--- title: IKEv2 (Windows) slug: device-management-guide/android/ikev2-windows createdAt: 2026-10-06T07:48:37.114Z --- This VPN connection type is supported on Windows devices. :::hint{type="info"} For Windows 10 devices, please add the configuration and value for auto proxy in the Custom Data Grid. Please note that the Automatic proxy is not supported in Windows 8.1. ::: **Note**: - Windows devices do not support pushing $USERID$ and $PASSWORD$ to the device in VPN settings. The device user must enter user name and password to connect to VPN. - For certificate authentication, Windows devices only support identity certificates using SCEP reverse proxy. Use the following guidelines to configure a IKEv2 (Windows) VPN. - [Proxy - None (default)](docId\:bjit1YkJU6P3C1TieFIKx) - [Proxy - Manual](docId\:bjit1YkJU6P3C1TieFIKx) - [Proxy - Automatic](docId\:bjit1YkJU6P3C1TieFIKx) Within these selections, you may make settings for: - [Windows Configuration](docId\:bjit1YkJU6P3C1TieFIKx) - [Custom Data](docId\:bjit1YkJU6P3C1TieFIKx) ## Proxy - None (default) Use the following guidelines to configure a IKEv2 (Windows) VPN connection without a proxy. Table: Proxy - None Settings | Item | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | Enter a short phrase that identifies this VPN setting. | | Description | Provide a description that clarifies the purpose of these settings. | | Channel | For macOS only. Select one of the following distribution options:
- Device channel - the configuration is effective for all users on a device. This is the typical option.
- User channel - the configuration is effective only for the currently registered user on a device. | | Connection Type | Select IKEv2 (Windows). | | Server | Enter the IP address, hostname, or URL for the VPN server. | | Proxy | None is the default setting. To configure a Manual or Automatic proxy, go to [Proxy - Manual ](docId\:bjit1YkJU6P3C1TieFIKx)or [Proxy - Automatic](docId\:bjit1YkJU6P3C1TieFIKx).
Windows 8.1 devices do not currently support *Automatic* Proxy. | | Proxy Server | *Select Manual proxy to see this option. *Enter the name for the proxy server. | | Username | Specify the user name to use (required.) The default value is $USERID$. Use this field to specify an alternate format, such as:
$USERID$, $EMAIL$, $SAM\_ACCOUNT\_NAME$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as the following:
- $USERID$:$EMAIL$
- $USERID$\_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant username.
Some enterprises have a strong preference concerning which identifier is exposed. | | User Authentication | Select the user authentication to use:
- Password - see next row for information.
- Certificate - If you select Certificate, select the identity certificate to be used as the account credential. | | Password | Specify the password to use (required.) The default value is $PASSWORD$. Include at least one of the following variables:
$USERID$, $EMAIL$, $PASSWORD$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant password. | | Send All Traffic | Select to send all traffic from the Windows device through the VPN gateway.
When *Send All Traffic* is checked, all traffic is sent through the VPN gateway with the exception of traffic from the resources you enter in this table.
When *Send All Traffic* is unchecked, only traffic from the resources you enter in this table is sent through the VPN gateway. | Continue to [Windows Configuration](docId\:bjit1YkJU6P3C1TieFIKx). Continue to [Custom Data](docId\:bjit1YkJU6P3C1TieFIKx). ## Proxy - Manual Use the following guidelines to configure a IKEv2 (Windows) VPN connection with a manual proxy. Table: Proxy - Manual Settings | Item | Description | | ---------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | Enter a short phrase that identifies this VPN setting. | | Description | Provide a description that clarifies the purpose of these settings. | | Channel | For macOS only. Select one of the following distribution options:
- Device channel - the configuration is effective for all users on a device. This is the typical option.
- User channel - the configuration is effective only for the currently registered user on a device. | | Connection Type | Select IKEv2 (Windows). | | Server | Enter the IP address, hostname, or URL for the VPN server. | | Proxy | Select Manual. To configure an Automatic proxy, go to [Proxy - Automatic](docId\:bjit1YkJU6P3C1TieFIKx).
Windows 8.1 devices do not currently support *Automatic* Proxy. | | Proxy Server | *Select Manual proxy to see this option. *Enter the name for the proxy server. | | Proxy Server Port | *Select Manual proxy to see this option. *Enter the port for the proxy server. | | Type | *Select Manual proxy to see this option. *Select Static or Variable. | | Proxy Server User Name | *Select Manual proxy to see this option. *If the type is Static, enter the username for the proxy server
If the type is Variable, the default variable selected is $USERID$.
Windows devices do not support Proxy Server User Name. | | Proxy Server Password | *Select Manual proxy to see this option. *If the type is Static, enter the password for the proxy server
If the type is Variable, the default variable selected is $PASSWORD$.
Windows devices do not support Proxy Server Password. | | Username | Specify the user name to use (required.) The default value is $USERID$. Use this field to specify an alternate format, such as:
$USERID$, $EMAIL$, $SAM\_ACCOUNT\_NAME$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as the following:
- $USERID$:$EMAIL$
- $USERID$\_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant username.
Some enterprises have a strong preference concerning which identifier is exposed. | | User Authentication | Select the user authentication to use:
- Password - see next row for information.
- Certificate - If you select Certificate, select the identity certificate to be used as the account credential. | | Password | Specify the password to use (required.) The default value is $PASSWORD$. Include at least one of the following variables:
$USERID$, $EMAIL$, $PASSWORD$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant password. | | Send All Traffic | Select to send all traffic from the Windows device through the VPN gateway.
When *Send All Traffic* is checked, all traffic is sent through the VPN gateway with the exception of traffic from the resources you enter in this table.
When *Send All Traffic* is unchecked, only traffic from the resources you enter in this table is sent through the VPN gateway. | Continue to [Windows Configuration](docId\:bjit1YkJU6P3C1TieFIKx). Continue to [Custom Data](docId\:bjit1YkJU6P3C1TieFIKx). ## Proxy - Automatic Use the following guidelines to configure a IKEv2 (Windows) VPN connection with an automatic proxy. :::hint{type="info"} For Windows 10 devices, please add the configuration and value for auto proxy in the Custom Data Grid. Please note that the Automatic proxy is not supported in Windows 8.1. ::: Table: Proxy - Automatic Settings | Item | Description | | ------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Name | Enter a short phrase that identifies this VPN setting. | | Description | Provide a description that clarifies the purpose of these settings. | | Channel | For macOS only. Select one of the following distribution options:
- Device channel - the configuration is effective for all users on a device. This is the typical option.
- User channel - the configuration is effective only for the currently registered user on a device. | | Connection Type | Select IKEv2 (Windows). | | Server | Enter the IP address, hostname, or URL for the VPN server. | | Proxy | Select Automatic. To configure an Manual proxy, go to [Proxy - Manual ](docId\:bjit1YkJU6P3C1TieFIKx).
Windows 8.1 devices do not currently support *Automatic* Proxy. | | Proxy Server URL | *Select Automatic proxy to see this option. *Enter the URL for the proxy server. | | Username | Specify the user name to use (required.) The default value is $USERID$. Use this field to specify an alternate format, such as:
$USERID$, $EMAIL$, $SAM\_ACCOUNT\_NAME$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as the following:
- $USERID$:$EMAIL$
- $USERID$\_$EMAIL$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant username.
Some enterprises have a strong preference concerning which identifier is exposed. | | User Authentication | Select the user authentication to use:
- Password - see next row for information.
- Certificate - If you select Certificate, select the identity certificate to be used as the account credential. | | Password | Specify the password to use (required.) The default value is $PASSWORD$. Include at least one of the following variables:
$USERID$, $EMAIL$, $PASSWORD$, $USER\_CUSTOM1$, $USER\_CUSTOM2$, $USER\_CUSTOM3$, $USER\_CUSTOM4$, $CUSTOM\_DEVICE\_Attributename$, $CUSTOM\_USER\_Attributename$, $NULL$
You can use combinations such as $EMAIL$:$PASSWORD$
Enter $NULL$ if you want the field presented to the user to be blank. Users will need to fill in the relevant password. | | Send All Traffic | Select to send all traffic from the Windows device through the VPN gateway.
When *Send All Traffic* is checked, all traffic is sent through the VPN gateway with the exception of traffic from the resources you enter in this table.
When *Send All Traffic* is unchecked, only traffic from the resources you enter in this table is sent through the VPN gateway. | Continue to [Windows Configuration](docId\:bjit1YkJU6P3C1TieFIKx). Continue to [Custom Data](docId\:bjit1YkJU6P3C1TieFIKx). ## Windows Configuration Allowed Secured Resources (Windows Phone only) Excluded Secured Resources (Windows Phone only) See [Application-triggered VPN for Windows devices](docId\:bjvBroYZ4Tp_ME7E4S_Aq) for information on how to configure these settings to set up application-triggered VPN for 8.0.1 devices. Table: Windows Configurations | Item | Description | | --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Windows Configuration | Enter the secured resources (domains, IP ranges, or apps) used by the **Send All Traffic** option. | | Always On | Select this option to keep the VPN on. **Lock Down** supersedes this option for Windows devices. | | Lock Down | You cannot change the assigned settings unless 1) the **Lock Down** setting is removed from the profile and the new profile is pushed to the device or 2) the device is un-enrolled from Ivanti EPMM.
This option supersedes the **Always On** option. | ## Custom Data - Add+ - Select to add a new key / value pair. - Key / Value - Enter the Key / value pairs necessary to configure the VPN setting. The app creator should provide the necessary key / value pairs.