Enabling IKEv2 on Windows clients

[flachance]

So according to sk166415, to enable IKEv2 on Windows clients you need to make a registry change;

configure disable_ikev2 to 0 in HKLM\SOFTWARE\WOW6432Node\CheckPoint\TRAC, the reboot the device.

Is this the only way?  Can't be done via trac_client_1.ttm? Or trac.config?

thanks

[Aaron-pr]

I have the exact same question and went through our account rep's technical expert trying to come up with a solution but nothing so far. With the latest CVE, Check Point needs to do an emergency release of the Check Point Endpoint Security VPN for Windows with IKEv2 enabled by default (or at least put a way to enable it within the GUI). Expecting that all users/situations will have the ability to modify the registry is not acceptable.  

[PhoneBoy]

Right now, the registry is the only way to enable IKEv2 on the Remote Access clients...which also disables IKEv1 support.
Hopefully this will be addressed soon.

[Lubomir_Cerny]

So does it means, that gateway has possibility "Prefer ikev2, support ikev1" but client has only one option ? ie "ikev2 only" or "ikev1 only" ?

[PhoneBoy]

That's what at least one report on the community suggested.
Additional confirmation would certainly be helpful. 

[ccsjnw]

The latest release notes for CheckPoint Remote Access VPN Client E89.30 for Windows (released on 29 October 2026), mentions support for IKEv2 was added:

But there is absolutely no information as to what ESVPN-4523 affects. The sk article is just a link to the main R82 Quantum release features page.

Please can CheckPoint provide more information about what has actually been added / changed / updated?

Should the Windows VPN client now be able to negotiate IKEv2 or IKEv1 depending on how the Security Gateway is configured, without using the terrible Registry hack to force one or the other methods? If so, this is a momentous release! 

[Lubomir_Cerny]

We have tested in lab and the only setting we can see is registry setting HKLM\SOFTWARE\WOW6432Node\CheckPoint\TRAC\disable_ikev2 = 0 

Means this is not blocked on client level anymore and we can setup GW to preffer ikev2 with ikev1 fallback. So any VPN client with version 89.30 is able to accept ikev2. The small issue is that we need to push all our vpn external partners to update to new client before force this 🙂 So another feature the auto update is usefull and needed. 

[ccsjnw]

If you are using the full Workspace EndPoint Protection Client (previously called Harmony EndPoint Protection Client), and you are managing your clients centrally, then you can now auto-update the latest (or a specific) version of the client. 

But if you are using the vanilla CheckPoint Mobile VPN Client, then there isn't currently an option to auto-update.

[Lubomir_Cerny]

Yes, there is auto update process for external VPN clients.
See: Automatic Upgrade from the Security Gateway

Automatic update file:
Windows 89.30: https://support.checkpoint.com/results/download/138928
Mac OSX 89.40: https://support.checkpoint.com/results/download/143337

Work for R82 with Mobile Access Blade.

[jorgeluiznim]

As a workaround, I created a Compliance Rule under the policy (Application Control > Compliance & Posture > Compliance Rulebase) to automatically validate and remediate the registry setting required for IKEv2.

The rule checks Windows endpoints and verifies the existence/value of the registry key:

HKLM\SOFTWARE\WOW6432Node\CheckPoint\TRAC\disable_ikev2

If the key is not configured as required, the Compliance Rule performs a remediation action, updating the registry value to:

disable_ikev2 = 0

Configuration details:

• Operating System: Windows All
• Action Type: Applications/Files Check
• Registry Check: Enabled
• Registry Path: HKLM\SOFTWARE\WOW6432Node\CheckPoint\TRAC\disable_ikev2
• Registry Value: 0
• Action: Update
• Registry Type: REG_DWORD
• Validation: Check that the registry entry exists

This approach avoids the need to manually modify the registry on each endpoint and provides centralized enforcement through the Compliance Blade. A reboot is still required for the endpoint to fully apply the IKEv2 configuration, as described in SK166415.

[Lubomir_Cerny]

This or GPO is OK for internal users but can not be used for our external VPN users/contractors.
I hope future client versions will solve this.

[MariuszMajewski · Accepted solution]

Hi,

I have managed to edit the registry in the MSI installer itself.
Download Windows SDK, (after download when installing from the install list choose just MSI tools).
https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/

go to 

C:\Program Files (x86)\Windows Kits\10\bin\<SDK-version>\x86\

and run Orca-x86_en-us.msi and then:

1. Make a copy of your checkpointVPN.msi
2. Open the copy of msi in Orca.
3. Select the Registry table.
4. Find disable_ikev2 in the Name column.
5. Change Value from #1 to #0. Keep the # so it remains a DWORD.
6. Select File -> Save and close Orca.