1

We recently updated our Microsoft RRAS server security to meet the latest Apple AES 256 VPN standards in order to connect however we have a problem where an IKEv2 VPN disconnects after exactly 8 minutes on the Monterey or Catalina macOS. During the eight minute period everything works great. https://developer.apple.com/documentation/devicemanagement/vpn/ikev2/ikesecurityassociationparameters

We don't have any problems with an iPhone IKEv2 VPN on iOS 14.8 or a PC (after VPN policy update).

On the Microsoft Server 2019 I used this powershell command to update the IKEv2 security:

Set-VpnServerConfiguration -CustomPolicy -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -DHGroup Group14 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PFSgroup PFS2048 -SALifeTimeSeconds 28800 -MMSALifeTimeSeconds 86400 -SADataSizeForRenegotiationKilobytes 1024000

and of course restarted the RRAS server for the change to take effect,

Restart-Service RemoteAccess -PassThru

I also enabled IKEv2 fragmentation

New-ItemProperty -Path “HKLM:\SYSTEM\CurrentControlSet\Services\RemoteAccess\Parameters\Ikev2\” -Name EnableServerFragmentation -PropertyType DWORD -Value 1 -Force

But still having the same disconnect issue even after rebooting the RRAS server.

For reference, if you make this change you also have to update the Windows PCs to avoid a "policy match error" when connecting your VPN (change "IKEv2-VPN" to the name of the VPN you want to update):

Set-VpnConnectionIPsecConfiguration -ConnectionName "IKEv2-VPN" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -DHGroup Group14 -EncryptionMethod AES256  -IntegrityCheckMethod SHA256 -PFSgroup PFS2048 -Force

Side note: that this configuration change does not affect SSTP connections.

Update: We also tried manually changing the MTU to 1400 and checked to make sure that iCloud Private Relay was off which it already was.

FINAL SOLUTION:

Set-VpnServerConfiguration -CustomPolicy -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -DHGroup Group14 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PFSgroup None -SALifeTimeSeconds 28800 -MMSALifeTimeSeconds 86400 -SADataSizeForRenegotiationKilobytes 1024000

Get-VpnServerConfiguration

Matching Windows Client VPN update (change "IKEv2-VPN" to the name of your VPN connection):

Set-VpnConnectionIPsecConfiguration -ConnectionName "IKEv2-VPN" -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -DHGroup Group14 -EncryptionMethod AES256  -IntegrityCheckMethod SHA256 -PFSgroup None -Force
Improve this question

1 Answer 1

Reset to default
0

Perhaps those who are looking for a solution to the problem will help.

There are 2 solutions:

"Change or add" esp proposal: aes256-sha256 (disable pfs because according to the standard for matching child esp MacOS communicates without it)

(For people with strongswan) Don't use dh-group for this proposal, because in strongswan (and devices using it) it includes pfs.

Or create an ikev2 profile in MacOS via Apple Configurator 2, enabling pfs. (DNS strings in the created file often fail, preventing installation. You can simply delete their block.) ESP with pfs: AES256-SHA256-MODP2048(DH14)

Improve this answer
2
  • Do you know how to disable pfs? Based on the docs I'm going to assume that I would change -PFSgroup PFS2048 to -PFSgroup None ... docs.microsoft.com/en-us/powershell/module/remoteaccess/… however I did not see any specific docs on -PFSgroup
    – John D.
    Commented Feb 3, 2022 at 21:54
  • Yes, this will disable PFS. I am using the following template to connect to strongSwan without PFS. (Set-VpnConnectionIPsecConfiguration -ConnectionName 'VPN-NAME' -AuthenticationTransformConstants SHA256128 -CipherTransformConstants AES256 -EncryptionMethod AES256 -IntegrityCheckMethod SHA256 -PfsGroup None -DHGroup Group14) So for RRAS, the parameter looks similar.
    – Mouz
    Commented Feb 9, 2022 at 14:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .