IKev2 and 2012r2 authentication

another_user Posts: 12
First Comment Third Anniversary
 Freshman Member
edited April 2021 in Security

Hello guys , i have some questions/problems about IKEv2 and auth, i will start with these info:

- active directory (and ldap too) authentication works perfectly from AAA Server page, the server is a 2012 R2 64

- L2TP/IPSEC  works with Active directory users

-I Use VPN client from Windows (7 o 10) both works

- Firewall USG 1100 and 4.31(AAPK.0) firmware (last)

Then, from this guide http://onesecurity.zyxel.com/img/uploads/Next-Gen_IKEv2_VPN_Server_Role_CR.pdf , i create an IKEv2 Tunnel, a valid signed certificate and all necessary described.

In Extended Authentication Protocol from IKEv2 Tunnel i've selected EAP Server mode, with Active directory AAA method and "any" for allowed users.

In these conditions Nothing cannot connect on VPN, nothing about Active directory Users, because if i use a local USG user (like Admin)  it's works perfectly.

there is a bug with AD auth and IKE v2?

any ideas?

Many thanks

Accepted Solution

All Replies

  • Zyxel_Emily
    Zyxel_Emily Posts: 1,015
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 100 Answers 500 Comments
     Guru Member

    Hi @another_user,


    The USG1100 must join an AD domain.

    In the following example, domain name is usg.com.

    Go to CONFIGURATION > System > Host Name and enter the domain name.

    On AD server, usg1100 should appear in Computers.

    Go to CONFIGURATION > System > DNS > Address/PTR Record and add a record.

    Go to AAA Server > Active Directory > AD object. Configure Domain Authentication for MSChap.

    The user in this field should belongs to “domain admin” on your AD server.

    Result: IKEv2 is established with AD account successfully. 

Security Highlight