IKEv2 EAP between NordVPN and Vigor Router

1. You will need a NordVPN account and download the NordVPN root CA certificate from https://downloads.nordvpn.com/certificates/root.der

And copy Service Credentials in NordVPN.

2. Get the NordVPN server domain from https://nordvpn.com/servers/
You may get a recommended server by selecting the country you located. In the following picture, de241.nordvpn.com is the hostname of the VPN server.

3. Log into the router's management page. Go to Certificate Management >> Trusted CA Certificate page, and click IMPORT. Click Choose File to select the root.der file we downloaded in step 1. Then, click Import.

4. Wait for few seconds until the router responds “Import Success” and the Certificate Status shows OK

5. Go to VPN and Remote Access >> IPsec Peer Identity, edit a profile to for NordVPN server.

1. Check Enable this account
2. Select Accept Any Peer ID

6. Go to VPN and Remote Access >> LAN to LAN, click on an available index number, and edit the profile as follows. In Common Settings,

1. Give it a profile name
2. Check Enable this profile
3. Set Call Direction to "Dial-Out"
4. At Dial-Out Through, select the WAN interface for VPN connection

7. In Dial-Out Settings,

1. Select IKEv2 EAP for the VPN server type
2. Enter the domain of VPN server we get in step 3 at Server IP address/Hostname
3. Enter service credentials as Username and Password
4. Choose "Digital Signature" for IKE Authentication Method, and select the IPsec Peer Identity Profile created in step 6 for Peer ID
5. Select "AES with Authentication" for IPsec Security Method
6. Click Advanced

8. Click Advanced button, In the IKE advanced settings pop-up windows, confgure:

1. IKE phase 1 proposal as "AES256_SHA1_G14"
2. IKE phase 2 proposal as "AES256_SHA1"
3. IKE phase 1 key lifetime as "14400"
4. IKE phase 2 key lifetime as "3600"

9. Click OK o close the window. At TCP/IP Network Settings:

1. Enter Remote Network IP as "0.0.0.0"
2. Select Remote Network Mask to "0.0.0.0/0"

10. After finishing above settings, we can check the VPN status via VPN and Remote Access >> Connection Management page.

11. Go to Routing >> Load-Balance/Route Policy and set up a route policy to send all traffic to NordVPN.

12. We can use the command “tracert” to check if the traffic is going through the VPN tunnel correctly.

Note: In order to accept large packets from NordVPN, Allow pass inbound fragmented large packets (required for certain games and streaming) should be enabled.