Configuring authentication for IKEv2 connections

When you force a connection to use IKEv2 as its tunnel type, you have a choice of two authentication methods from which to select for authenticating the client to the server:

• Use EAP to authenticate the remote user to the VPN server.
• Use a machine certificate installed on the client computer to authenticate the client computer to the VPN server.

The default setting here is to use EAP, which doesn't require a machine certificate to be installed on the client computer. For IKEv2 to work, however, a machine certificate must be installed on the VPN server so that the server's identity can be authenticated by the client.

Note that if you select the Use Machine Certificates option on your client computers running Windows 7, you must also configure your VPN server running Windows Server 2008 R2 to support this configuration. To do this, follow these steps on the server:

1. Open the Properties dialog box of the VPN server in the RRAS console.
2. Select the Security tab and click Authentication Methods.
3. Select the check box labeled Allow Machine Certificate Authentication Using IKEv2.