<![CDATA[IKEv2 on PF2.2.2, iOS seems to send DELETE IKE_SA??]]>Hi everyone,

I try to establish an IKEv2 Tunnel from my Iphone to my pfsense. I tried it with 2.2.1 and iOS 8.2.x. The connection seems to come up for some seconds, but then iOS seems to drop the connection and I don't know why.

Since pf 2.2.2 and iOS 8.3 are released I thought I give it another try, but same effect :(

I fallowed this guide: https://forum.pfsense.org/index.php?topic=85367.0
This is the only VPN on my pf and I configured the apple configurator with exact the same settings and put the certificates in the payload of the configurator.

When I disable my wifi connection and try to connect with edge/lte the logfile on pf shows that authentication etc. is fine for my understanding, I don't know what´s wrong so that iOS seems to drop the connection some seconds after connecting:

I have cleared the logfile and tried to establish an connection and attached it.

Anyone got any ideas what´s going wrong?

Regards,

Dennis
ipsec_ikev2.txt
ipsec_ikev2.txt

]]>https://forum.netgate.com/topic/83260/ikev2-on-pf2-2-2-ios-seems-to-send-delete-ike_saRSS for NodeThu, 11 Jun 2026 01:35:51 GMTThu, 23 Apr 2015 18:59:17 GMT60<![CDATA[Reply to IKEv2 on PF2.2.2, iOS seems to send DELETE IKE_SA?? on Fri, 24 Apr 2015 17:04:12 GMT]]>Edit the config manually and on <pool_netbits>add an IPv6 subnet and see if it fixes it?</pool_netbits>

]]>https://forum.netgate.com/post/539611https://forum.netgate.com/post/539611Fri, 24 Apr 2015 17:04:12 GMT<![CDATA[Reply to IKEv2 on PF2.2.2, iOS seems to send DELETE IKE_SA?? on Fri, 24 Apr 2015 15:59:05 GMT]]>Thanks for your reply.
So there is no chance to setup an IKEv2 Dialin for IPhones at this time?
Is it possible to add an IPv6 entry in the config file(s) manually or will this be overwritten by pfsense config generators?

Regards,

Dennis

]]>https://forum.netgate.com/post/539591https://forum.netgate.com/post/539591Fri, 24 Apr 2015 15:59:05 GMT<![CDATA[Reply to IKEv2 on PF2.2.2, iOS seems to send DELETE IKE_SA?? on Fri, 24 Apr 2015 07:25:27 GMT]]>Probably because of this

Apr 23 20:31:16 charon: 09[IKE] <con1|4>no virtual IP found for %any6 requested by 'user@domain.tld'
Apr 23 20:31:16 charon: 09[IKE] <con1|4>no virtual IP found for %any6 requested by 'user@domain.tld'</con1|4></con1|4>

It is asking for a v6 as well as v4 virtual ip.
It is supported by backend software but the configuration is not yet there.

]]>https://forum.netgate.com/post/539428https://forum.netgate.com/post/539428Fri, 24 Apr 2015 07:25:27 GMT