VPN to ATP200 from MacOS

StevieG

A client has purchased a new MacBook and I am wondering if it is still possible to create an SSL VPN tunnel to a Zyxel ATP200?

The ATP200 is not configured within Nebula but done on-premise via a browser and I believe the software release notes are saying its not compatible with the USG Flex and ATP range. Is this correct?

Also am I right in saying the legacy SecuExtender software will not work on newer versions of MacOS?

Zyxel_Melen

Hi @StevieG ,

Here is the current status regarding macOS compatibility, the ATP200, and SecuExtender:

1. Legacy SecuExtender SSL VPN is EOL: The legacy SecuExtender SSL VPN client for macOS has officially reached End of Life (EOL). It is only compatible with macOS 14 (Sonoma) and older versions and does not support macOS 15 (Sequoia) or newer versions. Additionally, the license for the legacy SecuExtender SSL VPN client also reached End of Life (EOL). We don't sell this license anymore.
2. Newer Client Compatibility: You are correct about the release notes. The newer SecuExtender Zero Trust IPSec/SSL VPN Client only supports SSL VPN tunnels when connecting to the newer USG FLEX H series firewalls. It does not support SSL VPN connections to the standard ATP or USG FLEX (non-H) series. When connecting to an ATP200, only the IPSec protocol is supported.
3. Recommended Migration Path: Instead of SSL VPN, we strongly recommend configuring a native IKEv2 IPSec VPN. macOS has built-in native support for IKEv2. This configuration provides excellent performance, high security, and removes the need to maintain or purchase third-party client software on your client's new MacBook. Additionally, remote access VPN Wizard supports to generate VPN script for macOS. Please upgrade to the latest firmware version which ensure the wizard using the newest proposal and DH group settings.

Hope this helps.

StevieG

Zyxel Melen

I have come across the following article which has answered my second question :

VPN Zyxel USG FLEX/ATP VPN Quick Setup - Configure IKEv2 IPSec VPN via Wizard with Certificate on Android / iPhone iOS / Windows / MacOS – Zyxel Support Campus USA

It says the Google Authenticator App is not compatible with 2FA but we have now tested\setup the 2FA to go to email which works OK with the native IKEv2 IPSec VPN software.

Thanks again for your help.

Zyxel_Melen

Hi @StevieG ,

Here is the current status regarding macOS compatibility, the ATP200, and SecuExtender:

1. Legacy SecuExtender SSL VPN is EOL: The legacy SecuExtender SSL VPN client for macOS has officially reached End of Life (EOL). It is only compatible with macOS 14 (Sonoma) and older versions and does not support macOS 15 (Sequoia) or newer versions. Additionally, the license for the legacy SecuExtender SSL VPN client also reached End of Life (EOL). We don't sell this license anymore.
2. Newer Client Compatibility: You are correct about the release notes. The newer SecuExtender Zero Trust IPSec/SSL VPN Client only supports SSL VPN tunnels when connecting to the newer USG FLEX H series firewalls. It does not support SSL VPN connections to the standard ATP or USG FLEX (non-H) series. When connecting to an ATP200, only the IPSec protocol is supported.
3. Recommended Migration Path: Instead of SSL VPN, we strongly recommend configuring a native IKEv2 IPSec VPN. macOS has built-in native support for IKEv2. This configuration provides excellent performance, high security, and removes the need to maintain or purchase third-party client software on your client's new MacBook. Additionally, remote access VPN Wizard supports to generate VPN script for macOS. Please upgrade to the latest firmware version which ensure the wizard using the newest proposal and DH group settings.

Hope this helps.

StevieG

Zyxel Melen

Thanks for the above information. Just another question about setting up native IKEv2 IPSEC VPN on MacOS - Would it allow (2FA) to work or would it need the paid for SecuExtender to work with 2FA?

Thanks

StevieG

StevieG

Zyxel Melen

I have come across the following article which has answered my second question :

VPN Zyxel USG FLEX/ATP VPN Quick Setup - Configure IKEv2 IPSec VPN via Wizard with Certificate on Android / iPhone iOS / Windows / MacOS – Zyxel Support Campus USA

It says the Google Authenticator App is not compatible with 2FA but we have now tested\setup the 2FA to go to email which works OK with the native IKEv2 IPSec VPN software.

Thanks again for your help.