I had a IKEv2 VPN connection configured with MacOS Mojave that worked perfectly.

After updating to Catalina I can't connect to the VPN with the message User authentication failed.

Any idea how to fix or troubleshoot this problem?

The only logs I've found are in /var/system/wifi.log:

Wed Oct  9 23:47:06.462 <airportd[300]> _processIPv4Changes: ARP/NDP offloads disabled, not programming the offload

I had the same problem and I fixed with changing "Authentication Settings" from "Certificate" to "None". After this change, you will see 2 new options appeared just below, "Shared Secret" and "Certificate". Select "Certificate" option and reselect the certificate that is already used for the VPN connection before. Then click Connect button, confirm applying changes and viola!

|improve this answer|||||
  • Hi erkan, thanks for answering. The point is I'm using username authentication method (user password) so that wouldn't work for me. – codependent Oct 9 '19 at 20:30
  • This does work for client based authentication, but I wonder what the implications of using "None" for authentication with the certificate suboption are. – Swiss Oct 11 '19 at 21:46

Make sure you comply with the current "MUST" settings in this RFC for the IPSec/VPN-server:

RFC 8221 - Cryptographic Algorithm ... - IETF Tools

In my case we experienced disconnects after 480 seconds.

Found out that the proposal for "AES_CBC_256/HMAC_SHA2_256_128" was missing in the VPN-server. With AES-256/SHA-256 enabled the VPN-connection stays connected.

More info:

VPN enhancements in iOS 13 and macOS Catalina

|improve this answer|||||

Same here on iOS13 / macOS Catalina. iOS12 & Mojave working fine. We have an IKEv2 implementation using client certificates on MikroTik router.

You can follow this thread in the MikroTik forum: https://forum.mikrotik.com/viewtopic.php?f=2&t=153155&p=756230#p756230

Here are some infos in the FAQ of LibreSwan (https://libreswan.org/wiki/FAQ). (truncbug)

People with this issue started a thread in Apple's forum: https://forums.developer.apple.com/thread/121193

Regards, Flo

|improve this answer|||||

SOLVED: It turned out, that in iOS13 & macOS Catalina Apple has added SAN certificate field verification and it fails in the new version because my certificates does not have any Subject Alt. Name.

I re-created both certificates for client & server with subject alternative names field (SAN) configured: enter image description here

Solution: create certificates with SAN fields configured Now it's working on iO13 and macOS catalina

More here: https://forum.mikrotik.com/viewtopic.php?f=2&t=153155&p=755967#p755967

|improve this answer|||||

When you are facing this problem during the first time configuring the VPN, try out erkan's solution first.

If the issue persists even after that, restart your Mac.

My mac had a problem opening the prompt to get the password for the keychain where my certificate was stored. Before I restarted my Mac had issues showing the prompt, but after I restarted the Mac prompt came up and problem fixed.

|improve this answer|||||

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .