Intermittent Kerberos traffic drops prior to IPsec SA establishment under domain isolation policy

Question

Intermittent Kerberos traffic drops prior to IPsec SA establishment under domain isolation policy

FAQ Jadit 40

Has anyone seen this behavior with Windows 11 client workstations and Windows Server 2022 domain controllers:

Successfully scans local policy store for IPsec Transport Mode domain isolation rules.

Finds valid machine certificates for IKEv2 authentication.

Downloads update configurations from SYSVOL share without transport errors.

Installs active security policies into Windows Defender Firewall driver.

Event ID 5480 in Security log confirms successful IPsec policy assignment and driver initialization.

Therefore, domain isolation GPO processing appears to be working.

HTTP status 200 returned during background WSUS metadata synchronization over port 8530.

Active Directory group policy background synchronization completes on schedule across active connections.

Netlogon secure channel session maintenance continues without interruption.

but pre-SA Kerberos authentication traffic dropped in packet captures never reaches Active Directory KDC database (KRB_AS_REQ payload fields remain empty)?

How should IPsec exemption rules be configured to allow initial Kerberos authentication traffic prior to SA establishment?

0 comments

Answer accepted by question author

0 additional answers

Your answer

Answer 1

Hello,

What you are seeing is expected behavior when IPsec domain isolation rules are applied without proper exemption handling. Kerberos pre-authentication traffic (KRB_AS_REQ) must reach the KDC before any Security Association is established, otherwise the client cannot even obtain the initial TGT. By default, the IPsec driver enforces transport mode isolation immediately, which blocks those packets unless explicit exemptions are defined.

The correct way to handle this is to configure IPsec exemption rules for Kerberos and supporting infrastructure protocols. Microsoft’s guidance is that you must allow UDP/88 and TCP/88 (Kerberos authentication), UDP/389 and TCP/389 (LDAP), TCP/445 (SMB for SYSVOL/NETLOGON), and UDP/123 (NTP) as clear-text exemptions. These rules should be defined in the same GPO that applies the isolation policy, under Windows Defender Firewall with Advanced Security → Connection Security Rules → Exemptions. The exemption rules must be set to “Request but allow clear” or “Do not secure” for those ports, so that traffic to domain controllers is permitted outside of IPsec until the SA is negotiated.

In practice, you create a connection security rule with “Endpoint 1” set to Any, “Endpoint 2” set to Domain Controllers, and specify the Kerberos ports. The action should be “Do not authenticate” for those ports. This ensures that KRB_AS_REQ packets are delivered to the KDC unprotected, allowing the authentication handshake to complete. Once the SA is established, subsequent Kerberos traffic (KRB_TGS_REQ, KRB_AP_REQ) will be protected by IPsec as intended.

Without these exemptions, the firewall driver drops the pre-SA traffic, which is exactly what your packet captures are showing. Once you add the exemptions, you should see the KRB_AS_REQ payloads reaching the KDC and the domain isolation policy functioning correctly.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day

Domic Vo.