16

I know it's a bad idea to upgrade an OS so soon when you are running any enterprise software, especially related to security/vpns etc.

But I did! And I would like to avoid downgrading if possible.

Ever since I upgraded to OS X Yosemite though, juniper's network connect (vpn client) stopped working. First it just wouldn't launch. I realized that was because of the Java 7 compatibility issue on Yosemite. So I upgraded to the latest Java 8 build (and installed the JDK).

Now although Network Connect launches it hangs at the "Establishing Secure Session" step. It seems as though the connection is established (since I lose internet access in this period) but it can't create a tunnel.

Network Connect log

2014-10-17 19:21:06.144 ncproxyd[p64363.t771] ipsec.info New tunnel being created (tunnel.cpp:57)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route 0.0.0.0/0.0.0.0 gw 10.32.0.1 metric 2 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.248.0 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.0.0.0 gw 127.0.0.1 metric 1 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.255.255 gw 127.0.0.1 metric 1 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] rmon.info got system route <someip>/255.255.0.0 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] DSIPCHandler.info Saving the system routing table: 0|0|16785418|2|0|0000000000000000;8202|16318463|0|1|4|0000000000000000;16785418|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;127|255|16777343|1|0|0000000000000000;16777343|-1|16777343|1|0|0000000000000000;65193|65535|0|1|4|0000000000000000; (handler.cpp:345)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] config.info Setting key "ncproxyd_saved_routes" to value "0|0|16785418|2|0|0000000000000000;8202|16318463|0|1|4|0000000000000000;16785418|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;127|255|16777343|1|0|0000000000000000;16777343|-1|16777343|1|0|0000000000000000;65193|65535|0|1|4|0000000000000000;" in the persistent store (config.cpp:273)
2014-10-17 19:21:06.151 ncproxyd[p64363.t771] config_macos.info Setting value of ncproxyd_saved_routes to: 0|0|16785418|2|0|0000000000000000;8202|16318463|0|1|4|0000000000000000;16785418|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;-1711136758|-1|0|1|4|0000000000000000;127|255|16777343|1|0|0000000000000000;16777343|-1|16777343|1|0|0000000000000000;65193|65535|0|1|4|0000000000000000; (config_macos.objcpp:63)
2014-10-17 19:21:18.821 ncproxyd[p64463.t771] ipsec.info New tunnel being created (tunnel.cpp:57)
2014-10-17 19:21:18.828 ncproxyd[p64463.t771] rmon.info got system route 0.0.0.0/0.0.0.0 gw 10.32.0.1 metric 2 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:18.828 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.248.0 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:18.828 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:18.828 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:18.828 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.255.255 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:18.829 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.0.0.0 gw 127.0.0.1 metric 1 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:18.829 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.255.255 gw 127.0.0.1 metric 1 via 0x00000000 (routemon.cpp:729)
2014-10-17 19:21:18.829 ncproxyd[p64463.t771] rmon.info got system route <someip>/255.255.0.0 gw 0.0.0.0 metric 1 via 0x00000004 (routemon.cpp:729)
2014-10-17 19:21:18.829 ncproxyd[p64463.t771] DSIPCHandler.info Saving the system routing table:

Notice how there are repeated attempts to create a tunnel, and this happens continuously. I have only pasted the logs from the last two attempts that Network Connect made.

I have also tried Junos Pulse as an alternative, it's a little better at error reporting. It shows that there is a connection, but says "tunnel not enabled" and I can't connect to the internet with it either.

The VPN with network connect worked fine until a few hours ago (when I had not upgraded to Yosemite).

Improve this question

3 Answers 3

Reset to default
10

Figured it out. First downgrade JAVA to Apple 1.6 as mentioned by Joe L. Farina above. That actually does work in some situations, but if your VPN provider only supports an old version of Network Connect then it will continue to hang.

To fix that, on the terminal run the following, then restart your computer: 

sudo nvram boot-args="kext-dev-mode=1"

For some users it might be necessary to do this: https://discussions.apple.com/thread/6546349

Update: Some folks have been asking what the above command does, and fairly so. The above command basically disables kext signing on your OS X equipment. Kext signing is a security (Code signing) feature, that verifies if drivers and other software installed on your computer have been altered in anyway from what the developer of the application/driver had originally released. Old applications developed for the OS X (pre Yosemite) did not have this feature, since the feature was introduced with Yosemite. It does have a theoretical security risk, but if you know what you are installing and you do it from authentic sources (like the app store or well known developers you trust), then you should be fine. Otherwise refrain. To read more about kext signing see: https://developer.apple.com/developer-id/

Improve this answer
3
  • I have been visiting this page periodically. The solution suggested works fine but I couldn't find any clues what exactly kext-dev-mode does. Thus I have doubts about it's side effects. If you help me understand what it really is, your help is appreciated.
    – scriptmonster
    Mar 20, 2015 at 19:18
  • Updated answer with some information about kext signing @scriptmonster. You should also consider something like cindori.org/trim-enabler-and-yosemite if you want to control it without command line/restarts.
    – Faraaz Khan
    Mar 21, 2015 at 20:36
  • Ignore the part about control it without command line/restarts above, that is incorrect, the link above still has some useful information about kext signing though.
    – Faraaz Khan
    Mar 21, 2015 at 22:08
4

So, here's what worked for me: disabling Oracle Java, and reverting back to Apple Java's RE v6:

  1. Download Apple Java 2014-001 from here
  2. Run and install it
  3. Follow the notes here to disable Oracle's Java and re-enable Apple's Java

I understand Apple's RE v6 might be less flexible but, for now, I've gotten Juniper VPN to work properly. It was still connecting, but disconnecting every couple of minutes.

If you have any requirement to have the latest Oracle Java 8.25 running let me know - there are a few steps which may produce mixed results, like: manually downloading and installing the Network Connect Applet (from your secure gateway), always starting the connection from within the Safari browser (instead of from the Applet, as it'll never successfully connect) and, further, inside Safari / Preferences / Security / Allow Plugins > WebSite Settings setting Java / your VPN gateway to "Run in unsafe mode" (choose it twice, otherwise it won't get registered).

Improve this answer
2
  • I tried these steps but unfortunately, it does not seem to work for me. Any other suggestions? Thanks!
    – user96865
    Oct 21, 2014 at 18:27
  • Does not work for me either :( I am able to connect to the VPN from a Mavericks laptop. But on Yosemite it simply hangs. I have tried the other options mentioned as well, allowing plugin to run in unsafe mode etc.
    – Faraaz Khan
    Oct 23, 2014 at 16:28
2

Get your Network Connect from https://vpn.gaikai.com/dana-cached/nc/NetworkConnect.dmg

That, along with Faraaz's suggestion of rebooting after

sudo nvram boot-args="kext-dev-mode=1"

It fixed the problem for me

Improve this answer
6
  • Wouldn't safe boot mode do the same kernel extension rebuild as kext-dev-mode?
    – bmike ♦
    Dec 22, 2014 at 22:28
  • 1
    Is this a safe URL to use? What if this is a compromised package?
    – nwinkler
    Jan 21, 2015 at 7:39
  • 2
    @nwinkler, just replace the host name with yours.
    – Rubens Mariuzzo
    Feb 27, 2015 at 3:45
  • Yes, right - that actually worked once I was logged in. I replaced the host name with the one from our VPN, and I was able to download the NetworkConnect.dmg from there. I haven't tried the reboot yet to see whether it fixes the connection issue.
    – nwinkler
    Feb 27, 2015 at 7:20
  • I've altered host name in this url and this solves security issue, thanks.
    – Marek R
    Nov 13, 2015 at 19:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .