Thread Info
  • State Suggested Answer
  • Replies 4 replies
  • Answers 1 answer
  • Subscribers 6 subscribers
  • Views 11569 views
  • Users 0 members are here
Options
Suggested

Is anyone aware of issues with the Sophos system extension causing issues with connectivity while on VPN

Michael Callahan

I didn’t see this in the list of known issues, so I wanted to see if anyone else has come across this. Recently , we have begun deploying the EAP client to a small number of machines to start our BigSur upgrade testing. After upgrading the agent and OS to BigSur the sophos system extension looks to be conflicting with the Cisco Anyconnect sys extension. We are seeing problems with internet connectivity, reaching streaming services etc while connected to the VPN. Removing the Sophos agen Just wanted to see if anyone else has had a similar issue or if this is something Sophos is aware of.

Parents
  • 0

    Hi ,

    Thanks for the feedback and apologies about the difficulties you're having.

    We are aware of the issue, unfortunately it's an incompatibility between between 2 Apple APIs that the products are using (NEFilterDataProvider and NETransparentProxyProvider). This has been seen to affect websockets implemented using NSStream or CFStream, so far we have seen that this can affect Safari but Chrome appears to be unaffected. Other apps that implement websockets in similar ways may also encounter the issue.

    We have providing feedback to Apple and other developers have reported the issue to Apple too.

    In the meantime we can suggest trying a temporary workaround of disabling the features that rely on the network extension. This will leave file based protections in place.

    In the central amend, or create new, policies to disable:

    • Threat Protection

        • Real-time Scanning - Internet

          • Scan downloads in progress
          • Block access to malicious websites
        • Remediation
          • Enable threat case creation
          • Protect network traffic
    • Web Control
      • Disable Web Control 

    Once the features are disabled rebooting the machine will ensure the network extension is not loaded.

    Give that a try and let us know how you get on.
  • 0 in reply to David Lancaster

    Great, thank you for the response. We'll give that a try and update you

  • 0 in reply to Michael Callahan

    I'm pleased to say that macOS 11.2 appears to have fixed the problem. The team tested with Cisco AnyConnect v4.9 and with a custom own NEFilterDataProvider on macOS 11.2 and have confirmed web sockets worked correctly.

Reply Children
Unfiltered HTML