SSTP or another TLS-based VPN protocol is recommended if reliable operation and connectivity are desired. In these scenarios, the sacrifice of ubiquitous availability in favor of ultimate security might be desired. IKEv2 is recommend for deployments where the highest level of security and protection is required for remote connections. The minimum recommended security settings and guidelines for implementing them can be found here. IKEv2 Security and RRASīe advised that the default security settings for IKEv2 on Windows Server RRAS are very poor. Consult with your device manufacturer for more information. Support for IKEv2 fragmentation on non-Microsoft firewall/VPN devices is vendor-specific. Guidance for enabling IKEv2 fragmentation on Windows Server RRAS can be found here. IKEv2 fragmentation is supported in Windows 10 and Windows Server beginning with v1803.

IKEv2 fragmentation can be enabled to avoid IP fragmentation and restore reliable connectivity. Always On VPN IKEv2 Load Balancing with F5 BIG-IP.Always On VPN IKEv2 Load Balancing with Kemp LoadMaster.

Guidance for configuring IKEv2 load balancing on the Kemp LoadMaster and the F5 BIG-IP can be found here: Without special configuration, load balancers can cause intermittent connectivity issues for Always On VPN connections.

Load balancing IKEv2 connections is not entirely straightforward. This can result in failed connection attempts from some locations but not others. Unfortunately, many firewalls and network devices are configured to block IP fragments by default. This can result in fragmentation occurring at the network layer. IKEv2 packets can become quite large at times, especially when using client certificate authentication with the Protected Extensible Authentication Protocol (PEAP). Often, they are blocked by network administrators to prevent users from bypassing security controls or attackers from exfiltrating data. Unfortunately, these ports are not always open. IKEv2 uses UDP ports 5 for communication. It’s not without some operational challenges, however. It supports modern cryptography and is highly resistant to interception. IKEv2 is clearly the protocol of choice in terms of security. In addition, it provides important interoperability with a variety of VPN devices, including Microsoft Windows Server Routing and Remote Access Service (RRAS) and non-Microsoft platforms such as Cisco, Checkpoint, Palo Alto, and others. IKEv2 is a standards-based IPsec VPN protocol with customizable security parameters that allows administrators to provide the highest level of protection for remote clients. The Internet Key Exchange version 2 (IKEv2) VPN protocol is a popular choice for Windows 10 Always On VPN deployments.

Check point capsule vpn for windows 10