Who rated this post

Recommend opening a TAC case.
In order to investigate, you'll probably need something like the following:

On the Client - Mac machine:

• Right click on the Endpoint connect Icon
• Click "VPN Options"
• Click on the "Advanced" Tab > tick the box "Enable Logging" and change to "Extended"
• Click close.

On the GW side:

• Open SSH connection to the Security Gateway and log in as Expert;
• Initiate VPN debug on the Security Gateway:
  [Expert@HostName]# vpn debug trunc
  [Expert@HostName]# vpn debug on TDERROR_ALL_ALL=5
  
  >>>>

On the Client side:

• Right Click again on the Endpoint connect Icon.
• Click "VPN Options"
• Click on the "Advanced" Tab > click on the button "Collect Logs"
• Change from "Extended" to "Basic"
• A cab file will be created with the entire debug files inside.
• Provide the client log file called trlog_xx-xx-2021_time.cab

On the GW side:

• Open SSH connection to the Security Gateway and log in as Expert;
• Stop VPN debug on the FW:
  [Expert@HostName]# vpn debug off
  [Expert@HostName]# vpn debug ikeoff

The following files from the Security Gateway should be reviewed:

• $FWDIR/log/ike.elg
• $FWDIR/log/vpnd.elg