IKEv2 VPN with Pre-Shared key on Mobile Devices (Instead of L2TP)

Zyxel_Melen

This article will show you how to connect mobile phones (Android and iPhone (iOS)) with IKEv2 PSK (pre-shared key) instead of L2TP. Because in Android 12 and later, L2TP support is no longer available. This article will also look at how to set up IKEv2 PSK for iOS users.

First, we need to set up the Tunnel on our Firewall; in this case, the firewall is an ATP200 with fw 5.31.

1) Firewall: Setup VPN Gateway (Phase 1)

1. Login to your device using GUI
2. Go to "Configuration > VPN > IPSec VPN > VPN Gateway"

1. Click on "Add"
2. Click on "Enable"
3. Please give it a Name
4. Choose IKEv2
5. Choose your WAN Interface
6. Set the Peer Gateway Address to "Dynamic"
7. Set a Pre-Shared Key "PSK"

In "Phase 1 Settings", we need to change the Advance settings

1. Add Encryption and Authentication according to the picture below
2. Add Key Group according to the image below
3. Disable the Two-factor Authentication
4. Click "OK"

Note: For IOS 17 a key group is used: DH19 must be used

2) Firewall: Setup VPN Connection (Phase 2)

Go to the "VPN Connection" Tab and click "Add."

1. Click on "Add"
2. Click on "Enable"
3. Please give it a name
4. Choose "Remote Access (Server Role)"
5. Choose the Gateway we created in the previous Step
6. Choose "Local Policy," the subnet you want to connect to with the VPN

Enable Configuration Payload - This section is mandatory for iOS. In the case of using Android, this is optional.

In "Phase 2 Settings", we need to change the Advance settings

1. Add Encryption and Authentication according to the picture below
2. Add Key Group according to the picture below
3. Click "OK"

Note! You can also use DH2 and DH14 on both "Phase 1" and "Phase 2" settings if other devices (such as old Android phones) cannot connect.

3) Mobile: Configure on Android

1. Settings 
2. Enter the VPN and go to VPN settings
3. Add a new VPN Connection
4. Type the Name
5. Choose IKEv2/IPSec PSK
6. Enter the IP or FQDN from the WAN Interface of your Firewall
7. Enter IPSec identifier (If you have not changed anything on the Firewall, leave 0.0.0.0)
8. Enter the Pre-shared Key (same as you entered on the Firewall)
9. Click "Save"
10. Select the newly created VPN and click "Connect."

4) Mobile: Configure on iOS

1. Settings 
2. Enter the VPN and go to VPN settings
3. Add a new VPN Connection
4. Choose IKEv2
5. Type the Name
6. Enter the IP or FQDN from the WAN Interface of your Firewall
7. Enter Remote ID (If you have not changed anything on the Firewall, leave 0.0.0.0)
8. Choose User Authentication "None"
9. Disable "User Certification"
10. Enter the Pre-shared Key (same as you entered on the Firewall)
11. Click "Done"
12. Select the newly created VPN and click "Connect."

You can check the connection status in the firewall Settings (under Configuration -> VPN -> IPSec VPN, then you will see the green symbol if it's connected).

You can also see the connectivity under Monitor -> Logs.