Business Community > All Threads > Need advice for Ipsec IKev2 settings
< All Threads

Need advice for Ipsec IKev2 settings

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

Need advice for Ipsec IKev2 settings

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
Need advice for Ipsec IKev2 settings
Need advice for Ipsec IKev2 settings
2022-02-19 13:05:48
Model: ER605 (TL-R605)  
Hardware Version: V1
Firmware Version: 1.2.0

Hi all,

 

sorry for this long message :-)

I have been able to setup either L2TP or Openvpn client to LAN access to my home network, but I am still not able to setup an Ipsec IKev2 policy for client to LAN access. And I would like to use Ikev2, considering Ikev2 is described as more secure thant Ikev1 used in L2TP/IPsec access, and because I would like to avoid needing to install a dedicated application such as Openvpn Connect to connect.

 

My setup is the following : my ISP provided gateway is on local segment 192.168.1.x, on which is connected my ER605 router :

 

- Isp Gateway = 192.168.1.1

- ER605 Router (wan side) = 192.168.1.2 (set as static address)

- a route is defined on my Isp Gateway, to give access to 192.168.0.0 network through my router (192.168.1.2) 

And note : the DHCP of the ISP gateway is off 

 

The LAN managed by the router is indeed defined as follows :

 

- ER605 Router (LAN side) = 192.168.0.1

- Subnet 255.255.255.0

- DHCP distributing IP addresses between 192.168.0.130 and 192.168.0.135 (I have very few unknown equipment which may connect to my network at the same time)

- Numerous static addresses defined between 192.168.0.2 and 192.168.100, for well identified equipment

 

As I only want to be able to connect to my LAN from distant PC's or smartphones with an Ikev2 IPsec policy, I try to setup an adequate client-to-LAN policy, but can't manage to do that. Hereafter my questions - many many thanks if you can help me :

 

1 - for Remote Host, I still have doubts on what to put : I tried 0.0.0.0 considering my remote equipment I will use to connect to my LAN will have varying IP addresses, but I'm not 100% sure that this setting corresponds to the possible client IP addresses, just because of the word "Host". Shall I keep 0.0.0.0 ? I also made attempts with my domain name due to this word "host", but without more success in my various attempts.

 

2 - for Local subnet, I also still have doubts :

- my first idea was to put 192.168.0.0/24 which is the mask of my LAN,

- but I saw that when I had successfully setup a L2TP access (which had automatically set an IPsec policy), it had defined 192.168.1.2/32 as local subnet. Honestly I don't really understand this. Of course I tried also doing it when setting my own IPsec policy, but with no success.

- What would you recommend for that ?

 

3 - In the advanced settings section (allowing to choose Ikev2), I also have doubts on the choice of the Negotiation mode (initiator or responder). I thought "responder" was adapted to my need, but I'm not sure, and the information provided in the router standalone menu is confusing, as it says the same for both initiator and responder modes : "The local device initiates a connection to the peer.".

 

4 - For the IP address pool, I would like to have the possibility to define an IP address range on the 192.168.0.x segment, in order to avoid problems when connecting to other equipment on the LAN (and since 1.2.0 firmware, when configuring an Openvpn or L2TP/Ipsec access, it is possible to define an IP address pool on the same segment than the router LAN port, which helped me solving connection issues with some LAN equipment when I had to use a different segment previously).  But when trying to do so (for example 192.168.0.192/27, which worked for Openvpn), It says me :

- either "The IP pool subnet and the local subnet should not be in the same network segment", if I have defined 192.168.0.1/24 as local subnet,

- or "The IP pool subnet and the IP address of the LAN port should not be in the same network segment", if I have defined 192.168.1.2/32 as local subnet (as automatically defined when using L2TP/IPsec vpn access),

=> So I'm a bit lost on this setting also... If you have an advice, thanks a lot.

 

5 - For Local and Remote ID's, I tried to keep the default "IP Address" setting, but I have doubts because when trying to add an IKev2 VPN configuration on my iPhone, it requests at least a Remote ID name. So I'm not sure if I can let it with "IP Address" default setting. Is it possible, or should I define some names ?

 

And I didn't investigate the other settings such as crypting methods, because I want first to make it work "basically"... but I already struggle a little :-)

 

Again, sorry for this long message... I hope that my questions were clear enough, and many thanks if you can help me !

 

Best regards,

 

Benjamin

  0      
 
  0      
 
#1
Options
7 Reply
Re:Need advice for Ipsec IKev2 settings
2022-02-23 13:19:13

  @Ben-91 

 

I can set up openVPN on the same network segment, is your Omada gateway the latest 1.2 firmware?

Just striving to develop myself while helping others.
  0  
  0  
#2
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-23 15:39:15

  @Virgo Hi Virgo, thanks for your reply. Yes I have the latest firmware update, and I confirm I could chose a VPN IP Pool on the same segment than the LAN port when using OpenVPN (it works also using L2TP/Ispec method).

On the opposite, it seems it is not possible when using Ikev2 protocol (which is the point 4 raised in my post)  introduced in standalone mode in the latest firmware. But anyway I did not manage to make the Ikev2 IPSec policy work, blocked by the other points 1/2/3/5 for which I did not find yet the solution.

 

Best regards,

 

Benjamin

 

  0  
  0  
#3
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-24 06:31:08
1. The Remote Host can be 0.0.0.0 means any IP range. Tplink only mentioned this in their standalone guide but I believe it also works for controller: https://www.tp-link.com/us/support/faq/2162/; 3. Yes, Responder Mode should be correct; 4. It seems like a limitation on firmware, once you use IPSec VPN, no matter LAN-to-LAN or Client-to-LAN, we can't use the same IP range as your local LAN; 5. It doesn't matter, if your client devices want ID, just choose Local ID Type: Name. Make sure your Local ID is the remote ID on Client side(and remote ID should be local ID on the client)
  1  
  1  
#4
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-24 13:36:35

  @Somnus Thanks Somnus ! I use my router in standalone mode, so I think you advice will well apply for my first question, and I will try to apply your solutions for points 3 and 5 (in particular, I'm not sure I defined correctly the local/distant ID's). For the point 4, I think you're right: when defining directly Ipsec policy it seems you have to set a different IP range than the LAN port, which remains surprising to me, because when using L2TP/Ipsec VPN option, with the last firmware you can use the same one in VPN IP pool definition. Maybe a next firmware update could enable it also for user defined Ipsec policies.

For the local subnet definition, do you recommend me to put 192.168.0.0/24 which is the "real" LAN mask, or shall I stick to 192.168.1.2/32 automatically defined when using L2TP/Ipsec VPN option ? (just to eliminate another possible cause :-)).

Thanks again !

 

Benjamin

  0  
  0  
#5
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-24 20:18:57

Hi, I tried tonight with 0.0.0.0 as remote host, responder mode, and correct local and remote IDs, and still did not manage to make it work :-(

For the local subnet I tried either 192.168.0.0/24 (subnet mask on my router lan side)  or 192.168.1.2/32 (ip of my router on my gateway lan segment - which was the setting working with automatic L2TP/Ipsec definition), and none has worked. And of course, I tried these defining an IP address pool (192.168.3.100/29) on a different segment than my router lan port. Not able to find any solution... and really I don't see the problem. Any idea warmly welcome, thanks in advance.

 

Benjamin

  0  
  0  
#6
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-25 06:00:09

  @Ben-91 1. The local subnet should be 192.168.0.0/24;

 

2. The Modem should open port 500 and 4500 for IP 192.168.1.2 (tplink router WAN IP address)

 

3. Have you checked the settings on your client side? You will need to check the remote host (server IP), it should be your Modem Internet IP; and also need to check the IKE phase-1 /Phase-2 settings make sure they have the same option as your tplink router. 

 

Well, from here I will recommend OpenVPN. Much easier! 

  0  
  0  
#7
Options
Re:Need advice for Ipsec IKev2 settings
2022-02-25 07:36:23 - last edited 2022-02-25 07:57:27

  @Somnus Hi Somnus, many thanks for these advices !

 

I tried, adding NAT rules on my gateway to direct traffic from external 500 and 4500 ports to internal 500 and 4500 ports on IP 192.168.1.2, unfortunately it did not solve the problem. Without being sure it would be useful, I also tried with NAT rules on my router thanks to the virtual servers option, directing 500/4500 ports external traffic to 192.168.0.1 (my router gateway IP on LAN side) 500/4500 ports, but without more effect.

I know also that the modem IP I defined is OK - it works perfectly in OpenVPN and L2TP/Ipsec modes.  Last, for IKE Phase 1 / Phase 2 settings, I have no options to set them on the iPhone I use to check the connection. I had googled this topic last few days and concluded that the default options on the router should be OK.

 

As a conclusion, I think I will give up, and as you recommend, stay with OpenVPN which works flawlessly and without any complicated setting (except the fact to replace the WAN IP address in the automatically generated certificate by the modem IP address). 

 

Again, many thanks to have tried solving this issue !

 

Benjamin

 

Edit : I also tried with a PC operating Windows 10, selecting Ikev2 vpn type. I get an error message indicating that the strategies do not match. So maybe it means :

- that my router can be reached, which would be a first positive sign :-)

- but that I should deep dive in router ikev2 strategies settings for phase 1 and phase 2, in order to fulfill Windows 10 and iPhone settings... but first searches did not give very fruitful results. 

  0  
  0  
#8
Options

Information

Helpful: 0

Views: 2582

Replies: 7

Related Articles
Need advice for ER605 v2.0 settings
536 0
ER605v1: need of sha2 and dh14 options in IKev2 VPN settings
985 4
VPN Ipsec IKE v2 PSK
408 0
VPN IPSEC IKEv2 on er605 v2
2549 0
IKEv2/IPsec Support for ER605
684 0
IPSec IKEv2 VPN with internet access
1200 0
About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.