Description

The BIG-IP Edge Client for Mac OS fails to establish a VPN connection.

This issue occurs when the following condition is met:

• The captive portal feature is enabled.
  

The BIG-IP Edge Client for Mac OS uses the captive portal feature to detect when the user is behind a captive portal, and waits until the user completes sign-in to the portal. For example, the user may be behind a captive portal at hotels and airports.

Note: This issue can occur anytime a VPN connection is being established. It is not specific to being behind a captive portal.

Impact

BIG-IP Edge client for Mac OS clients are unable to establish a VPN connection.

Symptoms

As a result of this issue, you may encounter the following symptom:

• When connecting, users receive an error message that appears similar to the following example:
  
  Limited Connectivity Detected

Status

F5 Product Development has assigned ID 408917  to this issue for BIG-IP and 408921 for FirePass. F5 has confirmed that this issue exists in the products listed in the Applies To box, located in the upper right corner of this article. For information about releases or hotfixes that resolve this issue, refer to the following table:

An engineering hotfix has been released to fix this issue for FirePass 7.0.0. This hotfix is available from the F5 Downloads site as HF-408921-1.

Workaround

To work around this issue, you can disable the captive portal feature on the Edge Client for Mac OS. To do so, perform the following procedure:

Impact of workaround: When you are behind a captive portal network, you need to open a web browser session and authenticate to the portal network prior to establishing a VPN connection.

1. Log in to the Mac system.
2. Open a Terminal session from Applications > Utilities > Terminal.
3. Enter the following content in the terminal window:
   
   defaults write com.f5networks.EdgeClient CaptiveNetworkDetection NO
4. Close the terminal window.
5. Restart the BIG-IP Edge Client.
   
   Note: There are instances where restarting the client is not sufficient. If you are still experiencing the issue after restarting the client, reboot your system for the change to be recognized.
   

Note: You can re-enable the captive portal feature by entering YES in place of NO in Step 3.

Supplemental Information

• SOL4918: Overview of the F5 critical issue hotfix policy
• SOL167: Downloading software and firmware from F5
• BIG-IP APM release notes
• Captive Portal

  Note: This link takes you to a resource outside of AskF5, and it is possible that the link may be changed without our knowledge.