IKEv2 connection with Windows 11 native client

Options
Seabob
Seabob Posts: 7 image  Freshman Member
First Comment Second Anniversary
in Security

Dear Community,
I tried several settings derived from several articles in this forum, but nothing worked.
In the end, this is the state:
I created a dial-in connection for IKEv2-Clients using the wizard built into our ATP500.
Whenever I try to connect, I receive "server not responding".
Using the same setup to establish a L2TP-connection works fine, so we can widely exclude firewalls blocking IKE, I guess.
Any ideas?

All Replies

  • PeterUK
    PeterUK Posts: 4,608 image  Guru Member
    250 Answers 2500 Comments Friend Collector Eighth Anniversary
    edited March 19
    Options

    It would help to see the settings but really the wizard should of made this easy and work.

    when you receive "server not responding" do you know if it connecting to your WAN IP?

    Do you have other IKEv2 tunnels? 

  • Zyxel_Tina
    Zyxel_Tina Posts: 933 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    Hi @Seabob,

    To further investigate the issue, could you please help check the following:

    • First, confirm whether your firewall is deployed behind NAT. If yes, please verify that the uplink device has the required ports correctly forwarded (e.g., UDP 500 and UDP 4500 for IKEv2)
    • The detailed configuration of your IKEv2 VPN settings
    • If possible, please try to establish the VPN connection again and check whether there are any related error messages or log entries on the firewall at the time of failure. If so, kindly share them with us for further analysis

    If any of the information contains sensitive data, please feel free to share it via private message.

    Zyxel Tina

  • MikeForshock
    MikeForshock Posts: 66 image  Ally Member
    First Comment Friend Collector Fifth Anniversary
    Options

    Depending on the levels of Phase 1 & 2 , you may need to do some PowerShell work to make the Windows client match the security requirements.

  • Seabob
    Seabob Posts: 7 image  Freshman Member
    First Comment Second Anniversary
    Options

    Thanks for your thoughts and I apologize for my silence, but in the meantime I tried to resolve the problem by opening a support-ticket. The result of the ticket and tweaking wizard-generated scripts is:
    one site (Vienna) works fine now, but in our site BSU the IKE-Client gets connected to the wrong tunnel, which fails, of course. "Set SplitTunneling=false" didn't help.

    Maybe, we pick this issues up from here.

  • Zyxel_Tina
    Zyxel_Tina Posts: 933 image  Zyxel Employee
    Zyxel Certified Network Administrator - Security Zyxel Certified Network Administrator - Switch 100 Answers 500 Comments
    Options

    Hi @Seabob,

    To help us investigate the issue, could you please provide and confirm:

    1. Support ticket number
    2. IKEv2 VPN configuration details
    3. Firewall logs/error messages when the connection fails
    4. NAT status and port forwarding settings (UDP 500/4500) on the uplink device

    Feel free to share sensitive info via private message. This will help us understand the ticket progress and resolve the issue efficiently.

    Thanks for your cooperation!

    Zyxel Tina

  • MarkoD
    MarkoD Posts: 71 image  Ally Member
    First Answer First Comment Friend Collector Seventh Anniversary
    edited April 11
    Options

    @Seabob Take a look here - the settings in the post below work for Windows (and Mac) native clients:

    https://community.zyxel.com/en/discussion/26327/vpn-client-to-site-settings-for-macos-15-sequoia
  • Abudef
    Abudef Posts: 10 image  Freshman Member
    First Comment Friend Collector Eighth Anniversary
    Options

    Gateway:

    obrazek.png

    VPN:

    obrazek.png

    On the client device, the VPN certificate from the router must be installed (Trusted CAs store, Computer account context; this also applies to iPhone and Android), and the following must be added to the Windows registry (then restart the computer):

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RasMan\Parameters]
"NegotiateDH2048_AES256"=dword:00000001

    Then configure the native Windows VPN client and set the VPN type to IKEv2.

    If anything is unclear, any modern AI chatbot will be able to help you.

  • Abudef
    Abudef Posts: 10 image  Freshman Member
    First Comment Friend Collector Eighth Anniversary
    Options

    Has anyone managed to get this working over IPv6?

Categories

Security Help Center

EnglishTiếng ViệtРусскийไทย中文（台灣）