What does the IKEv2 client do?
IKEv2 negotiates the security association used by an IPsec connection. VPN Proto uses Android’s platform IKEv2 implementation, so this protocol requires Android 11 or later even though the app itself supports older Android phones.
What you need
- Android 11 or later for this protocol.
- A compatible IKEv2/IPsec server hostname and username/password account.
- A PEM CA certificate if your administrator uses a private certificate authority.
How to set up IKEv2 in VPN Proto
- Open Profiles → Add profile → Server details.
- Choose IKEv2. Enter the server hostname without https:// or a path.
- Add the supplied username and password. For a private CA, expand Private CA certificate and paste the full PEM certificate.
- Save, then select the profile on Connect and tap Connect.
- Approve any Android system VPN provisioning request. Wait for the app’s connection check to complete.
Use the right configuration. A saved profile is not a server account. Use details supplied for your own connection and keep credentials and private keys private.
If the connection does not work
IKEv2 is unavailable on my phone
This implementation needs Android 11’s platform API. On an older phone, use another protocol that your server actually supports. A protocol name change cannot make an incompatible profile work.
The server rejects authentication
Check the account and authentication method with your administrator. The current manual flow expects username/password authentication; do not assume every certificate-only or vendor-specific enterprise profile is supported.
The connection times out
IKEv2 commonly needs UDP 500 and 4500. The network and server must allow the appropriate exchange and IPsec forwarding. Certificate trust and server identity must also match.
Good to know before connecting
The Prevent IKEv2 bypass setting applies to the next IKEv2 connection. It is not a universal kill switch for all five protocols. For system-level always-on VPN and blocking without VPN, consult your device’s Android VPN settings and check whether the selected connection supports them.
To change a saved profile, open Profiles and use its menu. Disconnect an active connection before editing or switching. The app offers guidance, but server availability and configuration remain the responsibility of the server operator.