IKEv2 Brute Force Attacks
Hello
Since 2nd of October 2026 we see brute force IKEv2 attacks on several boxes.
The logs entry are like
"",C039XZT123456,db,"FWStatus, (185.x.z.y<->138.226.239.50)IKEv2 IKE_SA_INIT exchange from 138.226.239.50:40044 to 185.14.65.194:4500 failed. Gateway-Endpoint:'WG Default IKEv2 Gateway'. Reason:DH-Group 31 in the KE payload does not match DH-Group 14 selected in the IKE_SA_INIT request proposal., pri=3, proc_id=iked, msg_id=021A-000F",29423362,2026-10-01 20:10:05
"",C039XZT123456,db,"FWStatus, (185.x.z.y<->138.226.239.50)ike_user_free: invalid arguments User:0xaaaaeb729780 IKE policy:0xaaaaea239c58, pri=3, proc_id=iked, msg_id=",29423361,2026-10-01 20:10:05
"",C039XZT123456,ev,"FWStatus, Authentication of IKEv2 user [ruta@RADIUS] from 138.226.239.50 was rejected, received an Access-Reject response from the (192.168.X.Z) server, pri=4, proc_id=admd, msg_id=1100-0005",5204943,2026-10-02 18:51:55
we use the internal watchguard certificates from the boxes for IKEv2 and we have never seen IKEv2 connections from client which did not have this certificate installed.
The firmware of the boxes are the latest, but we see the attacks also on boxes with older firmware.
Is this a new kind of attack wave?
Greetings
Axel