Event ID 5451

An IPsec quick mode security association was established.

An IPsec quick mode security association was established.

Local Endpoint:
    Network Address:    %1
    Network Address mask:   %2
    Port:           %3
    Tunnel Endpoint:        %4

Remote Endpoint:
    Network Address:    %5
    Network Address Mask:   %6
    Port:           %7
    Private Address:        %8
    Tunnel Endpoint:        %9

    Protocol:       %10
    Keying Module Name: %11

Cryptographic Information:
    Integrity Algorithm - AH:   %12
    Integrity Algorithm - ESP:  %13
    Encryption Algorithm:   %14

Security Association Information:
    Lifetime - seconds: %15
    Lifetime - data:        %16
    Lifetime - packets: %17
    Mode:           %18
    Role:           %19
    Quick Mode Filter ID:   %20
    Main Mode SA ID:    %21
    Quick Mode SA ID:   %22

Additional Information:
    Inbound SPI:        %23
    Outbound SPI:       %24


Event 5451 records the successful establishment of an IPsec Quick Mode security association (SA).

Auditing:     Rarely

Security events in the Audit IPsec Quick Mode subcategory are monitored primarily for IPsec Quick Mode troubleshooting. Not recommended for general security monitoring due to volume. Enable only when actively diagnosing IPsec SA negotiation issues, auditing compliance requirements around encrypted host-to-host communication, or forensically reconstructing which hosts established IPsec sessions during a specific timeframe.


Volume:     High

On any system actively using IPsec, a new Quick Mode SA is negotiated for every protected connection and refreshed on key lifetime expiry. On a busy server this can produce hundreds of events per hour.




NameFieldInsertion StringOSExample
Local Network AddressLocalAddress%1Any 10.0.0.10
Local Network Address MaskLocalMask%2Any 255.255.255.255
Local PortLocalPort%3Any 0
Local Tunnel EndpointLocalTunnelEndpoint%4Any 0.0.0.0
Remote Network AddressRemoteAddress%5Any 10.0.0.20
Remote Network Address MaskRemoteMask%6Any 255.255.255.255
Remote PortRemotePort%7Any 0
Remote Private AddressRemotePrivateAddress%8Any 0.0.0.0
Remote Tunnel EndpointRemoteTunnelEndpoint%9Any 0.0.0.0
ProtocolProtocol%10Any 0
Keying Module NameKeyingModuleName%11Any IKEv2
Integrity Algorithm - AHIntegrityAlgorithmAH%12Any -
Integrity Algorithm - ESPIntegrityAlgorithmESP%13Any SHA-256
Encryption AlgorithmEncryptionAlgorithm%14Any AES-128
Lifetime - secondsLifetimeSeconds%15Any 3600
Lifetime - dataLifetimeData%16Any 0
Lifetime - packetsLifetimePackets%17Any 0
ModeMode%18Any %%2566
RoleRole%19Any %%2561
Quick Mode Filter IDQuickModeFilterId%20Any 84392
Main Mode SA IDMainModeSaId%21Any {A1B2C3D4-E5F6-...}
Quick Mode SA IDQuickModeSaId%22Any {B2C3D4E5-F6A7-...}
Inbound SPIInboundSpi%23Any 0x1A2B3C4D
Outbound SPIOutboundSpi%24Any 0x5E6F7A8B


Lookup Audit Policy Configuration Settings

C:\> AuditPol.exe /get /subcategory:"IPsec Quick Mode"



LEFT/RIGHT arrow keys for navigation

Back to List