IKEv2 with PSK not working on Android

Options
Userseb
Userseb Posts: 7 image  Freshman Member
First Comment
in Security

Hi everyone,

I'm trying to set up IKEv2 with PSK on a USG Flex 100 by following that article (https://support.zyxel.eu/hc/en-us/articles/8805317185298-IKEv2-VPN-with-Pre-Shared-key-on-Mobile-Devices-Instead-of-L2TP#h_01HB6CZ468E23YEB63SRPPFRS8) but it's not working.

Here is the log

IKE_LOG.PNG

What could be wrong ? I don't see any error in the log.

Thanks.

Seb

Accepted Solution

  • PeterUK
    PeterUK Posts: 4,426 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    Answer ✓

    For phase 2 change Local policy to 0.0.0.0

All Replies

  • PeterUK
    PeterUK Posts: 4,426 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Is this by IP or DNS?

    Have you tried changing the key group?

    looks like Phase 1 is not done

  • Userseb
    Userseb Posts: 7 image  Freshman Member
    First Comment

    Hi PeterUK,

    It's by IP

    Key groups are DH2 and DH14 as specified in the article (not tried the others)

    Ciphers are AES256/SHA256

    Yes it seems phase 1 do not terminate

    I noticed a [CERTREQ] at line 11 in the log, would it mean that it requests a certificate ? 🤷‍♂️

  • Userseb
    Userseb Posts: 7 image  Freshman Member
    First Comment

    Ok so I'm going to the right direction, phase1 is now OK but phase 2 fails.

    Phase 1 has been solved by changing the IPSec identifier in the client app on Android : I replaced 0.0.0.0 by then WAN IP (192.168.1.99 in my case behing a NAT) and it works.

    Here is the complete log now

    IKE_LOG.PNG

    I receive a correct IP (192.168.70.2), the Dynamic Tunnel is built successfully but the microsecond after, IKE SA is disconnected. I tried multiple policies without success. I don't know what else to do.

    Regards,

    Seb

  • PeterUK
    PeterUK Posts: 4,426 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    Answer ✓

    For phase 2 change Local policy to 0.0.0.0

  • Userseb
    Userseb Posts: 7 image  Freshman Member
    First Comment

    Oh man thank you so much it was as simple as that ! 👍👍👍

    Do you know why I had to change this parameter from the subnet to 0.0.0.0 ?

    Seb

  • PeterUK
    PeterUK Posts: 4,426 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary

    Think it to do with the WAN IP interface is on but by setting it to 0.0.0.0 it can be from any interface

  • Userseb
    Userseb Posts: 7 image  Freshman Member
    First Comment

    Ok I will keep this in mind next time ! Thanks again !

    Regards,

    Seb

  • mm_bret
    mm_bret Posts: 70 image  Ally Member
    First Comment Fifth Anniversary

    On a FLEX 200 5.42(ABUJ.1)

    I'm trying to get this working as well for an android/samsung phone.

    The difference on my Zyxel VPV gateway is…mine is a static ip.

    My phone connects, then disconnects immediately.

    What info from the log will help provide some assistance?

    Don't want to use strongswan etc, just the default protocols on the Flex 200 and my Samsung phone

    Thanks

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）