This article discusses how to configure a Mobile Device Management (MDM) to update macOS Clients for SDP users in your account.
This feature is supported for macOS Client v5.0 and higher.
Starting with macOS Client v5.0, you can configure the Cato Management Application to use an MDM to manage the updates for macOS Clients in your organization. All Client updates are controlled using the MDM and endusers don't receive notifications of new Client versions.
When you configure the Client Upgrade Policy for your account, the same policy is applied to Windows and macOS upgrades. For more about the Upgrade Policy, see Configuring the Client Upgrade Policy.
This is an overview of the workflow to implement an MDM solution for macOS Clients in your account.
-
In the Cato Management Application, set the Upgrade Policy to Managed Upgrade.
-
New Cato Management Application, from the navigation menu select Access > Client Access > Upgrade Policy.
-
Legacy Cato Management Application, from the navigation menu select Configuration > Global Settings > VPN Settings > Upgrade Policy.
-
-
Import the macOS package.
-
Configure the MDM to create a policy that allows the DMG extension and VPN profiles for endusers.
Otherwise, endusers need to manually approve and allow the above items in the macOS.
-
In the MDM, distribute the new macOS Client version to the endusers in your account.
To use the Managed Upgrade for the macOS Client in your account, first you need to import the package to the MDM.
Starting with the macOS Client v5.0, the following permissions are required to install the Client on a macOS host:
-
Allow the Cato Client to create a VPN profile
-
Allow system extensions for the Cato Client
You can configure the MDM to automatically allow these permissions for enduser as part of the installation process for the new Client version. Otherwise, the enduser must manually configure the macOS settings as part of the installation process.
In the MDM, create a VPN Payload that contains the settings to automatically set the macOS to allow permissions for the Cato Client VPN profile. When the Client is installed, the VPN Profile permissions are set correctly and the macOS doesn't request the enduser to manually configure them.
Setting |
Value |
---|---|
Connection Name |
Cato Networks VPN |
Connection Type |
Custom SSL (from the drop-down menu) |
Identifier |
com.catonetworks.mac.CatoClient |
Server |
vpn.catonetworks.net |
Account |
CatoClientVPN |
Provider Bundle Identifier |
com.catonetworks.mac.CatoClient.CatoClientSysExtension |
User Authentication |
|
Provider Type |
Packet Tunnel |
Provider Designated Requirement |
anchor apple generic and identifier "com.catonetworks.mac.CatoClient" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = CKGSB8CH43) |
Create the new profile and then configure the VPN settings for that profile.
-
Create the profile for the macOS Client:
-
From the navigation pane, select Computers > Configuration Profiles.
-
Click New and create a new profile for the Cato Client.
-
-
Edit the VPN settings to allow the VPN permissions for the profile (based on the data in the table above):
-
In Configuration Profiles, edit the profile you created in the previous step and select VPN.
-
Enter the settings for the VPN Type, Connection Type, Identifier, Server, Account, and Provider Bundle Identifier.
-
Configure the settings for the User Authentication, Provider Type, and Provider Designated Requirement.
-
In the MDM, configure the policy to allow the system extensions that are used by the macOS Client. When the Client is installed, the system extension permissions are set correctly and the macOS doesn't request the enduser to manually configure them.
Setting |
Value |
---|---|
Display Name |
CatoClient System Extension |
System Extension Types |
Allowed System Extensions |
Team Identifier |
CKGSB8CH43 |
Allowed System Extensions |
|
Edit the System Extensions settings to allow the system permissions for the profile (based on the data in the table above).
In the MDM, select the users and groups that are receiving the Cato VPN profile. Then create a new policy with the macOS package and push the policy to the users.
-
In Computers > Configuration Profiles, select the group or specific users that are receiving the Cato VPN profile.
-
Create a new policy and add the macOS package to it.
-
In Computers > Policy, create a new policy.
-
From the General section, configure these settings:
-
Enter the Display Name.
-
Configure the other policy settings based on the requirements for your organization.
-
-
In the Packages section, add the macOS Client package.
-
-
Click Save. The profile is ready to distribute the Client to the macOS devices.
Comments
10 comments
Updated article and added examples for configuring JAMF to distribute the macOS Client
The Team ID shows as Ch33 but the Kernel screenshot shows CH43. Which one is it?
Team ID on the documentations says CKGSB8Ch33, but screenshot says CKGSB8ch34.
Orlando and Ed,
Sorry for the confusion! Indeed CH43 is correct, and I updated the article to show the Team ID as CKGSB8CH43
Yaakov
Are there plans to support other MDMs in the future?
Peter,
Many MDMs are supported for the macOS Client. This article includes examples for JAMF.
If you have a question about a specific vendor, please contact Support.
Thanks!
Yaakov
Can we get an example with Microsoft Intune?
Hi, Do we need to adjust the JamF policy for computers with an Apple processor and a MacOS Monterey operating system?
Because the new operating systems are not supporting "Approved Kernel Extensions ".
Hello David!
My apologies that your comment has gone unnoticed for so long! I believe you are correct. I will ask the author of the document to update it appropriately.
Kind Regards,
Dermot Doran
Hello David!
The article has been updated to reflect the changes to macOS that resulted in "Approved Kernel Extensions" going out of support. Thank you again from bringing this to our attention.
Kind Regards,
Dermot Doran
Please sign in to leave a comment.