IKEv2 on Mac OS

Printable View

06-06-2019, 01:08 PM
dmor

IKEv2 on Mac OS

I've been unable to get a Mac OS X 10.11 or 10.14 laptop to connect to Untangle's IKEv2 VPN.

I've imported into the OS X Keychain Untangle's CA cert & machine cert. I've regenereated both certs to ensure they have the WAN IP included in the SANs. Then imported into Mac OS Keychain again & marked as trusted for all purposes.

I've rebuilt the VPN multiple times. Simplified & shortened the user password (for troubleshooting) in the Untangle Local Directory.

I'm not sure what else to try.

But I realize there may be some inherent compatibility issues between Untangle's current implementation of IKEv2, and Apple's in Mac OS. So maybe this will take the outside vendors to solve, in which case I need to go find a different solution for now (probably OpenVPN).

The Untangle is on 14.1.2.20190401T184625.3e1709127f-1stretch

Any ideas? Anyone out there actually been able to get a Mac OS computer to connect to Untangle via IKEv2?

Thanks!
-
Doug
06-12-2019, 04:05 PM
jcoffin

Quote:

Originally Posted by dmor

I've been unable to get a Mac OS X 10.11 or 10.14 laptop to connect to Untangle's IKEv2 VPN.

I've added the steps for Mac IKEv2 VPN to the IPsec FAQ. The step you were probably missing is marking the installed the root CA as trusted.
06-12-2019, 04:15 PM
dmor

jcoffin,

Thank you very much for taking the time to document that. I am sure it will serve untangle customers well, and I know it is time-consuming to do that kind of thing.

I did actually important to ca cert into keychain access and marked it as trusted for all purposes. But I will review your updated wiki instructions and try again. Thanks again. Much appreciated!

Sent from my iPhone using Tapatalk
06-12-2019, 04:21 PM
jcoffin

The only other issue I can think of is the root CA is not in the system key. Mac by default puts it in local not system where it should be. Also it should be the root CA not the Untangle certificate.
06-12-2019, 04:24 PM
dmor

John,

Based on the wiki, I need to set the Remote ID field on the Mac to the hostname on the certificate. I assume you are referring to the certificate’s Common Name?

I was using the Untangle public IP in this field, which happens to be a SAN on the cert.

Can you confirm a SAN is not acceptable in the Remote ID field? If so, that would be my problem.

Sent from my iPhone using Tapatalk
06-12-2019, 04:32 PM
jcoffin

You need the entire name at /admin/index.do#config/network/hostname hostname + domain name
06-12-2019, 07:50 PM
dmor

Quote:

Originally Posted by jcoffin

You need the entire name at /admin/index.do#config/network/hostname hostname + domain name

Ok. I’ll test it out ASAP. Thanks again!