Config Profile and Crowdstrike

ckreher
New Contributor

I am currently testing Crowdstrike to be deployed to our Macs in our environment and running into an oddity.  I have the config profiles created (one for Apple Silicon, one for Intel) and once applied to a computer, I get a weird network issue.  Hopefully I can explain this clearly.  I have Jamf open in a Safari tab apply the config profile to my same computer, verify it completes by opening Log.  I then open a second tab and attempt to open any website and it never will load the page (at least in a reasonable amount of time) but generates no error.  The tab that Jamf is open in works for the Jamf console, but you can't navigate to any other website.

I can either restart the computer or kill my network connection (in this case wifi) and it resolves the network issue.  I am still WFH so I can't test a wired connection.  I see no documentation that indicates this config profile needs a reboot.

As of today, we only run Crowdstrike on our Windows Servers and our Mac machines have Cisco Secure Endpoint but Cisco can't seem to produce a working client for a Mac so leadership has tasked me with seeing if Crowdstrike can be used.

Anyone seen this behavior before?

 

7 REPLIES 7

ckreher
New Contributor

I should point out the issue is only with Safari. If I open Chrome or Firefox while Safari is in this odd state, Chrome and Firefox work as expected.

 

sdagley
Esteemed Contributor II

@ckreher I've never seen the behavior you describe, but I'd suggest checking your CrowdStrike console logs any firewall rules being applied to the Mac you're seeing this issue with. My org is in the process of rolling out CrowdStrike after a lengthy evaluation period, and I have been very impressed by low impact of the Falcon agent on Macs.

gachowski
Valued Contributor III

I would double check the profiles the Web Content Network filter is tricky to get right. : ) and I'm not 100% sure the CS directions are 100% accurate. I know in the past you could download one from CS support pages. : ) 

 

C

sdagley
Esteemed Contributor II

@gachowski The current recommendation from CrowdStrike is to follow their KB article on building the profile in the Jamf Pro console (it shows every step needed)

ckreher
New Contributor

I followed Crowdstrike's recommendation for building the config profiles.  Again, I am only seeing this behavior in Safari.  Firefox and Chrome work as expected.

KyleEricson
Valued Contributor II

Crowdstrike should have these MDM profiles prebuilt you can download from the CS console.

Read My Blog: https://www.ericsontech.com

sdagley
Esteemed Contributor II

@KyleEricson The current recommendation from CrowdStrike is to follow their KB article to build the profile in the Jamf Pro console (it shows every step needed)