Apply local connection security rules

Purpose

Show registry keys (1)

• HKLM\Software\Policies\Microsoft\WindowsFirewall\PublicProfile\AllowLocalIPsecPolicyMerge

This REG_DWORD value controls whether connection security rules from the local policy store are merged into the effective IPsec policy for the public firewall profile.

A value of 0 disables that merge. Locally stored connection security rules remain present, but Windows ignores them and does not enforce them for the public profile, regardless of their schema or rule version. Connection security rules supplied through Group Policy continue to determine the effective policy.

Notes

Security

A value of 0 prevents locally created IPsec rules from affecting the centrally controlled connection security policy on public networks. Local rules therefore cannot introduce different authentication, integrity, or encryption requirements into the effective policy.

This setting does not itself require IPsec or select an authentication or encryption method. The protection provided depends on the connection security rules delivered through central policy.

Possible side effects

Connections, applications, or services that rely exclusively on local connection security rules no longer receive those rules' IPsec behavior under the public profile. Expected authentication or encryption might therefore be absent, or connections might fail when the peer or another centrally managed rule requires protected traffic.

Notes

The value applies only to the public firewall profile. It controls IPsec connection security rules, not ordinary inbound or outbound firewall rules. Merging of local firewall rules is controlled separately by AllowLocalPolicyMerge.

0 prevents local connection security rules from being merged. 1 permits the merge.

Microsoft documentation

Microsoft Learn: Allow Local IPsec Policy Merge registry value

Microsoft Learn: Firewall CSP – PublicProfile/AllowLocalIpsecPolicyMerge

See also

• Entry in the reference