@JarvisUno Hello. Is this because you are pushing out a Kernel Extension for a app which needs a System Extension? Big Sur uses System Extensions now. Cisco has a website about enabling System Extensions for AnyConnect
I am in the process of converting all my Kernel Extensions over to System Extensions for apps like Team Viewer, FireEye, AnyConnect to name a few.
Hi there - does anyone have a completed working Cisco AnyConnect system extension Configuration Profile created for macOS Big Sur? I'm sure this can be done with 1 config profile to apply to a computer.
I'm trying to create one using the AnyConnect_macOS_BigSur_Advisory.pdf that they provide but i'm not sure i'm setting it up correctly.
For macOS prior to Big Sur i have the approved kernel extension with team id that has worked with no issues 10.14/10.15, now with System Extensions for Big Sur i'm prepping for Cisco AnyConnect 4.9.04xxx
I'v included some images of my preliminary System Extenstion settings along with the Cisco information that is in the pdf.
I added the Web Content filter section to the Config Profiiles system configuration settings but I am not sure where to put that data the the Cisco pdf displays.
I had the Cisco Anyconnect Kernel extension installed on Mojave and it worked fine and then I did an in place upgrade to Big Sur and once the new macOS version was picked up by RECON a system extension configuration profile for Cisco Anyconnect was applied, but it now has that ATTENTION REQUIRED popup (just like this posts topic) telling me the AnyConnect system extension blocked.
So even though the System Extension is now applied to Big Sur it doesn't matter since Cisco Anyconnect was installed before the system extension was applied??????
is this how it works??? system extensions have to be configured before the application gets installed??
if done the other way around you will be prompted to 'allow'??
The configuration profile MUST be installed BEFORE the system extension is installed. A config profile cannot retro approve a SysExt as it could a kext. This is Apple's design. If done the other way around you will be prompted to approve, yes. If the config profile is in place and AnyConnect was already there you can also uninstall and reinstall. Highly suggest the profile is scoped to ALL machines that are UAMDM/Supervised no matter the OS version so it is in place before an upgrade causes issues such as this.