MacOS – IKEv2 VPN on macOS Sierra disconnects after eight minutes

macosvpn

When I establish a connection using the integrated IKEv2 client on my Mac (OS Sierra 10.12.1), I get disconnected after eight minutes. Until then it works perfectly as well. Any idea how to resolve this issue?

Best Answer

The essence of the solution described there is plausible – that it has to do with the re-keying process which occurs periodically. You ought to see something in the Console log, and perhaps also in logs on the server side, that will point you in the right direction.

At random times during the lifetime of the tunnel, the two sides will re-negotiate the symmetric-cipher keys that they are using, so that the conversation does not continue to use the same keys for too long. If this process failed, the connection would be dropped, and if it consistently occurs "after eight minutes," this could well be it. All of the parameters on both sides must match exactly, and there's nothing easy about debugging IPSec. I'd start with Console as my starting point. (There are several logs – look at 'em all.)

Related Solutions

MacOS – OSX ssh server disconnects after 15 minutes

You should be able to force the client to send keepalive messages if there is no activity by setting TCPKeepAlive yes (should be default) in ssh_config.

If it will not help, you can try to set

ServerAliveCountMax 5
ServerAliveInterval 600 # seconds = 10 minutes

MacOS – Port Knocking on macOS Sierra

If you need to get port knocking working as a client (i.e. you want to access a remote service that is protected by port knocking) - then install the knock program from Homebrew like this:

brew install knock

You'll need to have Homebrew installed in advance.

Then you can use the program from Terminal.app like this:

knock myserver 1234 5678 9012

where the numbers are the ports to knock.

If you need to get port knocking working as a server (i.e. you want to protect a local resource so that remote access is limited to those in-the-know by port knocking) - then similarly install knock from Homebrew.

After installation you'll need to create a knockd.conf configuration customized to your requirements (i.e. which type of service you want to protect, the ports to use, etc.) - and finally start knockd using launchd.

You can find an example of how to do this here:

Example knockd setup

Best Answer

Related Solutions

MacOS – OSX ssh server disconnects after 15 minutes

MacOS – Port Knocking on macOS Sierra

Related Question