I want to setup a VPN connection from a Macintosh to a Windows 2003 Server running RRAS. We are using L2TP/IPSEC and certificates to negotiate the IP-security. The MAC is running OS X 10.3.2.

What do I need to do to get it work?
I'm NOT interested in using pre-shared keys for IPSEC!
But how do I install a certificate and get the MAC to use that certificate when establishing the VPN tunnel?

Is it possible with the built-in VPN client or do I need a 3d party client?

Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

10.3.2? it's not available yet... unless you are a beta tester for it.

If you are running 10.3.x, then the Internet Connect application that came with Panther (10.3) will establish a vpn connection over IPSec.

Also look at Vapor, from <http://www.versiontracker.com/dyn/moreinfo/macosx/17212>.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
   I've never tried not using pre-shared keys.  The 10.3 internet connect tool doesn't appear to have a place to throw the certificate, although that doesn't mean it doesn't work.  You may be able to establish a VPN connection with that certificate through some console manipulation.  If you do however, use preshared keys, the OS-X's Internet Connect application will allow you to establish PPTP or IPSEC connections with ease, and I've tested it's ability to connect to 2k and 2k3 IPSEC servers, but again, with a pre-shared key  =).  I'd love to know if this is possible without purchasing any os-x vpn software.  If you do find a answer, or if anyone else knows, post it up here!  =)

 - Insolence
danaspAuthor Commented:
Yes, it is 10.3.1 and not 10.3.2. :) Sorry about that!

On Apple's website I found information about setting up the VPN connection. When it came to the section about the IPSEC preshared key it said something like: "Here you will write your preshared key(unless you are using certificates)"....   But the help didn't mention how to configure it with certificates....

How can I make a certificate request from a MAC? Then I can issue a certificate on my CA. And how do I install that certificate on my MAC?

My knowledge about MAC is limited....
I'm just trying to find a way so our MAC users can access the VPN server in the same way our Win2K and WinXP users can.
Why Diversity in Tech Matters

Kesha Williams, certified professional and software developer, explores the imbalance of diversity in the world of technology -- especially when it comes to hiring women. She showcases ways she's making a difference through the Colors of STEM program.

I would gather that you would use openssl from the command line, since it deals with client and server certificate requests.  Would be something like...

openssl req  -new -keyout newkey.pem -out newreq.pem  -days 360

I still do not know how you use the certificate once you get it back from your server with your VPN.  But, at least this is the first half of your problem!  =)

 - Insolence
danaspAuthor Commented:
I will try it out.
I don't have access to a MAC myself so I need to ask another guy to test it. I will get back to you with the result asap.

Cheers, Daniel
Well, if you have someone else do it... make sure they are in somewhere like their home directory where they have permission to write.  That command will generate two files.  Oh, I just noticed a copy/paste of the above text generates a few extra characters in the terminal on the mac since there are two &nbsp's in the middle of it.  If you want to copy/paste it, here is one without the nbsp's...

openssl req -new -keyout newkey.pem -out newreq.pem -days 360

And for your knowledge, this will generate two files which are named in the command above, newkey.pem and newreq.pem.  The req is the request, and the key is the private key.  =)  Enjoy... and if I come up with the second half of the answer to this I'll letcha know.  =)

 - Insolence
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Apple Networking

From novice to tech pro — start learning today.