Mac OSX update 10.11.4 breaks the Cisco IPSec Client

Hi Gary,

Greetings.

Please provide me logs when you try to connect to Sophos XG to investigate this further.

Thanks

Sachin Gurung

Do you want logs from XG or from my client? FYI I have a case opened #5832816 and have provided several logs. What I may have found is that Apple has updated the DH to group 14 and does not connect with the other earlier DH group levels. There is no place to set the DH level in XG.

One other thing, I have also filed a bug with Apple but I have not heard back on that yet.

You should try install the iOS IPSec profile from the captive portal.. That works for me.

Thanks for the suggestion. I will see if that works. Apple has confirmed my report as a duplicate bug. No info on when if ever it will get fixed. In talking with Apple support, they acknowledge they changed their IPSec, but little info on how to fix or work around it.

For those that may be interested, here is the Apple note on the changes to IPSec in Mac OSX/iOS

https://support.apple.com/en-us/HT206154

From reading this and other user posts, Apple (at Cisco request?) has dropped support for DH group 2 Aggressive mode and XG is not responding with DH group 5 or 14 and no options to set it to accept the newer standards.

Regards,

Gary