re: search

re: search — Simon Heimlicher's Homepage

In math we trust — everybody else, bring data.

Workaround for Disconnections of Cisco VPN in Mac OS X 10.6.0–10.6.3

The built-in Cisco VPN client introduced in Mac OS X 10.6 Snow Leopard has the habit of disconnecting itself when re-keying should be performed but fails after about 48 minutes up to one hour. This timeout issue has been fixed in Mac OS X 10.6.4.

In versions of Mac OS X 10.6.0 up to 10.6.3, the problem can be worked around by increasing the re-keying period to e.g. 1 week.

Note

The update to Snow Leopard 10.6.4 fixes the issue of the VPN disconnecting after 48 minutes many people have observed in 10.6.0–10.6.3. Therefore, there is no need to change the configuration of racoon anymore.

In order to revert your configuration to the stock one, remove the last line from /etc/racoon.conf, so that the last line is again include “/var/run/racoon/*.conf” ;

Please let me know in the comments if you still observe disconnections with 10.6.4.

Note that this workaround severely decreases the security of your VPN connection as attackers now have up to 1 week to attack the phase 1 key.

I have no clue where Apple stores the configuration template for racoon, but I have found the following workaround.

  1. Create directory “/etc/racoon/remote/” as root.

  2. Open a VPN connection to your Cisco VPN concentrator and copy the config file from /var/run/racoon/<IP address>.conf to /etc/racoon/remote, replacing all lines lifetime time 3600 sec; by lifetime time 168 hours;

This is achieved by the following sed command:

1
2

sudo sed -i.bak 's/lifetime time 3600 sec/lifetime time 168 hours/' /var/run/racoon/*.conf \
  && sudo mv /var/run/racoon/*.conf /etc/racoon/remote
  1. To make racoon read our converted file, insert a line include “/etc/racoon/remote/.conf” ; right before the last line of /etc/racoon.conf, so that the last two lines are now include “/etc/racoon/remote/.conf” ; include “/var/run/racoon/*.conf” ;

This is achieved by executing the following patch command:

1
2
3
4
5
6
7
8
9
10

sudo patch /etc/racoon/racoon.conf <<EOF
--- /etc/racoon.orig/racoon.conf	2009-06-23 09:09:08.000000000 +0200
+++ /etc/racoon/racoon.conf	2009-12-11 13:52:11.000000000 +0100
@@ -135,4 +135,5 @@
 # by including all files matching /var/run/racoon/*.conf
 # This line should be added at the end of the racoon.conf file
 # so that settings such as timer values will be appropriately applied.
+include "/etc/racoon/remote/*.conf" ;
 include "/var/run/racoon/*.conf" ;
EOF
  1. Restart racoon:
1
2

sudo launchctl stop com.apple.racoon
sudo launchctl start com.apple.racoon

That’s it. If this did not do the trick, try restarting your machine.

To summarize, here are all the commands to be executed:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

sudo mkdir /etc/racoon/remote
sudo sed -i.bak 's/lifetime time 3600 sec/lifetime time 168 hours/' /var/run/racoon/*.conf \
  && sudo mv /var/run/racoon/*.conf /etc/racoon/remote
sudo patch /etc/racoon/racoon.conf <<EOF
--- /etc/racoon.orig/racoon.conf	2009-06-23 09:09:08.000000000 +0200
+++ /etc/racoon/racoon.conf	2009-12-11 13:52:11.000000000 +0100
@@ -135,4 +135,5 @@
 # by including all files matching /var/run/racoon/*.conf
 # This line should be added at the end of the racoon.conf file
 # so that settings such as timer values will be appropriately applied.
+include "/etc/racoon/remote/*.conf" ;
 include "/var/run/racoon/*.conf" ;
EOF
sudo launchctl stop com.apple.racoon
sudo launchctl start com.apple.racoon