Recommend opening a TAC case.
In order to investigate, you'll probably need something like the following:
On the Client - Mac machine:
- Right click on the Endpoint connect Icon
- Click "VPN Options"
- Click on the "Advanced" Tab > tick the box "Enable Logging" and change to "Extended"
- Click close.
On the GW side:
- Open SSH connection to the Security Gateway and log in as Expert;
- Initiate VPN debug on the Security Gateway:
[Expert@HostName]# vpn debug trunc
[Expert@HostName]# vpn debug on TDERROR_ALL_ALL=5
>>>>
On the Client side:
- Right Click again on the Endpoint connect Icon.
- Click "VPN Options"
- Click on the "Advanced" Tab > click on the button "Collect Logs"
- Change from "Extended" to "Basic"
- A cab file will be created with the entire debug files inside.
- Provide the client log file called trlog_xx-xx-2021_time.cab
On the GW side:
- Open SSH connection to the Security Gateway and log in as Expert;
- Stop VPN debug on the FW:
[Expert@HostName]# vpn debug off
[Expert@HostName]# vpn debug ikeoff
The following files from the Security Gateway should be reviewed:
- $FWDIR/log/ike.elg
- $FWDIR/log/vpnd.elg
