What you will achieve

Configure macOS built-in VPN (L2TP, IKEv2, Cisco IPSec where supported) or import profiles from your provider.

macOS includes IKEv2, L2TP, and Cisco IPSec VPN types in System Settings without third-party clients for many enterprise profiles. Personal WireGuard or OpenVPN usually needs a separate app. Built-in VPN integrates with keychain and on-demand rules when profiles allow.

1) Add a VPN configuration

System Settings → VPN (or Network → VPN on older macOS).
Click Add VPN Configuration and choose type your provider specifies — IKEv2 is preferred for modern setups.
Enter server, remote ID, username/password or certificate.

2) IKEv2 example fields

Server address — hostname from IT or VPN vendor.
Remote ID — often same as server or a specific identity string.
Local ID — usually your username or left blank.
Enable Use certificate if IT issued a .p12 profile.

3) Connect and test

Toggle VPN on from menu bar or System Settings.
Visit an IP-check site to confirm egress location.
Test internal resources (file servers, intranet) required for work.

4) Third-party clients

OpenVPN and WireGuard often need apps from Tunnelblick, OpenVPN Connect, or vendor clients (Nord, Mullvad). macOS built-in does not cover all protocols.

5) Split tunnel and DNS leaks

Enterprise profiles may route all traffic. If DNS leaks, ask IT for a profile with correct DNS search domains. Personal VPNs usually handle this in their app.

6) Import configuration profiles

IT often emails .mobileconfig — double-click to install under Device Management or Profiles. Profiles can include VPN, Wi‑Fi, and certificate trust in one payload. Remove obsolete profiles before adding conflicting VPN types.

7) On-demand vs always-on

IKEv2 supports Connect on demand for trusted SSIDs exclusion — configure in profile or third-party app. Split tunnel routes only corporate subnets; full tunnel sends all traffic through HQ and slows video calls.

8) Sleep and reconnect

Mac sleep drops IPsec sometimes — enable Wake for network access in Battery if you need persistent VPN to home lab. If VPN connects but DNS fails, add internal DNS servers to VPN interface Advanced settings.

Verify

VPN connects without error; public IP changes; work resources reachable; disconnect restores normal browsing.

Additional troubleshooting notes

If steps above do not resolve the issue on the first attempt, reboot once, confirm System Settings → General → Software Update is current, and retry with a second administrator account to rule out profile or keychain corruption in your daily user. Document exact error text from Console.app with timestamp — vague “it still fails” without logs wastes support time. On Apple Silicon, re-test after full shutdown (not just restart) because firmware and Thunderbolt controllers reset only on cold boot. Intel Macs should repeat test in Safe Mode to bypass third-party login items. Before erase or keychain reset, verify Time Machine or clone backup completed — batch 3 guides assume Monterey/Ventura/Sonoma/Sequoia paths in System Settings; search Spotlight for renamed panes if your macOS version labels differ slightly.