How to Configure IPsec Task Offload on Windows 11 Using PowerShell

Internet Protocol Security (IPsec) provides robust network-layer encryption, integrity verification, and authentication for virtual private networks (VPNs), domain isolation, and secure corporate server communication. However, performing cryptographic operations—such as AES-GCM or SHA-256 calculation—on high-throughput connections demands substantial CPU processing cycles, which can introduce latency and throttle network bandwidth. To alleviate CPU overhead, modern network interface cards (NICs) support IPsec Task Offload (IPsecTOv2), shifting encryption, decryption, and security association calculations directly onto dedicated adapter silicon. On Windows 11, administrators and engineers can inspect, enable, and fine-tune IPsec Task Offload using native PowerShell cmdlets.

Understanding IPsec Task Offload (IPsecTOv2)

When IPsec Task Offload is active, the Windows TCP/IP networking stack delegates cryptographic processing of encapsulated security payload (ESP) packets directly to the network hardware. When sending packets, the NIC encrypts the payload and computes message authentication codes (MACs) at wire speed. When receiving inbound traffic, the NIC decrypts packets and validates checksums before passing clean payloads up to the operating system kernel.

Windows 11 supports IPsec Task Offload version 2 (IPsecTOv2), which accommodates modern cipher suites including AES-128-GCM and AES-256-GCM alongside IPv4 and IPv6 traffic. Offloading these cryptographic workloads reduces processor utilisation, minimises packet jitter, and allows high-bandwidth connections (such as 10 GbE and 25 GbE links) to sustain near-line-rate throughput.

Verifying Hardware and Driver Support with PowerShell

Before configuring IPsec Task Offload, ensure that your installed network adapters support hardware cryptographic acceleration. Open an elevated PowerShell session (Run as Administrator) and query the offload capabilities of all network adapters:

Get-NetAdapterAdvancedProperty | Where-Object { $_.DisplayName -match "IPsec" -or $_.RegistryKeyword -match "IPsec" }

To inspect general hardware task offload settings across all interfaces, run:

Get-NetAdapterHardwareInfo | Select-Object InterfaceDescription, DeviceType, LinkSpeed, Status

If your physical adapter supports IPsec offload, the driver exposes an advanced property such as IPsec Offload or IPsecTaskOffload. You can query its current operational status using:

Get-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "*IPsec*"

The output reports the display name, registry keyword, and current display value (typically Enabled or Disabled).

Enabling IPsec Task Offload on an Adapter

If IPsec Task Offload is disabled by default on your network adapter, enable it using the Set-NetAdapterAdvancedProperty cmdlet:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "IPsec Offload" -DisplayValue "Enabled"

Depending on your hardware manufacturer (such as Intel, Realtek, or Marvell), the property display name may vary slightly. To target the setting reliably using its driver registry keyword, run:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -RegistryKeyword "*IPsecOffload" -RegistryValue "1"

To confirm that the setting has applied successfully:

Get-NetAdapterAdvancedProperty -Name "Ethernet" -RegistryKeyword "*IPsecOffload"

Configuring Global TCP/IP IPsec Offload Settings

In addition to per-adapter driver settings, the Windows TCP/IP stack maintains global registry configurations that determine whether IPsec offload is permitted operating system-wide.

You can query the global IPsec task offload registry parameter in PowerShell:

Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableIPsecTaskOffload" -ErrorAction SilentlyContinue

If this value is missing or set to 0, the TCP/IP stack will not delegate cryptographic tasks to the hardware. To explicitly enable global IPsec task offload, configure the DWORD value to 1:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableIPsecTaskOffload" -Value 1 -PropertyType DWord -Force

Monitoring Active IPsec Cryptographic Sessions

To verify that active network connections are successfully leveraging IPsec protection, inspect the current Quick Mode and Main Mode Security Associations (SAs) using Windows Defender Firewall cmdlets:

Get-NetIPsecQuickModeSA | Select-Object LocalEndpoint, RemoteEndpoint, EncryptionAlgorithm, IntegrityAlgorithm, KeyManager

To check cumulative IPsec packet statistics and detect whether packets are processed without errors, use netsh through PowerShell:

netsh ipsec dynamic show stats

The statistical report lists:

• Total Packets Received / Sent: The volume of network datagrams traversing the IPsec filter.
• Offloaded Security Associations: The count of active cryptographic tunnels actively running on adapter hardware.
• Integrity Failures / Decryption Errors: Counters indicating whether dropped packets or cryptographic mismatches have occurred.

Disabling IPsec Task Offload for Troubleshooting

If you encounter dropped packets, VPN connectivity issues, or firmware anomalies after updating adapter drivers, you can temporarily disable IPsec Task Offload to verify whether hardware acceleration is the root cause:

Set-NetAdapterAdvancedProperty -Name "Ethernet" -DisplayName "IPsec Offload" -DisplayValue "Disabled"

Alternatively, disable it globally in the TCP/IP parameters:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters" -Name "EnableIPsecTaskOffload" -Value 0

When disabled, the Windows kernel processes all cryptographic routines via host CPU instructions (such as Intel AVX-512 or AMD AES-NI), restoring connectivity while isolating hardware driver faults.