2

I have several Server 2008 R2 Domain Controllers that have IPSec configured under their LOCAL Group Policy. The entries don't exist in the Windows Firewall or in a network GPO. These policies are old and convoluted and are preventing us from adding new DCs.

I'm looking to export/dump the rules so I can simplify and test in a separate environment. My preferred solution would be in CMD/PowerShell.

1

It doesn't matter if it's in the Local or Group policy, once it's been imported the server sees it in it's local store. Since this is Server 2008 R2 with POSHv2, we're limited to using the netsh commands, however I wrapped the output inside PowerShell to make objects that I could export for analysis on a remote computer.

$OutFile = "$env:temp\IPsecRules.csv"
$objects = @()
netsh ipsec static show filterlist all level=verbose |
  Select-String ':' |
    ForEach-Object {
      $split = $_.Line.Split(':')
      $name  = $split[0].Trim()
      $value = $split[1].Trim()
      switch ($name) {
        'Description'            {${Description}            = $value}
        'Store'                  {${Store}                  = $value}
        'Last Modified'          {${Last Modified}          = $value}
        'GUID'                   {${GUID}                   = $value}
        'No. of Filters'         {${No. of Filters}         = $value}
        'Mirrored'               {${Mirrored}               = $value}
        'Source IP Address'      {${Source IP Address}      = $value}
        'Source Mask'            {${Source Mask}            = $value}
        'Source DNS Name'        {${Source DNS Name}        = $value}
        'Destination IP Address' {${Destination IP Address} = $value}
        'Destination Mask'       {${Destination Mask}       = $value}
        'Destination DNS Name'   {${Destination DNS Name}   = $value}
        'Protocol'               {${Protocol}               = $value}
        'Source Port'            {${Source Port}            = $value}
        'Destination Port'       {${Destination Port}       = $value}
        #'FilterList Name'        {${FilterList Name}        = $value}
      }
      If (${Destination Port}) {
        $object = New-Object psobject -Property @{
          'Description'            = ${Description}
          'Store'                  = ${Store}
          'Last Modified'          = ${Last Modified}
          'GUID'                   = ${GUID}
          'No. of Filters'         = ${No. of Filters}
          #'Description'            = ${Description}
          'Mirrored'               = ${Mirrored}
          'Source IP Address'      = ${Source IP Address}
          'Source Mask'            = ${Source Mask}
          'Source DNS Name'        = ${Source DNS Name}
          'Destination IP Address' = ${Destination IP Address}
          'Destination Mask'       = ${Destination Mask}
          'Destination DNS Name'   = ${Destination DNS Name}
          'Protocol'               = ${Protocol}
          'Source Port'            = ${Source Port}
          'Destination Port'       = ${Destination Port}
          #'FilterList Name'        = ${FilterList Name} 
        }
        $objects += $object
        ${Destination Port} = ""
      }
    }
$objects | Export-Csv -Path "c:\temp\IPsecRules.csv" -NoTypeInformation -Force

Edited: Rewrote script to give more information. Only needed verbose filterlist query.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.