Configure iOS and macOS Devices for Mobile VPN with IKEv2 (2024)

Table of Contents
Automatically Configure VPNSettings Manually Configure VPN Settings FAQs

You can configure the native IKEv2 VPN client on iOS and macOS devices for a VPN connection to your Firebox. Fireboxes with Fireware v12.1 or higher support Mobile VPN with IKEv2.

To add the VPN connection, you can:

  • Automatically configure VPN settings — Download a pre-configured .MOBILECONFIG profile from the Firebox and install it on macOS or iOS devices.
  • Manually configure VPN settings — Manually configure an IKEv2 VPNconnection on Windows devices.

For information about which operating systems are compatible with each mobile VPN type, see the Operating System Compatibility list in the Fireware Release Notes. You can find the Release Notes for your version of Fireware OSon the Fireware Release Notes page of the WatchGuard website.

WatchGuard provides interoperability instructions to help our customers configure WatchGuard products to work with products created by other organizations. If you need more information or technical support about configuring a non-WatchGuard product, see the documentation and support resources for that product.

Automatically Configure VPNSettings

To automatically configure a VPN connection with a profile provided by WatchGuard, you must download a .TGZ file from your Firebox and extract the contents. This compressed file contains a README.txt instruction file and a .MOBILECONFIG profile. For information about how to download this file, see Configure Client Devices for Mobile VPN with IKEv2.

The profile creates a new IKEv2 VPN connection. It also installs the required CA certificate for the VPN connection.

See Also
How to use VPN App on iOS device - VPN Unlimited8 Best VPNs for iOS in 2024 — Secure, Fast & User-FriendlySetting up a VPN on your iPhone or iPad (iOS)Is a VPN safe for iPhone/iPad?

Tunneling Options

In Fireware v12.9 or higher, the Mobile VPN with IKEv2 configuration on the Firebox includes settings for split tunneling. If you configure split tunneling, the .MOBILECONFIG profile that you download from the Firebox and run on macOS and iOS devices includes a key that indicates clients should use the routes sent by the Firebox.

After you install the client configuration files:

  • The internal resources that you added to the Allowed Network Addresses list in the Mobile VPN with IKEv2 configuration are added to the routing table on the client. These routes are added on the client only when the connection is established.
  • These routes are bound to the specified VPN connection on the client. If the user computer has multiple VPN connections configured, these routes are not bound to the other VPN connections.
  • When the connection disconnects, these routes are deleted from the routing table on the client.

If you edit the Allowed Network Addresses list on the Firebox after you download and install the client configuration files on user computers:

  • Download updated client configuration files from the Firebox and reinstall those on user computers.
  • If you remove a host or network from the Allowed Network Addresses list, but you do not install updated client configuration files on user computers, VPN clients can initiate traffic to that host or network, but the Firebox denies the traffic.

You can also configure a full tunnel (default route) VPN. For information about split tunnel and full tunnel settings on the Firebox, see Edit the Mobile VPN with IKEv2 Configuration.

For information about split tunnel and full tunnel settings on clients, see Internet Access Through a Mobile VPN with IKEv2 Tunnel.

In Fireware v12.8.x or lower, you cannot configure split tunneling in the Mobile VPN with IKEv2 configuration on the Firebox. Fireware v12.8.x or lower supports connections from Mobile VPN with IKEv2 clients configured for split tunneling. However, you must manually configure IKEv2 clients for split tunneling. For example, you must manually add routes on the client computer for each remote network that you require access to. For Fireboxes with Fireware v12.8.x or lower, we do not provide customer support for split tunnel configurations on IKEv2 clients. See the documentation provided by your VPN client vendor. If you require split tunneling in Fireware v12.8.x or lower, we recommend that you use Mobile VPN with SSL. For information about Mobile VPN with SSL and split tunneling, see Options for Internet Access Through a Mobile VPN with SSL Tunnel.

Domain Name Suffix

See Also
What is a VPN on iPhone? A complete set up guide - Norton

In Fireware v12.9 or higher, the WatchGuard .MOBILECONFIG profile includes a domain name suffix if you specify one in the network (global) DNS settings on the Firebox. In the MobileVPN with IKEv2 configuration on the Firebox, you must select Assign the Network DNS/WINS settings to mobile clients. Mobile VPN clients inherit the domain name suffix.

For information about how to configure the network (global) DNS settings on the Firebox, see Configure Network DNS and WINS Servers.

For information about DNS settings in the Mobile VPN with IKEv2 configuration on the Firebox, see Edit the Mobile VPN with IKEv2 Configuration.

In the WatchGuard .MOBILECONFIG profile, the DomainName key in the IKEv2 dictionary value sets domain name suffix. The DomainName key is available in iOS 10.0 or later and macOS 10.12 or later.

In Fireware v12.8.x or lower, Mobile IKEv2 clients do not inherit a domain name suffix from the Firebox.

To automatically add a new IKEv2 VPN profile in macOS:

  1. Send the .mobileconfig file to your macOS computer.
  2. To import the file, double-click it. A Profile Installation message appears.
  3. Select System Preferences > Profiles.
  4. In the Profiles window, select the client profile.
  5. Click Install.
  6. When prompted to confirm the installation, click Install.
  7. From the Apple menu, select System Preferences > Network.
  8. To connect to the VPN, click the VPN connection that you added and click Connect.

To automatically add a new IKEv2 VPN profile in iOS:

  1. Send the .mobileconfig file to your iOS device.
  2. Open the message in the native iOS mail app and tap the .mobileconfig file.
    A Profile Downloaded message appears.
  3. Open the profile:
    (iOS 16) Tap Settings > General > VPN & Device Management.
    (iOS 15) Tap Settings > General > VPN & Device Management.
    (iOS 14) Tap Settings > General > Profile. In the Downloaded Profile section, tap the profile.
  4. Tap Install > Next > Install > Install.
  5. (Required) Specify the username and password.

    6. On iOS devices, you must type the user name and password when prompted. If you do not specify a user name and password, the VPN profile is created but does not work.

  6. Tap Done.
  7. On the Settings screen, tap VPN.
  8. To connect to the VPN, tap the VPN connection that you added.
  9. Slide the Status toggle to Connecting.

Manually Configure VPN Settings

You can manually add a new VPN connection rather than use the profile provided by WatchGuard.

To manually add a new IKEv2 VPN connection in macOS:

  1. Send the rootca.crt or rootca.pem file to your macOS computer.
  2. To install the certificate, click it.
    The Keychain Access application opens.
  3. Add the certificate to the existing list.
  4. Find the certificate in the list and double-click it.
  5. Expand the Trust menu. Change When using this certificate to Always Trust.
  6. From the Apple menu, select System Preferences > Network.
  7. To add a new service, click the + symbol.
  8. To configure the VPN, specify these settings:
  • Interface: VPN
  • VPN Type: IKEv2
  • Service Name: [Descriptive name such as MyCompany IKEv2 VPN]
  1. Click Create.
  2. On the next screen, specify these settings:
  • Server Address: [Firebox domain name or IP address configured for IKEv2 client connections]
  • Remote ID: [Firebox domain name or IP address configured for IKEv2 client connections]
  1. Click Authentication Settings and specify the user information:
  • Authentication Settings: Username
  • Username: [Your mobile VPN username]
  • Password: (Optional) To save your password for later use, specify it now.
  1. Click OK and then click Apply.
  2. To connect to the VPN, from the Apple menu, select System Preferences > Network.
  3. Click the VPN connection you added and click Connect.

To manually add a new IKEv2 VPN connection in iOS:

  1. Send the rootca.crt or rootca.pem file to your iOS device.
  2. To install the certificate, tap it. A Profile Downloaded message appears.
  3. (iOS 15) Tap Settings > General > VPN & Device Management > Install > Install > Done.
  4. Add a VPN Configuration:
    (iOS 16) Tap Settings > General > VPN & Device Management > VPN.
    (iOS 15) Tap Settings > General > VPN & Device Management > VPN.
    (iOS 14) Tap Settings > VPN.
  5. Click Add VPN Configuration.
  6. To configure the VPN, specify these settings:
  • Type: IKEv2
  • Description: [Descriptive name such as MyCompany IKEv2 VPN]
  • Server: [Host name or IP address of the Firebox]
  • Remote ID: [Host name or IP address of the Firebox]
  • User Authentication: Username
  • Username: [Firebox domain name or IP address configured for IKEv2 client connections]
  • Password: [Firebox domain name or IP address configured for IKEv2 client connections]

    • On iOS devices, you must type the user name and password when prompted. If you do not specify a user name and password, the VPN profile is created but does not work.

  1. Tap Done.
  2. To connect to the VPN, on the VPN screen, slide the Status toggle to Connecting.

Related Topics

About Mobile VPNwith IKEv2

Configure Client Devices for Mobile VPN with IKEv2

Configure Android Devices for Mobile VPN with IKEv2

Configure Windows Devices for Mobile VPN with IKEv2

Internet Access Through a Mobile VPN with IKEv2 Tunnel

Troubleshoot Mobile VPN with IKEv2

Give Us Feedback● Get Support● All Product Documentation● Technical Search

© 2024 WatchGuard Technologies, Inc. All rights reserved. WatchGuard and the WatchGuard logo are registered trademarks or trademarks of WatchGuard Technologies in the United States and other countries. Various other trademarks are held by their respective owners.

Configure iOS and macOS Devices for Mobile VPN with IKEv2 (2024)

FAQs

Configure iOS and macOS Devices for Mobile VPN with IKEv2? ›

Go to Settings -> Network & internet -> VPN, then tap the "+" button. Enter a name for the VPN profile. Select IKEv2/IPSec RSA from the Type drop-down menu. Enter Your VPN Server IP (or DNS name) in the Server address field.

Discover More Details ›
How do I setup my IKEv2 VPN on my Mac? ›

Setup IKEv2 on macOS
  1. IKEv2 is only available on macOS 10.11 and above. ...
  2. Click on "+".
  3. Select "VPN" in the dropdown menu "Interface" and "IKEv2" as VPN Type. ...
  4. Select a server in the members area and put the alternative server address as "Server Address" and hide.me as "Remote ID:".

Know More ›
How to configure IKEv2 VPN on iPhone? ›

Setup IKEv2 on iPad / iPhone
  1. Click on "Settings".
  2. Click on "General".
  3. Click on "VPN".
  4. Click on "Add VPN Configuration...".
  5. Take over the settings from the screenshot and set as "Description": hide.me VPN and select a server in the members area and put the alternative server address as "Server".

View More ›
How to setup IKEv2 VPN connection? ›

Go to Settings -> Network & internet -> VPN, then tap the "+" button. Enter a name for the VPN profile. Select IKEv2/IPSec RSA from the Type drop-down menu. Enter Your VPN Server IP (or DNS name) in the Server address field.

View Details ›
What is IKEv2 in VPN? ›

Internet Key Exchange version 2 (IKEv2) is a tunneling protocol, based on IPsec, that establishes a secure VPN communication between VPN devices and defines negotiation and authentication processes for IPsec security associations (SAs). Various VPN providers refer to this combination as IKEv2/IPsec, or IKEv2 VPN.

Find Out More ›
Does macOS support IKEv2? ›

The IKEv2/IPSec protocol will not be accessible through future builds of macOS and iOS applications. The IKEv2/IPSec protocol remains available as an option for manual VPN connection setups.

Get More Info Here ›
Which operating system supports IKEv2 VPN? ›

IKEv2 is supported on Windows 10 and Server 2016. However, in order to use IKEv2 in certain OS versions, you must install updates and set a registry key value locally. OS versions prior to Windows 10 aren't supported and can only use SSTP or OpenVPN® Protocol.

View Details ›
Does iOS support IKEv2? ›

This VPN connection type is supported on iOS devices. It is not supported on Android, macOS, and Windows devices. Internet Key Exchange version 2 (IKEv2) is the default VPN setting for iOS. The IKEv2 is used to create a security association in the IPSec (Internet Protocol Security) suite.

Explore More ›
How to add VPN configuration iOS? ›

Here's how to manually enable a VPN to work on your iPhone:
  1. Tap on your “Settings” app on the Home Screen of your iPhone.
  2. Choose “General.”
  3. Press “VPN.”
  4. Tap “Add VPN Configuration.”
  5. Press “Type” and pick the type of VPN protocol you're using. ...
  6. Type in a description, remote ID, and a server for the VPN.

Know More ›
What is the username and password for IKEv2 VPN? ›

On your Android device, go to Google Play , search and install strongSwan VPN Client app. VPN Type – IKEv2 EAP (Username/Password). Username – your IVPN account ID that begins with letters 'ivpnXXXXXXXX' or 'i-XXXX-XXXX-XXXX' (case-sensitive). Password – ivpn .

Discover More ›

What is the difference between IKEv2 and IKEv2 IPSec? ›

IPSec / IKEv2

Internet key exchange version 2 (IKEv2) is often used in combination with Internet Protocol Security (IPSec). IKEv2 forges a secure tunnel connecting the user to the VPN server, while IPSec provides the encryption and authentication.

Get More Info ›
What ports are open for IKEv2? ›

  • For IKEv2:
  • IP Protocol Type=UDP, UDP Port Number=500 <- Used by IKEv2 (IPSec control path)
  • IP Protocol Type=UDP, UDP Port Number=4500 <- Used by IKEv2 (IPSec control path)
  • IP Protocol Type=UDP, UDP Port Number=1701 <- Used by L2TP control/data path.
  • IP Protocol Type=50 <- Used by data path (ESP)

Read On ›
What is the server address for IKEv2? ›

And the IKEv2 VPN server does not have a router address, so you have to specify the DNS server address. If it is not specified, the client will not be able to resolve any name. The default DNS server is 78.47. 125.180 (this is the IP we purchased for the name my.keenetic.net).

Keep Reading ›
Is IKEv2 a good VPN? ›

IKEv2 offers a more stable and consistent VPN connection than IKEv1—due to its support of MOBIKE (Mobility and Multi-homing Protocol). Using encryption keys for both ends of the VPN connection, IKEv2 is more secure than IKEv1. With its built-in NAT traversal, IKEv2 establishes a connection much faster than IKEv1.

Get More Info ›
Which VPN is best IKEv2 or IPsec? ›

IPsec is a data-transporting tunnel that establishes a secure data transmission to a VPN server. That is why IKEv2 needs IPsec – thanks to this combination, the connection is both fast and well-protected. So in the IKEv2 vs. IPsec dispute, there is no winner.

See Details ›
What is IKEv2 mostly used for? ›

IKEv2 is used for secure VPN communication between VPN-capable devices and defines the negotiation and authentication for IPsec security associations. As it's one of the most popular VPN tunneling protocols, let's take a deeper look at it in this article.

Get More Info Here ›
How do I manually configure a VPN on my Mac? ›

Enter VPN settings manually

On your Mac, choose Apple menu > System Settings, then click Network in the sidebar. (You may need to scroll down.) Click the Action pop-up menu on the right, choose Add VPN Configuration, then choose the type of VPN connection you want to set up.

Tell Me More ›
How do I setup a VPN on my Mac? ›

On your Mac, choose Apple menu > System Settings, then click VPN in the sidebar. (You may need to scroll down.) On the right, click the Info button next to the VPN service you want to modify. If needed, change settings.

Get More Info ›
Does Apple have a built in VPN? ›

The iPhone doesn't have a built-in VPN but has VPN settings if you wish to build or install one. To make a VPN work, you would need to complete a manual setup and find a server to connect to, which is not an option for most users.

Discover More Details ›
Top Articles
What is WireGuard: VPN protocols 101 - Surfshark
Die 7 besten VPNs fürs Handy 2024: Sicher, schnell & intuitiv
Free Paper Shredding Events in Columbus, Ohio 2024
Shred Days, free confidential document shredding
Eden Fresh Weekly Ad
The 2024 Ford Mustang Is The Last Great V8-Powered Muscle Car
Craigslist Free Appliances Near Me
LSC Smart Plug + Tasmota EOL? - Duurzame energie en installaties
Prentice Hall Biology Workbook Answers Pdf
Currency Converter | Foreign Exchange Rates | Wise
The Mcfiles Facebook
Antonia Lofaso Net Worth, Restaurant, Daughter,Age, and More
Latest Posts
WireGuard VPN: wat is het en hoe werkt het? | NordVPN
WireGuard: veilig en supersnel VPN-protocol - VPN Nederland
Article information

Author: Zonia Mosciski DO

Last Updated:

Views: 5696

Rating: 4 / 5 (51 voted)

Reviews: 90% of readers found this page helpful

Author information

Name: Zonia Mosciski DO

Birthday: 1996-05-16

Address: Suite 228 919 Deana Ford, Lake Meridithberg, NE 60017-4257

Phone: +2613987384138

Job: Chief Retail Officer

Hobby: Tai chi, Dowsing, Poi, Letterboxing, Watching movies, Video gaming, Singing

Introduction: My name is Zonia Mosciski DO, I am a enchanting, joyous, lovely, successful, hilarious, tender, outstanding person who loves writing and wants to share my knowledge and understanding with you.