IKEv2 Remote Access guides?

[MikeH]

We have a customer with a requirement to provide remote access connectivity using IKEv2 via the native operating system (no client) VPN supplicant (Windows, MacOS, possibly iOS and Android) and connect to Gateways  running R80.40.  Has anyone successfully done this and have any guides they'd be willing to share?  Figured out how to navigate the conflicting encryption/authentication methods between the various OSes?

[G_W_Albrecht]

No. No secure solution available - and R80.40 will be end of support in 8 months...

[_Val_ · Accepted solution]

Please refer to sk166415 for the answer, which is "No, not at this moment". If you have a business case for this, please raise an RFE through the usual channels.

[lgarridor]

This SK is also valid for Gaia embedded  right?

[PhoneBoy]

It's not explicitly listed, but it should apply there as well.
Note that the release notes for R82 EA explicitly lists IKEv2 support.
It also requires specific Endpoint client versions.

R82 is planned for Embedded Gaia also.

[Alex-]

Interestingly, we find this in the release notes of R81.20 Take 70:

PRJ-48210, PMTR-91011

VPN

IKEv2 Remote Access stability issues.

[PhoneBoy]

Yes, because some clients already use IKEv2:

• Capsule VPN clients, which are largely wrappers around the built-in supplicants in the underlying OS, e.g. Windows).
• Strongswan for Linux, which has been supported since R81.

R82 will add support for IKEv2 for our native (Windows, macOS) VPN clients.

Whether you will be able to configure IKEv2 in e.g. Windows without Capsule VPN is a separate question.