Reset Search
 

 

Article

KB44592 - Pulse Desktop Client for macOS Open Issues on Big Sur

« Go Back

Information

 
Last Modified Date1/11/2021 11:49 PM
Synopsis

Pulse Desktop macOS Client Open Issues on Big Sur

This article outlines the list of all Open & Known issues on Big Sur (macOS 11) and a workaround.
Problem or Goal
Pulse Desktop (macOS) client 9.1R9 is compatible with the Big Sur Release.

Please find the list of Open & Known issues observed upon testing with Pulse Desktop (mac) Client 9.1R9 on Big Sur along with the workarounds:
Cause
Solution

Known Issue 1: Pulse Desktop mac Client 9.1R9 cannot be distributed via PCS that runs version prior to 9.1R8.2 without Manual installation of PSSetupClientInstaller.dmg
 

Impact

Admin cannot distribute Pulse Desktop Clients from PCS server running version prior to PCS 9.1R8.2.

End User Symptoms

End Users will see the following error during upgrade/installation if Admin deploys Pulse 9.1R9 package on the PCS running Pre-9.1R8.2
User-added image

Root Cause

System Extension requires
Notarization and this gave rise
to certificate dependencies.

Workaround

Manually install PSSetupClientInstaller.dmg if PDC (mac) 9.1R9 needs to be distributed via PCS versions prior to 9.1R8.2 (Check in the attachment section).

Plan to Fix

Resolved - Pulse Desktop Client 9.1R10

Pulse Bug

PRS-394581


Known Issue 2: When Lockdown Mode is configured, traffic other than TCP/UDP ProtocolUnicast Local Address and Unicast Remote Address will not be blocked (e.g. ICMP)

Impact

Network Traffic types other than TCP/UDP ProtocolUnicast Local Address and Unicast Remote Address will not be blocked in Lockdown Mode, as those rules cannot be applied.

End User Symptoms

End Users will be able to access Network resources other than TCP/UDP ProtocolUnicast Local Address and Unicast Remote Address in Lockdown mode.

Root Cause

mac OS API Limitation

Workaround

N/A

Plan to Fix

Waiting on Apple

Pulse Bug

PRS-394150


Known Issue 3: Pulse shows kernel extension blocked message post upgrade to BigSur for Pre-9.1-R8.2 PDC versions.

Impact

Operation of Traffic Enforcement and Lockdown Mode is affected

End User Symptoms

If PDC <9.1R8.2 is installed and the user upgrades macOS to Big Sur, the following message is shown:
User-added image

The PDC's Kernel Extension is prevented from loading and Lockdown/Traffic Enforcement will not work properly.

Root Cause

Apple has deprecated Kernel Extension from Big Sur and therefore it doesn't load Kext. Therefore, we have replaced Kernel Extension with System Extension from PDC 9.1R9 onwards.

Workaround

Install PDC 9.1R9 or above.

Plan to Fix

N/A

Pulse Bug

PRS-394016 


Known Issue 4: [Catalina & above] New System Extension install flow requires explicit end-user approvals

Impact

User prompts need to be accepted to activate PDC system extension (Firewall) component

End User Symptoms

The user will see a first prompt to allow "Pulse Secure" application load, and a second prompt to approve "Network Filtering". In both cases credentials are required.  
User-added image
User-added image

Root Cause

User approval of System Extensions (part of PDC starting in Catalina) is required as per macOS design

Workaround

N/A

Plan to Fix

This is a macOS limitation.

Pulse Bug

PRS-393513


Known Issue 5:  [Catalina & above] Pulse system extension remains on systemextensionsctl list even after uninstall and immediate reboot
 

Impact

No User Impact (Pulse reinstall will not have impact)

End User Symptoms

To verify use the command "systemextensionsctl list" that shows the state as "uninstalling"
User-added image

Root Cause

macOS Limitation

Workaround

N/A

Plan to Fix

N/A

Pulse Bug

PRS-393498


Known Issue 6:  On-Demand Pulse system extension with Traffic Enforcement is not supported (Pulse System Extension will be present as long as Pulse is installed)

Impact

No functional impact to the user

End User Symptoms

Pulse System extension process keeps running post reboot when when Traffic Enforcement or Lock Down mode was previously activated for the user.

Root Cause

macOS design/Limitation

Workaround

N/A

Plan to Fix

N/A

Pulse Bug

PRS-394339


Known Issue 7:  Catalina & above] Uneven VPN Performance.

Impact

May impact VPN Performance sometimes

End User Symptoms

Inconsistent throughput during download and upload may be observed.
 

Root Cause

macOS issue

Workaround

N/A

Plan to Fix

Waiting on Apple

Pulse Bug

PRS-392565


Known Issue 8:  Pre-9.1R8.2 Pulse Clients on Big Sur won't notify end users (who have LockDown configured) that kext (Kernel Extension) isn't supported.

Impact

May impact VPN Performance sometimes

End User Symptoms

Users will be able to connect successfully without the Firewall Rules being applied.

Root Cause

Apple has deprecated Kernel Extension from Big Sur and therefore it doesn't load Kext. Therefore, we have replaced Kernel Extension with System Extension from PDC 9.1R9 onwards.(macOS limitation)

Workaround

Move to PDC 9.1R9 or above.

Plan to Fix

N/A

Pulse Bug

PRS-394012

 

Known Issue 9:  Gibberish message is shown on chrome before re-directing to PSAL download page

Impact

Sometimes on Chrome browser before re-directing to PSAL download page, a gibberish value is shown in a popup.

End User Symptoms

User will see a message similar to the one shown below:
User-added image

Root Cause

Work in Progress

Workaround

Refresh the page or use Safari instead of Chrome

Plan to Fix

Under Consideration

Pulse Bug

PRS-394703

 

Known Issue 10:  

Impact

After upgrading to macOS 11.0 (Big Sur), Host Checker will fail macOS HDD Encryption compliance check.                                                 

End User Symptoms

The end user will receive the following error:

"FileVault 10.16 does not comply with policy. Compliance requires drives to be encrypted."

Root Cause

The issue occurs due to volume name changes in macOS 11.0 and above.

Workaround

Upgrade to ESAP 3.7.1+ release.

Plan to Fix

This issue has been addressed in the ESAP 3.7.1 release

Pulse Bug

PRS-395532

KBKB44635 - After upgrading to macOS 11.0 (Big Sur), compliance check fails with "FileVault 10.16 does not comply with policy. Compliance requires drives to be encrypted"
 

Known Issue 11:  

Impact

Host Checker policies will fail to pass compliance check and possibly crash when a Predefined Rule: OS Check rule is enforced for macOS Big Sur and the endpoint has upgraded to macOS Big Sur 11.0 and above.               

End User Symptoms

The end user may experience a crash or receive the following error:

'Server has not received any information for this policy.'

Root Cause

Apple changed the version formatting to something different than what the parser was expecting.

Workaround

Upgrade to a future ESAP release or disable the compliance check.

Plan to Fix

A fix is tentatively set for the ESAP 3.7.3 release.

Pulse Bug

PRS-397072
KBKB44631 - After upgrading to macOS 11.0 (Big Sur), end users may receive Error 1205 "Failed to setup virtual adaptor" when Traffic Enforcement or Lock Down Mode are configured
 

Known Issue 12:  

Impact

End users may receive Error 1205 "Failed to setup virtual adaptor" when Traffic Enforcement or Lock Down Mode are configured after upgrading to macOS 11.0 and above

End User Symptoms

The end user may receive the following error message:

Failed to setup virtual adaptor. (Error: 1205)

Root Cause

The issue occurs due System Extensions are not allowed by default and end user must explicitly approve the Pulse Secure application.  This is as per Apple Design in using System Extensions. If this is not allowed, the virtual adapter will fail 

Workaround

Deploy MDM policy payload for configuring web content filter pre-approval:

https://developer.apple.com/documentation/devicemanagement/webcontentfilter

Plan to Fix

The issue occurs due System Extensions are not allowed by default and end user must explicitly approve the Pulse Secure application.  This is as per Apple Design in using System Extensions. If this is not allowed, the virtual adapter will fail to setup.

Pulse Bug

PRS-396770
KBIn Progress
Related Links
Created ByRaghu Kumar

Feedback

 

Was this article helpful?


   

Feedback

Please tell us how we can make this article more useful.

Characters Remaining: 255