah 8 > <S"]t xx|$pRYxKpK:j£Dd~ke
<IH>># aLL38/3o7sLT|Rk2>}o z ȶQ<MTMht\jNV1#[{xK(:S)r C?m'R@JXO\VI@C;,mZw$?XA>qyUQ} 5| Lņ\w
.pVyذYa ϽU5smt Zsh4i*)&:ks# 1$Q췊^#> <j1R F^K@__䐷?'" K1f` $>|{ W\pSq3TU2d4L&ɸLGMbuwGY&jMܘP@u|:%}oFZַPF(6{
1ؘkm"i #feVvgSu^v @.<Uo6A[3)I^)26P yrm'xb9d AH2Z:LGoJJ4Z}3`5b1L#hb"OlϦn\+ B;13wIm{h}OӐ#y&IQ=vG3[mպ|
Cy~JR|둶`9u
V!z;`^k` 4!U%6 ~Ԣ{ć/=;{En_Wzjw:zqt[O.&38c7{z&y y=9TamŐE+?Z}]= +[ Dh$C-&U\2 W ?Z7 <
֣V@2 * 49kßuoAox-d~<}.Dx6fy!w
nu\پdf%yGfFo)0Hߞ7sYw/8hf[iAΦ|ȣ.Cd.ӕUkQ!) mO)`(:߳e
/֑ 14[嘝h%h ]̍zb!b5,& ?_ˈ2N[uCϋA+QY}#ߓ=b2tGeV&\Nc Hv"%!2"(PD\vr8~@M=#`OTmy #_F_]Sv@]ZB\^V|Iw'ߤ--jY
sc4H>KohjGn- Z87 F `V4\ _AIyW\in j=CS3j~l03^q|Nrq͉jyXIkۈ/ xsđZ5!:>S8en ^Yk)鼩r$P4 H6op>ڰfd*D}FrYM/1~w?f4``kN:Z'AjlYbR'N
im{NRP2{CA ]{}z(uX̐N%"4lNY"
)!O}gٴywN"ٚ}N-[\Gfu>f * ᎇC,!V݁}3>ӇrѹV `܂z_. Kڷ,g}p`α «=0&+~f#f30m |LXnkvFp(<xdL Da;k C4,20~GIiSof ;A"b55`3{.@Ѵw y
0Rc? CJ֗]PF`m1QM"RbqSLWXʗ Ω{1 }&uuUC ]+ \ Fb$AWɄ6
5O-D^*qz5[!
R" *JLdԣ 6<%"rk".ToOY3u["Sm Mok 0X3; >Aز [TRR]u"y&a %>QM8
sh+*\A<(_B)
)J.cɪ/Dꅏ+.2KxY
S AJƆ1K} 6>{ae#WfoO#;)̮0R}0(Ț]nӹd[Cau]3yTu" rMu]]6Las̓MƠ7Y"f-}bzQwQJz/.HV<Q
- p' s; x2>eW dbԥ[/jU%^H^Bdg
EjG3 <Z(:o j, m̱opn(,2M| UjHTz_Q\]R% o .,Fnn
d&ﶅL&N]ɲ*\yPE |P<.iIb 5v i(FrB\@_0VqfDm}<Bl Hu ('u%z4I
vPs?vQ>-k߸)X7MTN;fv̭v8!y>bp}28&JB<oGET x^ awKLUT,1qٔ |px@GN5ݹ(Β-3x.srD>; euO>&3Jgi'X49
kۗg嘷q9j7$_ v KCU*BAvs ;#n9_X7&?̻sY1yx+T ϣse}B=+
,'q%(3u
<qfxN5`5=0=z B흵&_/e-x 3pѯy2bl]1RHȁlH#6!5ＭPU)3
qُ-ʖ*ԺC~*˕n'L"ZK %iێ1p:#})eW@nVeVɆ3]{32 u*s=bEM$1eĴL}W,[MSXǦU7-LЩh <;#-j} \)aX
GiQL;ՏF+ cȥ2a?=06"NXN9`-9Iy}\ XukƷUВqʘ2$jbQxdzW-U =MT| M Z>ۯW "d)ydm9U?̰RhAƅ8@e G}=3S0o!==ަ| ?. [@<u
D܁\Σg6`vuFP6mQ>> S(o!"ԓ< x%n{v4<M{idc Z q[OY lG3(C'Gj0qJ'l'I7
s3,`&Mw.ǂC-\TiT<n5u.A ᠺ1U}jZȄǺǨtY.Լ:f.*7?ar cVõm3[gLJ
ڌuۉB O
t 0E R ; pZ ;Zh-ZkZ%**sT:U@F ???eEʀO^KgsUkəpd垻ؕLl ͥCR[h5B,)J2E @J
M#= CĿ{d 鄹ː<&q7&?
y xŊ3[Et.pzBz^ KW45I 7|,xkۏ&m$S$*|6/,?x ?O(R ^ΦQjc &#YQ z5xrFx``[%8u_>S =G
Fr͢qǾCe)EFUi~Nz%B_g_ 9.( cZ `>@D,! :B,T[[AE= O
@o&M
P)|qwm}DơkOzbV0p"T0ҏgffF` " '41M_oE^~ԆT+~e|=RBJ>scH(!VB6?tg n$WS40b CV&x,r(;⯿ԧ9/n~6 m !&
NtI@!r|=A1Q R/GGA(r9o${' `ڀq Wsx\$q{ 6s32Gɛ捹-zI
Ɵ
>/r78qGjisrNbEA) 3;ƠQNn Q@]2#sf!`E?>Q DǘKcQ$=Re?"ߍZ3y7'J1?O2j'0R}w
??/JzߛӴH ¡Ϸ|cZ(_I|~g# <-?ܤ9^Abpw}h.o?Vd.C'F=>~ɇ<TTc{ vw?Ϗ"9{(F} G,Lg+(F7o~q(1tLBgI/۶EE x,Z.㻑/\z܅v&T3_E5Fnj$ҿ H 74x2C_͋_?衯6C2]2}FX^/o:?H՟MN ~!8&#ӊæ7K %rM#Q]Z}ƽ*'&z$]]fa,HۄEN{?]l/Hy~ CßQ)W;6J :kpD=rUt6X;mhdƞ^nQ %qw3$ڟ&kc~53{p(DW}$=O
%xΝM2{_ wđh6MBp *fK`UJsdoo"}Sy*1A;| JWba" | yt~8 Nڀ?ka߫wQCIx8%-(;?JTJ#QmlYG 8 iA ka_>"fʗvcYXa!: qW~{ӣͽ r:ujڅ5$z툝4z!9 7E^Q HS*> <zMwbC{=~ ʱízv Jt_0ߣfh`9y=-')2-lLC{ |*%:"a gtE4_\" x8Mwf-4:Ԃ..5VL3S6J.P#pQUOl
|nj ۟߇nMx pgۚq_U'uD!_}TL @ wE!G?}lPݐk#\>R'
țN>?Tw' iӧ% |٧4& "\o>'?ށ~gtD|?P"u߰?/|oM~qםxI)̿^Jg )22-
ڀC0 /cc$~Kx|b b}3x_g<[MY$ R:[
wC ُI7|7Hݷ !1/2Br!g<7`)xk?
s?Yf}|gzWR5iO Q$CEպOJ?_/ %é|P`Q?UfOcg_v$9 (EQ3g-szD
\+.Ewi2B8^=lj&ל vVX Wޜ7q APGPg"f1< rQN'!
9 >N{aKw15@/ cXC IlX.Q
zm* 8 6&I y (>Fexz}XI놪bH?/b9=- o ~lyotQ'zzΘC4Gy#E^z5vESA+5dI`2yd;FS-gRr!gOy2(|g*Nigrq ~>3kNV,^î[J i &G@_Aii.5vB(PRq )<Y>4Gc]m+6Ԛ! cZ64zGV#v| K7~uo4Yx8_D_\>WS&o}=z2%.*1Kgk뱬e,4o
K3sm^I~Y &ĎFܠz +` Hn6vY` u1'4M߹M<\<Em7<w[Bo
|kDj˅.V#6 ';s}J?tWUeu912CfdC0)) pEڧE-9#3x[)/!idE 8Vp~lf
A#iMrv,οdjRw$j@cV}ebf{BTu Ÿ.ғ*sψ%UVyY^,lr~HT11?)8 6(k$q#߂hdօ&y˿Tx
K}t]iDzVd8ѡcй?OIfM5ٗ Oq]+Myn+fv2+ nJ}d0/,{֊G%o~>"w o 쒕 !-%qF._
JHd\@} UIg]^m _i 7|g
L+@+ fe~UJqM)0 ɏ eI9IbĘȽ#. ρIwukXK|I#= 䔘\8@J~ՌͧvLeo- fUBei`c{8x11(Uj qw}! >GU~|m+.~Ph?Oa0e;=OurBAO|9r5~g"? #-+=@S"DHsPDYK=Su^(BX*}g ^z - `2||
Ll o#-뾄m7ZpGƕ#UV#w e%qD*qI䓲S?o/É4v}{Ly~@ӏ|Ѣ߿/Sa? SȹA,-C!DF l72$uCoʨP";щ"al=>NN|}+oJ]#E0">(P/J2z OX<<pD3֯u|!w{{{{{{{!> g]ixQ{!Kߣ UoGU ~P$ ) (0 7# !IK$MXY/c J'tߐF4ݖ";R%$=
M\߀</8bJ}FdۧHb
͙~NDсbF/ ;.g'phȍ^ 镖OQ 'Fyorěxk貈d ݭ|Ra }H7]S먤#J;BQ '{>} LfO˛gxd'p$\@ Gl{S2xpO!ҎG2zQU2 qH"A 1pi1Aͨ*UX}B7abFE)U<9mPtlT ~Vrϐl߯߄rgK{j`VJc:{9<7e'.8K@Y'TFrrb65&VW)ĹNU Zn?4aVdl7xT)pj50Z:#
|_kf܄D5lyd,F"3 S wdXڮoK5\щSQ)BX)/d8>wSC"+=9"} )rʷ#H5B
-ߍTdsxpאƉ$e,ns&Qo H#
F'kd,$rv,RTE:.k<3F*H3vas)Lxz}6
3"<<Vx2]oF <;ņ3a*G1'M svڗc똍`v(l(XT_0h
R|JG6/ >({;7)Lgk0
D\?<DB'$zHTig /zLu&o\z92`=HDJhqQyJ/B@7!ޗZFU6Z5dXX$uM= J7A#`w_4aXN_ >9pMc_|(Q&n_~SA xk,f'LQUĂВHkSٰ7_-] %u)A#i xXe0Nu}=ND+ߘ*sd
vgqoЧxu! ". =Ղ/*RG% >6Avh4qcRdS&^_6(xHg.dFUxn*`c DxB淂-\.@!OY6DE=Β` HHyTL,U
<ڛK^Jam6:M/nӯɬ" J8p6i0iq >']!)L"X+юIRN+v:Dww;h!)r B7wWY%ɦ!ՈXKK/uD-qtjk{qƫ5=n-ؖW@/t M\5|h,'i
:u:f 3V-o$O'HÂhY6r~O @"1^)%PCcp< 3QlOol GE)(UWe[#>,ek*.AR*m\Us4I1oe2Ϣ:ډPV3n z-H+ 78IA bD"ak-2q=!5Hu:5d5{46v3!K\2CaVu:Uƃ"1_-z1Ov
`vaZ[ | gQn Ʊ(nqgqpQ1UvFA}LsX{(|!`KR3k;p +\QyB~n|gKs2S~Sn.BlB$vєLbrF
kKjx§pʐG]ɦArJijDh ʕ7-D^[bBw#"( 1#{^`S:q(LY@+-^$ \8Q}jrIU[_R.I_@M W (>5pg(x)qeDZ#S R#A}@OMo䧃#YEt?02+z0+A칮
<AmYʜzqn4e-倃0͞ |`ƠJqm#x$gJ n9z 6m枳BtRBֽ̨VIs̈q*> yI\ 09E8=˜,V MlsN C)@xK"
Jʭ[oNtW1!j `2S}ВrC8jG>#ݷg ۀvq1?Od%Oj_}K*Vl`9:jLկm'gp D(NWoq09V"TW%>oeBolX̍|J69+ Hu u]5!7G@mY}#`{:_Ih`Qĭ k/bVx<qj`U=K|)gLI0'V#r5b0 @ބ9Y~ܴ5o&<\ۄU:QX$+v)Ї"lPNG&FvMd&=k T# % <]0oʸ𑙄Ą
m`>_潒vM|~y]ْ ! p% h;F<i蘡)5ٍ.Lr hPI|%!kXpEɩYM2k:mmdWh*B^|!ߔ~~*$ \k)<@ʍzՔ9hKtCc4_rUw Ĭ5 C
`|y_`?Y8j+= ]{Xs ^hҨ Y/_OV n'Hyel1|⢵}GDZUo B g֫(3NBEg>~^h)H'[+Jڪ>)+@ G>bF yaw [>yJ~ pOvzHDe<0$5JGOuo74@fQt" ϕsr^(5omoCQPj?Jy+s^ȐnKz%gN2*~^gX@MUZoo XHR~;};x)\F4KUC{Dz]g AJKQ#Wm{Q:>XjZ\enxLV-b0.dŶa
#d !1R9|EɷŁ>l$L;Pp=y
B,ZCg дK:V!w-/Y^B 3uu.Jx$@z Oڞt٧SI_ZAb%ԩ9cqBEƞ=0m(!K1liQ# ]$ d6 ^:͵U&k~%RݲK7rPܞdBu|*/q@
{N{dBS%}=1r;
7 2єX<a&,A^V0vnekC"C[@n-ڌj_=8*W32sO8q(̞')U7ֵ> %9>> ]|~ۍt ͡u_` z/ٽ.TҎ^&1?l(
inAg-U<EI`sb=@Zu=~+0 v%>^v@'Zl7X^D`σ&\5
%Wa·48:\dB:% F/t\h6
>yx$, k H];A;os^K5j9ˆⅥ,8A^I{md0##ݞ FaR_Ndai(;YLSUT1**Gy0 zID3U^0|˦q^kbj*(4F%ٶsq ϗHd"> +I"6\ׇ _08+EpܚXAӊl.-j5®> X" _[H L
fz"ޔ̂{0A]qvMc"Dk"3_zhl z+ BE/&ⷝqA@
YnEvb8zTЦo\Gzv u"ϗ4ȸu\"7H91L-yk$0щ1x{6H N/-m,,)&OPV0ocH {Hn6憾B5iBQl'R4}8E҇S# 444lRe 8hFYCsg8w~z# LO,%_sRW@]u
v`ؤQR{d`9U^S d1S6;<!]LQcЊ9rL)* 5̭?!9vڧ~P s !@Uh"CIH
D#!F[aMN+ƠC-pÙ0]$ߜY V0ueu|<WHxZ~g]owA<$
Q3z0.vxTufDpڇY^pxOP"<G280bsKaj}[CJTC |"JnxdZ;<[XņZDaF4Kόuur~K2zⱁR}^6uR]_U;HIתTW"
y M:K <,:7 >D7C CNo'e"d?4 fύ ć] k4D{|n0+ +[3 ]}BQYF犚QpS-lY+fخ"4 (8jaA7lRv!
} |5?Tz[*W&s#fAhagq_Fhlιi6[l icTe)@|MW\ٕb/kX82I|Z\ MUy\ Dm"a=*ÏT^}%AUJ)qF/3p©SjK8/Jz ce[~( _h!Y>e`7&[u$
p6tE^YLHocd{Q)e]<sN.pT~>6|>sfD鸱):N,+OYLQ bl',M +' I~Lg l{gjIf>vXdQM 4a2#`:Qx'ǀ6 l\("/(/|hTV% [rp: >k-@FOFR6XΪYU-ϲ9ض- U%Ra#Q C}!?BoTvp$sG-harЃ1 |4*&ƅQr1kr]&&*\ UY~<qpw2 a}) `MpTQj_ B %ķkaMڔ"HxzK3TDU7<*fp?e+leK8ltĠj0D-c`i+:ƹ4@}ݗ.=UHWq5m<gZ[RM*-=}bΚZ^` Q21 X/[|x̗w_!i j˒X&KV4\PY2lkZ58 8)-XvT+lo:<iYX{sǬ+}3,%+' mJlw :: se 2 Qih!X`!oˣ&;T0NgDj !qB1Ż͗|7M50e=0! _JTo$Sɣ[\! Jhd`"5$Gؗ%ó>0MH' ZqOGW]>Y6">K@z+ز- &oq-^-;kgm sT.#^A<\ }QpޑCj rcd|{`sǮ߯ :0ǐnK\ݎ
ެqaI,+RjT')fvWV%E9*T p$Ǧ\X'vÁ Bv=m%$"P"rT|9ƍt~]SoB.> +sx ȮɁru(`C6^5E8֕ ۰Y:v'rp 7Ⱥ;5
E%8i{Ч
_W
On,H9)s0Y
uX Jmi26 dHiY{_D%1)Wc/:U'CMU1!%ry S V QF^N*t\F`EgXuKU00x,R=h
<{?M&~0R
=xt9nr3 FV < s-i" 0 %Ng
)a)ߵ=vԢI>D+K ,_G4 ~q㓀K_w?
7-%\6 )>j42|y # 0Fn=0ab;8jF)rM"&FSq + YQ- Ptf0^8U eSDdcx!ؚ 4|TahHd>b=+K v[x3Q*Su{9} P[猤
.H+۟ .9+vP[>!Vɻ~i>Z% ]sPo^sARj=p7h Ξ瀩4YHB" ]9'OmHHP:k7l
K6wȻ~CqBJ s@S QX0 ֣hy_]{sdՈnb-7vvk[
3 ~2g ͠`m}.nlREH C
Va ixm
k: Mc%$AnY
9(fznsV %AjF##/7׃BA8j0Dwˎ˟c~5qbO%X#QU"d_AD;b!sqIXK68vDS=qHRsHqmkd[h(ՙaxD܂guq(eRqpoR*C[Yf"[KF4Ppy]dL H'h H闫3/um2Һè`1gbFKz 8z4^;O ,lBn"=a{7 7OF͞}HSNq(m/4j_#PHyuctR_wfȘ!6o6 3-mv#L?Tz${=e6 n68b56v/MP H,:۴Q".\oZeX7R
! =\eVMl4v>@jB
sg
۽ͱ>*F'Eў>1ZP-Db=m2_v4\H]oI2_~Cf0xH4dRH 8,Te E~cEco &3n.,!ew} x8^jdKT& LydI܃a>:Kk-,U$8˛
6K}i~Vc
KXS wB5D9tWٺmc 0'C<cXηH7 ȜJ˘0@Z 9>?v)?D*^w>Z Q},ᴽptfbqG.|aW( dk,Qymҥi { x+5D=tx
ēoJO+Y[x߽%a,7B,g4sMpG#SLrsocx# +?|5Jϙ?"R#?qMS "
ߚ>'"c/j.:{j%˗ҟO F˾2чoA׆zdYQ`6Y{,,A`$( ݥvǹ*on`d/1I KX~K5խEY, N&4HS#jٓc/3FxZ;+<̛gS D3K){0mDPV"ONK˦gsvV6vêa9Ο
4yIz1rIPgT ]oKIjA!td:egnvzJ r#й݇l}+wNḩDMbW:MY'_} Ůrx& K]Fzm+'BWBLGP$Vao1L5K& |Sg^,%BN^o lL! Ჶ+(>*W$""tis.U(3N#^/L7L'P_n:W434:@({K}Ob=k ?by7uUv>ꐸ&v6BE9=-tC"3
^V
T(3Kݨ_{\HY_T2vFc.^1mµLV7ZJ4@@R#jIޡr;B4Λv aʘ䔝oCaѭL}'g ӘE?;xGl7]X `z-|;;A?y(N
㳫DEaCo2 1QԱ<pAp,xnt]]?5T+_½\2 5sAA*FGayYdUw=[0<9&eѻ
U a!}^yQ&o"j + /Dd=~x"pƧ;:2.uwr,nUb$;,1!! n|p*ikadtVDNJYc
}Z\Ʀ ,)E
A)ncJHuQ̲;Q↋
*6=><5./N5r\Kƶߣ_
cmqƖ2ZBHMoFGɄAbT#7FKݱ0ΓXAMfu{x ̒w*rY ~{Ʋ*
@=]
Y(?7t g#`r<Wǰ,+3
UJ-#0u¤vl?pJ o뵵ްz%1m^ɝTeEj8TgE]@ ]JHHɿ5an`%mH%cKBZ]j"ͱ;zK_B`JV{ +یpF9YnfI^oDS&0%70otI5+ڸn<'Tw<o1 Oۍ=OR1<5m (}t㶵a\\( G M3i`#P:pUP\)wï֡Gu܂T&t,! .06r BqKs# M(*rUf `ĴLgޯIEDr+3Q%].&$Qs_ԐJs eSnB+#kQkŷi@qtF?8?JGXdPOrﮪ*ZT{Ts D15\.CMhP%{u!fJĆLJ$Anɍ H| j\FNHA;9C( Cu>"&%Rtyn 82K\ dם23 1Fwk-(+[ TgPS
0x,.mGh8 Nˇװ^/T 5^V ejwB okf&+N 3p>FCMڮEs T#QRtJ"x6Fm%۷f "O+ߞEW;q131{.1z\ZNҊ*!/N ~#x3,XGEGקX5x0+ E\F" <<!Ȃ\NS"y)pja^ŐZA"tӫuTXR3^00.AHV
#y5 8qWQ'ENV{qgr-8}[zP@ V)Z# z
ob4tjȃ3 >y X·^Ap=U RTb] K\zyd fu r=
J \U 0촗Xx? q kz+m~sCӀ_N1sk\>qTJL`drQ'7"kK
WG<]ś(Ǽp\5W'QN
aO%sCf3ع8đV
4X)넾qK /gQJ .)0HkG7qBO-{ sF{#Tg ֥DT JYfMr- 5mk&jgcuz.]jo&/
! ${+V88K]+ kal\,r*Q. Q+")w*L"̑ÔAUIƲ6 T ތ@ `̉(:crb D$3> E8|KW5yЗh!ucywD-^_$f%P#5|YQ z%-RΗ/;,Wg\aB|uz
@6H}r¬֛֜*I
8ǹp
Lrgd8E*!@24@1QJa"l>/buyݐ0o%S ~@z5`(GTGDl Mc iTJ%s̲Utj~b#RC0@ *7 1ޝ"1Ue4@oI5#~9v֔0,O@,Mi ˗f/?2 `X kY "1*%/
q7 a-lO`|D%MM0jx!@1) x*f գKDKA] "*w\IōTDQ _PO ѿۊ%Mp:(xrV'|}VcC<yv ũ3ѧ@ DQ@+w3~s1b p`| ^IݖNp 7*ً# zRG,?1lf"$a9Fr.^֜rK7|-_Lͧa G3^fc MJؾ9ҙmYL ^#NJ I qox( rlI/
ő@oOmEZ'WO-} z3GgU WA ax k"U R9`k<eEFQ J R B*;֡ξzh#UgIC`#9
a2zFh?q^U\" iU9d)5wb+arh8dGlnhty1K n|WuIl!:.v<" "X,wxE3.8d>|HW,J5<3 (g$8So0$K z;:͗IM73&mTf7\>h%_O&R(%n
</jaͬu-()l>Z @ gxX_ޢ ZòKfk a%Go R'>oI&!+3v}%EYz)*k|x᛬hsYPFj9G5Tݢ S\AdNN2[
_"f
@ގU}/FGz3QfF@ نtk+Iag=@}Oh 3 A)}*R ʨW9 -Q[SáD,Θ3(roN Ozݻ|}J>_Ha3- ET}^>&sV$<1V]:mYd _H<
3a䶇H[B)dQJ
d*iXɐ$FEd~$7r PkJ/cŀ¢# Sݠ#Sƃ@3%tlM<jK=t2b>kzGmsl da>#dD-dǕ˔HOvH3H/W0[wA UaK)hf(>ZY B jLAd R \]!2w,^bHl֦oWޢrI-N` .XB Lo̹{J
.[J@ډ\B{1c8s@%'
&oYPQ\a҄3"J<B瀃n Pr5GK1 H7EG
| &wTKBC$!ߵUN}ǖRo[+|tJKix,Ki=T畟,@90j ?KnҚH ]I*bSȑNkzyʵA.}ݍ}ЕVW>H* ; #5Z@;yW[r_;UT^?&(Ǔyo_nq\we &5Vh a
d+Fty4f餉B)k;
yݘ
d7e#E"#ecDɖ -K!(r Y!IJU;T<tiUқuڅ#: ]߾|cW=\:8d0 GrO۔ ]/z+#*@9.?fT\њ 8~@l^$+=_jLNTa8 +b 8B6 8VB*;UW=D?$WaOk2T3GiUnXۤ:6Dir%w'x}Sp&]gqۋzgׄ~Jue|ZT,f,Nҁb?| wY7-ORZE(u ?ts uhF,Mc~%l^OEv[%a4w$&
3c@UK/\RT,Eׄ"w,Yr7,cC+xwۯ"K㰭6ZIiVa,بN $>T'e3;KvXڛH&7ȆTҨ>5ZӽY^67N虖d%ڀϮIJ /e3s3%ɺS^q. <â,"i% =(LƩK!YWZ(}s$͖?T oYEӽF<JW,En$؍!Zgb@6
xfFcIwˬ 3n(Vk"m<Z@LI
|mpGPv-=L8:YhG}0zi++KWr~L^YP[:J[7خjW :*dɆ%,=Ζ.
6f;AQ,il{tJ(ʪQ}bQ%@SҹyS .HXyKSk-JvbN#eƻo`2 'PVv9
'Y\q]V)TB~XcXHY%Xu߮8ZicBL_K +2u@ jLrp{ȓAZ9t %FeGK|XiR*TAݍnZrh%:=Q; ,*m`Ǽ[ +OfFbAM
V19p-]w 1ȯ5 {['c
Z4~N"$nw7}r2*-$,L RTXm
G-S?sU>a<|\^@!č ~+lda}P`%[g Y?x
8vnmb)@ _XG0@ J< I ЍQMv.sTwS}?,rCőU&;|㌎]R :#|jDsYS~7Os
5|fK:ᚈI\drߏ#wVTq0J[af)rdt[^aTQIyLINPͩvadԌ#nfH/֙{$ٖgquJl?(̗d gpRQST!On"6_0 P^ճ+#ݏF]]LO1\
ZL;( n',C}(Bn}˪B)QM(=8X& #'-^K \AYgpsgEׇ]>붶`0 `y 6czj1oSE@d2Y0p9X\
u%AKLJGVԾ2vRF%Zi]@AofTrTNtm% jڡZZˣZLK&wÝ ("fW쬧LqR ʬIFM98ԞAY.7W >}*ɑ{ˤ\ wʀSyu^)jL
X`^ <Ik'+= 23cWu;.~iz|mcNe>d6MHJW7o͛>#ueIcL7 9 b~[ }pN8ZOKԠCu1,Hi#7P+0h旛vfY֟@$qOEukCQݾ aWr0 qMZI_!b
\xKcT\JFc>;#:آH@c৭M]X,BzbJ< 2p)v
i|wl_W/4Λta([Tek /3ׅDzPg_-oձX`ruh'qjK`6G9SJ%3'چ{JVF'}d .5+)ep|GOcq7NuqF=g Ԅ$*Noz`IdwwriUt"-:kصB-B'ڼ`Gjy删_ A(l
ݛ*D읽詫U9V8"jϜ] R"d֒e"A) %`ق@uܞF@\"Έ6}x]`ⴄW8b'"y?+lހ9 Q鬛#_pk ' Yu hD9j We=Ϻ ? P6tt`R{RW:Ya6dĦ h||5\)z&} FN gf*j?`v+ڠ Mg
ˌTJFZ
p-# U $w n㏦o Ezn6!el^^ gI̛4UT2 Lꘘd@^'z"[2;](WnLNJQ 8Ьt NJ0BvZbcDo/(Y|2D}f6ӄ$z#܅QԣBQ7hהÎH]!nbyW ~Lߺ˲Oo" !|gj'j3?} PBL^
llE7R/$x$0,M?/dSN7L
d%|D|ҳx@'e; H|dLA-M]gWʺNA#h۱hq|}ko8OQG 7RMگ=t ()M:ʻ%x7oh'I^m#E$l2Y-tD: \WǺ'IBH<F}c1[QEE FLi͜ss{=zʎbl>_o__4^j3nr9qVK1ÚYqtA̅f!aie٪@7nhbbZVL
^[.a
L"c<IZdlvQk"pZ+|{3n>Eʴa )Q9*XIClK=1OXw .ŽQ ! TD4W`p]w Μsf
V3Ug9)~-U?o%L"S .Mv/`< ~ޞ_?3, <q$|(Z<) uqU:O+?S9ؚISwN57NEK0IMei@epi}xv:c3| [r 6
͙AYy< 'Hd&sQdmͲkF l[P Y˒aI.LAz %Ak~&&C.7}?A7MOp45ngV&خr?W
j*? ~ҝaWe>/cwbs}ľj%;թ;vOT0vΓ٩ ˓).vnЬLߙI Oj=征 &sY'УV itA4X"tm._,g zer.џD]~11s"ۂb}k+ M1"+qTs xz_{u`0f1?y_Nt7.P ^L{ n Hw䓮x
0%b` 8ű YN|u^ݽu~7XAY {m
9м}^{֭ۤU_뗿IJ8JnwrvL-=ˮ>)c:J!6}TuU?O?z{l
rR ܇w,Gni24^uVu#3>
x%0`b~ kw Gm{^oEi h8_j%kRy֬{5K4` V"u+hbKx)WTpy&(8uJB?IPDq>Gf0K['zvghBcxĒA ^f_5<!aluQM
Ac8_ߑ?<8P0 oP`zLO w }-x?c,Xa][?Cmzf xF+D_
O^ޱ #KhG>~x=̿{r~y"&- %qא DW<X# ))/Wws(&ZXC h X A D Q}%
RCu fY #aF0<%+6QCqPˮ1<a=B;'u7 .
l(E!( Jh t9sf@c3̹bY\c%=I!;{nHW_>i'E(=Ơ&if!7ha"_vQ / vxPbh ټ|<# ^גQlTa x648%Pz_1Kw8ZW6뷅w| +eLftDIErRjN y<2IS1a_Tg,lʟb,~':$(]+ސ|N\R!2x!y(L}y{ac?D1A o0 ݶ2XbG.mA,q̱h~w#4N\ -" o4"{Z9 u%z>mGu[cQ6U s#Jϔ LO#cf3}hhx>W" nyQ R9ߴbnu
cДQ˿CNYև!?) YcCU): <dy^\blx9#V_ɛv9zOW]tIbow8$eOS H_e_M/TͳO>exRStQsqYèV^6_b`y9V?Z9,Ԟ܇F ?AuvG"8sT5`ES̳T t/-1.V3M$ fn~ `Y[Er3ss\ PvZϓs:.4lJl h(鿣{}ȆV?8ѧ&Y;NE?-LxfW@=% /yw5Khcu#C>8R+H}%68c4z^ט&e =]>VfL %Nj<1'J>!̰RL.4&N rJ;a]5^ d#Ds"` ro$$;d0iGyC/%
#gw7u3myB%D Lql\/$|gze 3#?dy{\ewՍ۷w~(O&
+ $й}J&3w/1OHǘ'\fbsC}?u?$-A^u͓U2!ral0s OJL^)+J;h~ gP]'
]#7 '$Jv!6Ǎ"1#ߡ?%ۅqz H'fWx/0.J+Lc,eiPZR]WL%1IoRwJ#363A;hhW~" f!G.]20aо?e|z9)'͙")=_*c#{OD2tŷf˜q{sߌo/ dԈ9=d2cB#lBZ |z >L~<QØkO%ZSeV%EڧjޢW<ӥ(y9{隧{ )0~ Z꯫g-CzI { E+'{wjhez4?e @ @ @ S <9;RGFC3 3kzn*zf =:xa\ g`MO?ӇIQY/;u(AVZNSOnVW#= ,_(P KIsMN~ϷY]r&6?s>=!}{"kI w)`O>sFҍR{d̳&Ӭrj[ӝZ(sIf%?lz35r2Qd7<^ !9j}MR~Wl 2r<n.I$/Kzź IؤCd`|J@dž hνDt p p]{fBvOr燘
qM^c$<IJVSnfc:g`ң+Ch|>s' HtC &|s>>">XoCkKaM 3u i] uBA }m6 c!YSbzT[x~.0boNލQlrYN U(}굣 =7i]y"XWiЧëH6TsyM|y+ SX)ܦe9Tw_ZOݝ+O./; j<>^~tW1ͪiv6m`ȶɄ?x|}WWǰq?w?m gb<{^n%"-Wy5ŕW 6qMK1
Jk7[0_Ec.AmB{HO/<8 ++ڍ>nR0l[~{.a~|1 Fz'1nƗ sR]ڎP ))\ժZ7 ]kibl}W: YDrmb,㫜UkILi F Z>ejfkZ/7 <+JE;/Z+Ůx-c38Uxzڽ|g~n.ǁjV]~ 6<`-[jK4odx {oa^)Wi*+Lw?>H=^{>Z* @ @ ~ ݠb)z2|}|л=t~1"hwi6ݛ?PuϺ" E&ͯ STXv ıae_,`w®ZHvz ˢrwLV{乽{ T=[?DS zoRMZƸ4-GM vh*
6y*@27"y·JjЫ=ҝz{Z Cl>MU6/PU ,m`6eV gM::@ֽ {?Tb&Rs]IjAP;AG$~włPvEmIB O PUJ ICde$ءBxBx(k- d<AaiPmn)( Jn'+()
%'-(4|[pq$ @~4$$.P \yIEUx\ P$?`$Y<CI}C@ZZ>ōOп#B$t2@L֫x R[8tٿl CC%x-?=l
o- Q.!Up*@,4%*2A
J4=[)WkbWQ:lRoPak +XLy_AtzRp+xEϚ.*
D_0sSRD/_`d5_pꆳTZRܮt< x SǢ2R )ʋkAy
z0`/R< )t)RXt]0AӤ~.p% {. ZK ^SU[O0.u߭ӐH6"AIrX5zww,Y3:# ͝f2+c3۬QnFuN 9\g*❬33pÍ uK:鈮vs/] I:Ѭu#@ Kw-9YdGl|4OrCQYX fCHV rUهEbaIPFTXSYdl?,YdA:U^9qjU UjgJ+gñ: m
2Vh$2FґdKK,Vxjc2V'WR=@I,VA2V )GQXZ*2 !a7gFLk#YXkA>5RQ /<d ;NɮAlm`e]d=J+g Ì鋒Y*I*"g#c K9&
7cSdx[rZ|Cboq2"aЪ`MA8( rQ 0nd8ºD|nGɑ+
2td+R +95bhajnZ<2TՈU WXZQ2Za>+`衼ļ23f A4JYv@NFH( sED$c-m2
o2VCD'+
2d!刜+HH㬯(
H@,,`A2V8IEGavh5(, K9XXcQ5$cXdYȂdZam|k⮐a EQd0ɍga
"˒Hstj=rn2ZtSэga
"XQªU隻,,A+5wQX?]77f+2
ykVƨ_R^(z=]7M7fAeYXȬU2ی³5+KXgYtHEGavl5_F笯XXQ YKJDΕ:gwӅA9,,Ax!]<@B ,,jAsVXQ
D
D r]ecga "ZŶlAsVҲڑYGw(A @p g -~fy;gJ`$L`
+hSm l4Pcߚgl2@..Cf}k[~eb{!&gzs=0tYJ1Iʵd"F,ut8jdm
KB >ߴyE{2k3C _i0/0R7SU{)hla6+# f$5k3OY]'[,SOL%g @{X12H~mưsڗ%g*5^(dbVvc_X
z<>5 DDƤ~[J,+k/n~%J1ci,bH?LIHɖXoXz<Sq |G)go&mrK 5I֢KN1l"ǂ}& qj ˛cp_q#J˶ lN5\gw?_dR7S)@m.ƽa :qچZuiJvqaՆޔ-4-IB^(c4ѯ\Nа1fec0d k͘.]Vk K+{) ^30_v3ƁK1-ȹZU( M
x.#+ 1Q_0V4 TP08SϑtLW +L/l( Xl%KR6=Nf&7%)KQxҢ푇~;A9ydYjXXfE;A|n v É(tED˃Ɩ[_lqza~cH٭.3W¢+۲M9X|Au|ߦLmrL}}LZcsH[bN 4$N<B<&]^z0& #\cNozi: [HVL!^s>%65һqr)~5&H
H1:Z7"8l71ZRx/a\7[vf#dGYY1miQ\+V]$|~[r>Qc˿u.ocquB>} >ZBPCku+]{[Tmb+ o|i7oHCJ7GY#,YSX h[m[?K-[+́\ssDDj`L8;7N1Cq
H~2
(퍛 ;Huw%CfM7QJ .o0Mi__N]3U Cm=߆eHJ8 fS\҃;X pZIfMD.<CoτKT pk6Mᘬ( 7d/_ZU=l K9-wW H(RTDڞx:7 =E
|u9ɾD[ozܽ <=J.,mlxGz´Y fCǤ=CwТb9N[%\
?R Ը$Kr>ti÷o.2"C<KkMt՛K馊&㱎;j2ä|9S)&qj7ľG֙_ɿk:T`3 `E{)奵)J#>V*xxN_u*$oT\5WCihâLzw*gu^:q-vi?pgױ\ ϝ IWiޞa7H6AKawaɘ^A\Cn
=;wp[3q ƲT:`Z5tccf*.1LCӐgW RF'TrwLi(g;9ޒn ׳UQDda;v8 , Ҟv +\@ROВwpjSTNA]Y*}.QT.ǟ)ݞH
>"JaT8ZJ ^TU覞C$#M I՝3%g!rMJZ|l n;h ص;~=H\]J|]h{
*_QS`*EN{4 M,fup nHѐ˅Tfz20z` 8#_63TOCRmXho\{;'蝍6P#o z<l`gluW agDx\z;+boIv O9'8gD":'`(gpp6O7'a)oHwS/^Gx fxٞn6'r`6Zm'. y=Q`l<WsD[jAz 6j' dv'vd゚:Ե' $٩Gx"l< 6DHO$+ Rtf8x"<Al( Ɖf_-xl<ꮿ7ͷv%,pAruzS0L86Pj:5C.9/ Y˰xY<]G?\ i[QךdנW 0áH%ttNfGP֤(\ ʶP hsM *oM5%d# s4]0(OZZrLK:E/DD16GuCA]\ fkL# Ps5a% %X1 1ɐZV$WB:
M%Ġ5 د`8hdI
Od(5znr$JPkY SB[!~IΤ&
W
t%4YRWBMҒ
p;P*)ɒ y
3 4" ^P2GDg}DD| raUjRXQP 2L*@>zI|B4Jh #Ҡ D8 |wcr)S!KBeYH:dGnKH)Vr`MGcG;+;9_~Y=CX;%),V "[ｙvEUn1@;,%0EDh : Ax cX8L8w1&</r6G8]o!\!g _Cʴc,|ݕ
&cRڋBeB *Fq40ܖ|EciF Hn9i9{qR+C+;h_9BXqcyZ>s-&I9 D;đi,N&]taHctcc ,31C ~떶"fCۯ}_K| [Ed_aa6suy` d/D'Jl` Ĵ* aF=QiMN 1dL,!)h X&] uR; MYjwو~ X'ĀWyZ, nBJ L: 8NS.ALp44J(IA\S#C x0d8ƈUODLw(rY3MDYIIaX$<g Щ #KH.Nm z #C1p?H_q9h(MY*K3]:Ii#7
r.i4gG,'Mlj r(N&H|/NoNZ xqʛ>bCDlBY,ޝ|
MZ'? ϦjnF(/N&
)11sO, g .fM씗>^lzȨR5 a-Ed JCqx$˹S #u|jt( ʹ 771vg@O&}Hp)GQlaD!Pg x#l?{ dv橪4Ý9"|r3)Ċ ~J'N (. }Ycq+akDfx_\X ZOk[ ]ltKCĦԈU[\vQXqP?,_;TįC u&-` xσ2c<McTB!ɲ HȌuU< cRM^[-SxJ o#Τʵ6$.)GPkh!!2{4 cTLz5 σ'Oa+tM=ھ
+ѧ
k@z++;rNvqtђtl'qQQ#ڷfg4YSYC
F(]0Vѓ/F tEDH+7Si z"i'x#%cx"VMlW$ hIB$.ԑ3JEv"4w ubQ/U^>.lj:| ͩ<-<y.N%N <%[dkZpx25=m'(~'<Υ &-wxwzNKۍt4-
Ǔ='SƔ 9NNz$j&RPH2'&(w#ᏞR:
!<F~H~{;B'ՙXyJ ㉷ %LT9 e s}INR>S^Ut {9{]ތ Ќ h4 .$jRҋ7e
j}*n
iqP,NM4vU"PjI bfmw|gWb!L|Z&g|[Tvy}g^ CZ e~s<PG}TĸA.%I*PxW['1;
GGAcrT *[iҊ*V5T Ŏ zU?4]Ԑ F#U FN]$z =ՂJXѢ2ޭ"QYX i~ )Θ4i苅0-V])ٵ?i% `i@=ľ$<ǥ#/0@{@8,L 5rՕ¾,J"ʲ{42a3=Y Y["ΐdNFp\REt{ `<N^C9(UWӓe#0 UF;ony
)qib[ȥfB2qo~bH5l^;l ( bF 8(=Rb2 yV,M>4>Pj ~9G5B&v˒#F$
hbDjEҁ9q"∪ьI5G9 9V,\'>*9%KF{<d~ZZ(^[KRqI)'F7n'ފL⮐e~:P4Tf栊^\sGH 8RӤ#c7 -Bdž"?+KQT 1J5dr/Z ZE%8bŖ
;<Q\YiK sav'AN^ 8!2xKA XA=燘x<q_}"$$
2J_!Jd$+l!e@&Їo \Sɠ%4P Z1_Qo3j8P L/\p1,.t$;1@ =h+ CjYʨȧ$vc#R'
<D|⦪{(Hz`i"_Xk7"z% z34ៃ5鲋EiH2عyֿ 'WW>f9&٫5oNry*
Q̓+!I_m 5zڍؔ$Kd<d͋K3!E?TD5GᄬT$@,C'HȪ⣘`Vqj!=F;R g6dPYžu}DI/B1 p! 0F$Շ%Z tO0#~DtQ]l"͑YjoA ܫjhY[fnz ƈGB{E,1[rc )^K j÷<nJZ<{x&fV*:裧hǗ"LKI\;JD7,Q+6}E >ʻ+ zQV|h}[rWFڥ0m/g5Kqnf/.L>*Lvkq\R9"dAk=
P}l<gu;uT\\-i-_ï9Yݹ멃M?74-KYinyPh&+-"0î lR4+RӸŔe"1 +5ri1ovޓLZA6"5xF5c^O
k: jKMsC1I6E
]iNLLq:7%Il d)PK<TjzܳT*xSSk HBȟVaUw.ӰɰXZDB_2M\vӔ#2l.B'{2?P1ޯvR'C^f+oǹ~ݬs=jeOkVދ,w*Nڭ ^8ڬ/Bś&7zAӷ짵{G쯬nvi ̒BE~۶M(jʆ.U|ƺϾPf{mxK^͇\_JWps.pJX&. ܇%kfro nZ5K R]ΡpFwy"ٍrįOYS8b:ٕO r)=,cb-ίj2k a ulc۟u`}[cRw
'\ -6J7oĪEQwyKb
Ӝ}iaٜZSmn2Qfoŧn##:jO ^aϷz^sܢ c4O6s]R8Es
b U| gƹ_IgsZz*wH_0fFֆ{ohsh\mih(4IoCqN?OWs{-K-r)tno
NhzQ7+lzavtqʛV7Ϟ8gRlfu.o _w߲5 2`{b*bmbzunDSXds)
apn &%*f)X|[O~[# UQS]=D0=v^/#Uz_ =gLܫɑԀ^; b}0unU@PF!g@v0
?wq0(W as`W0<N ǒ
*]/hg
(#17s)
b'Va!%&`QၵF/e)do 6-|̨ q¾ f#N*Q + pd" ^ZR8<$i# ƄY(8 ߐShË5LT "
净LxM4)I: 20T;|hcM> Lj!9KwՄpm0,P(c)sUW7'F* ȳ;.gLeÈOrVWk!m# Ckzymh9~kjPnvCeoj iC{_mpqH!κ WYtؖ$"f=CpPP|щcI 1^!c2FT6!EAn#/*F\Ռ4!W'= 00_>D_2]ByFgdO\ߑQ>S0DP!З,ڭ_ QHLf Ox#uQV D>A JM 2L8<}\ |R,E ʷG*ku ʷ3DTK%s^CZNef1\k>n 7\Vj%q ]P~z#
G,v*ޗ '2owy(=3jOӧm-d >!dPv^~X?RO lõ -zB~ lHw eϫd}~uڴ^e& v, c0 Gcz2$\U^ 'g~Szદuo9 c$}qEuMO6tBoFv_b/ "߉g-j*ˑ~Z" X){q[5\Ő Bp m
RfZPv~rXQTΥom qw6FC-J㵍cf\\Zq_*X3qBT
4 `0 0` `0 0` 0 ( Y D p t& e x 8 v' -