How to Audit IPsec Cryptographic Suites in Windows 11 Using PowerShell

Internet Protocol Security (IPsec) is a core cryptographic suite used to protect communications across untrusted networks. While standard firewall rules filter traffic based on source and destination addresses, IPsec rules enforce authentication, integrity checks, and payload encryption. To prevent weak or compromised ciphers (such as DES, 3DES, or SHA-1) from being negotiated, system administrators must regularly audit active cryptographic proposals. Windows 11 provides dedicated PowerShell cmdlets within the NetSecurity module to audit Main Mode and Quick Mode IPsec suites.

Understanding Main Mode vs Quick Mode Cryptographic Suites

When an IPsec connection is negotiated between two Windows endpoints, it establishes security associations (SAs) in two distinct phases:

• Main Mode (Phase 1 / IKE & AuthIP): Establishes a secure, authenticated channel between the two negotiating hosts. It defines the Diffie-Hellman key exchange group, integrity algorithm (e.g., SHA-256 or SHA-384), and encryption cipher (e.g., AES-CBC-128 or AES-CBC-256).
• Quick Mode (Phase 2 / ESP & AH): Establishes the operational security associations used to encrypt and authenticate actual application data packets. It dictates whether Encapsulating Security Payload (ESP) uses modern authenticated ciphers such as AES-GCM-256 or legacy CBC combinations.

Auditing Main Mode Cryptographic Sets in PowerShell

To inspect active Phase 1 cryptographic proposals configured on Windows 11:

1. Right-click the Start button on Windows 11 and select Terminal (Admin) or PowerShell (Admin).
2. Run the Get-NetIPsecMainModeCryptoSet cmdlet:

   Get-NetIPsecMainModeCryptoSet

3. To review proposals in a readable tabular format:

   Get-NetIPsecMainModeCryptoSet | Select-Object Name, DisplayName, Proposal | Format-List

4. Audit the Proposal values to verify that legacy algorithms like DES or MD5 are absent, and modern key exchange groups (such as DH Group 14, 19, or 24) are enforced.

Auditing Quick Mode Cryptographic Sets in PowerShell

Phase 2 Quick Mode proposals dictate how data payloads are encrypted on the wire:

1. Execute the following cmdlet:

   Get-NetIPsecQuickModeCryptoSet

2. Filter the output to inspect specific encryption and hashing proposals:

   Get-NetIPsecQuickModeCryptoSet | Select-Object Name, DisplayName, Proposal

3. Verify that proposals utilize AESGCM256 or AES256-SHA256 to ensure compliance with modern zero-trust enterprise security baselines.

Inspecting Active Real-Time IPsec Security Associations

While crypto sets define configured policy, auditing live SAs verifies which ciphers were successfully negotiated with remote peers:

Auditing Active Main Mode SAs

Get-NetIPsecMainModeSA | Select-Object LocalAddress, RemoteAddress, PeerId, SelectedProposal

This displays active peer identities and the negotiated Diffie-Hellman and encryption parameters.

Auditing Active Quick Mode SAs

Get-NetIPsecQuickModeSA | Select-Object LocalAddress, RemoteAddress, SelectedProposal, InboundBytes, OutboundBytes

This confirms the active payload cipher and monitors data transfer volume secured under the tunnel or transport connection.

Creating Compliant AES-GCM Cryptographic Baselines

If legacy suites are discovered during auditing, replace them with modern hardware-accelerated AES-GCM suites:

# Create hardened Quick Mode Crypto Set
New-NetIPsecQuickModeCryptoSet -Name "Modern-AES-GCM" `
    -DisplayName "Modern AES-GCM Suite" `
    -CryptoProposal "AESGCM256"

# Create hardened Main Mode Crypto Set
New-NetIPsecMainModeCryptoSet -Name "Modern-MainMode" `
    -DisplayName "Modern Main Mode Suite" `
    -Proposal "AES256-SHA384-DH19"

Exporting Audit Reports for Compliance

To generate an audit log for security reviews or internal compliance records:

[PSCustomObject]@{
    ComputerName = $env:COMPUTERNAME
    AuditDate    = (Get-Date)
    MainModeSets = (Get-NetIPsecMainModeCryptoSet).Proposal -join "; "
    QuickModeSets = (Get-NetIPsecQuickModeCryptoSet).Proposal -join "; "
} | Export-Csv -Path "C:\Security\IPsec_Crypto_Audit.csv" -NoTypeInformation

Regularly auditing IPsec cryptographic suites via PowerShell ensures Windows 11 endpoints remain protected against cryptographic downgrade attacks and adhere to enterprise compliance standards.