IKev2 and 2012r2 authentication

another_user Posts: 12  Freshman Member
First Anniversary First Comment
edited April 2021 in Security

Hello guys , i have some questions/problems about IKEv2 and auth, i will start with these info:

- active directory (and ldap too) authentication works perfectly from AAA Server page, the server is a 2012 R2 64

- L2TP/IPSEC  works with Active directory users

-I Use VPN client from Windows (7 o 10) both works

- Firewall USG 1100 and 4.31(AAPK.0) firmware (last)

Then, from this guide http://onesecurity.zyxel.com/img/uploads/Next-Gen_IKEv2_VPN_Server_Role_CR.pdf , i create an IKEv2 Tunnel, a valid signed certificate and all necessary described.

In Extended Authentication Protocol from IKEv2 Tunnel i've selected EAP Server mode, with Active directory AAA method and "any" for allowed users.

In these conditions Nothing cannot connect on VPN, nothing about Active directory Users, because if i use a local USG user (like Admin)  it's works perfectly.

there is a bug with AD auth and IKE v2?

any ideas?

Many thanks

Accepted Solution

All Replies

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,296  Zyxel Employee
    First Anniversary 10 Comments Friend Collector First Answer

    Hi @another_user,


    The USG1100 must join an AD domain.

    In the following example, domain name is usg.com.

    Go to CONFIGURATION > System > Host Name and enter the domain name.

    On AD server, usg1100 should appear in Computers.

    Go to CONFIGURATION > System > DNS > Address/PTR Record and add a record.

    Go to AAA Server > Active Directory > AD object. Configure Domain Authentication for MSChap.

    The user in this field should belongs to “domain admin” on your AD server.

    Result: IKEv2 is established with AD account successfully. 

  • another_user
    another_user Posts: 12  Freshman Member
    First Anniversary First Comment
    Answer ✓

    very useful, now it works!

    many thanks!!

Security Highlight