Overview

This document provides instructions for downloading and installing the Cisco AnyConnect VPN client after the release of macOS Big Sur. Big Sur is macOS 11.0. and now requires users to open security preferences when installing Cisco Anyconnect. This step is required with changes to macOS security.

Cisco AnyConnect Socket Filter

Appendix:AnyConnectChangesRelatedto macOS11(BigSur) YoumustberunningAnyConnect4.9.04xxx(orlater)formacOS11.ItleveragestheSystemExtension frameworkavailableinmacOS.

1. After installing Cisco AnyConnect, click Open Security Preferences when the System Extension Blocked pop-up appears.
   
2. Click Allow when the Security & Privacy window opens.
   

AnyConnect 4.9.04xxx leverages the System Extension framework available in macOS 11 (Big Sur). This differs from past AnyConnect versions, which rely on the now-deprecated Kernel Extension framework. This is the minimum version required to run AnyConnect on macOS 11. MacOS Recommended Version 10.14 Mojave or newer - see below for more details) Windows; Linux; VPN Software Version. As of December 7, 2020, the current versions of the Cisco VPN client are as follows: macOS 4.9.04043 (for Big Sur, 11.0) 4.9.03047 (Catalina, 10.15) 4.9.00086 (for Mojave, 10.14) Windows 4.9.00086 for Windows 10 desktop and laptop. Download and Configure the VPN Client Locate and install Cisco AnyConnect from the App Store. Open the installed application. Select Connections, then Add VPN Connection. Staff, faculty, students, or sponsored affiliates should enter umvpn.umnet.umich.edu as the Server Address in the Connection Editor. A new version of Cisco AnyConnect Mobility Client is now available to support macOS Big Sur (macOS 11). Cisco AnyConnect is used to access McGill's virtual private network (VPN), which allows you to connect from home or off-campus to protected internal resources, such as the uPrint system, Workday, Banner and desktop computers on campus.

Note: Enabling this system extension is required. This action will only need to be taken when AnyConnect is first downloaded.

Big Sur is here and there is a lot of changes under the hood. One of them is the switch from Kernel Extensions to System Extensions. It has been a while since the Kernel Extensions are deprecated but now, time is over, they are not supported anymore.

So as a Jamf admin, you’ll have to do some changes if you have already allowed some kernel extensions, for example for an antivirus or VPN.

Let’s see how we can allow these system extensions, and avoid popups like this to your users.

Here we have a Configuration Profile, used to allow Cisco Anyconnect VPN on a macOS 10.15

As you can see, I’ve just provided the Team ID and it was good. But with Big Sur, it’s not enough. You’ll have to give the exact name of each System Extension. Here is the macOS 11 version of the same CP :

As you can see, I had to provide the full name of the allowed System Extension. But how do we find it ?

Cisco Anyconnect Client Download Macos Big Sur

You can use this spreadsheet, filled by the community. But, as everyone can edit, you can’t be sure the data are accurate. And as you should not have to do it more than one or two times a year, I recommend to use the manual way.

Cisco Anyconnect 4.9.01095 Download

First, on a test Mac, install the software and approve manually the System Extension. Then open a terminal and type

Macos Big Sur Release Date

Here we have the name of our System Extension that you’ve allowed before. You can now fill your Configuration Profile with the informations needed. Be careful to choose System Extension and not Approved Kernel Extensions.