How to Configure IPsec Phase 1 Authentication Sets in Windows 11 Using PowerShell

In modern enterprise networks, implementing zero-trust network segmentation and securing internal communications against lateral movement requires authenticated, encrypted transport channels. In Windows 11, IPsec (Internet Protocol Security) connection security rules enforce mutual authentication and cryptographic protection between domain workstations, application servers, and management clusters.

Every IPsec negotiation consists of two distinct phases: Phase 1 (Main Mode / IKEv1/IKEv2) and Phase 2 (Quick Mode / ESP). Phase 1 establishes an authenticated and encrypted management channel between the two endpoints, verifying their identities before Phase 2 negotiates the security associations used to encrypt application payloads. While administrators can configure these settings through the graphical Windows Defender Firewall with Advanced Security snap-in, PowerShell provides declarative, scriptable control over Phase 1 authentication using the NetSecurity module.

Understanding Phase 1 Authentication Mechanisms

During Phase 1 Main Mode negotiation, endpoints can authenticate using several independent or tiered cryptographic credentials:

• Computer (Machine) Kerberos v5: Uses Active Directory domain credentials to authenticate domain-joined computers automatically without requiring PKI certificate deployment. This is the standard choice for internal enterprise domain traffic.
• Computer Certificates (PKI): Authenticates endpoints using X.509 digital certificates issued by a trusted enterprise Root Certification Authority (CA) or commercial intermediate CA. Essential for non-domain workstations, cloud instances, or cross-forest federation.
• Pre-Shared Key (PSK): Uses a shared static secret key. While easy to configure in test laboratories, PSK should be avoided in production environments due to key distribution and rotation vulnerabilities.
• User Authentication: Second-tier authentication (User Kerberos or User Certificates) performed after the computer identity has been established, enabling user-specific firewall access restrictions.

Auditing Existing Phase 1 Authentication Sets in PowerShell

To inspect currently defined Phase 1 authentication sets in Windows 11, launch an elevated PowerShell console and execute Get-NetIPsecPhase1AuthSet:

# Query all configured IPsec Phase 1 authentication sets
Get-NetIPsecPhase1AuthSet

To view detailed properties—including proposals, authentication methods, and associated certificate authorities—format the output as a list:

# Inspect specific Phase 1 authentication proposals
Get-NetIPsecPhase1AuthSet | Format-List DisplayName, Name, Proposal

By default, Windows defines default authentication sets that prioritize Computer Kerberos v5 for internal domain communications.

Creating a New Phase 1 Authentication Set with Kerberos and Certificates

To build a robust Phase 1 authentication set that supports primary Kerberos authentication with certificate fallback (ideal for mixed environments with both domain-joined and standalone remote workstations), use New-NetIPsecPhase1AuthSet alongside New-NetIPsecAuthProposal.

First, define your prioritized authentication proposals:

# Define proposal 1: Computer Kerberos v5 authentication
$propKerberos = New-NetIPsecAuthProposal -Machine -Kerberos

# Define proposal 2: Computer Certificate issued by enterprise Root CA
$propCert = New-NetIPsecAuthProposal `
    -Machine `
    -Cert `
    -Authority "CN=Contoso Enterprise Root CA, DC=corp, DC=contoso, DC=com" `
    -AuthorityType Root

Next, assemble the proposals into a formal Phase 1 Authentication Set:

# Create the combined Phase 1 authentication set
New-NetIPsecPhase1AuthSet `
    -DisplayName "Corporate-Hybrid-Phase1-Auth" `
    -Description "Prioritizes Computer Kerberos with Enterprise CA certificate fallback" `
    -Proposal $propKerberos, $propCert

The cmdlet validates the proposal order and registers the authentication set in the Windows Firewall policy store.

Binding Phase 1 Authentication Sets to Connection Security Rules

Defining an authentication set alone does not enforce it; you must bind the set to an active IPsec Connection Security Rule using New-NetIPsecRule or Set-NetIPsecRule:

# Create a connection security rule requiring the new Phase 1 authentication set
New-NetIPsecRule `
    -DisplayName "Secure-Database-Traffic" `
    -RemoteAddress 10.20.50.0/24 `
    -InboundSecurity Require `
    -OutboundSecurity Require `
    -Phase1AuthSet "Corporate-Hybrid-Phase1-Auth"

Any outbound traffic originating from Windows 11 destined for the 10.20.50.0/24 subnet will now initiate Phase 1 Main Mode negotiation using your custom authentication proposal hierarchy.

Updating Existing Phase 1 Authentication Sets

If you migrate to a new enterprise Certification Authority or need to update authentication proposals, update the existing set using Set-NetIPsecPhase1AuthSet:

# Update proposals on an existing authentication set
$updatedProp = New-NetIPsecAuthProposal -Machine -Kerberos
Set-NetIPsecPhase1AuthSet `
    -DisplayName "Corporate-Hybrid-Phase1-Auth" `
    -Proposal $updatedProp

Removing Obsolete Phase 1 Authentication Sets

Before deleting an authentication set, verify that no active Connection Security Rules are referencing it. Once unlinked, delete the set using Remove-NetIPsecPhase1AuthSet:

# Remove an unused Phase 1 authentication set
Remove-NetIPsecPhase1AuthSet -DisplayName "Corporate-Hybrid-Phase1-Auth"

To execute deletions inside automated deployment scripts without interactive prompts, append -Confirm:$false.

Configuring declarative IPsec Phase 1 authentication sets via PowerShell ensures that Windows 11 workstations enforce strict endpoint identity verification, providing foundational protection against lateral network threats across enterprise environments.