Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Checkpoint SecureClient doesn't work with Snow Leopard, so I've been looking for some other options. VPN Tracker appears to work, but lacks username/password (XAUTH RSA) authentication support (PSK and X.509 only, it seems), so I can't use it to connect to our VPN-1 box.

I've looked at IPSecuritas, but I can't figure out how to configure it - specifically, mapping over the settings from the Checkpoint VPN-1 SecureClient. IPSecuritas has a billion more options, which I presume of course SecureClient was just hiding from me because obviously it knows what to do to connect to a VPN-1, and the IPSecuritas forums are generally full of questions with no answers, so that doesn't really appear to be a quality avenue for support.

Does anyone have an XAUTH RSA IPSec VPN to a Checkpoint VPN-1 working in Snow Leopard, and what software did you use?

share|improve this question
up vote 2 down vote accepted

I was having the same issue and finally was able to get it working. Here is a link to the screenshots:

CheckPoint VPN and Snow Leopard

Hope this helps.

share|improve this answer
That almost works, but I don't know what to put in for User FQDN, and I suspect it matters as I'm getting: "Message: '[0020] The user is not defined properly. (msg_obj :format (1.0) :id (VPN_USER_NOT_PROPERLY_DEFINED_2) :def_msg ("The user is not defined properly.") :arguments () )" from IKE. Does this have to match up to some value on the server that I don't know about? – Nick Bastin Aug 31 '09 at 14:15
I put in the user name that I login with. – user9114 Aug 31 '09 at 16:56
Annoyingly you also have to shut down any interfaces on your own machine that may overlap with the address space in the remote networks (even though with the VPN-1 SecureClient there isn't actually any bleed-through), so I have to whack my VMWare vmnet interfaces....anyone know how to control where VMWare decides to stick NAT'd interfaces? – Nick Bastin Aug 31 '09 at 22:47

I was able to get my IPSecuritas to work with VPN-1, I do however use Hybrid RSA, whenever I try using XAUTH RSA it doesn't work and in hybrid i dont have any certificates either..

basically try using hybrid rsa instead of xauth rsa

share|improve this answer
Sadly no go on that connection is actually never getting out of Phase 1, so it's not even getting to an authentication step. I suppose the thing to do is start fiddling with all the options in Phase 1 and see if I can get them to match up - maybe I can find a list of defaults for VPN-1 on the internet somewhere, as a place to start at least. – Nick Bastin Aug 30 '09 at 12:55
i just noticed that they released more recent version (3.3) then what i had before (3.2), try upgrading to more recent one regardless the case. also i remember when i create my connection first time i used wizard and believe it or not even though i was entering same settings i couldn't get to work, so try it again another time wizard i know that might sound stupid but thats how it worked for me... – alexus Aug 31 '09 at 19:29
oh yeah and another thing is, since snow leopard is officially out hopefully checkpoint get off of their lazy butts and do some actual work around there and make new version that is snow leopard compatible – alexus Aug 31 '09 at 19:30

SecureClient has been updated for Snow Leopard support, download it here:

share|improve this answer
this link is dead – codecowboy Jan 18 '11 at 16:23

Have you tried using an existing Checkpoint Guide as a starting point?

With the SonicWall I have at work I had to use their guide as a starting point and then change a couple settings that we had that were non-default.

share|improve this answer

protected by BinaryMisfit Nov 30 '10 at 7:57

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.