KB44592 - Pulse Desktop Client for macOS Open Issues on Big Sur

Impact

Admin cannot distribute Pulse Desktop Clients from PCS server running version prior to PCS 9.1R8.2.

End User Symptoms

End Users will see the following error during upgrade/installation if Admin deploys Pulse 9.1R9 package on the PCS running Pre-9.1R8.2

Root Cause

System Extension requires
Notarization and this gave rise
to certificate dependencies.

Workaround

Manually install PSSetupClientInstaller.dmg if PDC (mac) 9.1R9 needs to be distributed via PCS versions prior to 9.1R8.2 (Check in the attachment section).

Plan to Fix

Resolved - Pulse Desktop Client 9.1R10

Pulse Bug

PRS-394581

Impact

Network Traffic types other than TCP/UDP Protocol, Unicast Local Address and Unicast Remote Address will not be blocked in Lockdown Mode / TE (Traffic Enforcement) as those rules cannot be applied.

End User Symptoms

End Users will be able to access Network resources other than TCP/UDP Protocol, Unicast Local Address and Unicast Remote Address in Lockdown mode / TE (Traffic Enforcement)

Root Cause

mac OS API Limitation

Workaround

N/A

Plan to Fix

Waiting on Apple

Pulse Bug

PRS-394150

Impact

Operation of Traffic Enforcement and Lockdown Mode is affected

End User Symptoms

If PDC <9.1R8.2 is installed and the user upgrades macOS to Big Sur, the following message is shown:


The PDC's Kernel Extension is prevented from loading and Lockdown/Traffic Enforcement will not work properly.

Root Cause

Apple has deprecated Kernel Extension from Big Sur and therefore it doesn't load Kext. Therefore, we have replaced Kernel Extension with System Extension from PDC 9.1R9 onwards.

Workaround

Install PDC 9.1R9 or above.

Plan to Fix

N/A

Pulse Bug

PRS-394016 

Impact

User prompts need to be accepted to activate PDC system extension (Firewall) component

End User Symptoms

The user will see a first prompt to allow "Pulse Secure" application load, and a second prompt to approve "Network Filtering". In both cases credentials are required.  

Root Cause

User approval of System Extensions (part of PDC starting in Catalina) is required as per macOS design

Workaround

N/A

Plan to Fix

This is a macOS limitation.

Pulse Bug

PRS-393513

Impact

No User Impact (Pulse reinstall will not have impact)

End User Symptoms

To verify use the command "systemextensionsctl list" that shows the state as "uninstalling"

Root Cause

macOS Limitation

Workaround

N/A

Plan to Fix

N/A

Pulse Bug

PRS-393498

Impact

No functional impact to the user

End User Symptoms

Pulse System extension process keeps running post reboot when when Traffic Enforcement or Lock Down mode was previously activated for the user.

Root Cause

macOS design/Limitation

Workaround

N/A

Plan to Fix

N/A

Pulse Bug

PRS-394339

Impact

May impact VPN Performance sometimes

End User Symptoms

Inconsistent throughput during download and upload may be observed.
 

Root Cause

macOS issue

Workaround

N/A

Plan to Fix

Waiting on Apple

Pulse Bug

PRS-392565

Impact

May impact VPN Performance sometimes

End User Symptoms

Users will be able to connect successfully without the Firewall Rules being applied.

Root Cause

Apple has deprecated Kernel Extension from Big Sur and therefore it doesn't load Kext. Therefore, we have replaced Kernel Extension with System Extension from PDC 9.1R9 onwards.(macOS limitation)

Workaround

Move to PDC 9.1R9 or above.

Plan to Fix

N/A

Pulse Bug

PRS-394012

Impact

Sometimes on Chrome browser before re-directing to PSAL download page, a gibberish value is shown in a popup.

End User Symptoms

User will see a message similar to the one shown below:

Root Cause

Work in Progress

Workaround

Refresh the page or use Safari instead of Chrome

Plan to Fix

Under Consideration

Pulse Bug

PRS-394703

Impact

After upgrading to macOS 11.0 (Big Sur), Host Checker will fail macOS HDD Encryption compliance check.                                                 

End User Symptoms

The end user will receive the following error:

"FileVault 10.16 does not comply with policy. Compliance requires drives to be encrypted."

Root Cause

The issue occurs due to volume name changes in macOS 11.0 and above.

Workaround

Upgrade to ESAP 3.7.1+ release.

Plan to Fix

This issue has been addressed in the ESAP 3.7.1 release

Pulse Bug

PRS-395532

Impact

Host Checker policies will fail to pass compliance check and possibly crash when a Predefined Rule: OS Check rule is enforced for macOS Big Sur and the endpoint has upgraded to macOS Big Sur 11.0 and above.               

End User Symptoms

The end user may experience a crash or receive the following error:

'Server has not received any information for this policy.'

Root Cause

Apple changed the version formatting to something different than what the parser was expecting.

Workaround

Upgrade to a future ESAP release or disable the compliance check.

Plan to Fix

A fix is tentatively set for the ESAP 3.7.3 release.

Pulse Bug

Impact

End users may receive Error 1205 "Failed to setup virtual adaptor" when Traffic Enforcement or Lock Down Mode are configured after upgrading to macOS 11.0 and above

End User Symptoms

The end user may receive the following error message:

Failed to setup virtual adaptor. (Error: 1205)

Root Cause

Workaround

Deploy MDM policy payload for configuring web content filter pre-approval:

https://developer.apple.com/documentation/devicemanagement/webcontentfilter

Plan to Fix

The issue occurs due System Extensions are not allowed by default and end user must explicitly approve the Pulse Secure application.  This is as per Apple Design in using System Extensions. If this is not allowed, the virtual adapter will fail to setup.

Pulse Bug