When I establish a connection using the integrated IKEv2 client on my Mac (OS Sierra 10.12.1), I get disconnected after eight minutes. Until then it works perfectly as well. Any idea how to resolve this issue?

  • 1
    I am having the same issue already for months and haven't found a solution yet :( – P.T. Dec 13 '16 at 20:32

The essence of the solution described there is plausible – that it has to do with the re-keying process which occurs periodically. You ought to see something in the Console log, and perhaps also in logs on the server side, that will point you in the right direction.

At random times during the lifetime of the tunnel, the two sides will re-negotiate the symmetric-cipher keys that they are using, so that the conversation does not continue to use the same keys for too long. If this process failed, the connection would be dropped, and if it consistently occurs "after eight minutes," this could well be it. All of the parameters on both sides must match exactly, and there's nothing easy about debugging IPSec. I'd start with Console as my starting point. (There are several logs – look at 'em all.)


This is fixed in Mac OS Sierra 10.12.4, since updating to this version I can keep a IKEv2 session open to pfSense for hours.

Before on Mac OS Sierra 10.12.3 it was disconnecting every 480 seconds (8 min).

  • "480 seconds" seems like a very short re-keying interval but "re-keying" certainly appears to be the part of the exchange that is falling-down in each case. There's just nothing "easy" about debugging VPNs! – Mike Robinson Sep 14 '18 at 15:39

Someone posted a solution here: https://forum.pfsense.org/index.php?topic=110790.0

  • 1
    Welcome to Ask Different! We're trying to find the best answers and those answers will provide info as to why they're the best. Explain why you think the link you provided will answer the question. Links can change and become outdated so we prefer the answers to not just be a link. See How to Answer on how to provide a quality answer. - From Review – fsb Dec 16 '16 at 20:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .