VPN Setup

Set up Cloud1VPN on Windows with IKEv2/IPsec

Install or open the IKEv2 client, import your Cloud1VPN certificate profile, connect, and verify your public IP.

IKEv2/IPsec setup for Windows

Choose a VPN protocol

Before you begin

You need an active Cloud1VPN server configured for IKEv2/IPsec. Open My Servers and retrieve the issued certificate or configuration profile before importing it into your client.

Get your IKEv2/IPsec configuration

Windows setup

Connect with IKEv2/IPsec

Use Windows built-in VPN with the certificate and connection details generated for your Cloud1VPN server.

  1. Prepare Windows built-in VPN

    No additional app is required. Windows includes an IKEv2 client in Network & Internet settings.

    View the official IKEv2 client guidance

  2. Download your IKEv2 credentials

    Open My Servers and download the issued client certificate or configuration profile. Keep the private key and export password secure.

  3. Import the certificate and settings

    Install the issued client certificate for the current user. Add a Windows built-in VPN connection, select IKEv2, and enter the server address and identifiers shown in Cloud1VPN.

  4. Connect

    Start the IKEv2 connection and confirm Windows trusts the Cloud1VPN server certificate and identity.

  5. Verify your connection

    Confirm the IKEv2 connection is active, then verify that your public IP matches the Cloud1VPN server.

    Open What's My IP?

Frequently Asked Questions

Windows IKEv2/IPsec setup & troubleshooting

Why is my client certificate not available to the VPN connection?

Confirm the client certificate and private key are available to the current Windows user, and that the VPN server name matches the identity supplied by Cloud1VPN. Importing only the public certificate is not sufficient. If the certificate has expired, lacks its private key, or belongs to an earlier server deployment, download and import the current credential bundle.

What does a server identity or certificate-name mismatch mean?

The client expected one authenticated server name but received or was configured with another. Compare the server address and identity with the values in My Servers. Do not disable certificate validation or substitute an IP address unless the Cloud1VPN profile explicitly uses it as the identity.

Why does IKEv2 fail immediately after importing the profile?

Check the Windows date, time, and timezone first. Then confirm the full certificate chain and private key were imported and that the selected authentication method matches the issued profile. Clock and trust failures can stop the connection before a tunnel is created.

What do “authentication failed” or “no proposal chosen” mean?

Authentication failed usually points to the certificate, private key, identity, or stale credentials. No proposal chosen means the client and server did not agree on the IKE or IPsec settings. In either case, download a current profile rather than weakening or guessing the cryptographic settings.

IKEv2 says connected, but websites do not load. What should I check?

Disconnect other VPN and proxy software, reconnect IKEv2, and open What's My IP?. If the Cloud1VPN address appears but domains fail, check DNS. If no traffic works, check the installed routes and local firewall before replacing certificates.

Why is my normal public IP still visible?

The connection may not be using the default internet route, or another VPN may have higher priority. Confirm the imported Cloud1VPN profile is intended for full-tunnel access, disconnect competing profiles, and reconnect before testing again.

Why did IKEv2 stop working after a rebuild or relocation?

The previous profile can contain an obsolete server address, identity, or certificate. Remove the old VPN connection and its superseded client profile, then install the new configuration from My Servers instead of editing the old connection.

What should I send support for an IKEv2 problem?

Capture the Windows VPN error code and the related RasClient event at the failure time. Include the Windows version, Cloud1VPN server name, and time and timezone. Never send the private key, certificate export password, configuration profile, or account password.