6

I use both the Apple VPN client (L2TP over IPSec in Network preferences) and Checkpoint Endpoint Security client to connect to work.

I installed Yosemite last night and today I can not connect to work using VPN. It connects to the server but fails.

The Checkpoint software gives a bit more feedback: "Connection Failed: Enforce Firewall Policy failed". This occurs after authentication of my username/password.

Both clients work fine on my MacBook which still has Mavericks.

Suggestions?

Mac mini, OS X Yosemite (10.10)

Improve this question
  • Is this a duplicate of apple.stackexchange.com/questions/151126/… – mmmmmm Oct 19 '14 at 13:29
  • 1
    No, it is not a duplicate, thanks. Based on other comments, I reinstalled (using E75) which worked last night but broke again this morning. I did find one static IP that I had setup and removed it. I've tried wired and wifi and no luck. – Barry Oct 20 '14 at 14:25
  • My Apple IPSec client quit working immediately after I installed OS X 4.0 Server. I tried a lot of things including uninstalling OS X 4.0 server (as best as I could without any official guide to do so). Ultimately, the only thing that fixed my issue was re-running the Yosemite OS install. Luckily the re-install kept my files intact (no need to run time machine). – P.Brian.Mackey Dec 22 '14 at 1:20
  • The issue occurred again. I had to re-install OS-X Yosemite a second time. This time I did not install OS X 4.0 server. I turned off automatic updates for the OS and all my apps. – P.Brian.Mackey Jan 12 '15 at 16:00
9

I think the unerlying issue is that Yosemite will not load kext (kernel extensions) unless they are signed by an authorized kernel extension developer. However in 10.8 and earlier, kexts could not be signed and signed kexts for 10.9+ will not load in <10.9.

I experienced the same issue loading unsigned tuntaposx for the vpnc cisco client.

You can override this behavior and allow the cpfw.kext to load in Yosemite by putting your computer into kext developer mode. This essentially reverts to the 10.9 behavior by allowing unsigned kexts to load.

sudo nvram boot-args="kext-dev-mode=1"

Now reboot and your kext should load.

You can revert by doing this:

sudo nvram -d boot-args
Improve this answer
4

According to the debug logs this is related to a problem with loading /System/Library/Extensions/cpfw.kext

[ 66 2571][19 Oct 10:46:31][TR_FIREWALL] CFirewallWrapper::EnforcePolicy: firewall not initialized, calling init
[ 66 2571][19 Oct 10:46:31][TR_FIREWALL] CFirewallWrapper::Init: entering...
[ 66 2571][19 Oct 10:46:31][TR_FIREWALL] CFirewallWrapper::Init: MACOS init firewall, g_kextPath=/System/Library/Extensions/cpfw.kext
[ 66 2571][19 Oct 10:46:32][TR_FIREWALL] CFirewallWrapper::Init: CpfwLoadKext returned cpfwlib_kextload_failed
[ 66 2571][19 Oct 10:46:32][TR_FIREWALL] CFirewallWrapper::Init: CpfwLoadKext Failed with error cpfwlib_kextload_failed
[ 66 2571][19 Oct 10:46:32][TR_FIREWALL] CFirewallWrapper::Init: CpfwDiagnoseLoadKext return:
 Can't stat 4/System/Library/Extensions/cpfw.kext - No such file or directory.

Deleting the site and re-creating it does not fix this problem.

Uninstalling and re-installing the Check Point Endpoint Security client (version E75.01) worked for me too and I am using a static IP (not DHCP) on my mac mini.

Note about uninstalling the Endpoint Security client E75.x and newer: Open the original DMG package you used to install the client and launch the Uninstaller shown. If you get an error message about your security settings not allowing non-appstore apps or untrusted applications from launching, hold down the Control key and then click on the Uninstaller. Selecting Open at this point will allow the Uninstaller to run.

I did confirm the uninstall removed and the reinstall did create a new /System/Library/Extensions/cpfw.kext file. I did not have to reboot but note I did shutdown the client before running the uninstaller.

However this may be a temporary fix as there is a Checkpoint Forum entry about another person who has also encountered this problem and has fixed it by uninstalling and installing but on a reboot the problem came back for them. That person tried versions E80.41 and E80.42. See https://forums.checkpoint.com/forums/thread.jspa?threadID=21491&tstart=0

Another Check Point Mac VPN Yosemite thread is reporting similar issues where some claim their client still works after a reboot but others, including the author of the above thread, who continue to see the problem return after a reboot: https://forums.checkpoint.com/forums/thread.jspa?threadID=21181&tstart=0

Improve this answer
  • I have tried E80.50 version on Yosemite and I tried the uninstalling and reinstalling workaround. It fixes it for a while but the problem returns. I am on Yosemite 10.10.2 and the problem persists. A reboot does not fix it for me. – motionpotion Jan 29 '15 at 11:49
  • 1
    @motionpotion Version 80.60 has been working for me since I posted back in Nov. See the link in my answer. – Barry Mar 4 '15 at 13:37
  • @Barry I installed 80.60 and it is also working for me. – motionpotion Mar 6 '15 at 10:01
1

Version 80.60 has been released by Checkpoint. It works for me so far.

Download from: Endpoint Security VPN for Mac E80.60

Brian's answer regarding kext developer mode also worked.

Improve this answer
0

I set my Wifi to DHCP instead of static IP, then VPN worked for me.

Improve this answer
0

I completly removed Check Point Endpoint Security client (version E80.42), rebooted computer and installed it again. Now it works ok. My WiFi is getting IP from router via DHCP.

Improve this answer
0

I just re-installed Endpoint Security E75.01 after closing it (not un-installing it) and it worked correctly again.

Improve this answer
0

Same thing is happening here. L2TP VPN fails if I have a static IP. If I switch to DHCP it works. I'm connecting to a Sonicwall NSA4500.

Fun bug, Apple. Hope it gets resolved in 10.10.1.

Improve this answer
0

I tried the suggested solutions and they did not correct my issue. I reinstalled Yosemite to get my Apple IPSec client to work. The issue returned so I also turned off automatic updates for the OS and all applications. So far the issue has not returned for a third visit.

As of Yosemite 10.10.2 it seems Apple fixed the bug.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .