This document contains OIT notes and caveats about Mac OS X 10.6.x Network Configuration. This document covers version 10.6.1.
As a result, if you have moved your Mac to a different connection since last shutting down or logging out, the location in effect at network startup time may not be appropriate. Although you can select a more appropriate location once the Mac has finished starting and you are logged in, having the wrong location selected at network startup time can be inconvenient:
The brief information Apple provides indicates that the Mac tries the network ports in the order they appear in the network location's list of network ports. This information appears to be incomplete at best; it instead appears instead that the OS will make simultaneous use of the enabled ports, at least for some kinds of ports. The effect of the ordering is unclear.
For Macs with multiple physical network ports (which is typical), we generally recommend that you avoid possible unexpected behaviors by designating inactive all but one of the network ports in each location. Define a different network location for each physical network port you typically use.
We have confirmed this problem through version 10.6.8.
Mac OS X's IP implementation uses the "Weak End System Model" with respect to transmitting. The Mac transmits some data via one network port, but marks the data as coming from the IP address of the other network port. OIT's IP routers perform "IP ingress spoof filtering" to discard packets containing IP sources inappropriate for the network on which they were received, as such traffic can represent a security problem.
This is not a bug in Mac OS X's IP implementation; the "Weak End System Model" is allowed by IP specifications. Neither is there anything wrong with the IP ingress spoof filtering performed on OIT's IP routers. However, when used in combination, they result in packet loss. IP ingress spoof filtering is an important measure to combat certain kinds of network-based attacks; it will not be disabled.
One fix would be for Mac OS X to adopt the "Strong End System Model" with respect to transmitting. This ensures that data transmitted by the Mac from each network port is marked with the IP address of that network port, not the Mac's other network port. Such an approach is especially appropriate for multihomed hosts. However, we are not aware of any plans to enhance Mac OS X to do this.
This issue is not unique to Mac OS X; most current operating systems employ the Weak End System Model, as their IP implementations were written before IP ingress spoof filtering was a common practice. The issue is highlighted by Mac OS X because by default, it tries to make all ports active, and modern Macs often have both an Ethernet and a Wireless port.
To work around the problem, we recommend you not allow the Mac to find itself in a situation where more than one network port is designated Active and simultaneously attached to a live network. You can do so by following OIT's instructions for creating multiple locations, designated all but one network port as Inactive in each location. (I.e. do not rely on the Automatic location shipped with Mac OS X if the Mac has multiple network ports.)
This is a variation of the issue described above (the "Weak End System Model" with respect to transmitting), but is a larger problem when both interfaces are attached to the same IP subnet. Like most operating systems, Mac OS X may not operate well when it has multiple interfaces attached to the same IP subnet simultaneously. Most operating systems are not designed to handle this configuration.
You will not encounter this situation if your Mac has just an Ethernet and a Wireless interface, and the Wireless interface is configured to use only OIT Wireless Service, as OIT Wireless Service provides a connection to an IP subnet that is not available via any other mechanism (there are no customer Ethernet ports attached to the same subnet as OIT Wireless Service). But you will encounter this situation if you configure your Wireless interface to use other (private) Wireless Access Points, and any of them are configured to operate as a bridge and are attached to the same IP network that your Mac's Ethernet interface is currently wired to.
To work around the problem, you must not allow the Mac to find itself in this situation. You can do so by following OIT's instructions for creating multiple locations, designating all but one network port as Inactive in each location. (I.e. do not rely on the Automatic location shipped with Mac OS X if the Mac has multiple network ports.)
You should leave the firewall's "Stealth Mode" feature disabled.
If your Mac were to not respond to PING requests, it would sometimes be harder to perform some troubleshooting when your Mac experiences a network problem.
Additionally if your device ever uses a dynamically-assigned IP address (for example, an OIT Mobile IP Address) that is not assigned for its use at the time, and your Mac were not responding to PING requests, it would increase the likelihook that the IP address your Mac is "stealing" will be assigned (by OIT DHCP Service) to another device at the same time, resulting an a number of problems.
For these reasons, you should leave the firewall's "Stealth Mode" feature disabled.
This affects settings that appear on an AirPort interface's basic configuration display and settings under the AirPort tab in the Advanced configuration display.
Although the user interface for the AirPort interface in each the Network pane (in System Preferences) implies that the settings are specific to each AirPort interface in each network location, the Mac often does not behave that way.
For example, if you change the selected wireless network name in one location, alter the list of preferred wireless network names, or show/hide the AirPort status in the menu bar, these changes will often affect the AirPort interface in other locations as well.
This prevents you from reliably configuring separate locations to explicitly connect to different wireless networks. For example, if you want to create one location that will connect (only) to OIT Wireless Service (for use on campus), another location that will connect (only) to a private wireless network (e.g. when visiting a residence off-campus), and another location to connect to (only) a commercial wireless network in a cafe, you may be unable to do so. Any changes made to one location may appear in the other locations as well.
If you use multiple locations with different wireless networks, and rely upon these settings to ensure you only connect to specific wireless networks in specific locations, this represents a security problem, because it may allow your Mac to connect to a wireless network you didn't intend to connect to in a particular location.
This problem is still present in version 10.6.1.
This can happen when you explicitly click the Turn AirPort On button. (If the Switching the AirPort power will cause any unsaved changes to be lost... alert appears, the freeze doesn't happen until you click the Apply button in that alert.) It can also happen when you switch from a location that had the AirPort interface off to one that has the AirPort interface turned on.
During the time that the System Preferences application is frozen, the Mac is mostly responsive. A "busy" cursor is displayed when the System Preferences application is in the foreground. Often the freeze will end on its own; We've seen these freezes resolve themselves in as few as 5-10 minutes; other times they take an hour to resolve themselves, or do not unfreeze even after 24 hours. If the freeze resolves on its own, you may find that whatever change you had tried to make has not taken effect.
We speculate that this issue might be associated in some way with having enabled the AirPort setting Ask to join new networks and/or having disabling the AirPort setting Remember this network, especially if no wireless networks appear in the table of Preferred Networks.
We have confirmed this problem in version 10.6.1.
The Mac will still use those interface routes in preference to the default route that points to the VPN server.
As a result, traffic between the Mac and other devices on the same IP subnet as any of its interfaces will not use the VPN connection, but instead will continue to travel directly between the Mac and the other devices.
(It can effectively be used with more than account name/password combination, when all the other VPN settings for the VPN service configuration remain the same. As long as you don't save a password as part of the configuration, you will be prompted for the account name and password each time you connect to a VPN server.)
Although the basic configuration pane for a VPN (PPTP) network port has an Add Configuration... command (in the Configuration pop-up menu) to allow you to define multiple configurations, all these configurations share a single set of advanced configuration settings. It is unlikely that a single group of advanced settings would be appropriate for different VPN services.
To be able to have truly independant settings for each VPN service within a single network location, do not use the Add Configuration... command. Instead, for each VPN service, create a separate VPN (PPTP) network port in the location. The settings for separate VPN (PPTP) network ports in a single location are independent. You may select which VPN (PPTP) network port to use from the VPN Of course, a different approach is to use separate locations to store the settings for different VPN services.
We have confirmed this problem through version 10.6.1.
By default, this feature is turned off. If your Mac is attached to the campus network, do not turn on this feature.
For more details, see Do Not Use Mac OS X's Internet Sharing Feature on the Campus Network.