Android 12 and ikev2

13

All Replies

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,321
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 50 Answers 1000 Comments
     Zyxel Employee
    Hi @DavideV,

    This issue is fixed in V5.31 firmware. Please update to V5.31 and try it again.

    V5.31 release note:
     9. [ENHANCEMENT] eITS#180900304, 180801037
         a.Support VPN multiple Diffie Hellman groups.

    Untitled Image

  • mMontana
    mMontana Posts: 1,249
    50 Answers 1000 Comments Friend Collector Fourth Anniversary
     Guru Member
    Up!
    @Zyxel_Cooldia referring to this...
    https://community.zyxel.com/en/discussion/14436/firewall-usg110-with-vpn-connection-via-ikev2-is-not-working-both-on-preshared-key-or-cerfiticate#latest
    WK35 firmware has the issue fixed?
    If not, 4.x firmware will have the issue fixed?
  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,321
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 50 Answers 1000 Comments
     Zyxel Employee
    Hi @mMontana,
    The issue is fixed in WK35.  Lab test on Google Pixel 5 Android 13, and Xiaomi poco F3 Android 12.
    Both mobile phone can build up IKEv2 + PSK tunnel successfully. We may need to check if the issue is something related to specific brand mobile phone.

    Untitled Image

  • mMontana
    mMontana Posts: 1,249
    50 Answers 1000 Comments Friend Collector Fourth Anniversary
     Guru Member
    Thanks for your kind reply. :)
  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,321
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 50 Answers 1000 Comments
     Zyxel Employee
    Just found out that, if we test on Samsung mobile phone IKEv2 + PSK Remote access VPN, we cannot just provide 1 DNS server in phase 2 mode config. Mobile will send "DEL" message to gateway immediately when the tunnel is up assume we just set up 1 DNS server for mode config.
    That's weird. other brand mobile can accept one DNS server in mode config. 
    Not sure if it is limitation on specific version.

    Condition : 
    Samsung Android 12 + IKEv2 + PSK
    Mode config: Need to set up 2 DNS server for Samsung mobile in phase 2 mode config


    Untitled Image

  • mMontana
    mMontana Posts: 1,249
    50 Answers 1000 Comments Friend Collector Fourth Anniversary
     Guru Member
    Hint for @Zyxel_Cooldia: update the manuals and the howtos published.
  • Peppino
    Peppino Posts: 104
    First Comment Friend Collector Fifth Anniversary
     Ally Member
    edited December 2022
    Dear Zyxel team,

    Now that Android 13 has rolled out onto Samsung phones, and L2TP has practically stopped working on them, I was wondering if you guys have a plan to overcome this situation, as Samsung apparently still uses a weird hashing algorithm, that we cannot set in the Zyxel firewalls if trying to move towards IKEv2.
    Whatever I tried wouldn't let me past Phase 1. 
    This guide here unfortunately doesn't work for these phones, you may consider putting there a note, that Samsung phones are an exception.

    Any chance we can get back our VPNs soon? :-)

  • Zyxel_Cooldia
    Zyxel_Cooldia Posts: 1,321
    Zyxel Certified Network Administrator - Security Zyxel Certified Sales Associate 50 Answers 1000 Comments
     Zyxel Employee
    edited December 2022
    Hi @Peppino,

    We would suggest to install Strongswan client on Samsung phone for IKEv2 connection.

    Untitled Image

  • Peppino
    Peppino Posts: 104
    First Comment Friend Collector Fifth Anniversary
     Ally Member
    Zyxel_Cooldia said:
    Hi @Peppino,

    We would suggest to install Strongswan client on Samsung phone for IKEv2 connection.
    Can you eventually suggest a configuration guide for this?
  • Peppino
    Peppino Posts: 104
    First Comment Friend Collector Fifth Anniversary
     Ally Member
    I actually succeeded setting it up, but it might not be trivial for others

Categories

Security Highlight


Read more

Security Help Center

  • FAQ
  • New & Release
  • Monthly Express
  • Threat Intelligence
  • Video Tutorials
    • EnglishTiếng ViệtРусскийไทย中文（台灣）