VPN Setup

Set up Cloud1VPN on macOS with IKEv2/IPsec

Install or open the IKEv2 client, import your Cloud1VPN certificate profile, connect, and verify your public IP.

IKEv2/IPsec setup for macOS

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

macOS setup

Connect with IKEv2/IPsec

Use macOS built-in VPN with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare macOS built-in VPN

    No additional app is required. macOS includes IKEv2 under Add VPN Configuration in Network settings.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Open and approve the issued certificate or configuration profile, then confirm the IKEv2 server address and identifiers in Network settings.

  4. Connect

    Start the IKEv2 connection and confirm macOS trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Frequently Asked Questions

macOS IKEv2/IPsec setup & troubleshooting

Why is my client certificate not available to the VPN connection?

Approve the complete configuration profile in System Settings. If an older profile exists for the same server, remove it before installing the replacement so macOS does not select stale credentials. If the certificate has expired, lacks its private key, or belongs to an earlier server deployment, download and import the current credential bundle.

What does a server identity or certificate-name mismatch mean?

The client expected one authenticated server name but received or was configured with another. Compare the server address and identity with the values in My Servers. Do not disable certificate validation or substitute an IP address unless the Cloud1VPN profile explicitly uses it as the identity.

Why does IKEv2 fail immediately after importing the profile?

Check the macOS date, time, and timezone first. Then confirm the full certificate chain and private key were imported and that the selected authentication method matches the issued profile. Clock and trust failures can stop the connection before a tunnel is created.

What do “authentication failed” or “no proposal chosen” mean?

Authentication failed usually points to the certificate, private key, identity, or stale credentials. No proposal chosen means the client and server did not agree on the IKE or IPsec settings. In either case, download a current profile rather than weakening or guessing the cryptographic settings.

IKEv2 says connected, but websites do not load. What should I check?

Disconnect other VPN and proxy software, reconnect IKEv2, and open What's My IP?. If the Cloud1VPN address appears but domains fail, check DNS. If no traffic works, check the installed routes and local firewall before replacing certificates.

Why is my normal public IP still visible?

The connection may not be using the default internet route, or another VPN may have higher priority. Confirm the imported Cloud1VPN profile is intended for full-tunnel access, disconnect competing profiles, and reconnect before testing again.

Why did IKEv2 stop working after a rebuild or relocation?

The previous profile can contain an obsolete server address, identity, or certificate. Remove the old VPN connection and its superseded client profile, then install the new configuration from My Servers instead of editing the old connection.

What should I send support for an IKEv2 problem?

Capture the message shown in Network settings and the first relevant VPN or NEIKEv2Provider log entry at the failure time. Include the macOS version, Cloud1VPN server name, and time and timezone. Never send the private key, certificate export password, configuration profile, or account password.