Android 12 and ikev2

Zyxel_Cooldia

Hi @Peppino,

Thanks for feedback. We can refer to this FAQ to set up  Strongswan in Android phone.
https://community.zyxel.com/en/discussion/12522/remote-access-vpn-wizard-for-secuextender-ipsec-and-non-secuextender-ipsec-vpn-clients#latest

Peppino

Thanks Cooldia, I did not notice there is a whitepaper on this. :-)

QuiteSmart

https://community.zyxel.com/en/discussion/comment/46017#Comment_46017

I'm trying to use the wizard to connect an android phone (samsung!) to an ATP with latest firmware, the firewall is under a router, I modified phase 1: in my address instead of "interface" i selected "domain name/IPv4" and entered my public (static) ip.

this is what i get on the firewall:

this is what i get from strongswan:

any help?

Peppino

Is that same ip included in the certificate too?

QuiteSmart

update: i tried the same configuration on another firewall with the same firmware, the only difference is that the 2nd fw is not under NAT. In this case it works (same phone).

QuiteSmart

https://community.zyxel.com/en/discussion/comment/61065#Comment_61065

Peppino

https://community.zyxel.com/en/discussion/comment/61067#Comment_61067

Well client VPN needs a fw exposed to a public IP. Hidden behind a NAT will obviously not work. The only exception is when this FW will act as a client to another one that has public IP, then they can build a tunnel between themselves.

QuiteSmart

https://community.zyxel.com/en/discussion/comment/61167#Comment_61167

actually the firewall it's not hidden: the ISP router is configured so that the Firewall ip (router lan / firewall wan) is in DMZ so that (theorically) all the traffic to the ISP router is redirected to the firewall.

I suppose that in this scenario one's able to connect via VPN, am I wrong?

PeterUK

If the certificate says a IP then the fw needs to have that IP and be WAN

for IPsec identifier on phone need to be:

ikev2

for IPSec pershared key

PeterUK

With strongswan I was able to setup on Zywall 110 a IKEv2 certificate VPN with a DNS by no-ip