MacOS – A Cisco AnyConnect VPN alternative for Mac

You can put extra configuration in /etc/ppp/ip-up file, which is described in man pppd, and which is a standard shell script file that will be fired when the pppd establishes a connection.

I don't use the VPN anymore and unfortunately it seems I don't have a copy of my ip-up file anymore, but the way I used to do it is something similar to below (you'll need to verify this with the aforementioned man page).

Once pppd establishes the connection, it will call /etc/ppp/ip-up with the following arguments:

ip-up interface-name tty-device speed local-IP-address remote-IP-address ipparam

Your ip-up script could therefore look something like:

#!/bin/bash

IFNAME="${1}"
LOCALIP="${4}"
REMOTEIP="${5}"

if [[ "${REMOTEIP}" == "192.0.2.1" ]]; then
  /sbin/route add -host lab_computer.foo -interface "${IFNAME}"
fi

Please note the following:

1. I'm assuming that the IP address of the VPN gateway you connect to is always the same and never changes, and in the example above I'm assuming it's 192.0.2.1 (RFC5737 address range specified to use as Documentation Examples - PLEASE CHANGE IT). The comparison here is used to only add the route when you're connected via the VPN to your office, and not any other VPN or PPP connection.
2. It's also better to use an IP address instead of the hostname for the computer you want to add a static route to. Instead of using lab_computer.foo I would use an IP address in the route command.
3. I'm using the -interface ${IFNAME} as opposed to hard-coding ppp0, which should make this work even if you have two VPN connections established at the same time (or a VPN and another form of PPP, e.g. a 3G modem)

A little late , but I did get this working.

In ipsec.conf, I had to update the ciphers and the rightauth. I'd prefer to use something better, but at the time it connects.

rightauth=eap-tls
ike=3des-sha1-modp1024
esp=3des-sha1-modp1024

BTW: even with connecting, I still get the above errors/warnings.

Update: I found that the mobileconfig profile needed for iOS can be used for OS X also, which will allow you to define and update the encryption algorithm, integrity algorithm and diffiehellman group. You can read about all the config settings on Apple's Developer site. It looks like you can max everything out at at AES-256/SHA2-512/18 (modp_8192)