Configuring IPsec IKEv2 Remote Access VPN Clients on Android

Note

Android considers using a VPN an action that must be secure. When activating
any VPN option the OS will force the user to add a lock method to the device
if one is not already present. It does not matter which type of lock is
chosen (PIN lock,Pattern lock,Password,etc) but it will not allow a VPN to
be configured until a secure lock has been added.

Android devices Face lock ,that is is available secure lock
type .

There are two methods to configuring IKEv2 on Android: Natively on Android 11.x
and later,or using the strongSwan app from the Play Store.

Native IKEv2 on Android

Android 11.x later include IKEv2 client options compatible
mobile IPsec pfSense ® software . example is covers covers EAP – MSCHAPv2
works EAP – RADIUS .

Note

The settings below are from pure Android 11.x. These exact settings may not
present on all Android devices,depending on the Android version and changes
made by the OEM.

Import the Server CA

validate server ,client is needs needs know server certificate .
Android IKEv2 client is validate validate entities imported
user .

Note

Though this validation is optional it is the best practice as otherwise the
client cannot verify it is connecting to the correct server.

Warning

Installing self – signed root Android manner carries
danger impersonate servers . danger is is
lower controlled firewall administrators warnings
presented confuse worry end users .

If this is unacceptable,use the strongSwan application instead. It can
validate against an existing root CA as well as validating a CA without
installing it into the operating system trust store.

• Copy the certificate to the device

• Swipe down twice from the top of the screen

• Tapthe Settings cog

• TapSecurity,Encryption & Credentials

• TapInstall a certificate

• Tapcertificate

• Read warning text

• TapInstall to continue

• Locate and tap the certificate which was copied to the device

Setup the VPN Connection

• Swipe down twice from the top of the screen

• Tapthe Settings cog

• TapNetworks & Internet,Advanced,VPN

• Tap+

• Enter the connection settings as follows:

  Name:

  ExampleCo Mobile VPN or another suitable description

  Type:

  IKEv2/IPsec MSCHAPv2

  Server Address:

  The address of the server.

  Note

  This must match a value in the server certificate. For example,a
  hostname or IP address in a certificate SAN entry.

  IPsec Identifier:

  The identifier on the EAP pre-shared key for this user (e.g. a username or
  e-mail address)

  IPsec CA Certificate:

  Select the imported CA (optional,but the best practice)

  Username:

  The identifier for this user again.

  Password:

  The EAP key value associated with the identifier for this user.

• TapSave

Connecting and Disconnecting

To Connect:

• Swipe down twice from the top of the screen

• Tapthe Settings cog

• TapNetworks & Internet,Advanced,VPN

• Tapthe name of the VPN

• TapConnect

Android displays a key icon in the notification bar near the network status
icons and clocks while a VPN is connected.

To Disconnect:

• Swipe down twice from the top of the screen

• Tapthe Settings cog

• TapNetworks & Internet,Advanced,VPN

• Tapthe name of the VPN

• TapDisconnect