native Windows VPN connection KO in the last few days (IPSec IKEv2)

Zyxel_USG_User

Many reasons to ditch built-in IPSec clients (Windows, macOS, etc.) and their patch management, as for example the hijack risk: a tampered system process phoning home blends into normal OS noise. A dedicated client has a narrow footprint - if it phones elsewhere, even at rest, it stands out.

For IPSec I use specifically: SecuExtender on macOS/Windows, strongSwan on Android.

iPhones are the pain - native IPSec config only (nothing else exists), and every update breaks something undocumented. At least Windows is more scrutinised with a bigger community, so better forum/online help.