Vpnclient For Mac

Posted on

VPN for Mac allows you to use the service with ease. Just download the app, run it and choose from which country you want to appear. As of now there was no VPN Client 5.x available for MAC OS. The latest and last available client is vpnclient-darwin-4.9.01.0280-universal-k9.dmg. Shimo is the swiss-army knife when it comes to VPN connections on the Mac. It supports all major VPN protocols and provides awesome automation features for those who regularly use VPN connections.

Publisher's Description. Simple to deploy and operate, the Cisco VPN Client enables customers to establish secure, end-to-end encrypted tunnels to Cisco remote access VPN devices supporting the Unified Client Framework. This thin design, IPSec implementation is available via Cisco.com for use with any Cisco central site remote access VPN.

MacOS provides native support for connecting to the IT Services Cisco-based VPN service. Please note that IT Services support the current and two previous versions of macOS only; for details of supported versions please refer to the Apple Mac Support page.

This document contains instructions on how to configure the native VPN client that comes with macOS. In order to use the VPN service you will also need to have the necessary Remote Access Services username and passwords - for details see the main IT Services VPN Service page.

Please make sure that you have read the introduction and general requirements, which apply to all VPN clients, before attempting to configure your computer or mobile device to connect to the VPN.

1. Requirements

There are a number of requirements necessary in order to use the VPN service on Apple Macintoshes; these are detailed below.

  • Your computer must be running a supported version of macOS (see Apple Mac Support page for details).
  • You computer must already have a connection to the Internet (e.g. via NTL, Compuserve, broadband, ADSL, etc., etc.)
  • You must have a Remote Access Services account.
  • You must be able to log on as an Administrator of your Mac.

2. Obtaining the prerequisite information for configuring the inbuilt VPN client

As part of the process of configuring the inbuilt VPN client you will need to supply some group configuration information. Members of Oxford University can download a file containing this information from the IT Services Self-Registration Software Registration and Downloads web page. Once on this page select VPN client from the list. On the next page that appears select VPN shared credentials. A window containing the information should now pop up on your desktop. Make a note of the IPSec secret as you will need this information later on (it will be referred to as the shared secret) and then close the window using the close window link.

You have now obtained the information that you need from the Self-registration web pages.

3. Configuring and using the inbuilt VPN client

To use the macOS inbuilt support for Cisco VPN you will first need to open [System Preferences], which you can do from the dock, the [Apple] menu or by finding it in the Applications folder.

From the [System Preferences] window click the Network icon to bring up the Network window.

Click the + at the bottom of the left hand pane to bring up a dialogue window to add a new network interface. Within the dialogue window make the follow changes:

  • set the Interface drop down menu to VPN
  • set the VPN type drop down menu to Cisco IP Sec
  • change the Service Name field to something that is meaningful to you, eg VPN (OUCS)

Finally, click the Create to add the new interface. This will return you to the Network window with the newly added interface ready to configure. To configure the interface make the following changes:

  • set the Server Address field to vpn.ox.ac.uk
  • set the Account name and Password fields to your remote access account name and password

Next click the Authentication Settings.. button to bring up another dialogue window which requires the following information:

  • click the Shared secret radio button and fill in the text field using the information that you obtained earlier
  • set the Group Name field to oxford

Click the OK button to return to the Network window. If you are likely to use the VPN client regularly you may want to include the status of the VPN connection in your menu bar. If you do want to do this you must tick the check box labelled Show VPN status in menu bar.

Finally, click the Apply button to complete the configuration for this new VPN interface. The new interface should now appear in the left hand pane indicated by a locked padlock icon. Note that the status of the interface will show as Not connected.

To make a connection to the VPN service simply click the Connect found on the Network window. (This can be found underneath the Authentication Settings.. button.) Once the connection has been established the Network window will show that the status of the VPN interface has changed to Connected and it will display the connect time and the IP address.

4. Connecting to the IT Services VPN service using the inbuilt VPN client

Once you have configured a network interface on your Mac to connect to the IT Services VPN service you can make a VPN connection whenever you need to. To connect via the inbuilt client:

  • Open [System Preferences]
  • Click the Network icon to switch to the Network window
  • Select the VPN connection you configured previously (in this example called VPN (OUCS)) in the left hand pane
  • Click the Connect button (found underneath the Authentication Settings.. button)

Do remember to disconnect from the VPN service once you no longer need it by clicking the Disconnect button within the Network window.

Alternatively, if you chose to include the status of the VPN connection in your menu bar by ticking the box labelled Show VPN status in menu bar during the configuration process you can connect and disconnect using the VPN icon in the top menu bar. Look for the VPN icon in the top menu bar and click the icon to bring up the drop down menu.

Simply choose the [Connect] option from this menu to make a VPN connection. You can also use this menu to disconnect your session once you no longer need it.

5. Further Information

For information on firewalls and IP address allocations refer to the IT Services VPN Service technical details page.

If you have problems with the inbuilt client you may be advised to use the Cisco AnyConnect Client. Instructions are available from the Configuring the AnyConnect Client on Mac OS X Systems page.

-->

VPN client configuration files are contained in a zip file. Configuration files provide the settings required for a native Windows, Mac IKEv2 VPN, or Linux clients to connect to a VNet over Point-to-Site connections that use native Azure certificate authentication.

Client configuration files are specific to the VPN configuration for the VNet. If there are any changes to the Point-to-Site VPN configuration after you generate the VPN client configuration files, such as the VPN protocol type or authentication type, be sure to generate new VPN client configuration files for your user devices.

  • For more information about Point-to-Site connections, see About Point-to-Site VPN.
  • For OpenVPN instructions, see Configure OpenVPN for P2S and Configure OpenVPN clients.

Important

Starting July 1, 2018, support is being removed for TLS 1.0 and 1.1 from Azure VPN Gateway. VPN Gateway will support only TLS 1.2. Only point-to-site connections are impacted; site-to-site connections will not be affected. If you’re using TLS for point-to-site VPNs on Windows 10 clients, you don’t need to take any action. If you are using TLS for point-to-site connections on Windows 7 and Windows 8 clients, see the VPN Gateway FAQ for update instructions.

Generate VPN client configuration files

Vpn Client For Mac Sonicwall

Before you begin, make sure that all connecting users have a valid certificate installed on the user's device. For more information about installing a client certificate, see Install a client certificate.

You can generate client configuration files using PowerShell, or by using the Azure portal. Either method returns the same zip file. Unzip the file to view the following folders:

  • WindowsAmd64 and WindowsX86, which contain the Windows 32-bit and 64-bit installer packages, respectively. The WindowsAmd64 installer package is for all supported 64-bit Windows clients, not just Amd.
  • Generic, which contains general information used to create your own VPN client configuration. The Generic folder is provided if IKEv2 or SSTP+IKEv2 was configured on the gateway. If only SSTP is configured, then the Generic folder is not present.

Cisco Vpn Client For Mac

Generate files using the Azure portal

  1. In the Azure portal, navigate to the virtual network gateway for the virtual network that you want to connect to.
  2. On the virtual network gateway page, click Point-to-site configuration.
  3. At the top of the Point-to-site configuration page, click Download VPN client. It takes a few minutes for the client configuration package to generate.
  4. Your browser indicates that a client configuration zip file is available. It is named the same name as your gateway. Unzip the file to view the folders.

Generate files using PowerShell

Note

This article has been updated to use the new Azure PowerShell Azmodule. You can still use the AzureRM module, which will continue to receive bug fixes until at least December 2020.To learn more about the new Az module and AzureRM compatibility, seeIntroducing the new Azure PowerShell Az module. ForAz module installation instructions, see Install Azure PowerShell.

  1. When generating VPN client configuration files, the value for '-AuthenticationMethod' is 'EapTls'. Generate the VPN client configuration files using the following command:

  2. Copy the URL to your browser to download the zip file, then unzip the file to view the folders.

Windows

You can use the same VPN client configuration package on each Windows client computer, as long as the version matches the architecture for the client. For the list of client operating systems that are supported, see the Point-to-Site section of the VPN Gateway FAQ.

Note

You must have Administrator rights on the Windows client computer from which you want to connect.

Use the following steps to configure the native Windows VPN client for certificate authentication:

  1. Select the VPN client configuration files that correspond to the architecture of the Windows computer. For a 64-bit processor architecture, choose the 'VpnClientSetupAmd64' installer package. For a 32-bit processor architecture, choose the 'VpnClientSetupX86' installer package.
  2. Double-click the package to install it. If you see a SmartScreen popup, click More info, then Run anyway.
  3. On the client computer, navigate to Network Settings and click VPN. The VPN connection shows the name of the virtual network that it connects to.
  4. Before you attempt to connect, verify that you have installed a client certificate on the client computer. A client certificate is required for authentication when using the native Azure certificate authentication type. For more information about generating certificates, see Generate Certificates. For information about how to install a client certificate, see Install a client certificate.

Mac (OS X)

You have to manually configure the native IKEv2 VPN client on every Mac that will connect to Azure. Azure does not provide mobileconfig file for native Azure certificate authentication. The Generic contains all of the information that you need for configuration. If you don't see the Generic folder in your download, it's likely that IKEv2 was not selected as a tunnel type. Note that the VPN gateway Basic SKU does not support IKEv2. Once IKEv2 is selected, generate the zip file again to retrieve the Generic folder.
The Generic folder contains the following files:

  • VpnSettings.xml, which contains important settings like server address and tunnel type.
  • VpnServerRoot.cer, which contains the root certificate required to validate the Azure VPN Gateway during P2S connection setup.

Use the following steps to configure the native VPN client on Mac for certificate authentication. You have to complete these steps on every Mac that will connect to Azure:

  1. Import the VpnServerRoot root certificate to your Mac. This can be done by copying the file over to your Mac and double-clicking on it. Click Add to import.

    Note

    Double-clicking on the certificate may not display the Add dialog, but the certificate is installed in the correct store. You can check for the certificate in the login keychain under the certificates category.

  2. Verify that you have installed a client certificate that was issued by the root certificate that you uploaded to Azure when you configured you P2S settings. This is different from the VPNServerRoot that you installed in the previous step. The client certificate is used for authentication and is required. For more information about generating certificates, see Generate Certificates. For information about how to install a client certificate, see Install a client certificate.

  3. Open the Network dialog under Network Preferences and click '+' to create a new VPN client connection profile for a P2S connection to the Azure VNet.

    The Interface value is 'VPN' and VPN Type value is 'IKEv2'. Specify a name for the profile in the Service Name field, then click Create to create the VPN client connection profile.

  4. In the Generic folder, from the VpnSettings.xml file, copy the VpnServer tag value. Paste this value in the Server Address and Remote ID fields of the profile.

  5. Click Authentication Settings and select Certificate.

  6. Click Select… to choose the client certificate that you want to use for authentication. This is the certificate that you installed in Step 2.

  7. Choose An Identity displays a list of certificates for you to choose from. Select the proper certificate, then click Continue.

  8. In the Local ID field, specify the name of the certificate (from Step 6). In this example, it is 'ikev2Client.com'. Then, click Apply button to save the changes.

  9. On the Network dialog, click Apply to save all changes. Then, click Connect to start the P2S connection to the Azure VNet.

Linux (strongSwan GUI)

Install strongSwan

The following configuration was used for the steps below:

ComputerUbuntu Server 18.04
DependenciesstrongSwan

Use the following commands to install the required strongSwan configuration:

Use the following command to install the Azure command-line interface:

Generate certificates

If you have not already generated certificates, use the following steps:

Generate the CA certificate.

Microsoft office communicator for mac free download. Print the CA certificate in base64 format. This is the format that is supported by Azure. You upload this certificate to Azure as part of the P2S configuration steps.

Generate the user certificate.

Generate a p12 bundle containing the user certificate. This bundle will be used in the next steps when working with the client configuration files.

Install and configure

The following instructions were created on Ubuntu 18.0.4. Ubuntu 16.0.10 does not support strongSwan GUI. If you want to use Ubuntu 16.0.10, you will have to use the command line. The examples below may not match screens that you see, depending on your version of Linux and strongSwan.

  1. Open the Terminal to install strongSwan and its Network Manager by running the command in the example.

  2. Select Settings , then select Network.

  3. Click the + button to create a new connection.

  4. Select IPsec/IKEv2 (strongSwan) from the menu, and double-click. You can name your connection in this step.

  5. Open the VpnSettings.xml file from the Generic folder contained in the downloaded client configuration files. Find the tag called VpnServer and copy the name, beginning with 'azuregateway' and ending with '.cloudapp.net'.

    The Surface Go range is seei.Lenovo’s Miix 630 is one of the first Qualcomm Snapdragon-based Windows devices. Skype application for macbook.

  6. Paste this name into the Address field of your new VPN connection in the Gateway section. Next, select the folder icon at the end of the Certificate field, browse to the Generic folder, and select the VpnServerRoot file.

  7. In the Client section of the connection, for Authentication, select Certificate/private key. For Certificate and Private key, choose the certificate and the private key that were created earlier. In Options, select Request an inner IP address. Then, click Add.

  8. Turn the connection On.

Linux (strongSwan CLI)

Install strongSwan

The following configuration was used for the steps below:

Vpn Client For Macbook

ComputerUbuntu Server 18.04
DependenciesstrongSwan

Use the following commands to install the required strongSwan configuration:

Use the following command to install the Azure command-line interface:

Vpn Client For Mac Sophos

Generate certificates

If you have not already generated certificates, use the following steps:

Generate the CA certificate.

Print the CA certificate in base64 format. This is the format that is supported by Azure. You upload this certificate to Azure as part of the P2S configuration steps.

Generate the user certificate.

Cisco Anyconnect Client For Mac

Generate a p12 bundle containing the user certificate. This bundle will be used in the next steps when working with the client configuration files.

Install and configure

  1. Download the VPNClient package from Azure portal.

  2. Extract the File.

  3. From the Generic folder, copy or move the VpnServerRoot.cer to /etc/ipsec.d/cacerts.

  4. Copy or move cp client.p12 to /etc/ipsec.d/private/. This file is client certificate for Azure VPN Gateway.

  5. Open VpnSettings.xml file and copy the <VpnServer> value. You will use this value in the next step.

  6. Adjust the values in the example below, then add the example to the /etc/ipsec.conf configuration.

  7. Add the following to /etc/ipsec.secrets.

  8. Run the following commands:

Vpn Client For Mac Download

Next steps

Os X Vpn Client

Return to the article to complete your P2S configuration.

To troubleshoot P2S connections, see the following articles: