Everytime I connect to the Cisco VPN using the built-in VPN client, it asks me for the password. I am wondering is there a way we can auto save the password, like using the keychain?


This looks like a very annoying and longstanding bug in Mac OS X/macOS.

10.6: Save Cisco IPSec password in the Keychain:

Mac OS X Snow Leopard added the support for Cisco IPSec VPN connections – that is, plain IPSec with XAuth authentication and mode_cfg.

That makes it two layers of authentication: first, Machine Authentication with a password (Shared Secret) or an X509 certificate. Then a traditional username-password pair for XAuth, both of which you can enter and save in the Account Name and Password fields respectively when you set up the connection. Trouble is, even though you entered your password and it is apparently saved in the keychain properly, Mac OS X keeps nagging you to manually enter the password every time you connect. Turns out this is a just bug with a simple fix.

Open the Keychain Access Application, select the System keychain and find your saved XAuth password entry in the list. Its Kind field will say IPSec XAuth Password. Open it, then on the Access Control tab click the Plus button to add another application. The file we need to select, /usr/libexec/configd, resides in a hidden folder. To navigate there, press Command+Shift+G, enter /usr/libexec, then pick configd in the dialog. Save your changes and that's it – your saved password should now work.

Another guide using pretty pictures: https://anders.com/guides/native-cisco-vpn-on-mac-os-x/

Apparently the same manual fix of adding configd to the Keychain-allowed applications has to be applied for using the built-in ipsec-vpn tools.

VPN ipsec Prompting Saved Password:


On Mac OS X Snow Leopard (10.6.x) you are prompted to enter your VPN password even though you’ve previously saved it in the keychain You are using IPSec on the built in VPN client on Mac OS X Snow Leopard


This is caused by a problem with the Keychain Access item for the VPN IPSec connection. A two minute fix will sort it out for you.


  • Launch Keychain Access by clicking Applications > Utilities > Keychain Access
  • On the left upper pane, under Keychains select System
  • On the left lower, under Category select All Items
  • On the right side of the screen scroll to the bottom and locate the two items called VPN(IPSec)
  • Double-click the VPN(IPSec) whos kind is IPSec XAuth Password
  • Click the Access Control button/tab. The applications permitted to use this keychain item will be displayed below. If you’re prompted for your password, enter it.
  • Click the plus (+) sign
  • When the Finder window appears, press Cmd + Shift + G on your keyboard
  • When the Go To Folder dialog appears, enter /usr/libexec
  • Click Go
  • When the /usr/libexec folder appears scroll to configd, select it and click Add
  • Click Save Changes
  • Close Keychain Access and try connecting to your VPN again
| improve this answer | |
  • Followed these steps but still being prompted for my password when connecting to my corporation’s VPN on Mojave. – Martin Bean Jan 4 '19 at 9:56
  • @MartinBean Meanwhile, could you try this github.com/halo/macosvpn ? – LаngLаngС Jan 4 '19 at 10:18
  • 4
    Unfortunately, does not seem to work on 10.14. – hendrik Mar 5 '19 at 8:51

I am now using a very comfortable workaround with AnnyConnect CLI and Keychain.

Say I want to connect to foo.bar.com with account foo and password bar.

  1. Save foo and bar pair in Keychain (under login not iCloud) with name fookey
  2. Run the following bash script to connect (save it in /usr/local/bin)
/opt/cisco/anyconnect/bin/vpn connect foo.bar.com -s << EOM
0    # foo.bar.com doesn't require two factor authorization
foo  # vpn account
$(sudo security find-generic-password -ws fookey)  # vpn password

Using this approach, I don't need to type in my vpn password every time, and I won't write my password to files without encryption.

If you are not familiar with bash script, read below for explanation:

  • /opt/cisco/anyconnect/bin/vpn connect -s enters non-interactivel mode.
  • << EOM ... EOM is called here-docs, which uses a string to replace a file. It is very useful to script interactive CLI, by writing each respond as a new line.
  • security is a nice tool to access your Keychain from the command line.
| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .