How to Configure IPsec Quick Mode Cryptographic Sets in Windows 11 Using PowerShell

In high-security enterprise environments and zero-trust network architectures, IPsec connection security rules secure data transmissions between endpoints. While Main Mode establishes the initial authenticated and encrypted management channel between hosts, Quick Mode (Phase 2) negotiates the actual Encapsulating Security Payload (ESP) algorithms used to encrypt and authenticate operational network traffic. In Windows 11, the NetSecurity PowerShell module provides granular cmdlets to define, inspect, and enforce custom Quick Mode cryptographic sets, enabling network engineers to mandate robust cipher suites like AES-GCM while retiring deprecated algorithms.

Understanding Quick Mode Cryptographic Sets

During IPsec negotiation, Quick Mode establishes the Security Associations (SAs) responsible for protecting individual IP packets. A Quick Mode cryptographic set specifies the ordered list of cryptographic proposals that the Windows Filtering Platform (WFP) presents to or accepts from peer endpoints.

Each cryptographic proposal within a Quick Mode set defines three fundamental attributes:

• Encryption Algorithm: Encrypts the payload to provide confidentiality (for example, AES-GCM-256, AES-CBC-256, or AES-CBC-128).
• Integrity and Hash Algorithm: Protects against packet tampering and provides message authentication (for example, SHA-256 or SHA-384). When combined cipher modes like AES-GCM are used, integrity is integrated directly into the algorithm.
• Key Exchange and Perfect Forward Secrecy (PFS): Forces independent Diffie-Hellman key renegotiation during Quick Mode renewals to ensure that compromised master keys cannot decrypt historical session captures. Supported groups include PFS2048 (Group 14), ECP256 (Group 19), and ECP384 (Group 20).

Creating explicit custom sets prevents Windows from falling back to legacy suites like DES, 3DES, or SHA-1 when communicating with external firewalls or branch gateways.

Creating a Quick Mode Cryptographic Proposal

Before assembling a complete set, you must define one or more cryptographic proposals using the New-NetIPSecQuickModeCryptoProposal cmdlet. This cmdlet specifies the specific combination of encryption, integrity, and key lifetime parameters.

Launch an elevated PowerShell prompt by right-clicking the Start button and selecting Terminal (Admin). To create a modern, high-performance proposal utilising AES-GCM-256 with Elliptic Curve Diffie-Hellman Group 19 PFS, execute:

$ProposalGCM = New-NetIPSecQuickModeCryptoProposal -Encapsulation ESP -Encryption AES256 -Hash SHA256 -KeyGroup ECP256 -LifetimeMinutes 60 -LifetimeKiloBytes 10485760

If your infrastructure connects to legacy appliances that require CBC mode, define an alternate proposal as a fallback:

$ProposalCBC = New-NetIPSecQuickModeCryptoProposal -Encapsulation ESP -Encryption AES256 -Hash SHA256 -KeyGroup Group14 -LifetimeMinutes 60 -LifetimeKiloBytes 10485760

In these commands, the -LifetimeMinutes and -LifetimeKiloBytes parameters govern SA expiration, triggering renegotiation whenever 60 minutes elapse or 10 GB of data has been transferred.

Assembling the Quick Mode Cryptographic Set

Once individual proposals are prepared in memory, link them together into a persistent Quick Mode set using the New-NetIPSecQuickModeCryptoSet cmdlet. Proposals are evaluated in order of preference during the IPsec Phase 2 handshake.

To register the combined set containing your primary AES-GCM proposal and secondary fallback proposal, run:

New-NetIPSecQuickModeCryptoSet -DisplayName "Enterprise-HighSecurity-QMSet" -Name "Enterprise-HighSecurity-QMSet" -Proposal $ProposalGCM, $ProposalCBC

Windows 11 registers the object within the local security policy store, assigning it a unique identifier accessible by connection security rules.

Auditing Existing Quick Mode Sets

To inspect all configured Quick Mode sets across the system and verify their proposal rankings, use the Get-NetIPSecQuickModeCryptoSet cmdlet:

Get-NetIPSecQuickModeCryptoSet | Select-Object Name, DisplayName, Proposal

To view detailed cryptographic parameters for a specific set, expand the nested proposal collection:

(Get-NetIPSecQuickModeCryptoSet -Name "Enterprise-HighSecurity-QMSet").Proposal | Format-Table Encapsulation, Encryption, Hash, KeyGroup, LifetimeMinutes

The output lists the exact encryption mechanisms, hash algorithms, and Diffie-Hellman groups bound to the set, confirming that legacy protocols are completely excluded.

Binding the Cryptographic Set to IPsec Connection Security Rules

A Quick Mode cryptographic set remains inactive until it is associated with an active IPsec connection security rule. You can link your custom set to an existing rule or bind it during the creation of a new rule using the -QuickModeCryptoSet parameter.

To associate the set with an existing rule named "Secure-Branch-Traffic", run:

Set-NetIPSecRule -DisplayName "Secure-Branch-Traffic" -QuickModeCryptoSet "Enterprise-HighSecurity-QMSet"

Alternatively, if you are provisioning a brand new connection security rule that enforces mutual computer authentication and Quick Mode encryption for a sensitive subnet, execute:

New-NetIPSecRule -DisplayName "Database-Cluster-Isolation" -Name "Database-Cluster-Isolation" `
    -LocalAddress Any -RemoteAddress 192.168.10.0/24 `
    -Protocol TCP -RemotePort 1433 `
    -Requirement RequireInRequireOut `
    -QuickModeCryptoSet "Enterprise-HighSecurity-QMSet"

Traffic matching remote port 1433 on subnet 192.168.10.0/24 will now mandate an established IPsec SA adhering strictly to your defined Quick Mode cryptographic proposals.

Inspecting Active Quick Mode Security Associations

When communication occurs between the Windows 11 host and the target peer, the Windows Filtering Platform negotiates the Quick Mode SA. You can inspect live active SAs in real time to verify that the desired cipher suite was chosen by both endpoints.

Execute the Get-NetIPSecQuickModeSA cmdlet:

Get-NetIPSecQuickModeSA | Format-List LocalEndpoint, RemoteEndpoint, EncryptionAlgorithm, IntegrityAlgorithm, KeyGroup

A successful connection will reflect AES256 encryption alongside the negotiated key group (such as ECP256), confirming that operational payload traffic is protected with modern cryptographic standards.

Modifying and Removing Quick Mode Sets

If network security policies require updating cipher parameters—such as phasing out CBC fallbacks entirely—you can update the set using Set-NetIPSecQuickModeCryptoSet.

To enforce an exclusive AES-GCM proposal and drop fallback proposals, generate a single new proposal and overwrite the set:

$StrictGCM = New-NetIPSecQuickModeCryptoProposal -Encapsulation ESP -Encryption AES256 -Hash SHA384 -KeyGroup ECP384 -LifetimeMinutes 30
Set-NetIPSecQuickModeCryptoSet -Name "Enterprise-HighSecurity-QMSet" -Proposal $StrictGCM

If a set is no longer needed, first verify that no active IPsec rules reference it. Once dissociated from all rules, delete the set using Remove-NetIPSecQuickModeCryptoSet:

Remove-NetIPSecQuickModeCryptoSet -Name "Enterprise-HighSecurity-QMSet" -Confirm:$false

This automated PowerShell workflow ensures your Windows 11 fleet maintains strict cryptographic compliance across enterprise networks without manual registry adjustments or legacy GUI navigation.