VPN client-to-site settings for MacOS 15 (Sequoia)

MarkoD

Hi, I'm currently using these settings for a working VPN connection from Windows native clients:

Gateway:
- SA Lifetime: 86400
- Negotiation mode: Main
- Proposal (enc/auth): 3DES/SHA1
- Key Group: DH2

Connection:
- SA Lifetime: 3600
- Active Protocol: ESP
- Encapsulation: Transport (L2TP/IPSec) or Tunnel (IKEv2)
- Proposal (enc/auth): AES256/SHA1
- PFS: None

These settings have proven stable and widely supported in Windows' native VPN client and work for both L2TP/IPSec and IKEv2. I now have to connect a new Mac with macOS 15 (Sequoia) via VPN and I'm looking for a minimal change to the above settings in order for the native Mac client to successfully connect.

If anyone has the working settings for the newsest MacOS, please share. I cannot find the supported protocols for Sequoia anywhere online.

Thanks!

PS: I'd like to use the native client on the Mac (or a free alternative), not a paid VPN client.

MarkoD

For anyone interested, the native macOS 15 Sonoma VPN client works with the settings that I have posted. No need to do any adjustements, L2TP/IPSec with pre-shared key worked flawlessly.

Caroll

Hi @MarkoD, which firewall model are you using?

MarkoD

https://community.zyxel.com/en/discussion/comment/70604#Comment_70604

USG60

MarkoD

For anyone interested, the native macOS 15 Sonoma VPN client works with the settings that I have posted. No need to do any adjustements, L2TP/IPSec with pre-shared key worked flawlessly.

Zyxel_Kay

Hi @MarkoD

Thank you for sharing your experience and the successful VPN settings for macOS 15 (Sonoma)!

To confirm, the default L2TP VPN setup using the Zyxel VPN wizard can indeed work with the following encryption settings:

• Phase 1: 3DES/SHA1/DH2
• Phase 2: 3DES/SHA1/None

MarkoD

Dear @Zyxel_Kay, you can bump up security by using SHA256 instead of 3DES in Phase 2. It works for built-in clients in Windows and also Mac.

Zyxel_Kay

Hi @MarkoD

Thank you for sharing this valuable insight!

We've tested the following configuration for IKEv2 VPN between the USG60 and macOS 15, and it works with the native client:

• Phase 1: AES256, SHA256, DH19
• Phase 2: AES256, SHA256, PFS: None