The second authentication method can be one of the following: User (Kerberos V5). Selecting this option tells the computer to use and require authentication of the currently logged-on user by using his or her domain credentials. This authentication method works only with other computers that can use AuthIP.
If you select Second authentication is optional, then the connection can succeed even if the authentication attempt specified in this column fails. Important: Make sure that you do not select the check boxes to make both first and second authentication optional. Doing so allows plaintext connections whenever authentication fails.
On the IPsec Settings tab, click Customize. In the Authentication Method section, select the type of authentication that you want to use from among the following: Default.
Preshared key (not recommended). Selecting this method and entering a preshared key tells the computer to authenticate by exchanging the preshared keys. If they match, then the authentication succeeds. This method is not recommended, and is included only for backward compatibility and testing purposes.
Computer (Kerberos V5). Selecting this option tells the computer to use and require authentication of the computer by using its domain credentials. This option works with other computers that can use IKE v1, including earlier versions of Windows. Computer (NTLMv2). Selecting this option tells the computer to use and require authentication ...
If you also select Accept only health certificates, then only certificates that include the system health authentication enhanced key usage (EKU) typically provided in a Network Access Protection (NAP) infrastructure can be used for this rule. Advanced.