Cisco AnyConnect client deployment for Mac with Microsoft Intune

Platforms

macOS

Products

IntuneCisco Secure Client

Result

The Cisco client installs and connects with no Allow or Open System Settings prompts for users

Overview

Deploy the Cisco VPN client to Macs with Intune so it installs silently: upload the package as a LOB app and pre-approve its system extension, content filter and notifications with settings catalog profiles.

Cisco Secure Client (formerly Cisco AnyConnect Secure Mobility Client) is a security endpoint agent that provides remote access to the corporate network over a Virtual Private Network (VPN), as well as Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) capabilities through its built-in modules. The Cisco client is available for many platforms (Windows, Linux, iOS, Android, etc.), including macOS. Customers on Mac and Linux can keep using Cisco AnyConnect v4.x until the new Cisco Secure Client v5.x fully supports their OS.

Intune can deploy the Cisco client to enrolled macOS devices, but its System Extensions must be approved, either by a user with administrator rights or, preferably, by MDM. It also needs the WebContentFilter payload to configure the network content filter on Mac devices.

In this post, I explain how to deploy Cisco AnyConnect Secure Mobility Client v4.10 together with Intune MDM profiles (System Extensions, Web Content Filter, etc.), so the client installs without asking users to accept or allow anything manually.

Prerequisites

Before you start, check that you have the following.

Configuration

With the prerequisites in place, add the app and its three profiles in this order.

Add a LOB app to Intune

Download the latest Cisco AnyConnect 4.10.x (or the new Cisco Secure Client 5.x) as a DMG file (e.g. anyconnect-macos-4.10.06090-predeploy-k9.dmg).

Note: After you mount the DMG volume, you can extract the single package file from it.

Upload the client package (.pkg) to the Intune admin center (intune.microsoft.com) as a line-of-business (LOB) app.

For Intune to detect the app after installation, the included apps list must contain only one entry with CFBundleIdentifier and CFBundleShortVersionString:

• App bundle ID (CFBundleIdentifier): com.cisco.anyconnect.gui
• App version (CFBundleShortVersionString): 4.10.06079

System Extensions profile

Cisco AnyConnect uses a Network System Extension on macOS 11 or later, bundled into an application named Cisco AnyConnect Socket Filter. This app activates and deactivates the extension and is installed in the /Applications/Cisco folder.

In an Intune Settings Catalog profile, under System Configuration > System Extensions, add the following Allowed System Extensions (or Allowed System Extension Types: Network):

• Allowed System Extensions: com.cisco.anyconnect.macos.acsockext
• Team Identifier: DE8Y96K9QP

Web Content Filter profile

Create a new Settings Catalog profile and select Web Content Filter:

Configure the following settings:

• Filter Data Provider Bundle Identifier: com.cisco.anyconnect.macos.acsockext
• Plugin Bundle ID: com.cisco.anyconnect.macos.acsock
• Filter Browsers: Disabled
• User Defined Name: Cisco AnyConnect Content Filter
• Filter Grade: firewall
• Auto Filter Enabled: Disabled
• Filter Sockets: Enabled
• Filter Packets: Disabled
• Filter Data Provider Designated Requirement (copy the whole value below):

anchor apple generic and identifier "com.cisco.anyconnect.macos.acsockext" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = DE8Y96K9QP)

Notifications profile

In the Settings Catalog, under User Experience, configure app Notifications to suit your requirements:

• Bundle Identifier: com.cisco.anyconnect.notification

Result

Intune Company Portal reports that Cisco AnyConnect Secure Mobility Client was installed (detected) successfully on the Mac:

Without the two profiles, users would have to approve the extension and the content filter themselves. These are the macOS prompts the profiles remove:

The Cisco AnyConnect extension has three components:

• DNS proxy
• App/Transparent proxy
• Content Filter

To work properly, the System Extensions and all their components must be Active (Enabled). You can see these components in macOS System Preferences > Network > Filters:

If you see issues or unexpected user prompts, check that all required profiles (System Extensions, Web Content Filter, etc.) were installed successfully on the device:

To confirm that the system extension was approved and activated, run systemextensionsctl list in the Terminal app with the network extension category:

systemextensionsctl list com.apple.system_extension.network_extension

Example output:

Category: com.apple.system_extension.network_extension
3 extension(s)
--- com.apple.system_extension.network_extension
enabled  active  teamID      bundleID (version)                                             name                                       [state]
*        *       DE8Y96K9QP  com.cisco.anyconnect.macos.acsockext (4.10.06079/4.10.06079)   Cisco AnyConnect Socket Filter Extension   [activated enabled]
                 UBF8T346G9  com.microsoft.wdav.netext (101.98.30/101.98.30)                Microsoft Defender Network Extension       [terminated waiting to uninstall on reboot]
*        *       UBF8T346G9  com.microsoft.wdav.netext (101.98.54/101.98.54)                Microsoft Defender Network Extension       [activated enabled]