Cisco anyconnect socket filter mac os

AnyConnect macOS 11 Big Sur Advisory

Available Languages

Download Options

AnyConnect Changes Related to macOS 11 (Big Sur)

Table of Contents

Table of Figures

1. Introduction

AnyConnect 4.9.04xxx leverages the System Extension framework available in macOS 11 (Big Sur). This differs from past AnyConnect versions, which rely on the now-deprecated Kernel Extension framework. This is the minimum version required to run AnyConnect on macOS 11.

This advisory describes changes introduced in the new AnyConnect version and the steps administrators can take to confirm AnyConnect is operating correctly on macOS 11. There are important changes in approving the AnyConnect system extension, as detailed in the next section.

The advisory also details the steps for failing over to the AnyConnect kernel extension, as last-resort workaround in case a critical system extension (or related OS framework) issue is encountered. The AnyConnect kernel extension is installed on macOS 11 solely for this purpose, it is no longer used by default.

2. About the AnyConnect System Extension

AnyConnect uses a network system extension on macOS 11, bundled into an application named Cisco AnyConnect Socket Filter. (This app controls the extension activation and deactivation and is installed under /Applications/Cisco.)

The AnyConnect extension has the following three components:

These components are visible in the macOS System Preferences – Network UI window:

Figure 1 — DNS proxy component

Figure 2 — App/Transparent proxy component

Figure 3 — Content filter component

AnyConnect requires its system extension and all its components to be active in order to operate properly, which implies that the mentioned components are all present and show up as green/running in the left pane of the macOS Network UI, as per above screenshots.

3. Approving the AnyConnect System Extension

macOS 11 requires end user or MDM approval before system extensions are allowed to run.

Two approvals are required for the AnyConnect system extension:

— Approve the system extension loading/activation.

— Approve the extension’s content filter component activation.

3.1 Extension Approval by End User

The AnyConnect system extension and its content filter component can be approved by end user, by following either the OS prompting, or the more explicit AnyConnect Notification app’s instructions.

Figure 4 — Extension blocked — OS prompt

Figure 5 — Extension blocked — AnyConnect prompt

After opening the Security & Privacy Preferences window, click the bottom-left lock and provide the requested credentials, as prompted, to unlock it and allow changes.

The window’s appearance depends on whether the AnyConnect extension is the only one requiring approval. If that’s the case, simply click the Allow button.

Figure 6 — AnyConnect extension approval

Otherwise click the Details… button, then select the ”Cisco AnyConnect Socket Filter” check box and click OK.

Figure 7 — AnyConnect extension approval (multiple unapproved extensions)

Shortly after approving the AnyConnect extension, the user is shown another popup, this time for approving the extension’s content filter component.

Figure 8 — AnyConnect extension’s content filter approval

After the extension’s content filter approval is complete, the extension and its components should be active, as confirmed by the AnyConnect Notification app:

Figure 9 — AnyConnect extension approval confirmation

3.2 Extension Approval using MDM

The AnyConnect system extension can also be approved without end user interaction, using a management profile’s SystemExtensions payload with the following settings:

Источник

Install Cisco AnyConnect Secure Mobility Client on a Mac Computer

Available Languages

Download Options

Objective

This article shows you how to download and install the Cisco AnyConnect Secure Mobility Client version 4.9.x on a Mac Computer.

This article is only applicable to the RV34x series routers, not Enterprise products.

Introduction

AnyConnect Secure Mobility Client is a modular endpoint software product. It not only provides Virtual Private Network (VPN) access through Secure Sockets Layer (SSL) and Internet Protocol Security (IPsec) Internet Key Exchange version2 (IKEv2) but also offers enhanced security through various built-in modules.

AnyConnect Software Version

Install AnyConnect Secure Mobility Client

This toggled section provides details and tips for beginners.

Prerequisites

• You need to purchase client license(s) from a partner like CDW or through your company’s device procurement. There are options for 1 user (L-AC-PLS-3Y-S5) or packets of licenses including one year for 25 users (AC-PLS-P-25-S). Other license options available as well, including perpetual licenses. For more details on licensing, check out the links in the Licensing Information section below.
• Download the latest version of firmware available for your router.

Make sure your operating system has one of the following versions: macOS 11.x (including Big Sur when using the latest version of AnyConnect firmware), 10.15, 10.14, and 10.13 (only 64-bit is supported from 10.15 and later). If you are not sure if a macOS version is supported, you can check the release notes. View the release notes from May 2021.

Check these other articles out!

Applicable Devices | Software Version

• RV340 | 1.0.03.21 (Download latest)
• RV340W | 1.0.03.21 (Download latest)
• RV345 | 1.0.03.21 (Download latest)
• RV345P | 1.0.03.21 (Download latest)

Licensing Information

AnyConnect client licenses allow the use of the AnyConnect desktop clients as well as any of the AnyConnect mobile clients that are available. You will need a client license to download and use the Cisco AnyConnect Secure Mobility Client. A client license enables the VPN functionality and are sold in packs of 25 from partners like CDW or through your company’s device procurement.

Want to know more about AnyConnect licensing? Here are some resources:

Step 1

Open a web browser and navigate to the Cisco Software Downloads webpage.

Step 2

In the search bar, start typing ‘Anyconnect’ and the options will appear. Select AnyConnect Secure Mobility Client v4.x.

Step 3

Download the Cisco AnyConnect VPN Client. Most users will select the AnyConnect Pre-Deployment Package (Mac OS) option.

The images in this article are for AnyConnect v4.9.x, which was latest version at the time of writing this document.

Step 4

Double-click the installer.

Step 5

Step 6

Go over the Supplemental End User License Agreement and then click Continue.

Step 7

Step 8

Choose the components to be installed by checking or unchecking the corresponding check boxes. All components are installed by default.

The items you select in this screen will appear as options in AnyConnect. If deploying AnyConnect for end-users, you may want to consider deselecting options.

Step 9

Step 10

Step 11

(Optional) Enter your password in the Password field.

Step 12

Click Install Software.

Step 13

You have now successfully installed the AnyConnect Secure Mobility Client Software on your Mac computer.

Additional Resources

AnyConnect App

To try out AnyConnect on mobile devices, the App can be downloaded from Google Play store or Apple store.

View a video related to this article.

Источник

Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9

Book Title

Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.9

Chapter Title

Appendix: AnyConnect Changes Related to macOS 11 (Big Sur)

View with Adobe Reader on a variety of devices

Results

Chapter: Appendix: AnyConnect Changes Related to macOS 11 (Big Sur)

Appendix: AnyConnect Changes Related to macOS 11 (Big Sur)

You must be running AnyConnect 4.9.04xxx (or later) for macOS 11. It leverages the System Extension framework available in macOS, while it formerly used the now-deprecated Kernel Extension framework. Because of this change, administrators must approve the AnyConnect system extension and can confirm correct operation with these updates. Also, if a critical system extension (or related OS framework) issue is encountered, you can follow the steps for failing over to the AnyConnect kernel extension, as a last resort workaround, but it is installed solely for this purpose and is no longer used by default

About the AnyConnect System Extension

AnyConnect uses a network system extension on macOS 11, bundled into an application named Cisco AnyConnect Socket Filter. The app controls the extension activation and deactivation and is installed under /Applications/Cisco.

The AnyConnect extension has the following three components that are visible in the macOS System Preferences-Network UI window:

AnyConnect requires its system extension and all its components to be active for proper operation, which implies that the mentioned components are all present and show as green (running) in the left pane of the macOS Network UI.

Approving the AnyConnect System Extension

macOS 11 requires either extension approval by end user or MDM approval without end user approval, before system extensions can run. Two approvals are required for the AnyConnect system extension:

Approve the System Extension Loading/Activation

Approve the AnyConnect system extension and its content filter component by following the OS prompts or the more explicit AnyConnect Notification application’s instructions.

Procedure

Click the Open Preferences button in the AnyConnect notification app, or the Open Security Preferences button, when you receive the «System Extension Blocked» app message. You can also navigate to the System Preferences application and go to the Security&Privacy window.

Click the bottom-left lock and provide the requested credentials to unlock and allow changes.

Click Allow on the Security & Privacy window to accept the Cisco AnyConnect Socket Filter.

When multiple system extensions require approval, the button is labeled Details. . In this case, click Details. , choose the Cisco AnyConnect Socket Filter checkbox, click OK, and approve any subsequent prompts that require an Allow.

What to do next

You will receive a notification when the extension’s content filter component is approved.

Approve the System Extension Using MDM

Approve the AnyConnect system extension without end user interaction using a management profile’s SystemExtensions payload with the following settings:

System Extension Type

Approve the extension’s content filter component with the following WebContentFilter payload settings:

Источник