Windows VPN Server, IKE VPN Error

I've setup a Windows 2012R2 VPN server with IKEv2 and SSTP.

Public Certificate has been installed and users can connection just fine using SSTP.

Also, from an internal 2012R2 server I'm able to connect to the VPN server using IKEv2 using the public hostname.

However, from external users when they try and connect using IKEv2 I get an error, see attached images.

The firewall in use is a Sonicwall NSA.

The ports being NAT'd are:

    IP Protocol Type=UDP, UDP Port Number=500   <- Used by IKEv2 (IPSec control path)
    IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv2 (IPSec control path)
    IP Protocol Type=UDP, UDP Port Number=1701  <- Used by L2TP control/data path
    IP Protocol Type=50 <- Used by data path (ESP)

In the Sonicwall I've also checked the box for: "Preserve IKE Port for Pass Through Connections" and also disabled the WAN VPN Group so its not using IKE.

See attached security configuration for clients. This works for an internal client but not an external one.
Win-10-Connection-Error.PNG
Win-7-Connection-Error.PNG
IKEv2-settings.PNG
RFVDBAsked:
Who is Participating?
 
RFVDBAuthor Commented:
Looks like the issue is with the Windows Client when the Firewall is behind a NAT for IKEv2. I just tried this Microsoft KB handling on a Windows 7 PC and it allowed the IKEv2 connection just fine.

https://support.microsoft.com/en-us/kb/926179

I didn't have to import any certificate of any kind as I'm using a public certificate on the server.

I'm trying this on Win 10 and I'll let you know on the results.
0
 
Manuel FloresCommented:
Could you try to configure in NAT-T (transversal mode)?
0
 
Adam BrownSr Solutions ArchitectCommented:
IKEv2 requires that the computer or user connecting to the VPN have a valid certificate to provide the underlying PKI encryption. Basically, if you don't have certificates installed on the client machines that they can use to authenticate themselves, IKEv2 won't work. It requires an Internal CA or Client certificates from a Third Party CA (super expensive).
0
 
RFVDBAuthor Commented:
Just tried that article that supposed only works for Windows Vista and Server 2008 and it works on Windows 10. I was able to now connect using IKEv2.
0
 
RFVDBAuthor Commented:
I figured out the finite solution in the end and thus selected my answer as the best solution.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.