OSX Sonoma VPN IKEv2 randomly disconnects

kiffin · October 2023

I've setup VPN IKEv2 on Mac OSx Sonoma and now I'm randomly being disconnected and reconnected every few minutes while I'm connected. I've performed Layer 1 Troubleshooting on my network and here at Corporate and I'm still suffering the same issue. Anyone have any tips on how I can check my setup on my Mac?

james.carson · October 2023

Hi @kiffin

It might be helpful to have the firewall admin turn logs up for the IKE/IPSec services up to information so you can see logs for the VPN connections building/being torn down in the firebox's traffic monitor. If you search for the IP your Mac is coming from, it should reasonably filter down the logs.

If there is an option to log to a file or similar on the Mac itself, you may be able to discern why it's disconnecting

Some customers have complained that upgrading changed their VPN profile on their Mac to include PFS (perfect forward secrecy) and/or completely removed the rekey timer on their VPN. If either of those are the case, it may be helpful to reimport the VPN profile. The OS should really not change a pre-configured profile like this without notifying the user.

kiffin · October 2023

Ill give it a shot and update you. Cheers.

Veloso · October 2023

same here - annoying because reconnect needs auth point :-/

edgar.ciraconnect · October 2023

Any updates on this? We're experiencing the same issue in our team. All three of us who have M1 Macs running Sonoma have encountered this issue and our VPN disconnects exactly at 24 minutes.

https://forums.macrumors.com/threads/sonoma-bug-ikev2-vpn-no-longer-rekeys-so-vpn-connections-drop-every-20-25-minutes.2406029/

Seems like other people are having the same issue.

These are some of the logs I can see on my Mac, I've forwarded them to our IT team:

[CREATE_CHILD_SA R resp10 B31BAAD3612A1D66-06012828995D9C27] 
Rekey child received notify error 
Error Domain=NEIKEv2ProtocolErrorDomain 
Code=17 
"InvalidKEPayload" 
UserInfo={NSDebugDescription=InvalidKEPayload}

IKEv2Session[1, B31BAAD3612A1D66-06012828995D9C27] 
Received DH group preference 0 is not in Child rekey proposal (child rekey retry DH)

ChildSA[1, 0C141F56-16745CA0] state Connected -> Disconnected error (null) -> Error Domain=NEIKEv2ErrorDomain Code=6 
"PeerInvalidSyntax: Received DH group preference 0 is not in Child rekey proposal (child rekey retry DH)" 
UserInfo={NSLocalizedDescription=PeerInvalidSyntax: 
Received DH group preference 0 is not in Child rekey proposal (child rekey retry DH)}

edgar.ciraconnect · October 2023

@kiffin said:
Ill give it a shot and update you. Cheers.

Were you able to get this resolved?

Veloso · October 2023

worked for me:
IKEv2 Shared Settings:
Phase1: AES-GCM-256bit / 24hours / DH Group 19

IKEv2 Configuration:
Security / Phase2
PFS DH Group 19
ESP/SHA2-256/AES 256bit

kiffin · October 2023

oh sweet thanks. Any chance there are instructions to verify those settings and update them?

james.carson · October 2023

@kiffin

The link here should drop you into the IKEv2 phase1/2 article:

https://www.watchguard.com/help/docs/help-center/en-US/Content/en-US/Fireware/mvpn/ikev2/mvpn_ikev2_config_edit.html?tocpath=Fireware|Configure Network Settings|Mobile VPN Tunnels|Mobile VPN with IKEv2|_____6#Phases

edgar.ciraconnect · October 2023

[Duplicate comment]

james.carson · October 2023

@edgar.ciraconnect That would be MacOS changing the proposals without telling you. If you match the proposals that its asking for, the VPN should come up.

I would suggest sending feedback to Apple that they should never change the proposal on an existing VPN without notifying/confirming that is what is needed.

edgar.ciraconnect · October 2023

@james.carson

Sorry for the double comment, the one from yesterday kept failing to post so I submitted again today without realizing it actually succeeded.

Unfortunately I'm not knowledgeable about this enough to know what exactly to include in the feedback to Apple. But I'll definitely do it.

james.carson · October 2023

Hi @edgar.ciraconnect
Absolutely willing to help, however, pointing out that it was taken from a working config to a broken config.

In theory re-loading the VPN profile should generate the VPN using those proposals. The other option would be to change the proposal on the WatchGuard side -- see the post Veloso up the page a bit for those settings.

kiffin · October 2023

cool! Thanks! ill give it a whirl. Cheers!

Anso · October 2023

IKEv2 Shared Settings and IKEv2 Configuration doesn't work for me that Veloso mentioned. Every 24 minutes, my IKev2 VPN disconnects by itself.

aesterling · November 2023

I think we may have fixed the 24-minute disconnection issue by going to Fireware Web UI > VPN > Mobile VPN > IKEv2 > Configure > Security > Phase 2 Settings > Enable Perfect Forward Secrecy > and changing it to Diffie-Hellman Group 19.

Our affected macOS Sonoma system's VPN has now been connected for 33 minutes and counting.

UPDATE: Now the Mac's VPN is disconnecting at the 48-minute mark instead of 24. So, exactly double the time. Unsure what that tells us...

flyingtiger · January 13

@Veloso said:
worked for me:
IKEv2 Shared Settings:
Phase1: AES-GCM-256bit / 24hours / DH Group 19

IKEv2 Configuration:
Security / Phase2
PFS DH Group 19
ESP/SHA2-256/AES 256bit

Just thought I would let you know that this worked for me. At least so far - I've been connected for 53 minutes this most recent session. Thanks for posting.

Anso · January 16

Hi,

We've finaly found a solution with @Veloso.

But if you have different settings in the phase 1 you have to place the config Diffie-Hellman Groupe 19 at the top of the list.

Thank you.

Veloso · February 12

Fireware 12.10.2
VPN

      Mobile VPN statistics now include the IP address of the destination interface on the Firebox. [FBX-25239, FBX-24360, FBX-25839   , FBX-25240]
iOS and macOS users no longer disconnect from IKEv2 VPN connections after eight minutes. [FBX-24694]
This release resolves an issue that caused network access enforcement to become unconfigurable in Policy Manager when multiple mobile VPN types used the same group for authentication. [FBX-25977]
This release resolves an issue that caused macOS computers with M1 or M2 processors to disconnect mobile VPN with IKEv2 connections after ten minutes. [FBX-25883]

ehlippelt · February 20

@Veloso said:
Fireware 12.10.2
VPN

Hi, the new release did not fix the problem for me. Has it been fixed for anybody else ?

RobertoT · February 20

@ehlippelt said:

@Veloso said:
Fireware 12.10.2
VPN

Hi, the new release did not fix the problem for me. Has it been fixed for anybody else ?

You might need to download and install a fresh copy of the IKEv2 profile.

RobertoT · February 20

@ehlippelt said:

@Veloso said:
Fireware 12.10.2
VPN

Hi, the new release did not fix the problem for me. Has it been fixed for anybody else ?

Well, we just upgraded to 12.10.2 this morning. I downloaded a fresh copy of the IKEv2 profile and installed it on my MacBook, and I'm still getting disconnected at the 24 minute mark as well.

seanlee20 · February 20

This worked for me.

IKEv2 Shared Settings:
Added - Phase1: AES-GCM-256bit / 24hours / DH Group 19 and moved to the top
Mobile VPN - IKEv2 Configuration:
Security / Phase2
Added ESP/SHA2-256/AES 256bit
Enable Perfect Forward Secrecy > and changing it to Diffie-Hellman Group 19

Exported IKE v2 profile from firebox and imported it into my macbook pro running Sonoma 14.3.1

OSX Sonoma VPN IKEv2 randomly disconnects

Comments