It is very wordy. The process is not complicated, but there are a lot of pieces to making it work properly that have to be done in a certain order.
Basically, you need to create some new profiles that will pre-approve the network extension and socket filtering to suppress the permission prompts on devices, as outlined in steps 5 & 6 under MDM deployment in the guide that you linked.
5.) Configure Content Filter Payload
Jamf requires that the following Team ID and Bundle IDs are added as approved System Extensions. Jamf will also have you approve specific System Extension types. If this is the case, use the same information below to also approve these System Extensions with Network as the type.
- Team ID: ZAGTUU2342
- System Extension Bundle IDs
- com.lightspeedsystems.network-agent
- com.lightspeedsystems.network-agent.network-extension
6.) Configure Content Filter Payload
Jamf will want to configure a content filter payload to pre-approve the security prompts when the Network Extension asks to filter the device. Use the settings below when setting this up.
- Filter Name (found at System Preferences > Network): Lightspeed Agent
- Identifier: com.lightspeedsystems.network-agent
- Filter Order: Firewall (Give this the highest priority setting available)
- When adding, select Socket Filter and use the following values:
- Socket Filter Bundle Identifier: com.lightspeedsystems.network-agent.network-extension
- Socket Filter Designated Requirement:
anchor apple generic and identifier "com.lightspeedsystems.network-agent.network-extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = ZAGTUU2342)
That's it for what's needed for the autoupdate to work successfully.
There is another consideration, however, that you will need to check on: the certificate utilized by Relay for filtering. The autoupdate will NOT renew the CA certificate used by Relay for filtering, so you will need to renew this certificate manually before the expiration date. You would use the create_deploy utility included on the SmartAgent.dmg that you can download from Relay to generate a new root CA and deploy to your fleet. By doing this, you will also need to re-deploy the necessary ETC files needed by the root CA. This can be done automatically with Lightspeed's new utility agent, also included on the .dmg. Please look at the Generate Certificate section of the documentation you linked for the steps on this.
Again, basically, you will use the create_deploy to generate the certificate and deployment files needed. Upload the new certificate to Jamf and deploy to fleet (this can be in a new profile deployed alongside your existing Relay certificate, the old one will be used until the other files are replaced and the services restarted). Upload the deployment_jamf.plist to a configuration profile, deploy to fleet. Once the profile is on the device, have a policy to install the LightSpeed utility agent. This will create the support files needed by the new CA, copy them to the ETC folder (overwriting the existing files), then restart the services to use the new files.
Test, test, test, and test some more to make sure everything works as intended before deploying anything to entire fleet.
