Teleworker VPN - IPsec XAuth - macOS Client

DrayTek routers running 3.8.9.1 or later firmware support IPsec with XAuth authentication, which allows many VPN clients to authenticate with a username and password. With IPSec XAuth you are not limited to pre-shared key because each teleworker can use their unique credentials.
This article demonstrates how to create an IPsec Xauth tunnel between Vigor Router and macOS client

Vigor Router Configuration

1. Go to [VPN and Remote Access] > [IPsec General Setup]
a. Enter Pre-Shared Key for Xauth User
b. Click OK to save

2. Go to [VPN and Remote Access] > [Remote Dial-in User]
a. Enable User account and Authentication
b. Allow IPsec Xauth dial-in type
c. Enter Username and password
d. Click OK to save.

macOS VPN Client Configuration

1. Go to [System Preferences] > [Network] and click +

• Set Interface to VPN
• For VPN Type select Cisco IPsec
• Enter Service Name
• Click Create

2. Populate Server Address with router's WAN IP address or domain, followed by the Account Name and Password.

3. Click Authentication Settings and enter the Pre-shared Key in Shared Secret. Then click OK.

4. Click Connect to start the VPN connection.

Vigor routers display VPN status in [VPN and Remote Access] > [Connection Management] section

---