---
title: "VPN not working after macOS update (IKEv2, L2TP, IPsec) · Kilobat Guides"
url: "https://kilobat.app/guides/vpn-broken-after-macos-update"
description: "A VPN that worked before a macOS update now fails to connect. Check the protocol settings, the profile and the VPN app’s network extension."
---

# VPN stopped working after a macOS update

A macOS update can change which VPN algorithms are allowed. It can also ask you to approve a VPN app’s network extension again. This guide finds which of these stops your VPN.

**Fix this with your agent**Copies a prompt for Claude Code, Codex or any agent that can use Terminal.

My Mac has this problem: VPN stopped working after a macOS update. Read https://kilobat.app/guides/vpn-broken-after-macos-update.md and work through it with me. Install the Kilobat CLI if it’s missing: brew install seifip/kilobat/kilobat. Run the guide’s Terminal and kilobat checks yourself and tell me what you find. List the steps only I can do. Ask before you change any setting.

Applies to: macOS 14 Sonoma and later for the System Settings steps. The algorithm limits apply to macOS 26 and later. · Checked: 7 November 2026

## Symptoms

- The VPN worked before the update and now fails to connect.
- A built-in IKEv2, L2TP or Cisco IPSec connection shows an error, or stays at “Connecting”.
- A VPN app opens, but it cannot connect, or asks for permission again.
- A VPN configuration profile does not install, or its VPN is missing after the update.

## Likely causes

- **The server uses algorithms that macOS 26 no longer allows.** Apple’s IKEv2 profile documentation says that DES, 3DES, SHA1-96, SHA1-160 and Diffie-Hellman groups 1, 2 and 5 are available only before macOS 26.
- **The VPN app’s network extension is off.** VPN apps use network extensions. These are listed in System Settings > General > Login Items & Extensions.
- **The VPN app is too old for the new macOS.** Some VPN apps need an update from the vendor after a major macOS release.
- **The configuration profile is not installed.** A downloaded profile only takes effect after you install it in System Settings > General > Device Management.
- **Another network extension conflicts.** Content filters, firewalls and other VPN apps can block or reroute the tunnel. See [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts).

## How to check

1. Note the VPN type. The built-in types in macOS are IKEv2, L2TP over IPSec and Cisco IPSec.
2. List the VPN configurations and their states.

   ```
   scutil --nc list
   ```
3. Try the connection. Then show the VPN log messages from the last five minutes.

   ```
   log show --last 5m --predicate 'process == "NEIKEv2Provider" OR process == "racoon" OR process == "nesessionmanager"'
   ```
4. For a VPN app, choose Apple menu > System Settings > General > Login Items & Extensions.
5. Click the Info button next to Network Extensions. Make sure that the VPN app’s extension is on.
6. For a profile, open System Settings > General > Device Management. Make sure that the VPN profile is installed.

## How to fix it

1. Update the VPN app to the version its vendor lists for your macOS release.
2. Turn on the VPN app’s network extension in Login Items & Extensions, then click Done.
3. Open the VPN app again and connect once. Approve any system prompt that it shows.
4. Install a downloaded profile. Double-click it in the Downloaded section of Device Management, then click Install.
5. For IKEv2, ask the server administrator to use AES-256 or AES-256-GCM, SHA2-256 or higher and DH group 14 or higher.
6. For L2TP or IPSec, ask your administrator if the server supports IKEv2. Apple supports IKEv2 on all its platforms.
7. Remove old VPN apps and content filters that you no longer use. Then restart the Mac.
8. Delete the built-in VPN configuration and add it again with the settings from your administrator.

## With Kilobat

1. Show the VPN that macOS reports, and whether DNS or IPv6 go around it.

   ```
   kilobat vpn
   ```
2. Check whether the VPN carries all traffic or only some destinations.

   ```
   kilobat ip
   ```
3. When the VPN connects but a site fails, compare the direct path with the tunnel.

   ```
   kilobat why intranet.example.com
   ```
4. Check that the app, its filter and monitoring are healthy after the update.

   ```
   kilobat doctor
   ```

## Questions

**Does macOS still support L2TP over IPSec?**

Yes. Apple’s VPN overview lists L2TP over IPSec and Cisco IPSec for macOS, beside IKEv2.

**Does macOS support PPTP?**

No. Apple’s VPN overview does not list PPTP among the supported protocols.

**The Network Extensions list does not show my VPN app. What can I do?**

Open the VPN app and try to connect once. The app asks macOS for its extension at that point. Then check the list again.

## Sources

- [Apple Platform Deployment: VPN overview for Apple devices](https://support.apple.com/guide/deployment/vpn-overview-depae3d361d0/web)
- [Apple Developer: VPN.IKEv2.IKESecurityAssociationParameters](https://developer.apple.com/documentation/devicemanagement/vpn/ikev2-data.dictionary/ikesecurityassociationparameters-data.dictionary)
- [Apple Support: Set up a VPN connection on Mac](https://support.apple.com/guide/mac-help/mchlp2963/mac)
- [Apple Support: Change Login Items & Extensions settings on Mac](https://support.apple.com/guide/mac-help/mtusr003/mac)
- [Apple Support: Use configuration profiles to standardize settings on Mac computers](https://support.apple.com/guide/mac-help/mh35561/mac)
- scutil(8) and log(1), man pages installed with macOS 27.2

Checked on 7 November 2026.

## Related guides

- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet): A VPN sends traffic through a tunnel.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts): Firewalls, VPNs and content filters on macOS use network extensions.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names): macOS can send queries for one domain to one DNS server and other queries to another.
- [VPN blocks Messages, iCloud or FaceTime on a Mac](https://kilobat.app/guides/vpn-blocks-apple-services-mac): Messages, FaceTime and iCloud use Apple Push Notification service and other Apple servers.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect): When the internet works but one address fails, Kilobat checks each layer in turn.