VPN - clients on various different OS versions

[inglesworth]

I recently set up a VPN server through my new dell sonicwall tz600. Our facility is very much Mac based, and the majority of our outside contractors are Mac based as well. I previously had ben running our VPN through an old mac mini running the Server app. But alas, it was time to put that machine to bed...

The tech who arrived to install our new firewall was absolutely not familiar with Mac in any way at all. In our old configuration, outside contractors were connecting to VPN using the built in protocols in the Network system preferences. We had created and exported a configuration profile from the Server app and it was easy enough for them to double click and install and it allowed them to connect. In the new system, the tech who showed up for install told me it was not possible to do this and that everyone would have to download a specific dell sonicwall client software to run the VPN. While I am not totally against, this, I know that some of our users are not quite as computer literate as we would hope. So I was really hoping to get it to work with minimal changes.

Wouldn't you know, the sonicwall is able to host L2TP, and most of our contractors are connecting the same way as before. I made the same Shared Secret, and set the users list to be the same for the L2TP as for SSL VPNs, etc.

But - there's always the thorn in the bush. The two people I was most worried about not being able to access the VPN, are the ones with the issues.

First, one of them is running OS 10.7 still. My main concern is that the chances are that the Dell Sonicwall client software is very unlikely to be compatible that far back. However, I also kind of feel like dude shouldn't be using an OS from 2010 anymore (and expecting to be compatible in a professional setting). So I am inclined to push on him to do something about it on his end. Just curious if anyone knows if there is a setting somewhere that I am missing that may allow it to be used with an older OS like 10.7?

Second one having issues is on OS 10.10. Here I am more inclined to have them install the sonicwall client and set it up that way and use the SSL protocol. But just curious if anyone knows if there is an easy setting for this too? Maybe there is a setting that fixes both? I am not entirely sure.

Both are getting the message that the L2TP server is not responding when they try to connect. It is not authentication error.

Any help is greatly appreciated.

 

[hobowankenobi]

Don't have an answer for you...

Have you been through this Sonic Wall document to verify everything is configured correctly?

I can only add that yes, VPN standards within Mac OS has changed over the years, and I am not surprised that all those different legacy OSes are not playing nice.

Is there any chance of getting the older machines upgraded to a newer OS?

If not, you might be looking at a VPN client...but that is money and complexity (distribution). Others talk about it here...

Just a hunch, but Sonic Wall is owned by Dell, so great MacOS support and compatibility may be alot to expect. Too bad there was not an option for more Mac friendly VPN.

Seems like most known work-arounds may be more painful than getting all the client machines to at least 10.11.

 

[Mikael H]

@inglesworth:
I don't have experience with SonicWall specifically, but my experience with a number of software VPN clients from various Firewall manufacturers (Fortigate, Juniper, Palo Alto), is that they generally work fine and are simple to manage on supported macOS versions. One key thing to keep an eye out for, is that some of them require an upgrade of the client software when the OS is upgraded to a new major version. That said, users should really be urged (or forced) to stay on modern enough OS versions that they still receive timely security updates; that's kind of a minimum requirement...

When it comes to L2TP, if you don't have specific requirements to transport L2 traffic over the Internet, I would attempt to retire that solution for a pure IPsec based one, preferably with certificate based authentication. This shouldn't be hard on modern firewalls, and it only requires configuring the correct certificates and VPN settings in a .mobileconfig on the macOS/iOS side. That is if you need such a solution in addition to the SSL VPN provided by the SonicWall appliance.

Edited for blatant self-promotion:
Here's a link to the first in a series of two articles on setting up an IPsec VPN between Apple devices and a pfSense firewall that I actually finished this week.
Note that this is something I set up for personal home use, so it has self-signed certificates and ugly stuff like "allow any from any to any" firewall rules, that you might want to do differently in a corporate setting, but the geist should be applicable to any solution.