BigSur EAP - Compatibility with Zscaler client

Hi Nicholas,

I'm genuine sorry to hear about your issues, I understand how frustrating this can be - we have struggled with some compatibility issues with VPN clients ourselves. We are aware of an API issue in the OS that caused compatibility problems with other network extensions but from our testing and other users' feedback we believed they were fixed in Big Sur 11.2

We would love to investigate your issue more, could you please provide us with an SDU from an affected machine?

You can upload this as follows:

Hi Nicholas,

I'm genuine sorry to hear about your issues, I understand how frustrating this can be - we have struggled with some compatibility issues with VPN clients ourselves. We are aware of an API issue in the OS that caused compatibility problems with other network extensions but from our testing and other users' feedback we believed they were fixed in Big Sur 11.2

We would love to investigate your issue more, could you please provide us with an SDU from an affected machine?

You can upload this as follows:

Hi David,

Thank you for the prompt response. I had to exit Zscaler to be able to access the internet and trigger the SDU.

This is the SDU: edbe1689-3e69-f423-6865-32865592a6a9_2021-02-11-22-52-40.zip

The problem is that Zscaler fails to fully start and it is going through repetitive connect/disconnect cycles which makes accessing the internet nearly impossible.

If you have a look at the device crash reports you can see loads of issues with Zscaler, almost every other minute and in the end the Sophos network extension crashed my device...

Hi David, Can you please let me know if you were able to get what you wanted out of the provided SDU? The challenge that we have here is that we need to either stop Zscaler or remove Sophos to get a device connected to the internet and to get the SDU. Is there a way to generate one from the device itself when the issues occur? Maybe we can build a more complete picture using this approach?

Another important aspect that I have seen of the devices running Big Sur is the need to do SMC resets as their passwords to make changes to the system was no longer working... To make changes to Privacy and Security settings you have to "unlock" the config mode and the passwords were not recognised/accepted. To fix this I had to advise my colleagues to do SMC resets and in some instances even to reset the passwords....

The interesting part is that these were reported shortly after Sophos was installed...

Hi Nicholas,

The SDU can be run locally, while Internet access is unavailable, using the following instructions:

1. From the Sophos GUI, click About (lower right)
2. Click Run Diagnostic Tool
3. Click "Launch SDU..."

Once an SDU is generated, you can private message me with your SDU and I'll have it analyzed.

Also, are you using Zscaler Client Connector 1.5 (or later)? If so would you mind following the instructions provided here: Enabling Packet Capture for Zscaler Client Connector to collect the packet capture for us to analyze?

Thank you for on going feedback and I'm very sorry to hear about the continued issues. I assure you, we're working hard to understand what's going on and to come up with a fix.

Regards,

Eric

Thank you Eric. I was able to find and generate a local SDU. Unfortunately, I have not heard back any encouraging news on the issue reported here. My devices have not updated yet to 10.0.4 but from other people comments it does not seem this has added any changes to the issues when it comes to clashes with other VPN's ...

Hi Eric, I can run a diagnostic locally and happy to do this when required.

Regarding Zscaler, we are using version 2.2.4 on our Mac devices. The issue was reported on most devices that have been updated to BigSur once the system extensions were installed and activated.

Currently, we have to run with the custom policy that blocks the culprit extension to load as advised by your colleagues.

As mentioned to David and Richard I am happy to demonstrate the issues on a remote session as this is a big problem for us as both solutions should run without impacting each other. I'll prepare a packet capture as advised and I can share this with you.

Hope this helps,

Nicholas

Hi Nicholas,

Thank you for the feedback. We would like to take you up on the offer of a remote session to diagnose the problem. I'll DM and coordinate with you on that effort.

Regards,
Eric

Was there any resolution to this? We're having the exact same issue. Happy to also provide logs and/or remote sessions.

hi Arjun, so far I do not have a resolution for this. I am using a dedicated policy to block this extension from the BigSur devices as it is rendering them unusable. I am waiting to confirm a remote session to demo the issues on one of my devices as I do not believe the team at Sophos have access to Zscaler....

Would you mind sharing the policy?

Hi Arjun, you can find it in this ticker, prepared by David Lancaster from Sophos

community.sophos.com/.../10-0-3-sophos-network-extension-process-using-150-cpu