richardmhicks

Correct. You can install Wireshark on the server, but you could also take a network trace natively using the following command: netsh trace start capture=yes tracefile=c:\capture.etl Once you're done you can stop the trace using the following command: netsh trace stop It will produce an .ETL file that you'll have to open using Microsoft Network Monitor or Message Analyzer. It won't open in Wireshark, unfortunately. :/ If you feel comfortable installing third-party software on your server, install Wireshark. I'd recommend removing it when you're done though. If not, netsh will get you the network trace without having to install any software.

If it works internally that would rule out server or client configuration for sure. In that case it could be a firewall configuration issue such as UDP 500 and/or 4500 not being open, or perhaps the NAT isn't configured correctly (NATing to wrong IP address, for example). It could certainly be fragmentation too. Best way to tell would be to take a network trace on the server. If you see the client begin the connection but not complete it, chances are that its a fragmentation issue. Enabling IKEv2 fragmentation is done on the server side (supported only in Windows Server 2019 though) and forces fragmentation at the IKE layer as opposed to the IP layer. This allows the traffic to pass through firewalls/routers that are blocking IP fragments. No changes required on firewalls/routers at all.

As a quick test I would suggest testing the VPN connection when you're on the same subnet as the VPN server. This will eliminate any firewalls or routers interfering with the connection. If it works, verify (again) the firewall is allowing inbound UDP 500 and 4500. Check the firewall logs to ensure the traffic is being allowed too. Also, know that IKEv2 packets can sometimes be quite large and will require fragmentation at the IP layer. Some firewalls and routers are configured to block IP fragments by default, however. You may need to enable IKEv2 fragmentation support on the server to make this work. Details here: https://directaccess.richardhicks.com/2019/02/11/always-on-vpn-and-ikev2-fragmentation/.