Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a client's PCI compliance. One of the failing items is:

3.1.5. ISAKMP Allows Weak IPsec Encryption Settings (ipsecweakencryptionsettings)

The solution given is: "Modify the ISAKMP settings to only allow secure encryption algorithms to be negotiated."

Can someone please give something a little more detailed on how I might fix this issue?

OS is SBS2011, with Exchange 2010, IIS 7.5

share|improve this question
Are you using your server as a VPN end point? What did you find when you searched for this on Google? What part of what you found didn't you understand. It is important that you expend some effort on your own doing your homework before you ask a question so you can as a question that is actually useful. – Zoredache Jul 30 '12 at 23:21
Not using the VPN, though it looks like the router's VPN (Ipsec specifically) settings are the issue. Sorry if it looks like I didn't do any homework, but I have been going over a PCI scan failure list as long as my arm for the last 5 hours, researching and resolving items. So ya, I was kinda looking for a few easy answers at the end of the day. Thanks! – Aegyptus Jul 30 '12 at 23:48
If you are the one running the compliance scan (audit) why are you the one to fix the issue also? – user266070 Jan 21 '15 at 0:08
up vote 1 down vote accepted

You fix this by going to the device or server that serves up your VPN tunnel and "[modifying] the ISAKMP settings to only allow secure encryption algorithms to be negotiated." It probably allows weaker encryption options to be used for legacy support, so you turn that off. It's really starting to sound like you're way out of your depth with this client, honestly.

Not that I want to sound like too much of dick or parrot back the question information at you, but it's really as simple as changing the settings on your VPN tunnel to enforce stronger crypto (more modern algorithms and/or longer keylengths). This might even be as simple as disabling support for DES, which is a common standard from many years ago, that's incredibly insecure now.

It doesn't seem like this would would be found on your SBS/Exchange server (though I've seen stranger things), and I'd suggest looking at the routing gear first, in particular, any firewall or edge equipment that might be being used as the connection point for VPN users, where the VPN tunnel would be negotiated.

share|improve this answer
Its on the router, got it, thats all I needed, thanks! – Aegyptus Jul 30 '12 at 23:44

Try disabling isakmp aggressive-mode. Aggressive mode is faster than main mode but is less secure since it only passes 3 authentication packets. It is generally recommended to use main mode instead of aggressive mode. If aggressive mode must be used for performance issues, for example, use Public Key Encryption authentication.

share|improve this answer

Disable DES and MD5​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​​

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.