Hello,
Yes, this behavior can occur under certain conditions in macOS. Based on what you described, it’s likely that macOS is clearing the stored password from the IKEv2 VPN entry due to a security policy or keychain access issue during OnDemand reconnection, especially after sleep/wake cycles.
macOS can delete or unreference saved VPN passwords in the following cases:
1. Keychain Permission Issues
If the VPN configuration loses access to the Keychain (due to corruption, user permission change, or keychain timeout), macOS may fail to retrieve the saved password and prompt for it instead.
2. Sleep/Wake Interruption
OnDemand connections triggered immediately after waking can sometimes initiate before the Keychain is fully accessible, causing the password retrieval to fail. This is especially true for IKEv2 profiles using certificate or hybrid auth.
3. System Integrity Protection (SIP) or TCC Restrictions
macOS might restrict background services from accessing stored credentials under certain TCC or SIP security contexts after wake, treating it as an untrusted access attempt.
4. Keychain Item Modified or Removed
If the keychain item was manually altered or another system process updated/invalidated it (like a security agent, sync issue, or user profile tool), the reference might be broken, even though the entry still appears intact in the VPN configuration.
5. VPN Profile Corruption
Sometimes, VPN entries behave inconsistently due to hidden corruption in the configuration profile or plist. This would explain why deleting and recreating the entry resolves it temporarily.
Why it keeps happening:
Since it mostly occurs after waking and during OnDemand connections, the most probable cause is the timing of Keychain access vs VPN initialization. macOS attempts to start the VPN before the Keychain is fully responsive, resulting in a missing credential. When it fails, it doesn’t retry fetching the stored password.
⸻
Workarounds:
• Delay VPN OnDemand connection slightly after wake (via a helper script or launchd job).
• Store credentials explicitly in the Keychain with Always Allow access for system processes.
• Consider using a configuration profile (.mobileconfig) with embedded credentials or certificate auth if possible.
• Use a script to monitor Keychain and reset the VPN if password access fails.
