topic Re: migrating remote access client to IKEv2 in Endpoint

migrating remote access client to IKEv2

flachance — Mon, 22 Jun 2026 15:20:12 GMT

So we want to move or client from using IKEv1 to v2.

On the gateways we've selected Prefer IKEv2, support IKEv1.

We've started pushing registry changes to set disable_ikev2 to 0. I can't seem to find a way to verify if people connect with IKEv1 or v2.

vpn tu tlist doesn't show that info. I tried fw tab -t userc_key -f and it shows Schema: IKE(3). Anyone knows what IKE(3) means?

Or any other way to show which IKE version clients are using?

thanks

Re: migrating remote access client to IKEv2

PhoneBoy — Mon, 22 Jun 2026 22:37:56 GMT

I believe it will show in the log entry when the user connects.
That said, I've seen reports that suggest the registry change on clients will cause the clients to use IKEv2 only.

Re: migrating remote access client to IKEv2

Lesley — Wed, 24 Jun 2026 19:25:56 GMT

Indeed try to filter with: action:Connect AND "Remote Access" or action:Login AND "Remote Access"

Re: migrating remote access client to IKEv2

flachance — Wed, 24 Jun 2026 19:34:32 GMT

I can filter with action:"Log In" AND blade:"Mobile Access". All I see in the details is

Data Protocol IPSec

Data Encryption AES-256 + SHA256 + Group 14, Certificate

Nothing about IKEv1 or v2

Re: migrating remote access client to IKEv2

Lesley — Wed, 24 Jun 2026 19:39:31 GMT

can I have a vpn tu tlist output of a few clients? Just remove the external IP info, dont need that.

Also anything in cpview? There should a global counter for ikev1 and ikve2 tunnels to give you a global idea what is mostly used

Re: migrating remote access client to IKEv2

flachance — Wed, 24 Jun 2026 19:46:53 GMT

Didn't think to look at cpview. It does show the Concurrent IKEv1 SAs and IKEv2 SAs.

Unfortunately for me IKEv2 SAs shows 0. ☹️

So with the gateway set to Prefer IKEv2, support IKEv1 and the registry change on the client it' s still using IKEv1. Or it fails IKEv2 and reverts to v1.

Re: migrating remote access client to IKEv2

dunkelmorten — Wed, 01 Jul 2026 10:54:33 GMT

Yes, indeed to be found at cpview: software-blades > VPN > Overview

An additional indicator could be the FW log for 'action:"Key Install" which is showing information like:
VPN Feature: IKE

or in section "More":
Ike: Quick Mode completion (which is in indicator for IKEv1) as there ain't no Quick Mode on IKEv2.

Re: migrating remote access client to IKEv2

PeterH — Fri, 17 Jul 2026 13:49:05 GMT

vpn tu list ike

Peer 10.131.32.254, user md5 d5d97eebc9c840d3:

Realm: vpn

Machine cert authentication: false

IKEv2 SA <e9b394c9b4ac0872,d206797d57731d61>

Unfortunalty it works only once per client. Each time the user disconnect and reconnect again, he didn't not succeed, until the connection IKEv2 SA timed out and "vpc tu tlist" is empty for this user. Otherwise in our testing environment, we reboot the gateway and afterwards it works again, but only once.

TAC case is open