Cato Networks Knowledge Base

macOS Ventura Users Unable to Reach Resources Via Cato

  • Updated


On macOS Ventura, users aren't able to reach internal resources when connected to Cato


  • macOS Ventura 13.0 and above
  • Cato SDP Client regardless of the version
  • DNS forwarding configured for internal domains

The Problem

If Cato DNS settings applied to SDP users are default (empty fields), Cato will push to the client the following DNS information:

  • Primary DNS server
  • Secondary DNS server

macOS Ventura natively prefers DNSSEC which Cato does not currently support. Once macOS sees a DNS server compliant with DNSSEC, it will ignore all the rest – including Cato. This can be a public server that supports DNSSEC, such as, or a local server that is configured for DNSSEC. Further information can be found in this Apple discussion.

The issue may also occur with any other DNS server configured for the account that supports DNSSEC. For example, Be aware that when DNS settings between entities conflict, the entity closest to the host (from host > site > group > account) takes precedence. For more information see: Configuring DNS Settings

Since Cato doesn't intercept DNSSEC queries, DNS forwarding fails and the user isn't able to reach internal resources or the DNS results being retrieved aren't the expected ones.


The Solution

This is a known issue that Apple is actively working on. As a workaround, set as the only DNS server EXPLICITLY in CMA. This will prevent (or any other DNSSEC-supported DNS) from being sent as a DNS server to the client and will force ALL DNS queries to go to Cato.

The DNS server can be set globally or per group, preferably the pre-configured 'All SDP Users' user group. For more information see: Customizing DNS Servers and Suffixes for Groups or User Groups

This is currently the only workaround to this issue until Apple implements a final solution on their side.




Was this article helpful?

0 out of 0 found this helpful



Please sign in to leave a comment.