IKEv2 profile broken since Sonoma 14

Question

Level 1

14 points

IKEv2 profile broken since Sonoma 14

Hello,

Since macOS Sonoma 14.0, the following IKEv2 VPN profile doesn't work anymore. It was fine with Monterey and Ventura, as this VPN configuration was specifically created for Apple devices. The server is iked on OpenBSD 7.3, we have no problems with Ventura.

Here the profile :

https://paste.chapril.org/?3a0fbc0e776483dc#Dop7CqUjJ21e55kcPfEfyDHyAf78VBz5RQ7Znm1oJLf5

As you can see, working versions are written in the profile.

Here the server logs :

ikev2_resp_recv: failed to negotiate IKE SA
ikev2_log_proposal: IKE #1 ENCR=AES_GCM_16-256
ikev2_log_proposal: IKE #1 PRF=HMAC_SHA2_256
ikev2_log_proposal: IKE #1 DH=ECP_256
ikev2_log_proposal: IKE #2 ENCR=AES_GCM_16-256
ikev2_log_proposal: IKE #2 PRF=HMAC_SHA2_256
ikev2_log_proposal: IKE #2 DH=MODP_2048
ikev2_log_proposal: IKE #3 ENCR=AES_CBC-256
ikev2_log_proposal: IKE #3 PRF=HMAC_SHA2_256
ikev2_log_proposal: IKE #3 INTEGR=HMAC_SHA2_256_128
ikev2_log_proposal: IKE #3 DH=ECP_256
ikev2_log_proposal: IKE #4 ENCR=AES_CBC-256
ikev2_log_proposal: IKE #4 PRF=HMAC_SHA2_256
ikev2_log_proposal: IKE #4 INTEGR=HMAC_SHA2_256_128
ikev2_log_proposal: IKE #4 DH=MODP_2048
ikev2_add_error: NO_PROPOSAL_CHOSEN

It seems proposal settings are very limited and do not match what is specified in the profile. It's very urgent, as our clients can't update their systems.

Posted on Sep 27, 2023 12:25 AM

Reply

Answer 1

amachay

Level 1

8 points

Oct 11, 2023 5:36 PM in response to amachay

Noticed a pattern that this isn't a problem for our IPv4-only hosts.

It is only a problem for dual-stacked IPv4 and IPv6 hosts. Wondering if this is relevant.

Reply

Answer 2

si8001 Author

Level 1

14 points

Oct 31, 2023 12:34 AM in response to mvg009

Thanks for your response. Glad you managed to find a way to fix that works for you. On our profile, the Diffie-Hellman group is 31 (Curve25519). I do not want to lower that setting. According to my server logs, it could also work with 14 (MODP 2048), but it is even worse.

Reply

Answer 3

czhangx

Level 1

8 points

Oct 31, 2023 1:25 AM in response to mvg009

I would like to point out that the problem you were facing may be different from the problem we are talking about here. I presume that you are referring to a rekeying problem which causes the VPN to disconnect after certain amount of time. But I believe many of us are facing an issue that IKEv2 VPN simply won't connect from the beginning.

Reply