Troubleshoot Point-to-Site VPN connections from macOS X VPN clients

  • Article
  • 10/09/2024

This article helps you troubleshoot point-to-site connectivity issues from macOS X clients that use the native macOS X VPN client and IKEv2. VPN client configuration in macOS X is very basic for IKEv2 connections and doesn't allow for much customization. There are only four settings that need to be checked:

  • Server Address
  • Remote ID
  • Local ID
  • Authentication Settings
  • OS Version (10.11 or higher)

Certificate-based authentication

  1. Check the VPN client settings. Go to Settings and locate VPN.
  2. From the list, click the i next to the VPN entry that you want to investigate. This opens the settings configuration for the VPN connection.
  3. Verify that the Server Address is the complete FQDN and includes the cloudapp.net.
  4. The Remote ID should be the same as the Server Address (Gateway FQDN).
  5. The Local ID should be the same as the Subject of the client certificate.
  6. For Authentication, verify that "Certificate" is selected.
  7. Click the Select button and verify that the correct certificate is selected.
  8. Click OK to save any changes.

If you're still having issues, see the IKEv2 packet capture section.

Username and password authentication

  1. Check the VPN client settings. Go to Settings and locate VPN.
  2. From the list, click the i next to the VPN entry that you want to investigate. This opens the settings configuration for the VPN connection.
  3. Verify that the Server Address is the complete FQDN and includes the cloudapp.net.
  4. The Remote ID should be the same as the Server Address (Gateway FQDN).
  5. The Local ID can be blank.
  6. For Authentication, verify that "Username" is selected.
  7. Verify that the correct credentials are entered.
  8. Click OK to save any changes.

If you're still having issues, see the IKEv2 packet capture section.

Packet capture - IKEv2

Download Wireshark and perform a packet capture.

  1. Filter on isakmp and look at the IKE_SA packets. You should be able to look at the SA proposal details under the Payload: Security Association.
  2. Verify that the client and the server have a common set.
  3. If there's no server response on the network traces, verify you enabled IKEv2 protocol on the Azure VPN gateway. You can check by going to the Azure portal, selecting the VPN gateway, and then selecting Point-to-site configuration.

Next steps

For more help, see Azure Support.