Description:

This document describes how to set up an IKEv2 connection between an Android device (smartphone or tablet) and a LANCOM R&S®Unified Firewall.


Requirements:


The availability of IKEv2 in Android depends on the manufacturer of your mobile device. E.g. the manufacturer Samsung implements IKEv2 in many Android versions while other manufacturers forego to do so. If IKEv2 isn't supported by your Android device you have to use an additional VPN client app.




Scenario:

1) The Unified Firewall is connected directly to the Internet and has a public IPv4 address:


2) The Unified Firewall is connected to the Internet via an upstream router:




Procedure:

The setup for scenarios 1 and 2 are basically the same. Scenario 2 additionally requires port and protocol forwarding to be set up on the upstream router (see section 3).

1) Configuration steps on the Unified Firewall:

1.1) Connect to the configuration interface of the Unified Firewall and navigate to VPN → IPSec → IPSec Settings.

1.2) Activate IPSec.

1.3) Switch to VPN → IPSec → Connections and click on the “+” icon to create a new IPSec connection.

1.4) Save the following parameters:

If you have created your own template or security profile , you can use these here.

1.5) Change to the Tunnels tab and enter the following parameters:

1.6) Change to the Authentication tab and enter the following parameters:


The local and remote identifiers must not match!


Depending on the used smartphone and its Android version, it is possible that only a local identity is supported (Remote Identifier on the Unified Firewall). If both identities are configured on the Unified Firewall, this may lead to the VPN connection not being able to be established. In this case the Local Identifier on the Unified Firewall has to be left empty in the configuration.

1.7) Click the icon to create a new VPN host.

1.8) Save the following parameters:

1.9) In the VPN host click on the "connection" icon and, to open the firewall objects, click on the network object that the Advanced VPN Client should access.

1.10) Use the “+” sign to assign the required protocols to the VPN host.

A Unified Firewall uses a deny-all strategy. You therefore have to explicitly allow communication.

Firewall objects can also be accessed via Desktop → Desktop Connection and clicking on the “edit” icon. 

1.11) Finally, implement the configuration changes by clicking Activate in the firewall.

1.12) This concludes the configuration steps on the Unified Firewall.



2) Manual setup of the VPN connection on your smartphone or tablet PC:

2.1) Open the Settings menu and, under Connections, select the menu item More networks.

2.2) Select the option VPN.

2.3) Tap on the “+” icon in the top right-hand corner to create a new entry.

2.4) In the next dialog box, enter the following settings:

2.5) Tap Save to store the configured VPN profile.

2.6) To start the VPN connection, just tap the newly created VPN profile.



3) Setting up port and protocol forwarding on a LANCOM router (scenario 2 only):

IPSec requires the use of the UDP ports 500 and 4500 as well as the protocol ESP. These must be forwarded to the Unified Firewall.

Forwarding the UDP ports 500 and 4500 automatically causes the ESP protocol to be forwarded.

If you are using a router from another manufacturer, ask them about appropriate procedure.



If the UDP ports 500 and 4500 and the ESP protocol are forwarded to the Unified Firewall, an IPSec connection to the LANCOM router can only be used if it is encapsulated in HTTPS (IPSec-over-HTTPS). Otherwise, no IPSec connection will be established.

3.1) Open the configuration for the router in LANconfig and switch to the menu item IP-Router → Masq .  → Port forwarding table .

3.2) Save the following parameters:

3.3) Create a further entry and specify the UDP port 4500.

3.4) Write the configuration back to the router.