IKEv2/IPsec setup for macOS

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

macOS setup

Connect with IKEv2/IPsec

Use macOS built-in VPN with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare macOS built-in VPN

    No additional app is required. macOS includes IKEv2 under Add VPN Configuration in Network settings.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Open and approve the issued certificate or configuration profile, then confirm the IKEv2 server address and identifiers in Network settings.

  4. Connect

    Start the IKEv2 connection and confirm macOS trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Installation & Configuration FAQs

macOS IKEv2/IPsec setup

Which IKEv2/IPsec client should I use?

Use the built-in macOS VPN or profile-management tools described in this guide. Use the supported client and setup flow in this guide instead of a random third-party VPN application.

Where do I download my IKEv2/IPsec profile?

In My Servers, open the Cloud1VPN server you want to use and download its current IKEv2/IPsec credential bundle or configuration profile. It is tied to that server, so retrieve a replacement after a rebuild, relocation, or credential renewal.

How do I import the profile and certificates?

Open the downloaded configuration profile and finish installing it in the system settings. Approve the complete profile rather than importing only its public certificate. Keep the server address, server identity, authentication method, and certificate material exactly as supplied by Cloud1VPN.

Do I need the complete certificate bundle?

Yes. Certificate-based IKEv2 needs the client certificate, its private key, and the issuing CA as required by your client. Importing only the public certificate is not enough to authenticate the connection.

How should I configure the VPN connection?

Use the Cloud1VPN server address and identity exactly as given. Do not replace the server identity with an IP address or disable certificate validation. If the client offers a connection name, label it clearly and keep only one VPN connection active while testing.

Should I replace an older IKEv2/IPsec profile?

Yes, whenever Cloud1VPN supplies a new profile or credential bundle. Remove the old VPN connection and its superseded profile, then import the current download instead of editing the old configuration manually.

How do I confirm that setup worked?

Connect the installed profile, confirm the system shows the VPN as connected, then open What's My IP?. A full-tunnel Cloud1VPN profile should show your Cloud1VPN server address.

Still Need Help?

Visit our Knowledge Base for troubleshooting guides. Premium members can also sign in to submit a support ticket.