Ikev2 параметр задан неверно windows 10

Hi,

Solved this issue myself but saw no mention on here.

I recently moved to a new server where I have Algo VPN but kept getting a weird error «parameter is incorrect» when connection to it.

SOLUTION:

If you install the Windows 10 ps1 file (as noted in the installation instructions) and when you try to connect is says «parameter is incorrect» then so the following:

1. Clear the Networking caches

Run windows cmd window (click windows start menu, type ‘cmd’, right click on ‘Command Prompt’ and select «Run as Administrator»).

type command below
netsh int ip reset

then type
netsh int ipv6 reset

then type
netsh winsock reset

Restart your computer.

1. Reset Device Manager adaptors

   Open Device Manager
   Find Network Adapters
   Uninstall WAN Miniport drivers (IKEv2, IP, IPv6, etc)
   Click Action > Scan for hardware changes
   The adapters you just uninstalled should come back

The VPN connection then works.

Hope this helps someone.

Все указывает на то, что винде не нравится сертификат

проблемы могут быть в свойствах сертификата (шаблон, назначение, параметры ключа и т.д.), в списке альтернативных имен, в субъекте сертификата и т.д.

вот что пишет журнал «Здоровье» по этой ошибке — что из этого проверяли/пробовали?

Error 13801: the IKE authentication credentials are invalid
You encounter this issue when either the server or client can’t accept the IKE authentication credentials.

Error 13801 cause
This error can occur due to the following:

— The machine certificate used for IKEv2 validation on the RAS server doesn’t have Server Authentication enabled under Enhanced Key Usage.
— The machine certificate on the RAS server expired.
— The client machine doesn’t have the root certificate for validating the RAS server certificate.
— The client machine’s VPN server name doesn’t match the subjectName value on the server certificate.

Solution 1: verify the server certificate settings
If the issue is the RAS server machine certificate, make sure the certificate includes Server Authentication under Enhanced Key Usage.

Solution 2: make sure the machine certificate is still valid
If the issue is that the RAS machine certificate expired, make sure it’s still valid. If it isn’t, install a valid certificate.

Solution 3: make sure the client machine has a root certificate
If the issue is related to the client machine not having a root certificate, first check the Trusted Root Certification Authorities on the RRAS server to make sure the certification authority you’re using is there. If it isn’t there, install a valid root certificate.

Solution 4: make the client machine’s VPN server name matches the server certificate
First, make sure the VPN client connects by using the same fully qualified domain name (FQDN) that the VPN server certificate uses. If not, change the client name to match the server certificate name.

The Internet Key Exchange version 2 (IKEv2) VPN protocol is the protocol of choice for Windows 10 Always On VPN deployments where the highest levels of security and assurance are required. However, as I’ve written about in the past, often the default IKEv2 security settings are less than desirable. Before using IKEv2 VPN in a production environment the administrator will need to update these security settings accordingly.

Connection Failure

When configuring Windows Server Routing and Remote Access Service (RRAS) or a third-party VPN appliance to support IKEv2 using custom security policies, the administrator may encounter a scenario in which a connection cannot be established due to a policy mismatch error. When the connection attempt fails, an error will be recorded in the Windows Application event log from the RasClient source with Event ID 20227. The error message states the following:

“The user [username] dialed a connection named [connection name] which has failed. The error code returned on failure is 13868.”

Картинка с сайта: directaccess.richardhicks.com

Error Code 13868

Error code 13868 translates to ERROR_IPSEC_IKE_POLICY_MATCH. Essentially this error indicates that the IKEv2 security policy on the client did not match the configuration on the server.

Server Configuration

To view the current IKEv2 IPsec policy configuration, open an elevated PowerShell command window and run the following command.

Get-VpnServerIPsecConfiguration

Картинка с сайта: directaccess.richardhicks.com

Client Configuration

To ensure interoperability, the VPN client must be configured to use the same IKEv2 security policy as defined on the sever. To view a VPN client’s currently configured IKEv2 security policy, open an elevated PowerShell command window and run the following command.

Get-VpnConnection -Name [connection name] | Select-Object -ExpandProperty IPsecCustomPolicy

Картинка с сайта: directaccess.richardhicks.com

Note: If this PowerShell command returns no output, the VPN connection is not using a custom IKEv2 IPsec security policy.

Updating Settings

Guidance for configuring IKEv2 security policies on Windows Server RRAS and Windows 10 can be found here.

NPS Policy

Another common cause of IKEv2 policy mismatch errors is a misconfigured Network Policy Server (NPS) network policy. Specifically, administrators may disable Basic and Strong encryption for MPPE in an attempt to improve security.

Картинка с сайта: directaccess.richardhicks.com

The NPS policy for Always On VPN must include Strong encryption at a minimum. Basic and No encryption can be safely disabled.

Картинка с сайта: directaccess.richardhicks.com

Summary

IKEv2 policy mismatch errors can be resolved easily by ensuring both the VPN server and client are configured to use the same IPsec security policies. Use the PowerShell commands in the above referenced above to validate settings and make changes when necessary.

Additional Information

Windows 10 Always On VPN IKEv2 Security Configuration

Windows 10 Always On VPN IKEv2 Features and Limitations

Show-VpnConnectionIPsecConfiguration PowerShell script on Github

Set-IKEv2SecurityBaseline PowerShell script on Github