IPsec on Mac OS X Panther?

ItsMr.Data wants to take a bite out of this issue: "I just got a new PowerBook with Airport. I wish to use it in the wireless network at the university I attend. The problem is that the university uses BlueSocket to secure the WIFI connections. The BlueSocket gateway is configured for IPsec tunnels. The client tool that BlueSocket provides does not work properly under Panther. I was told by the network department that it would be up to me to find a solution until BlueSocket comes out with an updated client. Being a poor college student, I would like to find a cheap or free solution. I have never worked with VPNs or IPsec. Do any Slashdot readers have any good ideas?"

Comments

Internet Connect

[CptChipJew]

Can't you use the Internet Connect application that ships with OS X to make an IPSec connection to their VPN? That's how I connect to my school's.

First post?

Re:Internet Connect

[Anonymous Coward]

My Universety use IPsec and VPN, I use cisco VPN client for OS X.

Re:Internet Connect

[Anonymous Coward]

cisco makes one, my university uses it...try that out. I dunno how to obtain it if not from your university, but it's ipsec and works under panther

At Rutgers...

[Fuzzle]

When I was an organizer with NJPIRG at Rutgers, I used Bluesocket's IPSEC utility with early Developer's builds of Panther and it worked fine. YMMV.

Re:Cisco..

[sinergy]

LEAP is proprietary as well. A more open standard is PEAP.

Re:+5, Funny

[Anonymous Coward]

Yeah, the first post has a good idea. Use the Internet connection utility. It allows you to create a IPSec connection and is integrated very well with Panther.

Re:Cisco..

[peterjhill2002]

Would that be Microsoft PEAP (PEAP-EAP-MSCHAPv2) or Cisco PEAP (PEAP-EAP-GTC)?

The lovely thing about open standards is that there can be some many ways to implement them :-p

Windows ships with a client that supports MS PEAP. The Cisco aironet client supports Cisco PEAP. They are not really compatible. The MS PEAP client works great when authenticating against and NT Domain or an AD. The Cisco version works with more third party radius backends to authenticate clients. Designing a wireless security and authentication infrastructure can be interesting. Particularly if you want to avoid storing cleartext passwords anywhere.

The Apple Panther client supports L2TP over IPsec. I am not sure what bluesockets is doing with IPsec, but that would be a good thing for them to support.

unfortunately

[austad]

The IPSec VPN software that is built into panther is missing a lot of features that would make it actually useful. It does not support NAT Traversal, so you can't use it from behind a firewall or NAT device. It does not support XAUTH, which I assume is what your school is using to authenticate you.

You may be able to use the Cisco VPN client though. The GUI for OSX is fairly unconfigurable, but you can edit the .pcf files that describe the connection manually. Cisco has docs on their site of what each line does. I use the Cisco client under OSX to connect to my Netscreen box at home, and I use it for work too. Although, the Netscreen required messing with the .pcf file.

Re:unfortunately

[azpcox]

Although the IPSec VPN client doesn't support NAT traversal, if you have a Linksys or something similar, they have an item called IPSec pass through which will do the NAT (technically there is no port associated with ESP traffic) for you to a single device. The UDP/500 traffic has no problem, just the ESP/AH traffic in certain instances.

Good luck

[cbiagini]

I've tried to connect to my school's network, too, with little success. We use Cisco's VPN, and it's the same deal: no Panther-compatible client.

Best I can do for you is this hint at macosxhints:
http://www.macosxhints.com/article.php?story=20031 11911433687&query=cisco+vpn

I tried it, and it didn't work, but who knows...maybe the settings files for your VPN client are similar. Stab in the dark...it's all I got.

Re:Good luck

[caseih]

Cisco's VPN client is very much panther compatible. I use it every day. Just make sure you have the lastest version (version 4.something I believe).

Re:Good luck

[Glial]

4.0.2 And yes, I agree, it is very much Panther compatible.

Re:Good luck

[thehe]

I found the, seemingly, same Cisco VPN Client for OS X that my university provides (v. 4.0.1) freely available on several web pages, of which this is one that seemed to work fine:
http://portnetworks.com/download.html

I use the 4.0.1 quite happily on a daily basis, with my university (NTNU in Trondheim, Norway) running IPSec, UDP style.

Panther Compatibility for Bluesocket IPSec tool

[Anonymous Coward]

Hello,

I'm the software engineer responsible for the Mac client for Bluesocket. The client software *should* work with Panther. The client software isn't really client software, however, its just a frontend to the built-in IPSec support that was first made available in 10.2.

If you're having trouble, you can try emailing support@bluesocket.com. Because it is just a frontend to the built-in support, you can try this on the command line to see if you're logged in:

$ sudo setkey -D

Which will print out your tunnel status. If it comes back empty, you're not connected. If you see two tunnels, you're good to go. (the GUI will reflect this as well)

I just tested it again on my Panther box, and it works OK. As an aside, you can also ask your network admin if they support PPTP. The bluesocket box has PPTP support, and is compatible with Jaguar and Panther's PPTP client.

Thanks!

VaporSec

[cpct0]

I don't have experiece with the other IPSec frontends...

But I can tell you that Vaporsec works well (http://afp548.com) -- oh and don't download the Jaguar version on the site, download the version in the forums (The major difference between the two are a few applescript bugs of no consequence, but it's nice to have a bug-free system.

And I suggest you ask your admins for the PRECISE configuration, it's not really easy to implement.

Mike

try VPN Tracker

[garment]

at www.equinux.com. relatively cheap considering ease of use - and they might have a student discount, if you ask (beg).

IPSecuritas

[wangooroo]

I use IPsecuritas v 1.0.3 http://www.lobotomo.com It works with Panther's built in IPSec "racoon" which is a command line tool. man racoon for more info. IPSecuritas works great and its FREE

IPSecuritas

[Anonymous Coward]

If you want a free solution that's actually as configurable as VPN Tracker, check out IPSecuritas (http://www.lobotomo.com). It can be tricky to configure, but we got it to work with our company's Checkpoint VPN without altering anything on the firewall side. It even does DNS settings replacement. Not perfect, but better than anything else I"ve run across.

VPN and IPSec

[baddawg65]

I've been using Internet Connect to connect to our school network. If that doesn't work you can use freeware VaporSec (URL: http://www.versiontracker.com/dyn/moreinfo/macosx/ 17212) which is graphical configuration of 'racoon' which is the built-in VPN in Mac OS X. You will need a alot of information from the school's network people to configure this properly.

IPSecuritas

[mikeoreilly]

Check out IPsecuritas:
http://www.apple.com/downloads/macos x/networking_s ecurity/ipsecuritas.html

It has connected to every VPN endpoint/router that I have tried to connect to, with the exception of point to multipoint access. VPN Tracker had to release a new racoon binary to get point to multipoint to work. (This is only an issue if you must connect from a fixed IP address and almost no one does this anymore.)

The racoon IPSec stack in OSX is based on the kame (kame.org) project. See afp548.com for a writeup on how to get the whole thing working via the command line.

Remember, IPSecuritas is just a GUI for something already built in to OSX.