We wanted to upgrade our existing L2TP connections to IKEv2 for connecting to our corporate servers. The problem is as follows:
With L2TP, only the assigned IP range is routed through the tunnel, because the option to "Send all traffic over VP connection" is disabled and the service order is pretty low. Here is an excerpt from the routing table:
Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default 192.168.123.254 UGSc 99 0 en0 default link#17 UCSI 0 0 ppp0 10 ppp0 USc 0 0 ppp0 10.1.102.55 10.1.102.56 UH 1 0 ppp0
With IKEv2, on the other hand, there is no such option "Send all traffic over VP connection", and the interface is not even shown under "Set Service Order". We don't want to route all internet traffic over the VPN connection, just the range that is assigned to the interface. Here is an excerpt from the routing table:
Routing tables Internet: Destination Gateway Flags Refs Use Netif Expire default link#15 UCS 60 0 ipsec0 default 192.168.123.254 UGScI 21 0 en0 18.104.22.168 link#15 UHW3I 0 0 ipsec0 88 10.1.102.57 10.1.102.57 UH 0 0 ipsec0 22.214.171.124 link#15 UHWIi 20 351 ipsec0
As you can see, not only has the IKEv2 interface become the primary interface, it has also become the primary gateway for most routes on the table (redacted here for readability). I don't know if this is a built-in macOS "feature" but it is undesirable at the very least.
Does anyone have any ideas on how to change or circumvent this behavior (either client- or server-side)?
PS We also have Windows clients that use IKEv2 without problem because the "Use default gateway on remote network" is unchecked. The server we are connecting to is a Windows Server 2016 with RRAS role installed, setup as a RADIUS client to our isolated DC-AC machine.