Windows Event ID 4977 – Microsoft-Windows-Security-Auditing: IPsec Main Mode Security Association Established

Start by examining the complete event details to understand the IPsec connection parameters.

1. Open Event Viewer → Windows Logs → Security
2. Filter for Event ID 4977 using the filter option
3. Double-click the most recent Event 4977 entry
4. Review the General tab for basic information
5. Click the Details tab and select XML View for complete data
6. Note the following key fields:
   • LocalAddress and RemoteAddress - endpoint IP addresses
   • AuthenticationMethod - how endpoints authenticated
   • CipherAlgorithm and HashAlgorithm - encryption details
   • KeyLength - encryption key size
   • LifetimeSeconds - SA validity period

Use PowerShell to efficiently query and analyze IPsec Main Mode events across multiple systems.

1. Open PowerShell as Administrator
2. Query recent Event 4977 entries:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4977} -MaxEvents 20 | Format-Table TimeCreated, Id, LevelDisplayName, Message -Wrap

3. Extract detailed IPsec information:

   $Events = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4977} -MaxEvents 10
   foreach ($Event in $Events) {
       $XML = [xml]$Event.ToXml()
       $EventData = $XML.Event.EventData.Data
       Write-Host "Time: $($Event.TimeCreated)"
       Write-Host "Local IP: $($EventData | Where-Object {$_.Name -eq 'LocalAddress'} | Select-Object -ExpandProperty '#text')"
       Write-Host "Remote IP: $($EventData | Where-Object {$_.Name -eq 'RemoteAddress'} | Select-Object -ExpandProperty '#text')"
       Write-Host "Auth Method: $($EventData | Where-Object {$_.Name -eq 'AuthenticationMethod'} | Select-Object -ExpandProperty '#text')"
       Write-Host "---"
   }

4. Check for corresponding deletion events:

   Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4978} -MaxEvents 10 | Format-Table TimeCreated, Message -Wrap

Verify that the established security associations match your configured IPsec policies.

1. Check current IPsec policies using netsh:

   netsh ipsec static show all

2. Review Windows Firewall connection security rules:

   Get-NetIPsecRule | Format-Table DisplayName, Enabled, Direction, Action

3. Examine active IPsec security associations:

   netsh ipsec dynamic show all

4. For Windows Server environments, check Group Policy IPsec settings:
   • Open Group Policy Management Console
   • Navigate to Computer Configuration → Windows Settings → Security Settings → IP Security Policies
   • Verify assigned policies match the authentication methods in Event 4977
5. Cross-reference event details with policy configuration:

   Get-NetIPsecMainModeSA | Format-Table LocalEndpoint, RemoteEndpoint, AuthenticationMethod, CipherAlgorithm

Implement comprehensive monitoring to track IPsec tunnel health and performance metrics.

1. Create a PowerShell script for continuous IPsec monitoring:

   # IPsec-Monitor.ps1
   $LogFile = "C:\Logs\IPsec-Monitor.log"
   while ($true) {
       $NewEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4977; StartTime=(Get-Date).AddMinutes(-5)} -ErrorAction SilentlyContinue
       foreach ($Event in $NewEvents) {
           $XML = [xml]$Event.ToXml()
           $EventData = $XML.Event.EventData.Data
           $LogEntry = "$(Get-Date): New IPsec SA - Local: $($EventData[0].'#text') Remote: $($EventData[1].'#text')"
           Add-Content -Path $LogFile -Value $LogEntry
       }
       Start-Sleep -Seconds 300
   }

2. Set up Windows Performance Toolkit counters:

   Get-Counter "\IPSec Connections\Active Tunnels" -Continuous

3. Monitor IPsec-related registry keys for policy changes:

   HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Policy\GPTIPSECPolicy

4. Create scheduled task for regular IPsec health checks:

   $Action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\IPsec-Monitor.ps1"
   $Trigger = New-ScheduledTaskTrigger -Daily -At 9am
   Register-ScheduledTask -TaskName "IPsec Health Monitor" -Action $Action -Trigger $Trigger

Perform deep packet analysis when IPsec establishment issues require detailed investigation.

1. Enable IPsec audit logging for detailed troubleshooting:

   auditpol /set /subcategory:"IPsec Main Mode" /success:enable /failure:enable
   auditpol /set /subcategory:"IPsec Quick Mode" /success:enable /failure:enable

2. Start network packet capture during IPsec negotiation:

   netsh trace start capture=yes provider=Microsoft-Windows-IPsec tracefile=C:\Traces\ipsec.etl

3. Reproduce the IPsec connection and stop the trace:

   netsh trace stop

4. Analyze the trace file using Network Monitor or Wireshark to examine IKE packets
5. Enable IPsec diagnostic logging:

   HKLM\SYSTEM\CurrentControlSet\Services\PolicyAgent\Oakley\EnableLogging = 1

6. Review IPsec logs in %SystemRoot%\debug\oakley.log
7. Use PowerShell to correlate network events with security events:

   $StartTime = (Get-Date).AddHours(-1)
   $IPsecEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4977,4978,5049; StartTime=$StartTime}
   $NetworkEvents = Get-WinEvent -FilterHashtable @{LogName='System'; ProviderName='Microsoft-Windows-Kernel-Network'; StartTime=$StartTime}
   # Correlate events by timestamp and IP addresses