APM 12.1.2 EHF 271 OPSWAT Mac File Check Issues
I have an access policy that I'm having issues with. I had to update APM to 12.1.2 with engineering hotfix 271. When I updated it, OPSWAT v4 was installed inadvertently. As soon as it was installed, any user in my company with McAfee Endpoint Encryption v6.x could not get past the HD Encryption check. I ran the OESIS Diagnostic tool on their computers and it did not detect any HD Encryption software. Users that have Bitlocker work just fine. I was able to get around this by setting up a process check coming off of the fallback branch of the HD Encryption macro, and everything is fine for Safeboot/Endpoint Encryption 6.x users (about 1500). I have some other users with Mac OS 10.12.5 that are unable to pass the client check. This is a bug in the version of the OPSWAT SDK that is installed (4.2.1067.0). There's also an issue with Mac Endpoint Security 10.x. I was going to try to get around the issue for now by checking that the files exist for the endpoint encryption and the endpoint security processes. I put the files in a Mac file check but it is still failing to see them. The files are: /Library/Application Support/JAMF/JAMF.keychain for JAMF, and /Library/Application Support/JAMF/status.0 for Filevault. Does anyone out there with Mac experience have the ability to check to see if that is correct? The only thing I can think of is that it needs a ~ in front of /Library. If I remove the check altogether it works. The other issue Mac users are having is that they keep getting disconnected right when they log in. Their log files show this: 1106,1106,edge, 48, , 143, TunnelController, Tunnel Server, Connecting state 1106,1106,edge, 2, , 171, TunnelController, Disconnected state, Error code, Routing table cannot be patched 1106,1106,edge, 48, , 183, ConnectivityService, activeServices, Service is active, en5 1106,1106,edge, 48, , 183, ConnectivityService, activeServices, Service is active, en0 1106,1106,edge, 48, , 183, ConnectivityService, activeServices, Service is active, awdl0 1106,1106,edge, 48, , 84, DoRequest, DoRequest, cancel 1106,1106,edge, 48, , 165, TimerController, TimerController, Captive Network Not Detected 1106,1106,edge, 48, , 77, TimerController, Timer Controller, Activated 1106,1106,edge, 48, , 80, TimerController, Timer Controller, Timer Activated (interval: 10 secs) 1106,1106,edge, 48, , 124, TimerController, Timer Controller, Deactivated 1106,1106,edge, 48, , 330, SvpnHandler::StopSvpn, TunnelService, Cannot open pid file, svpn already closed Does anyone know why this would be happening? F5 support suggested adding a split tunnel entry of 0.0.0.0/0.0.0.0 to their network access profile, but I don't know if that will help.
F5 BIG-IP Edge Client Now Supported in Apple macOS Sierra and iOS 10
F5 BIG-IP Edge Client and other F5 BIG-IP Access Policy Manager (APM) client features are now supported in Apple macOS Sierra (10.12) as of Tuesday, September 20, 2016 – the same day as the macOS Sierra was released! AND, BIG-IP Edge Client also supports Apple iOS 10 as of September 13, 2016 – the same day as it was released! Compatibility matrices for BIG-IP versions – only for those versions that still have active Software Development support – have been updated for support for both iOS 10 and macOS Sierra. The EPSEC release for macOS Sierra (release 450) is targeted for availability by thisFriday, September 23, 2016. macOS Sierra related known issues – some issues were found which might affect some BIG-IP Edge Client and BIG-IP APM customers. Thosechanges are: When usedwithJava 8, Java RDP freezes after using Caps Lock, Alt, Shift or Ctrl keys(611478). This issue will need to be addressed by Oracle. “Internal error” messages have been seen when using app tunnel on Safari 10 (611327) BIG-IP Edge Client customizations are not applied on macOS Sierra (611669). F5 will issue Engineering Hotfixes to address this issue inthe short term if there are customer support requests (CSRs). iOS 10 related changes – some behavior changes were also discovered with iOS 10 that customers may wish to know that relate to BIG-IP Edge Client and VPN use: When a user uses a per-app VPN configuration, that VPN connection is usually indicated with a VPN icon on the device status bar (at the top of the screen). In iOS 10, when an application that uses the per app VPN tunnel is not in the foreground, the VPN icon is not displayed on the status bar. In addition, when Safari is in the foreground and uses the per-app tunnel, the VPN icon is not displayed. This is a change in the OS, and not on Edge Client. Note: The behavior has not changed for a full device VPN initiated by On-Demand VPN or if the user manually uses Edge Client to establish a VPN connection. For these configurations, the VPN icon is always displayed when the VPN connection is active, as long as the connection has not been disconnected. iOS 10 known issues – the following are identified issues on iOS 10 that may affect the BIG-IP Edge Client, depending on the use case: •Previous settings from the Client Proxy Autoconfig Script are used and not refreshed until Safari is restarted (612997) •BIG-IP Edge Client fails to establish a layer 3 connection when layer 4 per-app VPN is already established. The following error is displayed: "Server unreachable. Please check your network connectivity and server address” (611923) The above behavior changes are due to changes in macOS or iOS 10 and not due to Edge Client changes. An AskF5 solution withthisinformation and more specifics on the issue, additional minor issues, and possible workarounds forcustomers should be available shortly. For further information on currently supported versions of BIG-IP software, please see the following article: SOL8986: F5 software life cycle policy https://support.f5.com/kb/en-us/solutions/public/8000/900/sol8986.html and the F5 Access and Edge Apps Compatibility Matrix.F5 BIG-IP Edge Client Now Supported in Apple macOS Sierra and iOS 10
F5 BIG-IP Edge Client and other F5 BIG-IP Access Policy Manager (APM) client features are now supported in Apple macOS Sierra (10.12) as of Tuesday, September 20, 2016 – the same day as the macOS Sierra was released! AND, BIG-IP Edge Client also supports Apple iOS 10 as of September 13, 2016 – the same day as it was released! Compatibility matrices for BIG-IP versions – only for those versions that still have active Software Development support – have been updated for support for both iOS 10 and macOS Sierra. The EPSEC release for macOS Sierra (release 450) is targeted for availability by thisFriday, September 23, 2016. macOS Sierra related known issues – some issues were found which might affect some BIG-IP Edge Client and BIG-IP APM customers. Thosechanges are: When usedwithJava 8, Java RDP freezes after using Caps Lock, Alt, Shift or Ctrl keys(611478). This issue will need to be addressed by Oracle. “Internal error” messages have been seen when using app tunnel on Safari 10 (611327) BIG-IP Edge Client customizations are not applied on macOS Sierra (611669). F5 will issue Engineering Hotfixes to address this issue inthe short term if there are customer support requests (CSRs). iOS 10 related changes – some behavior changes were also discovered with iOS 10 that customers may wish to know that relate to BIG-IP Edge Client and VPN use: When a user uses a per-app VPN configuration, that VPN connection is usually indicated with a VPN icon on the device status bar (at the top of the screen). In iOS 10, when an application that uses the per app VPN tunnel is not in the foreground, the VPN icon is not displayed on the status bar. In addition, when Safari is in the foreground and uses the per-app tunnel, the VPN icon is not displayed. This is a change in the OS, and not on Edge Client. Note: The behavior has not changed for a full device VPN initiated by On-Demand VPN or if the user manually uses Edge Client to establish a VPN connection. For these configurations, the VPN icon is always displayed when the VPN connection is active, as long as the connection has not been disconnected. iOS 10 known issues – the following are identified issues on iOS 10 that may affect the BIG-IP Edge Client, depending on the use case: •Previous settings from the Client Proxy Autoconfig Script are used and not refreshed until Safari is restarted (612997) •BIG-IP Edge Client fails to establish a layer 3 connection when layer 4 per-app VPN is already established. The following error is displayed: "Server unreachable. Please check your network connectivity and server address” (611923) The above behavior changes are due to changes in macOS or iOS 10 and not due to Edge Client changes. An AskF5 solution withthisinformation and more specifics on the issue, additional minor issues, and possible workarounds forcustomers should be available shortly. For further information on currently supported versions of BIG-IP software, please see the following article: SOL8986: F5 software life cycle policy https://support.f5.com/kb/en-us/solutions/public/8000/900/sol8986.html and the F5 Access and Edge Apps Compatibility Matrix.
BIG-IP and sharing connection on OS X
Hello, My Macbook running OS X 10.10 (Yosemite) is connecting well to a BIG-IP network with my Ethernet interface. What I would like to achieve is to share this connection through the WiFi interface. I'm trying to do it with the built-in functionality (System Preferences -> Internet sharing) using the "Thunderbolt Ethernet" interface as the source. Unfortunately all clients connecting to the WiFi does not have access to the vpn. Did someone already have this problem? Thanks.
