<div class="content"><p> </p><p>This structure describes a connection security rule.</p><dl>
<dd>
<div><pre> typedef struct _tag_FW_CS_RULE {
   struct _tag_FW_CS_RULE* pNext;
   unsigned short wSchemaVersion;
   [string, range(1,10001), ref] wchar_t* wszRuleId;
   [string, range(1,10001)] wchar_t* wszName;
   [string, range(1,10001)] wchar_t* wszDescription;
   unsigned long dwProfiles;
   FW_ADDRESSES Endpoint1;
   FW_ADDRESSES Endpoint2;
   FW_INTERFACE_LUIDS LocalInterfaceIds;
   unsigned long dwLocalInterfaceTypes;
   unsigned long dwLocalTunnelEndpointV4;
   unsigned char LocalTunnelEndpointV6[16];
   unsigned long dwRemoteTunnelEndpointV4;
   unsigned char RemoteTunnelEndpointV6[16];
   FW_PORTS Endpoint1Ports;
   FW_PORTS Endpoint2Ports;
   [range(0,256)] unsigned short wIpProtocol;
   [string, range(1,10001)] wchar_t* wszPhase1AuthSet;
   [string, range(1,10001)] wchar_t* wszPhase2CryptoSet;
   [string, range(1,10001)] wchar_t* wszPhase2AuthSet;
   [range(FW_CS_RULE_ACTION_SECURE_SERVER, FW_CS_RULE_ACTION_MAX - 1)] 
     FW_CS_RULE_ACTION Action;
   unsigned short wFlags;
   [string, range(1,10001)] wchar_t* wszEmbeddedContext;
   FW_OS_PLATFORM_LIST PlatformValidityList;
   [range(FW_RULE_ORIGIN_INVALID, FW_RULE_ORIGIN_MAX-1)] 
     FW_RULE_ORIGIN_TYPE Origin;
   [string, range(1,10001)] wchar_t* wszGPOName;
   FW_RULE_STATUS Status;
   [string, range(1,512)] WCHAR* wszMMParentRuleId;
   DWORD Reserved;
   [size_is((Reserved &amp; FW_OBJECT_CTRL_FLAG_INCLUDE_METADATA) ? 1 : 0)] 
     PFW_OBJECT_METADATA pMetaData;
   [string, range(1,512)] WCHAR* wszRemoteTunnelEndpointFqdn;
   FW_ADDRESSES RemoteTunnelEndpoints;
   DWORD dwKeyModules;
   DWORD FwdPathSALifetime;
   [string, range(1,10001)] LPWSTR* wszTransportMachineAuthzSDDL;
   [string, range(1,10001)] LPWSTR* wszTransportUserAuthzSDDL;
 } FW_CS_RULE,
  *PFW_CS_RULE;
</pre></div>
</dd></dl><p><b>pNext:</b>  A pointer to the next
FW_CS_RULE in the list.</p><p><b>wSchemaVersion:</b>  Specifies the
version of the rule.</p><p><b>wszRuleId:</b>  A pointer to a <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_c305d0ab-8b94-461a-bd76-13b40cb8c4d8" data-linktype="relative-path">Unicode</a></span>
string that uniquely identifies the rule.</p><p><b>wszName:</b>  A pointer to a Unicode
string that provides a friendly name for the rule.</p><p><b>wszDescription:</b>  A pointer to a
Unicode string that provides a friendly description for the rule.</p><p><b>dwProfiles:</b>  A bitmask of the <span><a href="7704e238-174d-4a5e-b809-5f3787dd8acc" data-linktype="relative-path">FW_PROFILE_TYPE</a></span>
flags. It is a condition that matches traffic on the specified profiles.</p><p><b>Endpoint1:</b>  A condition that
specifies the addresses of the first host of the traffic that the rule matches.
An empty <b>EndPoint1</b> structure means that this condition is not applied
(any match).</p><p><b>Endpoint2:</b>  A condition that
specifies the addresses of the second host of the traffic that the rule
matches. An empty <b>EndPoint2</b> structure means that this condition is not
applied (any match).</p><p><b>LocalInterfaceIds:</b>  A condition that
specifies the list of specific network interfaces that are used by the traffic
that the rule matches. If the <b>LocalInterfaceIds</b> field does not specify
an interface <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_f49694cc-c350-462d-ab8e-816f0103c6c1" data-linktype="relative-path">GUID</a></span>, the rule
applies to all interfaces; that is, the condition is not applied.</p><p><b>dwLocalInterfaceTypes:</b>  A bitmask of
<span><a href="d067c028-4ea9-4319-9ddf-0fb51c191b35" data-linktype="relative-path">FW_INTERFACE_TYPE</a></span>.
It is a condition that restricts the interface types used by the traffic that
the rule matches. A value of 0x00000000 means the condition matches all
interface types.</p><p><b>dwLocalTunnelEndpointV4:</b>  This field
specifies the IPv4 address of the <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_b91c1e27-e8e0-499b-8c65-738006af72ee" data-linktype="relative-path">endpoint</a></span> that the
host machines use as their local endpoint when <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_f8a5b7f0-25e0-4c81-9abf-00b56a580deb" data-linktype="relative-path">IPsec</a></span> operates in
tunnel mode.</p><p><b>LocalTunnelEndpointV6:</b>  This field
specifies the IPv6 address of the endpoint that the host machines use as their
local endpoint when IPsec operates in tunnel mode.</p><p><b>dwRemoteTunnelEndpointV4:</b>  This
field specifies the IPv4 address of the endpoint that the host machines use as
their remote endpoint when IPsec operates in tunnel mode.</p><p><b>RemoteTunnelEndpointV6:</b>  This field
specifies the IPv6 address of the endpoint that the host machines use as their
remote endpoint when IPsec operates in tunnel mode.</p><p><b>Endpoint1Ports:</b>  A condition that
specifies the first host&#39;s ports of the <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_b08d36f6-b5c6-4ce4-8d2d-6f2ab75ea4cb" data-linktype="relative-path">TCP</a></span> or UDP traffic
that the rule matches.</p><p><b>Endpoint2Ports:</b>  A condition that
specifies the second host&#39;s ports of the TCP or UDP traffic that the rule
matches.</p><p><b>wIpProtocol:</b>  A condition that
specifies the protocol of the traffic that the rule matches. If the value is in
the range of 0 to 255, the value describes a protocol as in IETF IANA numbers
(for more information, see <span><a href="https://go.microsoft.com/fwlink/?LinkId=89889" data-linktype="external">[IANA-PROTO-NUM]</a></span>).
If the value is 256, the rule matches any protocol.</p><p><b>wszPhase1AuthSet:</b>  A Unicode string
that represents the set identifier for the Phase1 authentication policy
objects.</p><p><b>wszPhase2CryptoSet:</b>  A Unicode
string that represents the set identifier for the Phase2 cryptographic policy
objects.</p><p><b>wszPhase2AuthSet:</b>  A Unicode string
that represents the set identifier of the Phase2 authentication policy objects.
If this field is NULL, no second authentication is performed.</p><p><b>Action:</b>  The connection security
action that the rule takes for the traffic matches. This field MUST contain a
valid value from the <span><a href="358add6d-adf7-4b6f-8b6a-66535ac802ed" data-linktype="relative-path">FW_CS_RULE_ACTION</a></span>
enumeration.</p><p><b>wFlags:</b>  A bit flag or flags from <span><a href="567fdc53-7b1c-418b-8b11-dd7267f75bad" data-linktype="relative-path">FW_CS_RULE_FLAGS</a></span>.</p><p><b>wszEmbeddedContext:</b>  A pointer to a
Unicode string. It specifies a group name for this rule. Other components in
the system use this string to enable or disable a group of rules by verifying
that all rules have the same group name.</p><p><b>PlatformValidityList:</b>  A condition
in a rule that determines whether or not the rule is enforced by the local
computer based on the local computer&#39;s platform information. The rule is
enforced only if the local computer&#39;s operating system platform is an element
of the set described by <b>PlatformValidityList</b>.<a id="Appendix_A_Target_14"></a><a aria-label="Product behavior note 14" href="1da2ee70-a6ae-4f76-b08f-fdc25c77d8a0#Appendix_A_14" data-linktype="relative-path">&lt;14&gt;</a></p><p><b>Origin:</b>  This field is the rule
origin, as specified in the <span><a href="9d295321-d75c-41c0-ab0d-7a78df40f77c" data-linktype="relative-path">FW_RULE_ORIGIN_TYPE</a></span>
enumeration. It MUST be filled on enumerated rules and ignored on input.</p><p><b>wszGPOName:</b>  A pointer to a Unicode
string containing the displayName of the <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_dec32233-8776-4151-91a0-8624a2b9abb0" data-linktype="relative-path">GPO</a></span> containing this
object. When adding a new object, this field is not used. The client SHOULD set
the value to NULL, and the server MUST ignore the value. When enumerating an
existing object, if the client does not set the
FW_ENUM_RULES_FLAG_RESOLVE_GPO_NAME flag, the server MUST set the value to
NULL. Otherwise, the server MUST set the value to the displayName of the GPO
containing the object or NULL if the object is not contained within a GPO. For
details about how the server initializes an object from a GPO, see section <span><a href="e8924ac5-aa4a-41d1-bf65-4f46b3d399aa" data-linktype="relative-path">3.1.3</a></span>.
For details about how the displayName of a GPO is stored, see <span><a href="../ms-gpol/62d12924-6252-4052-996f-161d2b9019f4" data-linktype="relative-path">[MS-GPOL]</a></span>
section <span><a href="../ms-gpol/a0b3f9f6-da35-4c8a-8b8d-1318d4673e9d" data-linktype="relative-path">2.3</a></span>.</p><p><b>Status:</b>  The status code of the
rule, as specified by the <span><a href="c4fd81e6-38dd-47c5-8a0f-a98a11cf190e" data-linktype="relative-path">FW_RULE_STATUS</a></span>
enumeration. This field is filled out when the structure is returned as output.
On input, this field MUST be set to <i>FW_RULE_STATUS_OK</i>.</p><p><b>wszMMParentRuleId:</b>  This field is
not used.</p><p><b>Reserved:</b>  Not used other than to
instruct <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">RPC</a></span> by using the
FW_OBJECT_CTRL_FLAG_INCLUDE_METADATA flag that a pointer to a
FW_OBJECT_METADATA structure is present. It has no semantic meaning to the
object itself</p><p><b>pMetaData:</b>  A pointer to an
FW_OBJECT_METADATA structure that contains specific metadata about the current
state of the connection security rule.</p><p><b>wszRemoteTunnelEndpointFqdn:</b>  A
pointer to a Unicode string containing the <span><a href="d891304d-92d8-4f9f-9e60-a1f02b28ae30#gt_1769aec9-237e-44ed-9014-1abb3ec6de6e" data-linktype="relative-path">fully qualified domain name
(FQDN)</a></span> of the endpoints that the host machines use as their remote
endpoint when IPsec operates in tunnel mode.</p><p><b>RemoteTunnelEndpoints:</b>  This field
specifies the IPv4 and IPv6 addresses of the endpoints that the host machines
use as their remote endpoint when IPsec operates in tunnel mode.</p><p><b>dwKeyModules:</b>  A bitmask of the
FW_KEY_MODULE flags. It specifies the key modules used to establish the
cryptographic keys used by IPsec.</p><p><b>FwdPathSALifetime:</b>  This value is
the lifetime in seconds before a Phase2 established key is renegotiated if the
key is used to secure traffic forwarded from one interface to another on the
same host machine.</p><p><b>wszTransportMachineAuthzSDDL:</b>  A
pointer to a Unicode string in Security Descriptor Definition Language (SDDL)
format (<span><a href="../ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2" data-linktype="relative-path">[MS-DTYP]</a></span>
section <span><a href="../ms-dtyp/50e9ef83-d6fd-4e22-a34a-2c6b4e3c24f3" data-linktype="relative-path">2.2.36</a></span>).
The security descriptor describes which remote machines are allowed to send and
receive traffic. Machines granted access by the security descriptor are allowed
to send and receive traffic. Machines denied access by the security descriptor
are blocked from sending and receiving traffic. This field MUST be null for
tunnel mode rules.</p><p><b>wszTransportUserAuthzSDDL:</b>  A
pointer to a Unicode string in Security Descriptor Definition Language (SDDL)
format ([MS-DTYP] section 2.2.36). The security descriptor describes which
remote users are allowed to send and receive traffic. Users granted access by
the security descriptor are allowed to send and receive traffic. Users denied
access by the security descriptor are blocked from sending and receiving
traffic. This field MUST be null for tunnel mode rules.</p><p>The following are semantic checks that connection security
rules MUST pass:</p><ul><li><p><span><span> 
</span></span>The <b>wSchemaVersion</b> field MUST NOT be less than 0x000200.</p>
</li><li><p><span><span> 
</span></span>The <b>wszRuleId</b> field MUST NOT contain the pipe &#39;|&#39;
character, MUST NOT be NULL, MUST be a string of at least 1 character, and MUST
NOT be greater than or equal to 512 characters.<a id="Appendix_A_Target_15"></a><a aria-label="Product behavior note 15" href="1da2ee70-a6ae-4f76-b08f-fdc25c77d8a0#Appendix_A_15" data-linktype="relative-path">&lt;15&gt;</a></p>
</li><li><p><span><span> 
</span></span>The <b>wszName</b> field string MUST meet the following criteria:</p>
<ul><li><p><span><span>  </span></span>MUST
contain at least one character.</p>
</li><li><p><span><span>  </span></span>MUST
contain less than 10,000 characters.</p>
</li><li><p><span><span>  </span></span>MUST
NOT be NULL.</p>
</li><li><p><span><span>  </span></span>MUST
NOT contain the pipe &#39;|&#39; character.</p>
</li><li><p><span><span>  </span></span>MUST
NOT equal the string &#34;ALL&#34; (case-insensitive).</p>
</li></ul></li><li><p><span><span> 
</span></span>If the <b>wszDescription</b> field string is not NULL, it MUST be
at least 1 character, MUST NOT be greater than or equal to 10,000 characters,
and MUST NOT contain the pipe &#39;|&#39; character.</p>
</li><li><p><span><span> 
</span></span>If the <b>wszEmbeddedContext</b> field string is not NULL, it
MUST be at least 1 character, MUST NOT be greater than or equal to 10,000
characters, and MUST NOT contain the pipe &#39;|&#39; character.</p>
</li><li><p><span><span> 
</span></span>The <b>dwProfiles</b> field MUST NOT contain invalid values, and
if it is not equal to the ALL profile type, it MUST NOT contain unknown
profiles.</p>
</li><li><p><span><span> 
</span></span>The <b>wIpProtocol</b> field MUST NOT be greater than 256.</p>
</li><li><p><span><span> 
</span></span>If <b>wIpProtocol</b> is 6 or 17, the <b>wPortKeywords</b> field
of <b>Endpoint1Ports</b> MUST be 0.</p>
</li><li><p><span><span> 
</span></span>If <b>wIpProtocol</b> is 6 or 17, the <b>wPortKeywords</b> field
of <b>Endpoint2Ports</b> MUST be 0.</p>
</li><li><p><span><span> 
</span></span>If <b>wIpProtocol</b> is neither 6 nor 17, the <b>Endpoint1Ports</b>
and <b>Endpoint2Ports</b> fields MUST be empty.</p>
</li><li><p><span><span> 
</span></span>If the <b>Endpoint1</b> field is not empty, <b>LocalInterfaceIds</b>
MUST be empty and <b>dwLocalInterfaceTypes</b> MUST be 0. If the <b>Endpoint1</b>
field is empty, <b>LocalInterfaceIds</b> MUST NOT be empty and <b>dwLocalInterfaceTypes</b>
MUST NOT be 0.</p>
</li><li><p><span><span> 
</span></span>The <b>Endpoint1</b> and <b>Endpoint2</b> address keywords MUST
contain valid address keywords.</p>
</li><li><p><span><span> 
</span></span>The <b>Endpoint1</b> and <b>Endpoint2</b> structures MUST NOT
contain multicast v4 or v6 addresses.</p>
</li><li><p><span><span> 
</span></span>The <b>dwLocalInterfaceTypes</b> MUST NOT be greater than or equal
to FW_INTERFACE_TYPE_MAX.</p>
</li><li><p><span><span> 
</span></span>The <b>Action</b> field MUST be a valid action from the
FW_CS_RULE_ACTION enumeration.</p>
</li><li><p><span><span> 
</span></span>The <b>wFlags</b> field MUST NOT be greater than or equal to
FW_CS_RULE_FLAGS_MAX.</p>
</li><li><p><span><span> 
</span></span>If the <b>Action</b> field is FW_CS_RULE_ACTION_DO_NOT_SECURE, <b>wszPhase1AuthSet</b>,
<b>wszPhase2AuthSet</b>, and <b>wszPhase2CryptoSet</b> MUST all be NULL;
otherwise, <b>wszPhase1AuthSet</b>, <b>wszPhase2AuthSet</b>, and <b>wszPhase2CryptoSet</b>
MUST all be at least 1 character long, MUST NOT be greater than or equal to
1,000 characters,<a id="Appendix_A_Target_16"></a><a aria-label="Product behavior note 16" href="1da2ee70-a6ae-4f76-b08f-fdc25c77d8a0#Appendix_A_16" data-linktype="relative-path">&lt;16&gt;</a> and MUST NOT contain the pipe
&#39;|&#39; character.</p>
<p>However, the <b>wszPhase2AuthSet</b>
member can always be NULL. When <b>wszPhase2AuthSet</b> is not NULL, it SHOULD
pass all of the string checks performed by the <b>wszPhase1AuthSet</b> member
and the <b>wszPhase2CryptoSet</b> member.</p>
</li><li><p><span><span> 
</span></span>A tunnel rule has the <b>dwRemoteTunnelEndpointV4</b> (or V6)
field as an address or the <b>dwLocalTunnelEndpointV4</b> (or V6) as an
address. If the rule is a tunnel rule, the <b>Endpoint1</b> and <b>Endpoint2</b>
addresses MUST NOT be empty; the <b>Action</b> field MUST be
FW_CS_RULE_ACTION_SECURE; <b>wIpProtocol</b> MUST be ANY (256); <b>Endpoint1Ports</b>
and <b>Endpoint2Ports</b> MUST be empty; and <b>dwRemoteTunnelEndpointV4</b>
and <b>dwLocalTunnelEndpointV4</b> MUST either both be ANY or both be specified.
The same applies to v6 tunnel endpoint fields.</p>
</li><li><p><span><span> 
</span></span>If the rule&#39;s <b>wFlags</b> field contains the
FW_CS_RULE_FLAGS_DTM flag, then the rule is also a tunnel rule and the
following requirements are relaxed: Either <b>dwRemoteTunnelEndpointV4</b> or <b>dwLocalTunnelEndpointV4</b>,
or both, can now be empty. The same applies to the v6 tunnel endpoint fields. <b>Endpoint1</b>
or <b>Endpoint2</b> or both can now be empty. The action can now also be
FW_CS_RULE_ACTION_DO_NOT_SECURE.</p>
</li><li><p><span><span> 
</span></span>Tunnel endpoint addresses MUST NOT be the loopback addresses.</p>
</li><li><p><span><span> 
</span></span>If the <b>wFlags</b> field has the
FW_CS_RULE_FLAGS_OUTBOUND_CLEAR flag set or the
FW_CS_RULE_FLAGS_TUNNEL_BYPASS_IF_ENCRYPTED flag set, the rule MUST be a tunnel
mode rule.</p>
</li></ul></div>