IPSec VPN does not work with latest MacOS, restoring a configuration does NOT reinstall the VPN part

Zyxel_USG_User

Thank you as well for confirming that v3.2.5.10 adds native Apple Silicon (ARM) support.

I only discovered this release because a macOS device suddenly displayed a warning that the current Intel version would stop working in a future macOS release - which prompted me to come back here and investigate. Without that warning, I would not have known. There will be many other users currently running the Intel SecuExtender v3.2.4.19 under Rosetta 2 on Apple Silicon Macs who are unaware that a native ARM version now exists. A proactive announcement would help all of them.

Before upgrading, I need answers to the following practical questions:

1. Licence compatibility I have an active 3-year subscription licence registered to this Mac. Is it valid with v3.2.5.10, or is a different licence type required?

2. Uninstall procedure Must v3.2.4.19 be manually uninstalled first, or does the v3.2.5.10 installer handle the old version automatically? Does it need manual removal of the older version after the new version has been successfully installed, and the current configurations have been taken into the new ARM-capable SecuExtender client?

3. Licence re-registration After installing v3.2.5.10, must the licence key be re-entered and re-activated, or is the existing activation carried over automatically?

4. VPN configuration Is the existing tunnel configuration preserved after the upgrade, or must it be re-downloaded from the USG20W-VPN? And, which are the cases when an existing configuration will not work and will have to be reconfigured (eg specific parameters on the server/firewall will have to be changed to a safer version from min. sha256 to min. sha… etc).

In summary: what is the complete step-by-step upgrade procedure from v3.2.4.19 to v3.2.5.10 on macOS?

Partial answers exist in various sections of the release document, but there is no single clear migration guide. Please provide one - and consider publishing a dedicated upgrade PDF alongside future release binaries. Users upgrading from the Intel version to the native ARM version will have exactly these questions.

Zyxel_Melen

Hi @Zyxel_USG_User

1. Licence compatibility 

I have an active 3-year subscription licence registered to this Mac. Is it valid with v3.2.5.10, or is a different licence type required?

Yes, the license type is the same, and the key information is kept in your device. If there has any issue, please feel free to send me a private message with the key information.

2. Uninstall procedure 

Must v3.2.4.19 be manually uninstalled first, or does the v3.2.5.10 installer handle the old version automatically? Does it need manual removal of the older version after the new version has been successfully installed, and the current configurations have been taken into the new ARM-capable SecuExtender client?

You need to manually uninstall the v3.2.4.19 first before install v3.2.5.10.

3. Licence re-registration 

After installing v3.2.5.10, must the licence key be re-entered and re-activated, or is the existing activation carried over automatically?

Edited: You don't need to re-entered since the key information is in your device. Additionally, if there has any issue, please feel free to send me a private message with the key information.

4. VPN configuration 

Is the existing tunnel configuration preserved after the upgrade, or must it be re-downloaded from the USG20W-VPN? And, which are the cases when an existing configuration will not work and will have to be reconfigured (eg specific parameters on the server/firewall will have to be changed to a safer version from min. sha256 to min. sha… etc).

The VPN profile will not be kept. You need to apply it again if you haven't deleted the script. Additionally, if you find there has an issue, please help to re-configure the VPN by using the wizard, which provides VPN script. This is because the VPN configuration which generated in old firmware version might not meet the new MACOS requirement. The latest firmware version supports the new requirement, so, re-configure should fix it.