Unable to establish VPN connection using EAP authentication method

App & System Services Core OS
sujithcy OP
Created Aug ’21
Replies 2
Boosts 0
Views 609
Participants 1

I created an MDM payload based on the article below

https://support.apple.com/en-ca/guide/mdm/mdm4ce9487d/web

my device gets the MDM policy for VPN without any issue still, there is something missing in the configuration, or for EAP-TLS is there a specific approach to create a VPN profile?

I am getting the error "The VPN server did not respond" and I am not able to see the logs under ppp.log. please assist.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>DNS</key>
			<dict>
				<key>DomainName</key>
				<string></string>
			</dict>
			<key>IKEv2</key>
			<dict>
**				<key>AuthenticationMethod</key>
				<string>Certificate</string>**
				<key>CertificateType</key>
				<string>RSA</string>
				<key>ChildSecurityAssociationParameters</key>
				<dict>
					<key>EncryptionAlgorithm</key>
					<string>AES-256</string>
					<key>IntegrityAlgorithm</key>
					<string>SHA2-256</string>
				</dict>
				<key>DeadPeerDetectionRate</key>
				<string>Medium</string>
**				<key>ExtendedAuthEnabled</key>**
				<integer>1</integer>
				<key>IKESecurityAssociationParameters</key>
				<dict>
					<key>EncryptionAlgorithm</key>
					<string>AES-256</string>
					<key>IntegrityAlgorithm</key>
					<string>SHA2-256</string>
				</dict>
				<key>LocalIdentifier</key>
				<string>*************</string>
				<key>NATKeepAliveInterval</key>
				<integer>20</integer>
				<key>OnDemandMatchDomainsAlways</key>
				<array/>
				<key>OnDemandMatchDomainsNever</key>
				<array/>
				<key>OnDemandMatchDomainsOnRetry</key>
				<array/>
				<key>RemoteAddress</key>
				<string>client-vpn-eu.softwareone.com</string>
				<key>RemoteIdentifier</key>
				<string>client-vpn-eu********</string>
				<key>ServerCertificateCommonName</key>
				<string>******</string>
				<key>ServerCertificateIssuerCommonName</key>
				<string>******* Root Certificate Authority</string>
			</dict>
			<key>IPv4</key>
			<dict>
				<key>OverridePrimary</key>
				<false/>
			</dict>
			<key>PayloadDisplayName</key>
			<string>VPN (****-AOVPN)</string>
			<key>PayloadEnabled</key>
			<true/>
			<key>PayloadIdentifier</key>
			<string>com.apple.mdm.******************</string>
			<key>PayloadType</key>
			<string>com.apple.vpn.managed</string>
			<key>PayloadUUID</key>
			<string>0114e380-e186-0139-f044-109add5c0f44</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>Proxies</key>
			<dict/>
**			<key>UserDefinedName</key>**
			<string>SWO-AOVPN</string>
			<key>VPN</key>
			<dict>
				<key>AuthenticationMethod</key>
				<string>Password</string>
				<key>OnDemandEnabled</key>
				<integer>0</integer>
				<key>ProviderType</key>
				<string>packet-tunnel</string>
			</dict>
			<key>VPNType</key>
			<string>IKEv2</string>
		</dict>
	</array>
	<key>PayloadDisplayName</key>
	<string>Settings for Everyone</string>
	<key>PayloadIdentifier</key>
	<string>com.apple.mdm.*********************************</string>
	<key>PayloadOrganization</key>
	<string>Sujithkumar</string>
	<key>PayloadRemovalDisallowed</key>
	<false/>
	<key>PayloadScope</key>
	<string>User</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>f4166450-f542-0138-f036-109add5c0f44</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
</dict>
</plist>

the above profile was created using profile manager and it is under user (groups-->everyone) context because under device context IKEV2 isn't available. In the console app choosing, ppp.log does not show up any trace of this connection.

Replies  2
Boosts  0
Views  609
Participants  1
sujithcy OP
Aug ’21

I have also tried enabling "NetworkExtension" debug logging using terminal like shown below and still, I don't see the logs.

sudo defaults write /Library/Preferences/com.apple.networkextension.control.plist LogToFile -boolean true sudo defaults write /Library/Preferences/com.apple.networkextension.control.plist LogLevel -int 7

reproduced the issue

/System/Library/Frameworks/SystemConfiguration.framework/Resources/get-mobility-info

really, I have no clue to get this issue resolved. therefore I ask for your support to direct me into the right process to set this up.

For "IKEv2 with certificate auth EAP-TLS" are there any specific policy changes to be made from the server-side as well. In my opinion, I don't think so but if I am wrong then please let me know what setting needs to be done.

0
sujithcy OP
Aug ’21

the authentication method we use is not EAP-TLS instead it is EAP-PEAP.

0
Unable to establish VPN connection using EAP authentication method
First post date Last post date
 
 
Q