topic Re: migrating remote access client to IKEv2 in Endpoint

migrating remote access client to IKEv2

flachance — Mon, 22 Jun 2026 15:20:12 GMT

So we want to move or client from using IKEv1 to v2.

On the gateways we've selected Prefer IKEv2, support IKEv1.

We've started pushing registry changes to set disable_ikev2 to 0. I can't seem to find a way to verify if people connect with IKEv1 or v2.

vpn tu tlist doesn't show that info. I tried fw tab -t userc_key -f and it shows Schema: IKE(3). Anyone knows what IKE(3) means?

Or any other way to show which IKE version clients are using?

thanks

Re: migrating remote access client to IKEv2

PhoneBoy — Mon, 22 Jun 2026 22:37:56 GMT

I believe it will show in the log entry when the user connects.
That said, I've seen reports that suggest the registry change on clients will cause the clients to use IKEv2 only.

Re: migrating remote access client to IKEv2

Lesley — Wed, 24 Jun 2026 19:25:56 GMT

Indeed try to filter with: action:Connect AND "Remote Access" or action:Login AND "Remote Access"

Re: migrating remote access client to IKEv2

flachance — Wed, 24 Jun 2026 19:34:32 GMT

I can filter with action:"Log In" AND blade:"Mobile Access". All I see in the details is

Data Protocol IPSec

Data Encryption AES-256 + SHA256 + Group 14, Certificate

Nothing about IKEv1 or v2

Re: migrating remote access client to IKEv2

Lesley — Wed, 24 Jun 2026 19:39:31 GMT

can I have a vpn tu tlist output of a few clients? Just remove the external IP info, dont need that.

Also anything in cpview? There should a global counter for ikev1 and ikve2 tunnels to give you a global idea what is mostly used

Re: migrating remote access client to IKEv2

flachance — Wed, 24 Jun 2026 19:46:53 GMT

Didn't think to look at cpview. It does show the Concurrent IKEv1 SAs and IKEv2 SAs.

Unfortunately for me IKEv2 SAs shows 0. ☹️

So with the gateway set to Prefer IKEv2, support IKEv1 and the registry change on the client it' s still using IKEv1. Or it fails IKEv2 and reverts to v1.