# Interoperability with Microsoft Windows* 2000

Microsoft Windows* 2000 contains built-in Internet Protocol Security. If your LAN contains Windows 2000-based systems, they will be able to communicate securely with Intel® Packet Protect-enabled systems.

By default, IPSec is not enabled in Windows 2000. Windows 2000 is installed with "No Security" as the IPSec default action. You can use the IP Security Policy Management tool to activate IPSec in Windows 2000.

Windows 2000 has three IPSec default behaviors—Server, Secure Server, and Client—that you can choose from when you configure the system.

## Limitations

There are two restrictions when configuring Windows 2000-based systems to interoperate with Intel Packet Protect.

### Use the "All IP Traffic" Protocol Filter

On Windows 2000, the rule used to communicate with Intel Packet Protect clients must be set to "All IP Traffic" protocol filter, even if you are only interested in specific protocols (e.g. TCP, UDP, etc) on top of IP.
For example, if you are only interested in TCP communications between Windows 2000 and Intel Packet Protect, you must create a new rule in Windows 2000, which can communicate with the active rule or default behavior on Intel Packet Protect. If you select TCP as the protocol filter in the Windows 2000 rule, the communication will FAIL. You MUST select "All IP Traffic" filter instead.

### Use a Matching Pre-Shared Key

Currently, Intel Packet Protect interoperates with Windows 2000 using a pre-shared key. However, because Windows 2000 default authentication mechanism is Kerberos, which is not supported by Intel Packet Protect, the authentication must be changed to use pre-shared keys. Be sure to use the same pre-shared keys on Windows 2000-based systems as Intel Packet Protect-enabled systems for proper interoperability.

## Creating Policies

### To Create Custom IPSec Policies in Windows 2000

1. OnFrom the Start menu, select: Settings > Network and Dial-up Connections > Local Area Connection.
   The Local Area Connection Status dialog appears.

2. Click the Properties button.
   The Local Area Connection Properties dialog appears.

3. Click the Internet Protocol (TCP-IP) component and select Properties.
   The Internet Protocol (TCP/IP) dialog appears.

4. Click the Advanced button.
   The Advanced TCP/IP Settings dialog appears.

5. Click the Options tab.

6. Click the IP security tab, then click the Properties button.
   The IP Security dialog appears.

7. Click Use this IP security policy, and then select the IPSec policy you want to use.

8. You can also use the IPSecurity Policies snap-in in the Microsoft Management Console* (MMC).
   Set it to use the local system, right-click the policy you want to use, and then click Assign.

9. You must be a member of the Administrators group to set IPSec policies. If a system participates in a Windows 2000 domain, the system may receive the IPSec policy from Active Directory, overriding the local IPSec policy. In this case, the options are disabled and you cannot change them from the local system.

Copyright © 2002 Intel Corporation. Legal Information