AZ-802: Administering Windows Server

In Windows Defender Firewall with Advanced Security, the connection security rule type determines the scope of the IPsec protection that is negotiated. A server-to-server rule authenticates and protects connections between explicitly specified endpoints: the wizard asks for Endpoint 1 and Endpoint 2 as computers, IP addresses, or subnets, so IPsec is applied only to traffic between those named hosts and to nothing else. That is what keeps IPsec protection limited to just the two servers involved, and the rule can be configured to require authentication for inbound and outbound connections and, through its IPsec settings, to encrypt the data, which satisfies the requirement that the traffic between the two servers be both authenticated and encrypted. An isolation rule is the wrong instrument here because it does not target specific peers at all: it restricts every connection that matches the selected firewall profiles based on credentials such as domain membership or health status, which is a broad domain- or enterprise-wide isolation posture rather than a protection limited to two servers. An authentication exemption rule removes IPsec protection from designated hosts, and a tunnel rule is for gateway-to-gateway (site-to-site) tunnel mode traffic, so neither fits.

Connection security rules by themselves only negotiate IPsec; they never grant or block access, so a separate firewall rule is required to make access conditional on that IPsec negotiation succeeding. Because the traffic in question arrives at the second server, the rule must be an inbound rule on that server, and its action must be set to allow the connection only if it is secure. That action permits the traffic solely when the connection has been protected and authenticated by IPsec and drops anything that has not been, and it also exposes the Customize option for requiring the connections to be encrypted along with the Users and Computers pages for restricting the permitted accounts. An action of simply allowing the connection, or a predefined rule that allows a built-in Windows feature, would admit unauthenticated traffic, and an outbound rule governs traffic the server sends rather than traffic it accepts.