Skip to main content

Check out Interactive Visual Stories to gain hands-on experience with the SSE product features. Click here.

Skyhigh Security

Deploy Skyhigh Client Using Jamf

  1. Last updated
  2. Save as PDF

This topic details how to deploy Skyhigh Client using Jamf.

User consent is required to load any third-party system extensions (for products using network extensions on macOS). As Skyhigh Client macOS 5.0.0 uses a couple of Network System Extensions for network events, prior approval of the following is required:

  • Network Extension Transparent Proxy
  • Content Filter Configurations
  • Network Extension Packet Tunnel Provider

Jamf is a third-party MDM tool used for device management. You can install Skyhigh Client via Jamf.

Enroll a Device to Jamf

You can enroll a device into Jamf using the URL and an administrator login.

  • After the application deployment is set up, you can enroll a device by invoking a URL on the device and logging in as an administrator. 
  • You must turn on the user-initiated enrollment for iOS devices in the Jamf console. The enrollment URL is the following website: https://xyz.jamfcloud.com/enroll/ , where xyz is the URL portion provided by Jamf. 

NOTE: Ensure that the URL link consists the prefix https or the URL may not load in a browser.


To enroll a device in Jamf:

  1. Navigate to the https://mfepsdev.jamfcloud.com/enroll/ URL. 
  2. In the Assign to user field, enter Jamf login credentials.
  3. Skip over the Select the site to use for enrolling this computer or mobile device.
  4. Click Enroll.
    The Notice window displays.
  5. Click Accept to continue:

    1.png
     
  6. Click Continue to Install CA certificates.
  7. Click Download.
  8. You need an MDM profile for your organization for enrollment. Click Continue.
  9. Navigate to Privacy & Security > Profiles > MDM Profile.
  10. Click Install to install the downloaded configurations:

    clipboard_ecfd3c540557706c894842a56bf51bba0.png

    Profiles are installed. 

  1. From the main menu, In the Jamf dashboard, navigate to Computers.
    A list of all the managed accounts via the     Jamf accounts displays.

Create Profiles

To install Skyhigh Client, create a profile for System Extension, Content Filter, and App Proxy Filter and push these packages to the selected devices:

  1. Navigate to the Jamf dashboard.
  2. Click  New to create a new profile. 
  3. In Content Management, click Configuration Profiles.
  4. Navigate to Options tab and select General.
  5. In the Name field, enter the name of the profile . 
  6. In the Description field, enter the purpose of the profile.
  7. From the Site drop-down list, select the site to add the profile.
  8. From the Category drop-down list, select a category to add to the profile.
  9. From the Level drop-down list, select the level at which the profile is applied:
  10. Click the Save button to save the profile details:

    3.png

    The profile is created.

Install the Skyhigh Client

To install the Skyhigh Client, create profiles for System Extension Payloads, Content Filter Payload and App Proxy Filter Profiles and push these packages to the selected devices:

  1. Create Profiles.
  2. Update the following profiles:
    • System Extension Profile
      • Allowed System Extensions
      • Removable System Extensions
    • Content Filter Profile
    • App Proxy Filter (VPN) profile
      • VPNprofile
      • Packet Tunnel profile
  3. Install and uninstall SC using the following Profile settings: 

System Extension Profile

To configure a System Extension Profile:

  1. Navigate to Configuration Profiles and click the Options tab.
  2. Select System Extensions to define settings for system extension.
  3. Click Configure:

    4.png

 

Allowed System Extensions

To configure the allowed system extensions:

  1. From the System extension types drop-down list, select Allowed system extensions.
  2. In the Team identifier field, enter team identifier.
  3. Under the Allowed System Extension section, select the applicable system extension.
  4. Configure the following System Extension Profile:
     

    Property

    Value

    Allow users to approve system extensions

    		 Uncheck/disable
    Allowed Team IDs and System Extensions  
    Display Name System_extensions_allowed

    System Extension Types

    Allowed System Extensions

    Team Identifier

    W6824P2V89

    Allowed system extensions
    • com.skyhighsecurity.epclient.networkextension
    • com.skyhighsecurity.epclient

     
  5. Click Save to save the changes:

    Allowed.png
     
Removable System Extensions

To configure the removable system extensions:

  1. From the System extension types drop-down list, select Removable system extensions.
  2. In the Team identifier field, enter team identifier.
  3. Under the Removable System Extensions section, select the applicable system extension.
  4. Configure the following System Extension Profile:

     Profile

    Settings

     

     

     

     

     

     

     

     

    System Extensions Profile
    1. Add System Extensions Profile.
    2. Configure following:

    Property

    Value
    Removable Team IDs and System Extensions  
    Display Name System_extensions_removal
    System Extension Types Removable System Extensions
    Team Identifier W6824P2V89
    Allowed system extensions
    • com.skyhighsecurity.epclient.networkextension
    • com.skyhighsecurity.epclient

     

     

  5. Click the Save button to save the changes:


5.png

 

Create a Content Filter Profile 

To create a content filter profile:

  1. Navigate to Configuration Profiles and select the Options tab.
  2. Select Content Filter.
  3. Enter the Filter name and Identifier. 
  4. Enter details from the Content Filter Payload:

    6.png
     
  5. Select Payload details from the table below and fill in the fields:
     Profile  Settings

     

     

     

     

     

     

    Content Filter Profile

    1. Add Content Filter Profile.

    2. Configure following:

      Property

      Value

      Filter Sockets (Socket Filter)

      True

      Plugin Bundle ID (Identifier)

      com.skyhighsecurity.epclient
      Filter Packets (Network Filter)
             		 False
      Filter Data Provider Bundle Identifier (Socket Filter Bundle Identifier) com.skyhighsecurity.epclient.networkextension
      Filter Type Plug-in
      Filter Data Provider Designated Requirement (Socket Filter Designated Requirement) anchor apple generic and identifier "com.skyhighsecurity.epclient.networkextension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = W6824P2V89)

  6. Add Content Filter Profile.

  7. Click Save to save the changes.

Configure the VPN Profile

VPN Profile have two payload configuration to be added: 

  • Packet-tunnel
  • App-proxy
Packet-tunnel Payload

To configure the Packet-tunnel Payload:

  1. Navigate to Configuration Profiles and select the Options tab.
  2. Select VPN:

    7.png
     
  3. Configure with the following Packet-tunnel Payload settings and fill in the fields:

 

 

 

 

 

 

 

 

 

 

 

Packet-tunnel Payload

You can use the following Proxy payload for the approval of the extension Packet-tunnel components (VPN Payload):

  1. Add VPN of type Packet-tunnel

  2. Configure the following:

    Property

    Value

    Connection Name

    		 VPN Network Connection

    VPN Type

    VPN

    Connection Type

    Custom SSL

    Identifier

    com.skyhighsecurity.epclient

    Server

    localhost

    Provider Bundle Identifier

    com.skyhighsecurity.epclient.networkextension

    User Authentication

    Certificate

    Provider Type

    Packet-tunnel

    Include All Networks

    False (unchecked)

    Exclude Local Networks

    False (unchecked)

    Provider Designated Requirement

    		 anchor apple generic and identifier "com.skyhighsecurity.epclient.networkextension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = W6824P2V89)

    Enable VPN on demand

    False
    Prohibit users from disabling on-demand VPN settings False
    Idle Timer Do not disconnect

 

App-Proxy Payload

To configure the App-Proxy Payload:

  1. Navigate to Configuration Profiles and select the Options tab.
  2. Select VPN:

    7.png
     
  3. Configure with the following settings for App Proxy Payload:
     

 

 

 

 

 

 

 

 

 

 

 

App-Proxy Payload

You can use the following Proxy payload for the approval of the extension Proxy components (VPN Payload):

  1. Add VPN of type App-Proxy

  2. Configure the following:

    Property

    Value

    Connection Name

    		 VPN proxy Connection

    VPN Type

    VPN

    Connection Type

    Custom SSL

    Identifier

    com.skyhighsecurity.epclient

    Server

    localhost

    Provider Bundle Identifier

    com.skyhighsecurity.epclient.networkextension

    User Authentication

    Certificate

    Provider Type

    		 App-Proxy

    Include All Networks

    False (unchecked)

    Exclude Local Networks

    False (unchecked)

    Provider Designated Requirement

    		 anchor apple generic and identifier "com.skyhighsecurity.epclient.networkextension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = W6824P2V89)

    Enable VPN on demand

    False
    Prohibit users from disabling on-demand VPN settings False
    Idle Timer Do not disconnect

 

  1. Navigate to the Scope tab to specify the target user and target computers.
  2. In the Target Computers field, select Specific Computers and in the Target Users field, select Specific Users: 

    8.png
     
  3. Click Save. 
    Profile is saved to your managed device.

Deploy SC using Self Service

To deploy Skyhigh Client using self service:

  1. Navigate to the Jamf server at https://mfepsdev.jamfcloud.com, then select Full jamf pro from the drop-down list to get all the features.

  2. Navigate to Content Management > Policies > New > General. Use the respective Site from the drop-down list and select the required Category.

  3. Under to the Options tab, click Packages.

  4. Add the Skyhigh Client package you wish to install.

  5. From the Actions drop-down list, select Install.

  6. Under the Scope tab, select target computer and target users.

  7. Add the machine you want the Skyhigh Client to be installed.

  8. Ensure to add the below configuration to display in the Self Service portal (in the above policy).

  9. Navigate to the client machine and open Self Service from Application, select to install the configured package:

    9.png
     

NOTE: On VPN Status modifications, the system settings pop-up displays the following message: VPN is trying to modify your system settings. Upon cancelling the pop-up, any of the functionalities are not affected.  

 

 

Uninstall Skyhigh Client 

A prompt appears for entering the admin credentials to uninstall the system extension for both Skyhigh Client standalone and managed with Trellix ePO. If no credentials are entered or incorrect credentials are entered, the Skyhigh Client removal does not continue. Provide correct credentials for successfully uninstalling new Skyhigh Client. For an MDM-managed system, no admin credentials are required. Jamf has provided a configuration profile through which the new Skyhigh Client can be silently uninstalled from the device without the user's intervention.

 

  1. Back to top
  • Was this article helpful?

Recommended articles

  1. Article type
    How-to
  2. Tags
    This page has no tags.