# IKEv2

An IKEv2 monitor connects to the server and authenticates with EAP-MSCHAPv2 by default.

:::tip[New to TunnelHQ?]
Start with the [Quick start](/docs/quickstart/).
:::

## Adding an IKEv2 monitor

In **Add monitor**, click **Enter details manually** and choose **IKEv2**.

| Field | Required | Details |
| --- | --- | --- |
| Host | Yes | The server address. |
| Username, Password | Yes | The EAP credentials. |
| Remote ID | No | Under **Advanced options**. Defaults to the host. |
| Port | No | Not asked when adding. Set it later in the monitor's settings; leave it empty to use the default. |

:::caution[Limited automated testing]
Depending on the server's configuration, automated testing of IKEv2 can be limited.
:::

## When a check fails

The failure you're most likely to see is **Tunnel unreachable**: the connection or authentication didn't complete. Check that the server is running, that the host is right, and that the username and password work in an IKEv2 client. If the server expects a specific identity, set **Remote ID**.

- **Server reachable — it rejected the monitor's credentials or certificate.**: the server answered and refused them. The monitor reads **Degraded** with no alert, unless it passed a check in the last 30 days: then TunnelHQ treats the refusal as an outage, and the monitor goes **Down** after its retries and alerts.

[What a failed check says](/docs/concepts/monitors/#what-a-failed-check-says) lists every failure message.