Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to get VPN access up and running. The company has a SonicWall firewall/concentrator and I'm working on a Mac. I'm not sure of the SonicWall's hardware or software level. My MacBook Pro is OS X 10.8, x64, fully patched.

The Mac Networking applet claims the remote server is not responding. The connection attempt subsequently fails:

Mac OS X network applet lying to its users

This is utter bullshit, as a Wireshark trace shows the Protected Mode negotiation, and then the fallback to Quick Mode:

Wireshark trace showing Mac OS X network applet lying to its users

I have two questions: (1) does Mac OS X VPN work in real life? (2) Are there any trustworthy (non-Apple) tools to test and diagnose the connection problem (Wireshark is a cannon and I have to interpret the results)?

And a third question (off topic): what is so broken in Cupertino such that so much broken software gets past their QA department? I pay good money for the software to run their hardware, and this is an absolute joke.

EDIT (12/14/2012, 6:00 PM): The network guy sent me "VPN Configuration Guide" (Equinox document SonicOS_Standard-6-EN). It seems an IPSec VPN now requires a Firewall Unique Identifier. Just to be sure, I revisited RFC 2409, where Main Mode, Aggressive Mode, and Quick Mode are discussed. I cannot find a reference to Firewall Unique Identifier.

EDIT (12/14/2012, 11:00 PM): From the Mac OS X logs (so much for the bullshit message box from this crappy operating system):

Wed Nov 14 16:25:41 2012 : IPSec connection started
Wed Nov 14 16:25:41 2012 : IPSec phase 1 client started
Wed Nov 14 16:25:41 2012 : IPSec phase 1 server replied
Wed Nov 14 16:25:42 2012 : IPSec phase 2 started
Wed Nov 14 16:26:12 2012 : IPSec connection failed
Wed Nov 14 17:23:16 2012 : L2TP connecting to server '173.167.XXX.YYY' (173.167.XXX.YYY)...
Wed Nov 14 17:23:16 2012 : IPSec connection started
Wed Nov 14 17:23:16 2012 : IPSec phase 1 client started
Wed Nov 14 17:23:16 2012 : IPSec connection failed <IKE Error 23 (0x17) Invalid hash information>

EDIT (12/15/2012, 12:00 AM):

I think I am screwed here: http://forums.macrumors.com/showthread.php?t=383855. I am trying to connect to a broken (non-standard) firewall, with a broken Mac OS X client.

share|improve this question

migrated from serverfault.com Nov 14 '12 at 20:38

This question came from our site for system and network administrators.

2 Answers 2

Have you given VPN Tracker a try? http://www.vpntracker.com/us/vendor/10/sonicwall-mac-vpn-client.html They have a bunch of guides on how to connect SonicWALL devices.

share|improve this answer

SonicWall VPN does work with OSX devices, though not always out of the box. The SonicWall server's VPN policy has to be configured the right way. I've managed to get iPads and iPhones to connect to them once I got the VPN policy created right. If the SonicWall's VPN policy is not set up right, it just won't work.

share|improve this answer
Thanks SysAdmin. Can you share the details. Its a waste of time to go through Apple KBs (been there, done that). –  jww Nov 14 '12 at 21:10
By the way, the question was migrated from ServerFault. But the StackOverflow folks claim it should be on ServerFault (meta.stackexchange.com/questions/88303/…). Perhaps it would be a good idea to change the correct answer at StackOverflow. –  jww Nov 14 '12 at 21:12
@noloader The closest I've been able to get is this KB article at SonicWall. –  SysAdmin1138 Nov 14 '12 at 21:32
Thanks SysAdmn. The network guy sent me a setup document. Its states I need a Firewall Unique Identifier for L2TP/IPSec. Fortunately, I can purchase VPN Tracker Personal for $130. Vendor Lock-in FTW!!! I'll be talking to the owners of the company and proposing a move from SonicWall to a M0n0Wall (or pfSense), that works as expected and costs nothing. –  jww Nov 14 '12 at 21:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.