WinSecWiki > Security Settings > Local Policies > Audit Policy > Audit Logon > IPsec Quick

IPsec Quick Mode

IPSec is an IP protocol that provides authentication, integrity and optionally encryption at the packet level. This subcategory records all IPSec quick mode events. Why is this subcategory under Logon/Logoff? Your guess is as good as mine.

There are additional subcategories for main mode and extended mode as well as the IPSec driver itself. You can only configure this category using auditpol.

Coverage on events generated by this category are currently in the Security Log Encyclopedia:

Event ID	Title
4654	An IPsec Quick Mode negotiation failed
4977	During Quick Mode negotiation, IPsec received an invalid negotiation packet.
5451	An IPsec Quick Mode security association was established.
5452	An IPsec Quick Mode security association ended.

Back to top

 

Upcoming Webinars Assessing the Security of Your Active Directory: User Accounts Anatomy of a Cloud Hack: The Cloudflare/Okta Compromise – A Story of Tokens, Lateral Movement, Persistence and the Salvation of Zero Trust and Hard MFA Tokens

Additional Resources