Secure RDP/IPSec using connection security rules in Windows Defender

I am trying to configure RDP to use IPSec. I have configured two connection security rules for TCP and UPD, requiring authentication for inbound and requesting outbound connections. Authentication method is computer kerberos5. From there I am using a GPO to push this policy to the endpoints. I confirmed the policy is being applied to PCa and PCb via RSOP. There is a second firewall policy that only allows connections from specific PC's, and that policy is working just fine.

When using wireshark on PCa and attempting an RDP connection, I see ISAKMP packets being sent to PCb but there is no response for ISAKMP packets from that PCb. The connection then fails over to TLSv1.3, which I believe is the default for RDP.

My question is, where can I find the log files that show the ISAKMP negotiation? I am not seeing anything in event viewer relating to ISAKMP or IPSec failed connections.

Thank you in advance

Don