Creates an IPsec DoS protection setting and adds the setting to the target computer.
Networking / Security · Risk: High · Documentation Verified
Last verified: 2026-10-26
Microsoft NetSecurity reference: Creates an IPsec DoS protection setting and adds the setting to the target computer. The syntax and selected example below are adapted from the pinned Windows Server 2025 reference. Module availability, target configuration and delegated permissions determine whether it can run in your environment. Documentation and parameter text: Microsoft, CC BY 4.0; formatting adapted by Cmdlet World. No execution testing is claimed.
Use an account with the target resource permissions documented for New-NetIPsecDospSetting. Modifying administrative cmdlets may require elevation or delegated administration. This catalog does not assert that ordinary users can execute the command.
Supported environments
Windows / NetSecurity · Windows Server 2025 documentation; feature/module prerequisites apply
Parameters
-AsJob
Runs the cmdlet as a background job. Use this parameter to run commands that take a long time to complete.
-CimSession
Runs the cmdlet in a remote session or on a remote computer. Enter a computer name or a session object, such as the output of a New-CimSession or Get-CimSession cmdlet. The default is the current session on the local computer.
-Confirm
Prompts you for confirmation before running the cmdlet.
-DefBlockExemptDscp
Specifies the 6-bit value, specified as an integer from 1 to 63, that is placed in the differentiated services code point (DSCP) field of the IPv6 header when the traffic type matches traffic that is by default exempted from the default block behavior such as IPsec authenticated, IPsec unauthenticated, and ICMPv6 traffic. The DSCP value can be used in Quality of Service (QoS) implementations to prioritize network traffic and help ensure that less important network packets do not consume so much bandwidth that they interfere with the successful delivery of more important network packets. The acceptable values for this parameter are: 1 through 63, and Disabled. The default value is Disabled. - Disabled: This turns off DSCP marking for traffic that is by default exempted from the default block behavior. This includes IPsec authenticated, IPsec unauthenticated, and ICMPv6 traffic. This parameter is case-sensitive and requires Disabled to be specified using dot-notation.
-DefBlockExemptRateLimitBytesPerSec
Specifies the maximum rate at which IPsec authenticated, IPsec unauthenticated, and ICMPv6 inbound network traffic such as traffic that is by default exempted from the default block behavior is forwarded from the public interface to the internal interface. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 102400.
-EnabledKeyingModules
Specifies the IPsec negotiation protocol, or keying module, to allow. The IPv6 address or subnet to which the specified IPsec negotiation protocol is allowed to be sent with the *PrivateV6Address* parameter can be optionally specified. By default, only IPsec negotiation traffic that uses AuthIP is allowed to all addresses. ICMPv6 network traffic is always allowed to enable Teredo and other advanced network scenarios to work. The IPsec-protected traffic that is part of an established connection that uses ESP is always allowed, as long as the connection has not been idle for more than the number of seconds specified with the *StateIdleTimeoutSeconds* parameter. The acceptable values for this parameter are: None, IkeV1, IkeV2, or AuthIP. The default value is AuthIP.
-FilteringFlags
Prerequisites
Windows with the NetSecurity module and the Windows feature or management tools that provide it. Confirm target connectivity and version compatibility using the linked Microsoft reference.
Security considerations
This cmdlet changes system state. Review every target and parameter in the official reference, test outside production, and prepare an appropriate backup or rollback. Do not execute the example automatically.
This example adds the public and internal network adapters as interfaces of the IPsec DoS protection feature. Source: Microsoft, CC BY 4.0; transcript prompt/output removed. This example was not executed.
Specifies the action to take on network traffic that matches the Dosp setting address filters the public V6 address and the privateV6 address. Only one filter can be applied to a specific address or subnet. If a second Dosp setting with the exact same address or subnet parameter is created, then an error is displayed. If an address matches more than one filter, then the most specific match is selected and the corresponding filter is applied. For example, 2006:2006::2 matches a filter with the prefix 2006:2006::2/128 more closely than a filter with the prefix 2006:2006::2/64. The acceptable values for this parameter are: - None: IPsec DoS protection feature drops all IPv4 traffic, and all non-IPsec IPv6 traffic (except ICMPv6) that is forwarded between a public interface and an internal interface. - DisableDefaultBlock: IPsec DoS protection feature blocks no traffic. - FilterBlock: Specifies that network traffic that matches the Dosp setting address filters using the *PublicV6Address* and *PrivateV6Address* parameters is blocked even if it is IPsec-protected. - FilterExempt: Specifies that IPv6 network traffic that matches the Dosp setting address filters using the *PublicV6Address* and *PrivateV6Address* parameters does not have to be IPsec-protected to be allowed through. The default value is None.
-IcmpV6Dscp
Specifies that ICMPv6 protocol traffic is assigned the given DSCP value. This parameter specifies the 6-bit value, specified as an integer from 1 to 63, that is placed in the DSCP field of the IPv6 header, when the traffic type matches ICMPv6 protocol traffic. The DSCP value can be used in Quality of Service (QoS) implementations to prioritize network traffic and help ensure that less important network packets do not consume so much bandwidth that the packets interfere with the successful delivery of more important network packets. The acceptable values for this parameter are: 1 through 63, and Disabled. The default value is Disabled. - Disabled: Turns off DSCP marking for ICMPv6 protocol traffic. This parameter is case-sensitive and requires Disabled to be specified using dot-notation.
-IcmpV6RateLimitBytesPerSec
Specifies the maximum rate at which ICMPv6 inbound network traffic is forwarded from the public to the internal interface. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 10240.
-IpV6FilterExemptDscp
Specifies that IPv6 traffic with an IP address that is exempted by using an address filter is assigned the given DSCP value. To specify that the IPv6 network traffic that matches the Dosp setting address filters using the *PublicV6Address* and *PrivateV6Address* parameters does not have to be IPsec-protected to be allowed through set the *FilteringFlags* parameter to the filter exempt value. This parameter specifies the 6-bit value, specified as an integer from 1 to 63, that is placed in the DSCP field of the IPv6 header when the traffic type matches the exempted address filter traffic. The DSCP value can be used in Quality of Service (QoS) implementations to prioritize network traffic and help ensure that less important network packets do not consume so much bandwidth that they interfere with the successful delivery of more important network packets. The acceptable values for this parameter are: 1 through 63, and Disabled. The default value is Disabled. - Disabled: Turns off DSCP marking for traffic from the specified address filter, specified with the *PrivateV6Address* or *PublicV6Address* parameter. This parameter is case-sensitive and requires Disabled to be specified using dot-notation.
-IpV6FilterExemptRateLimitBytesPerSec
Specifies the maximum rate at which inbound IPv6 network traffic, that is exempted by using an address filter, is forwarded from the public to the internal interface. To specify that the IPv6 network traffic that matches the Dosp setting address filters using the *PublicV6Address* and *PrivateV6Address* parameters does not have to be IPsec-protected to be allowed through set the *FilteringFlags* parameter to the filter exempt value. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 102400.
-IpV6IPsecAuthDscp
Specifies that authenticated IPv6 IPsec-protected traffic is assigned the given DSCP value. This parameter specifies the 6-bit value, specified as an integer from 1 to 63, that is placed in the DSCP field of the IPv6 header, when the traffic type matches authenticated IPv6 IPsec-protected traffic. The DSCP value can be used in Quality of Service (QoS) implementations to prioritize network traffic and help ensure that less important network packets do not consume so much bandwidth that they interfere with the successful delivery of more important network packets. The default value is Disabled. - Disabled: Turns off DSCP marking for authenticated IPv6 IPsec-protected traffic. This parameter is case-sensitive and requires Disabled to be specified using dot-notation.
-IpV6IPsecAuthRateLimitBytesPerSec
Specifies the maximum rate at which authenticated IPv6 IPsec-protected inbound traffic is forwarded from the public to the internal interface. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 0, which disables the rate limit for this traffic.
-IpV6IPsecUnauthDscp
Specifies that unauthenticated IPv6 IPsec-protected traffic is assigned the given DSCP value. This parameter specifies the 6-bit value, specified as an integer from 1 to 63, that is placed in the DSCP field of the IPv6 header when the traffic type matches unauthenticated IPv6 IPsec-protected traffic. The DSCP value can be used in Quality of Service (QoS) implementations to prioritize network traffic and help ensure that less important network packets do not consume so much bandwidth that they interfere with the successful delivery of more important network packets. The acceptable values for this parameter are: 1 through 63, and Disabled. The default value is Disabled. - Disabled: Turns off DSCP marking for unauthenticated IPv6 IPsec-protected traffic. This parameter is case-sensitive and requires Disabled to be specified using dot-notation.
-IpV6IPsecUnauthPerIPRateLimitBytesPerSec
Specifies the maximum rate at which unauthenticated IPv6 IPsec-protected inbound traffic is forwarded from the public to the internal interface. If a per IP address rate limit is defined, then it is used instead of the global rate limit using the *IpV6IPsecUnauthRateLimitBytesPerSec* parameter. To rate limit on a per IP address basis, configure the number of per IP queues to support this by using the *MaxPerIPRateLimitQueues* parameter. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 10240.
-IpV6IPsecUnauthRateLimitBytesPerSec
Specifies the maximum rate at which unauthenticated IPv6 IPsec-protected inbound traffic is forwarded from the public to the internal interface. This rate limit is applied on a per IP address basis, instead of network-wide. If a per IP address rate limit is defined using the *IpV6IPsecUnauthPerIPRateLimitBytesPerSec* parameter, then it is used instead of the global rate limit. To rate limit on a per IP address basis, configure the number of per IP queues to support this by using the MaxPerIPRateLimitQueues parameter. The acceptable values for this parameter are: 1 through 4,294,967,295 bytes per second. The default value is 10240.
-MaxPerIPRateLimitQueues
When using rate limits on unauthenticated traffic, this value specifies the maximum number of queues that can be used to hold traffic while it is delivered at the configured rate. The per IP address rate limit is defined with the *IpV6IPsecUnauthPerIPRateLimitBytesPerSec* parameter. The acceptable values for this parameter are: 1 through 4,294,967,295 queues. The default value is 50000.
-MaxStateEntries
Specifies the maximum number of connections that the IPsec DoS protection feature can track at one time. The acceptable values for this parameter are: 1 through 4,294,967,295 sessions. The default value is 75000.
-Name (required)
Specifies the unique identifier of the Dosp configuration setting. This parameter is mandatory.
-PerIPRateLimitQueueIdleTimeoutSeconds
Specifies, when using rate limits on unauthenticated traffic on a per IP address basis, the timeout in seconds that the connection can be idle before the IPsec DoS protection feature treats the connection as stale and stops tracking the state. The per IP address rate limit is defined with the *IpV6IPsecUnauthPerIPRateLimitBytesPerSec* parameter. The acceptable values for this parameter are: 1 through 4,294,967,295 seconds. The default value is 360, or six minutes.
-PrivateInterfaceAliases (required)
Adds the specified interface to the IPsec DoS protection configuration as an internal interface. At least one public interface using the *PublicInterfaceAliases* parameter and one internal interface using the *PrivateInterfaceAliases* parameter for the Dosp setting must be set to be operational.
-PrivateV6Address
Specifies the internal IPsec address or subnet that matches the Dosp address filter. This parameter adds a filter that either blocks or allows via exempting the network traffic that is not IPv6 and IPsec-protected from the specified public address or subnet using the *PublicV6Address* parameter to the specified internal address or subnet using this parameter. This behavior, referring to blocking or exempting, is specified with the *FilteringFlags* parameter. Only one filter can be applied to a specific address or subnet. If a second rule with the exact same address or subnet parameter is created, then an error is displayed. If an address matches more than one filter, then the most specific match is selected and the corresponding filter is applied. For example, 2006:2006::2 matches a filter with the prefix 2006:2006::2/128 more closely than a filter with the prefix 2006:2006::2/64. If both the *PublicV6Address* parameter and this parameter are specified, then the Dosp rule treats the parameter values as a logical AND operator. Traffic matches the rule if it comes from an address with the specified public prefix and the traffic is destined for an address with the specified internal prefix. Network traffic of the specified protocol as specified using the *EnabledKeyingModules* parameter that is sent from an address or subnet not on the list is dropped. To specify a subnet, include the forward slash (/) followed by the number of digits that represent the network identifier.
-PublicInterfaceAliases (required)
Adds the specified interface to the IPsec DoS protection configuration as a public interface. At least one public interface using the *PublicInterfaceAliases* parameter and one internal interface using the *PrivateInterfaceAliases* parameter for the Dosp setting must be added to be operational.
-PublicV6Address
Specifies the external IPsec address or subnet that matches the Dosp address filter. This parameter adds a filter that either blocks or allows via exempting the network traffic that is not IPv6 and IPsec-protected from the specified public address or subnet using this parameter to the specified internal address or subnet using the *PrivateV6Address* parameter. This behavior, referring to blocking or exempting, is specified with the *FilteringFlags* parameter. Only one filter can be applied to a specific address or subnet. If a second rule with the exact same address or subnet parameter is created, then an error is displayed. If an address matches more than one filter, then the most specific match is selected and the corresponding filter is applied. For example, 2006:2006::2 matches a filter with the prefix 2006:2006::2/128 more closely than a filter with the prefix 2006:2006::2/64. If both this parameter and the *PrivateV6Address* parameter are specified, then the Dosp rule treats the parameter values as a logical AND operator. Traffic matches the rule if it comes from an address with the specified public prefix and the traffic is destined for an address with the specified internal prefix. Network traffic of the specified protocol as specified using the *EnabledKeyingModules* parameter that is sent from an address or subnet not on the list is dropped. To specify a subnet, include the forward slash (/) followed by the number of digits that represent the network identifier.
-StateIdleTimeoutSeconds
Specifies the number of seconds that an IPsec session can be idle before the IPsec DoS protection feature stops considering it to be a valid IPsec-protected connection that is allowed by the feature. After the specified number of seconds, the IPsec session is considered stale, and traffic that is part of the session is no longer allowed through the feature by default. The acceptable values for this parameter are: 1 through 4,294,967,295 seconds. The default value is 360, or six minutes.
-ThrottleLimit
Specifies the maximum number of concurrent operations that can be established to run the cmdlet. If this parameter is omitted or a value of 0 is entered, then Windows PowerShell® calculates an optimum throttle limit for the cmdlet based on the number of CIM cmdlets that are running on the computer. The throttle limit applies only to the current cmdlet, not to the session or to the computer.
-WhatIf
Shows what would happen if the cmdlet runs. The cmdlet is not run.