Cisco VPN Client...Simple to deploy and use, our IPSecurity (IPsec) -based VPN client is compatible with all Cisco VPN products.
The Cisco VPN Client:
Can be preconfigured for mass deployments
Requires little user intervention for initial logins
Supports Cisco Easy VPN capabilities, decreasing network security policy configuration at the remote location
Complements the Cisco AnyConnect Secure Mobility Client
What's New
The Cisco VPN Client for Mac OS X does NOT support the following:
This update has been out about a month. After installing it on both 10.5.8 and 10.6.6 Intel Macs, I got several kernel panics. I finally gave up and reverted to the previous version. It works in 10.6 and is much more stable for me.
About the most detrimental piece of software you can load on your Mac. You **will** have a kernel panic (actual UNIX crash) if you run this for any length of time. IPv6 traffic will most definitely cause the Cisco VPN to crater. Mac uses IPv6 more than other systems (Airport Utility, TimeMachine, Bonjour, others)
Just had a UNIX crash (kernel panic) on my Mac. 1-adam-5, see the perp below…
I'm not sure there's a real benefit to using Cisco VPN client on Mac. I mean there may be some features missing, but the built in IPSec client on Mac OS X 10.6 works like a charm.
@donmontalvo - Wish the built in IPSec (Racoon) worked across the board for all Cisco configurations... but not so lucky. The MSLogon flag which triggers the proprietary ms encryption for logins is MIA in the Apple provided solution.
This means that IT departments that are heavily biased towards Microsoft anything (and turn off other standards bases login encryption methods) cause the built in client to fail at login. The symptom is the Mac VPN client insisting it has a bad password even though it is entered correctly.
@Cerniuk Ahh, have you submitted a bug report to Apple? Apple are putting weight on anything related to security, and have been responsive to these kinds of reports.
The environments we support probably have a VPN set up differently since we're able to connect without any issues, but I'm sure if a change is made on the server side we may find ourselves in the same boat. :)
Thanks for the post. Would be great if you gave everyone a warm an fuzzy by signing the one you post up there with PGP (or did you?).
Biggest concern is that the Cisco software could either by nefarious operation or by corporate security be potentially sucking files off the system where it is running. If someone modified the Cisco client they could essentially backdoor a Mac.
Just thinking about it, Cisco has created a huge security problem by not providing the client free and clear so the source was assured to be secure and as safe as your IT security department is… Right now people download from unknown sources, including torrents.
You (Filipp) have a history of posting in MacUpdate, been a member since 2006 thus some street cred. So you are the safest source where this can be obtained with any reasonable ease… But what about the poor sap who gets a "loaded" copy from some bit torrent and opens his whole network up to a foreign hostile super-power :-) seriously though, shame on Cisco!
Still causes kernel panics, buggy software
Still has the coyote ugly windows 95 interface
Still requires that coyote ugly app to run the whole time the VPN connection is open
Still is hard coded to work with only specific network interfaces (bad practice design)
- cannot see a tethered iPhone on USB or BlueTooth
Still have to have a ruddy Cisco leet membership to download a "Free" client
- (thanks to whomever posted, hats off to you Sir!)
The Snow Leopard can connect now to the Cisco's proprietary implementation of standard IPSec VPN. Unfortunately I am having a hard time figuring out where the :
are set in the Apple VPN. It is not exposed in the interface so we are relegated to hacking conf files. Here is where the hints are. You must be quick to capture the file that is indicated here but the technique works:
http://patternbuffer.wordpress.com/2009/10/01/customizing-the-cisco-or-ipsec-vpn-client-in-snow-leopard/
I have tested it against a VPN connection that does not require the MS login style, worked great. Unfortunately not useful here. Need the common gateway and that requires the MS login business.
I have said it before and will say it again, companies need to get over this idea of forcing a login for a user to get simple download such as a bug fix or a patch. If it is a free feature-adding "extra" such as a free plugin for Photoshop or Xtension for Quark, it is acceptable. But for an update? No way. As long as they do that, I will continue to fill up their databases with fake names and emails.
I was having a bit of trouble believing Cisco would charge for this so I tried to login and download it using my Cisco guest account. Worked without any issues. You might want to give it a try again. The client should always be free. They charge you a per user fee on the VPN devices. That's where they make the money.
tried it again - tried another time using firefox instead of safari - no chance.
Got always the error
'Forbidden File or Application
The file or application you are trying to access may require additional entitlement or you are trying to access a file with an invalid name. Additional entitlement levels are granted based on a users relationship with Cisco on a per-application basis.'
Same problem here- I have a valid free account with Cisco, but it still won't let me download it, saying that I first need to have a valid Technical Support Services Agreement. However if you google for the name of the file (vpnclient-darwin-4.9.01.0180-universal-k9.dmg) there are other non-official places to download it- obviously use at your own risk.
Still have crashes due to putting my macbook pro to sleep/waking and using the VPN client. I always send feedback to Apple after the reboot, and I curse the Cisco VPN client in ever email...
Cisco VPN use to work for me but give the Error 51 - cannot communicate with VPN Subsystem since I've gone to 64-bit mode. This error use to be an occasional problem cured by restarting my MacBook Pro. But no longer - I've gone to using Apple's own VPN in the Network Sys Pref. THat works just fine.
I've been using this for years with nothing but problems. It's had the kernel panic issue for about a year, and the "unable to connect to VPN subsystem" bug even longer. I figured that a company like Cisco that charges so much for their products would have the courtesy to fix their own app after years of problems.
Latest problem being that I can't for the life of me get this to install and run properly on a brand new Mac Pro. I've done everything short of reformatting the drive and starting clean. I am running 10.6.5 on a 6-core mac pro. Pretty much a fresh system other than your normal productivity apps. I have been fighting with this app for years, and have tried all the workarounds I know of that usually fix it, but this one just will not fix. Sounds like the kext isn't loading at all anymore.
Figured out the kernel panic (KP) issue Cisco VPN software. It is a result of using IPv6 while a Cisco VPN session is active. The KP does not happen immediately which suggests a memory corruption occurring (overwrite memory).
In plain english, if the Cisco VPN is used and your TimeMachine backup starts to your TimeCapsule (across the network), you will likely experience a KP in the near future.
if the Cisco VPN is used and you open up the Apple AirPort utility and access your Airport settings (transfer data across IPv6) you will eventually experience a KP (sleep and unsleep your Mac a couple of times usually does it)
If you turn IPv6 off the problems go away... And so do a number of capabilities of your system. Not really an option. So I put my TimeMachine backups on manual and if I am not diligent, will lose data some day thank you Cisco.
So where is MSLogon as a setting for the Apple 'ciscoish' client in the system and on iOS?!? It will be the coup de grace for Cisco VPNClient.
The download link times out after very little download. Additionally the server does not report the size of the download as it occurs which indicates that it is behind a (malfunctioning?) proxy.
This file can be found on the torrents but does raise the question, can it be trusted?
The problem is that since Cisco does not provide this software freely and IT shops are typically Mac-ignorant or Mac-hostile in the enterprise, users are relegated to creating security issues by going after these downloads from unknown and untrusted sources. Cisco actually creates the security problem with their approach to software distribution.
Ironically, the software is awful (poor interface, poor performance, buggy and causes kernel panics) and not something that anyone would want short of needing to connect to proprietary Cisco VPN concentrators (servers).
Interesting. It didn't report the total size for me, either. Just showed a question mark... same as anything I try (and usually fail) to download from HP's servers.
The 4.9.00.0050 version, and all previous versions that I've used, have worked well on my single CPU 1.5GHz G4 PowerBook. However, all of those same versions, including this latest one, ALWAYS have problems maintaining their connection on my DP 2GHz G5 PowerMac. It's soooo annoying. Sometimes I'll have to re-connect within minutes of having connected. Sometimes the connection will last for hours. Presumably, this is some threading issue which only comes up in multi-processor machines. At least that's my initial guess.
Cisco devs, please test future versions on DP machines. Thanks!
I have just updgraded to version 4.9 from 4.6 and still have the same trouble whereby while I am connected to the VPN I cannot access the internet/email from my Mac. This problem does not happen when I login to the same network from my PC. Any ideas?
The subnet you are connecting to (behind the VPN gateway) is probably conflicting with your local subnet. Try changing your local subnet. For example, change 192.168.1.x to 10.56.34.x.
Do not use v4.8.00.0490 if you updated to 10.4.4. The ipsec nke causes kernel panics. Tested by removing the client after safe boot. Reboot after safe boot worked fine. Installed v4.8.00.0490 again (fresh install), rebooted, kernel panic. Disappointing.
Please login or create a new MacUpdate Member account to use this feature
Watch Lists are available to MacUpdate Desktop Members Upgrade Now
Download and auto-install
using MacUpdate Desktop. Save
time moving folders and cleaning-up.
Cisco VPN Client...Simple to deploy and use, our IPSecurity (IPsec) -based VPN client is compatible with all Cisco VPN products.
The Cisco VPN Client:
Can be preconfigured for mass deployments
Requires little user intervention for initial logins
Supports Cisco Easy VPN capabilities, decreasing network security policy configuration at the remote location
Complements the Cisco AnyConnect Secure Mobility Client
+2
+40
Lpeting reviewed on 24 Apr 2011
+1
+69
Cerniuk reviewed on 18 Feb 2011
Just had a UNIX crash (kernel panic) on my Mac. 1-adam-5, see the perp below…
Backtrace (CPU 1), Frame : Return Address (4 potential args on stack)
0x58bdbbf8 : 0x21b50c (0x5d4438 0x58bdbc2c 0x223974 0x0)
0x58bdbc48 : 0x2aab55 (0x59623c 0x295886 0xe 0x596406)
0x58bdbd28 : 0x2a09a8 (0x58bdbd40 0x50 0x58bdbe68 0x295886)
0x58bdbd38 : 0x295886 (0xe 0x58bd0048 0x10 0x1b20010)
0x58bdbe68 : 0x1b213c9 (0x58bdbed0 0x58bdbecc 0x58bdbed4 0x58bdbed8)
0x58bdbef8 : 0x31d191 (0x0 0x9088204 0x2 0x58bdbf74)
0x58bdbf68 : 0x31d5a7 (0x0 0x54c12700 0x0 0x8d93bac)
0x58bdbfc8 : 0x2a06cc (0x8d93b84 0x0 0x2a06db 0x88587a8)
Kernel Extensions in backtrace (with dependencies):
com.cisco.nke.ipsec(2.0.1)@0x1b1f000->0x1b8dfff
-1
+27
Don
+69
This means that IT departments that are heavily biased towards Microsoft anything (and turn off other standards bases login encryption methods) cause the built in client to fail at login. The symptom is the Mac VPN client insisting it has a bad password even though it is entered correctly.
+27
The environments we support probably have a VPN set up differently since we're able to connect without any issues, but I'm sure if a change is made on the server side we may find ourselves in the same boat. :)
Don
+1
+18
ftp://ftp.rrzn.uni-hannover.de//pub/local/vpn/macosx/10.4-10.5/vpnclient-darwin-4.9.01.0180-universal-k9.dmg
+27
Yep, still fugly.
Yep, still the only way to import Cisco VPN config files...
Don Montalvo, TX
-1
-1
+69
Biggest concern is that the Cisco software could either by nefarious operation or by corporate security be potentially sucking files off the system where it is running. If someone modified the Cisco client they could essentially backdoor a Mac.
Just thinking about it, Cisco has created a huge security problem by not providing the client free and clear so the source was assured to be secure and as safe as your IT security department is… Right now people download from unknown sources, including torrents.
You (Filipp) have a history of posting in MacUpdate, been a member since 2006 thus some street cred. So you are the safest source where this can be obtained with any reasonable ease… But what about the poor sap who gets a "loaded" copy from some bit torrent and opens his whole network up to a foreign hostile super-power :-) seriously though, shame on Cisco!
+1
+1
+1
+2
Tom Marvolo Riddle reviewed on 20 Oct 2009
The only "good" thing about it that someone wrote Shimo to control it.
-1
-1
+69
Cerniuk reviewed on 20 Jun 2009
Still has the coyote ugly windows 95 interface
Still requires that coyote ugly app to run the whole time the VPN connection is open
Still is hard coded to work with only specific network interfaces (bad practice design)
- cannot see a tethered iPhone on USB or BlueTooth
Still have to have a ruddy Cisco leet membership to download a "Free" client
- (thanks to whomever posted, hats off to you Sir!)
At least there is still Shimo...
+69
Interval Since Last Panic Report: 65 sec
Panics Since Last Report: 2
Anonymous UUID: 25CC323B-7196-47E1-AF34-99BB8AC202BD
Mon Jul 20 16:04:29 2009
panic(cpu 1 caller 0x2a6ac2): Kernel trap at 0x593eb888, type 14=page fault, registers:
CR0: 0x8001003b, CR2: 0x11cb6000, CR3: 0x75449000, CR4: 0x00000660
EAX: 0x00000000, EBX: 0x05779c16, ECX: 0x11cb6000, EDX: 0x000021a8
CR2: 0x11cb6000, EBP: 0x58ab3858, ESI: 0x00003327, EDI: 0x11cb1cb0
EFL: 0x00010287, EIP: 0x593eb888, CS: 0x00000008, DS: 0x11cb0010
Error code: 0x00000000
Backtrace (CPU 1), Frame : Return Address (4 potential args on stack)
0x58ab3668 : 0x21acfa (0x5ce6b0 0x58ab369c 0x223156 0x0)
0x58ab36b8 : 0x2a6ac2 (0x590ab0 0x593eb888 0xe 0x590c7a)
0x58ab3798 : 0x29c968 (0x58ab37b0 0x58ab38cc 0x58ab3858 0x593eb888)
0x58ab37a8 : 0x593eb888 (0xe 0x48 0x10 0x593e0010)
0x58ab3858 : 0x593e8867 (0x11cb1c9c 0x54751c36 0xe 0x6c4)
0x58ab3918 : 0x593e475e (0x58ab396c 0x58ab3970 0x58ab3974 0x58ab3964)
0x58ab3998 : 0x315fa1 (0x0 0x8992c04 0x2 0x58ab39fc)
0x58ab3a18 : 0x32b403 (0x8992c04 0x2 0x54751c00 0x111a0b80)
0x58ab3a48 : 0x34a20d (0x8992c04 0x2 0x54751c00 0x111a0b80)
0x58ab3bc8 : 0x35108f (0x54751c00 0x1 0x0 0x58ab3c14)
0x58ab3c48 : 0x352995 (0x1 0x0 0x0 0x0)
0x58ab3d68 : 0x35672f (0x11400740 0x1 0x4aec8c 0x0)
0x58ab3d88 : 0x4afc34 (0x114004cc 0x0 0x0 0x3)
0x58ab3e48 : 0x4971ca (0x114004cc 0x0 0x58ab3ec4 0x0)
0x58ab3e78 : 0x49523d (0x8932ac0 0x58ab3ec4 0x0 0x58ab3f54)
0x58ab3f18 : 0x4959ee (0x58ab3f54 0x8932ac0 0x1275d33 0x1)
0x58ab3f78 : 0x4ed858 (0x1093a540 0x10e9e9a8 0x10ea48f4 0x10e9e9a4)
0x58ab3fc8 : 0x29d3fd (0x10e9e9a4 0x0 0x10 0x88cb124)
Kernel Extensions in backtrace (with dependencies):
com.cisco.nke.ipsec(2.0.1)@0x593e2000->0x59450fff
+69
EnableMSLogon=1
MSLogonType=0
(settings our corporate .pcf files)
are set in the Apple VPN. It is not exposed in the interface so we are relegated to hacking conf files. Here is where the hints are. You must be quick to capture the file that is indicated here but the technique works:
http://patternbuffer.wordpress.com/2009/10/01/customizing-the-cisco-or-ipsec-vpn-client-in-snow-leopard/
I have tested it against a VPN connection that does not require the MS login style, worked great. Unfortunately not useful here. Need the common gateway and that requires the MS login business.
+3
+222
+2
+21
http://www.filedropper.com/vpnclient-darwin-49010180-universal-k9
+2
+8
Really, really incredible - for just a 'client' part
disapointed.
+14
+8
Got always the error
'Forbidden File or Application
The file or application you are trying to access may require additional entitlement or you are trying to access a file with an invalid name. Additional entitlement levels are granted based on a users relationship with Cisco on a per-application basis.'
:-(
+8
answer:
'If you have a guest level account, you won't be able to download any software from our site. You must have a software contract associated to it.'
+14
+10
+2
+11
cmdawson reviewed on 05 Feb 2009
+29
I'm using the latest: 4.9.01.0180 and 10.6.6
Anyone know of a fix to make this work?
Latest problem being that I can't for the life of me get this to install and run properly on a brand new Mac Pro. I've done everything short of reformatting the drive and starting clean. I am running 10.6.5 on a 6-core mac pro. Pretty much a fresh system other than your normal productivity apps. I have been fighting with this app for years, and have tried all the workarounds I know of that usually fix it, but this one just will not fix. Sounds like the kext isn't loading at all anymore.
+1
+69
In plain english, if the Cisco VPN is used and your TimeMachine backup starts to your TimeCapsule (across the network), you will likely experience a KP in the near future.
if the Cisco VPN is used and you open up the Apple AirPort utility and access your Airport settings (transfer data across IPv6) you will eventually experience a KP (sleep and unsleep your Mac a couple of times usually does it)
If you turn IPv6 off the problems go away... And so do a number of capabilities of your system. Not really an option. So I put my TimeMachine backups on manual and if I am not diligent, will lose data some day thank you Cisco.
So where is MSLogon as a setting for the Apple 'ciscoish' client in the system and on iOS?!? It will be the coup de grace for Cisco VPNClient.
+69
This file can be found on the torrents but does raise the question, can it be trusted?
The problem is that since Cisco does not provide this software freely and IT shops are typically Mac-ignorant or Mac-hostile in the enterprise, users are relegated to creating security issues by going after these downloads from unknown and untrusted sources. Cisco actually creates the security problem with their approach to software distribution.
Ironically, the software is awful (poor interface, poor performance, buggy and causes kernel panics) and not something that anyone would want short of needing to connect to proprietary Cisco VPN concentrators (servers).
+334
+50
+1
Cisco devs, please test future versions on DP machines. Thanks!
-6
Visual Contact rated on 17 Dec 2011
-1
Mbhayes rated on 24 Apr 2011