FIX OSX Lion Not Resolving DNS Addresses Over VPN

Problem: While connected to VPN, I was not able to resolve hostnames on the remote site.

Solution: Create a domain resolver file in /etc/resolver named for your domain, for example:

sudo mkdir /etc/resolver

vi /etc/resolver/yourdomain.com

Add the following content and save the file:

nameserver x.x.x.x <- your DNS server to resolve hosts on this domain
domain yourdomain.com
port 53

You can create as much as needed custom domain resolver files, one for each domain.

Mac OS X Lion and Cisco IPSEC VPN Pitfalls

The Mac OS X Lion, Native VPN client, with Cisco IPSEC EasyVPN Server was NOT working properly for myself. The problem I faced was that traffic was NOT passed to the remote LAN when connected to VPN. Split-tunnel and normal EasyVPN setups did NOT work.

1)  When presented with a split-tunnel ACL the Apple client will create a proxy pair for each line.
                        i.e.  VPN IP address of A
                                    split ACL of:
                                                            permit B
                                                            permit C
                                                            permit D

                        You would see an ipsec sa from A to B, A to C, and A to D.

2)  When presented with a split-tunnel ACL the Cisco client will crete a single ipsec sa:
                        i.e. A to any

            However the client will only route traffic to B, C, D over the tunnel.

This is fine and has no problems when using a crypto map style setup for ezvpn.

However when you configure the use of dVTI this becomes difficult.  This is because the VTI can only support 1 ipsec sa built to it.  As a results when the Apple client tries to propose the proxy pair for the A to C entry it is rejected.

This leaves you with two options here:

1)  Switch to a tunnel-all configuration
2)  Switch back to the crypto map configuration rather than the virtual-template configuration.

Reference: https://supportforums.cisco.com/thread/2095921

I chose to take the "old" crypto map style setup. Here's how I made it work on a Cisco 877 DSL router:

ip nat inside source route-map NAT interface Dialer0 overload

route-map NAT permit 10
match ip address 111
exit

access-list 101  remark ----------------------------------------------
access-list 101  remark *****VPN Access-list*****
access-list 101  permit ip 172.16.20.0 0.0.0.255 172.16.40.0 0.0.0.15
!
access-list 111  remark ----------------------------------------------
access-list 111  remark *****DENY Local LAN to VPN Traffic*****
access-list 111  deny ip 172.16.20.0 0.0.0.255 172.16.40.0 0.0.0.15 
access-list 111  remark ----------------------------------------------
access-list 111  remark *****PERMIT Networks Internet Access*****
access-list 111  permit ip 172.16.20.0 0.0.0.255 any
access-list 111  permit ip any any

aaa new-model
aaa authentication login userauth local
aaa authorization network groupauth local

username myusername password 0 mypassword

crypto isakmp policy 3
encryption 3des
authentication pre-share
group 2
lifetime 86400
exit

crypto isakmp client configuration group my_vpn
key mysecretgroupkey
dns 172.16.20.1 8.8.8.8
domain my.domain
pool my_vpn_pool
acl 101
max-logins 10
max users 10
save-password
split-dns my.domain
include-local-lan
exit

crypto ipsec transform-set my_set esp-3des esp-md5-hmac
exit

crypto dynamic-map dynmap 10
set transform-set my_set
set security-association idle-time 900
reverse-route
exit

crypto map clientmap client authentication list userauth
crypto map clientmap isakmp authorization list groupauth
crypto map clientmap client configuration address respond
crypto map clientmap 10 ipsec-isakmp dynamic dynmap

ip local pool my_vpn_pool 172.16.40.2 172.16.40.8

interface Dialer0
ip nat outside
crypto map clientmap

interface vlan1
no autostate
ip nat inside 

I have tested this setup with Mac OS X Lion VPN client and with iPhone IOS 5.0.1. All is working well now. Yeeaay!

AppleScript applications with Xcode 3.2.2

Xcode 3.2.2 on Snow Leopard does not support building new AppleScript applications anymore. It does allow you to edit pre-builded AppleScript projects, but you need to enable the AppleScript Studio palette in Xcode, which is hidden... I've build an installer package that will take care of it all and restore this feature in Xcode 3.2.2.

What it does is to automatically install "AppleScript Application", "AppleScript Automator Action" and "AppleScript Droplet" new project templates to "/Developer/Library/Xcode/Project Templates/Application/". This package will also automatically enable the hidden AppleScript Studio palette with the following command:

defaults write com.apple.InterfaceBuilder3 IBEnableAppleScriptStudioSupport -bool YES

Download Link

Quick Start AppleScript Application Guide:

Open Xcode and click "Create a new Xcode project". You will be presented with the following screen:

On the right, click on "AppleScript Application" and then the "Choose" button. Give your project a name and click "Save". You will be presented with the following screen.

Double click the MainMenu.xib file for the Interface Builder App to open up. In the Library pane, as shown below, type "button" in the search area. All button options will be shown:

Drag your button to the blank Window UI that you are designing:

We now need to link the button to our scripting code. Single click on the button and go to the Inspector AppleScript tab as shown below. Make the changes where marked in red.

In the Interface Builder main menu, click File and then Save. Close Interface Builder. You will now be back at the following screen:

Single click on yourProject.applescript to reveal the code. Add your code to the area where it says "(Add your script here.*)". Then lastly click the "Build and Run" button. You will now have an App that will do what the code tells it to do when the button is clicked.

Snow Leopard, Easy TFTP Server controls and Serial connectivity

I couldn't find a working TFTP server and serial Terminal for Mac OS X Snow Leopard, so I've put together two simple AppleScript programs to make life easier for updating Cisco routers and serial connectivity.

Download Links:
TFTP Controller
Serial Connection

To change the default TFTP server directory in Snow Leopard: NOTE that the directory must have full 777 permissions for all to be able to "get" and "put" data from and to TFTP server:

mkdir /Users/yourusername/TFTProot
chmod -R 777 /Users/yourusername/TFTProot

sudo nano /System/Library/LaunchDaemons/tftp.plist

Change <string>/private/tftpboot</string>
to your new path
<string>/Users/yourusername/TFTProot</string>

You can also start or stop the build-in TFTP server of Snow Leopard with the following commands:
Start TFTP server:

sudo launchctl load -F -w /System/Library/LaunchDaemons/tftp.plist

Stop TFTP server:

sudo launchctl unload -F -w /System/Library/LaunchDaemons/tftp.plist