<story><title>MacOS VPN architecture from System Preferences down to nesessionmanager</title><url>https://blog.timac.org/2018/0717-macos-vpn-architecture/</url></story><parent_chain><item><author>teilo</author><text>What boggles me about the VPN implementation on Mac is the massive amount of functionality that is not accessible unless you are using Apple Configurator to create a profile. Then you have to install the profile, and for any configuration change, you have to repeat the process.&lt;p&gt;For example, even though you can create a basic IKEv2 config, most of the parameters that are needed to actually make it work with a given router are not accessible except in Configurator. You cannot configure the encryption or hash algos, DH Group, group identifiers, etc.&lt;p&gt;And there is no access at all to other VPN types, such as a number of vendor-specific options, custom SSL, etc., even though they are supported.&lt;p&gt;Why can&amp;#x27;t there be advanced options for this stuff? It makes no sense.</text></item></parent_chain><comment><author>derefr</author><text>You&amp;#x27;re supposed to be managing the deployment&amp;#x2F;delivery of Apple Configurator profiles through Server.app&amp;#x27;s MDM features. If that is in play, then the workflow looks like:&lt;p&gt;1. You navigate your device to the MDM web portal served from the Mac running Server.app;&lt;p&gt;2. the MDM portal recognizes your MAC address as a new device, and allows you to register it;&lt;p&gt;3. an MDM profile is auto-generated for you, which you download and install;&lt;p&gt;4. the MDM profile transparently manages&amp;#x2F;updates a &lt;i&gt;real&lt;/i&gt; (Apple Configurator) profile, which has been customized by the MDM for any settings keyed specifically to your computer&amp;#x27;s MAC address.&lt;p&gt;Using Apple Configurator without MDM, just using Configurator .profile files, would be like using Windows Group Policy without Active Directory, just using GPO .cab files. It&amp;#x27;s &lt;i&gt;possible&lt;/i&gt;, but just kinda silly.</text></comment>
<story><title>MacOS VPN architecture from System Preferences down to nesessionmanager</title><url>https://blog.timac.org/2018/0717-macos-vpn-architecture/</url></story><parent_chain><item><author>teilo</author><text>What boggles me about the VPN implementation on Mac is the massive amount of functionality that is not accessible unless you are using Apple Configurator to create a profile. Then you have to install the profile, and for any configuration change, you have to repeat the process.&lt;p&gt;For example, even though you can create a basic IKEv2 config, most of the parameters that are needed to actually make it work with a given router are not accessible except in Configurator. You cannot configure the encryption or hash algos, DH Group, group identifiers, etc.&lt;p&gt;And there is no access at all to other VPN types, such as a number of vendor-specific options, custom SSL, etc., even though they are supported.&lt;p&gt;Why can&amp;#x27;t there be advanced options for this stuff? It makes no sense.</text></item></parent_chain><comment><author>Mister_Snuggles</author><text>&amp;gt; For example, even though you can create a basic IKEv2 config, most of the parameters that are needed to actually make it work with a given router are not accessible except in Configurator. You cannot configure the encryption or hash algos, DH Group, group identifiers, etc.&lt;p&gt;It seems like some of these, such as encryption, hash algorithm, and DH group, should be configured on the server side, not the client side.  I know that in the IPSec world the peers are roughly equal, but in this scenario the Mac is definitely playing the role of client.  Likewise, there is no ability to configure the traffic selectors, and I&amp;#x27;d argue that there probably shouldn&amp;#x27;t be.&lt;p&gt;I agree that there should be more configuration exposed in the UI though.&lt;p&gt;EDIT:  I spent about a half hour trying, unsuccessfully, to configure an IKEv2 connection on MacOS to a StrongSwan server.  I suspect a configuration problem on the StrongSwan side, but the MacOS side is so opaque that it makes it hard to match up the configs properly.&lt;p&gt;EDIT2:  I remember why I stopped trying to get IKEv2 working - the fact that Split-DNS is not in the protocol yet, but with IKEv1 I can use the Cisco Unity extensions to do it.</text></comment>