How to override the IP address as the default client identity on Windows IKEv2 VPN client?

Question

I am trying to manually set the client IKEv2 identity for the native Windows VPN client. The headend in this case in Cisco's FlexVPN Server, and there are specific policies that need to be applied per-user. The normal way to do this is to discriminate amongst connections using the IKE identities presented by each client. On most VPN clients, there is a way to set this value manually (e.g. to a string representing the client's FQDN). Looking at debug logs on the headend, the IKEv2 identity for the Windows client defaults to the IP address of the interface associated with the underlay connection. This is not ideal to use as a discriminator/matching criteria for the application of policies at the headend since client IP addresses are dynamic by nature (and the point of a remote access VPN is mobility). FQDN or some other static value would be preferable but I have been unable to find a way to override the default value (IP address). Is there any way to manually set the local IKE identity in the Windows IKEv2 VPN client? (Note that client-side authentication is performed using EAP, not PKI.)

Answer 1

Hello Cody,

About 5 years ago, I wrote an article about "Exploring use of Windows 10 VPN client to access Cisco AnyConnect IPsec/IKEv2" which touched on the subject of setting an IKEv2 IDi value.

When discussing the function that provides the IDi value, I wrote:

By default, it returns an ID_IPV4_ADDR ID Type but it can be persuaded (by setting the value “ExtendedIDiSupport” in the registry and meeting other requirements) to return an ID_FQDN ID Type. It is not possible to specify an arbitrary ID Type and Identification Data.

In the intervening 5 years, I have forgotten what the "other requirements" are - it is possible that they are already met in your environment.

Gary