topic Re: AMP for Mac 1.14 incompatible with other Mac software in Endpoint Security

AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Tue, 17 Nov 2020 15:27:39 GMT

We are an Apple Mac shop that uses Cisco AMP for endpoint protection. Cisco just released the new 1.14 endpoint client which will be compatible with macOS 11 (Big Sur) when released, but is also supposed to be backwards compatible with earlier versions of macOS. Unfortunately, there seem to be incompatibilities with other Mac software when installed on macOS 10.15.7 (Catalina). For example, once 1.14 is installed, we can no longer use our email client PostBox (https://www.postbox-inc.com/), The app crashes on launch, across all our computers, every time. If we remove or downgrade to AMP to version 1.12, everything works just fine.

Anyone else seeing anything similar?

UPDATE (12-Nov): Case filed with Cisco (#690297757).
UPDATE (17-Nov): macOS 11 (Big Sur) released. Upgrade seems to resolve the problem. See post below.

Re: AMP for Mac 1.14.0 incompatible with PostBox mail client

ckuwajima — Sun, 08 Nov 2020 22:09:27 GMT

We do not use PostBox, but AMP for Mac 1.14.0.794 breaks Bitdefender VPN.

I am still investigating, but it seems to also break Time Machine backups on Time Capsule.

Both, Bitdefender VPN and Time Machine backups works perfectly with AMP for Mac 1.12.7.767 on MacOS 10.15.7.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Mon, 09 Nov 2020 10:45:26 GMT

Interesting.

We are also running macOS 10.15.7 and are continuing to test. We eventually found a work-around for PostBox:

After booting up, with AMP 1.14 enabled ...
Disable WiFi (any network connectivity, really),
Open PostBox in a disconnected state,
Re-enable WiFi, and all seems OK.

However, if you close PostBox then you have to do this all over again, as it will crash on launch. And as noted above, downgrading 1.14 back to 1.12 solves all these problems directly.

Re: AMP for Mac 1.14 incompatible with other Mac software

DaphneG — Mon, 09 Nov 2020 18:40:39 GMT

We haven't heard of any incompatibility issue with Mac 1.14.0 yet. Can you check if the necessary extensions and access has been granted: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/216089-advisory-for-amp-for-endpoints-mac-conne.html

If you're still having some issues, please open a TAC case and submit a debug log so we can investigate.

Re: AMP for Mac 1.14 incompatible with other Mac software

ckuwajima — Mon, 09 Nov 2020 18:55:46 GMT

Of course, I did grant the necessary extensions and access for connector. The connector itself is working, shows up in console, but IT IS breaking aforementioned applications.

As for TAC case, sorry, I was not able to open, I guess because we are using an evaluation license.

Re: AMP for Mac 1.14 incompatible with other Mac software

DaphneG — Mon, 09 Nov 2020 19:29:32 GMT

The issue could probably be related to the new Network Content Filter extension however we won't be able to confirm or deny without logs.

Can you reach out to your sales account team? They might be able to open a case for you.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Tue, 10 Nov 2020 04:12:45 GMT

Thanks @DaphneG,

We also did installs with all the proper extensions enabled, including:

Authorization for the extensions
Full Disk Access for the AMP for Endpoints Service
Full Disk Access for the AMP Security Extension

(I mean, the instructions were almost foolproof -- good on Cisco for that.) We did further testing by disabling the AMP client (right-click in the system tray, select "Quit the AMP for Endpoints Client") but PostBox still crashed. We also did another test where we installed the 1.14 client, but did NOT enable the extra security extensions, and it still crashed the mail client. Only when we do a full uninstall of the 1.14 client does our software work properly again.

Cheers.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Tue, 10 Nov 2020 04:15:41 GMT

Going to do it now.

We have a production license, but the option to open a new case is disabled for some reason. See below. But I suppose that's a separate issue.

Re: AMP for Mac 1.14 incompatible with other Mac software

ckuwajima — Tue, 10 Nov 2020 12:05:48 GMT

That's exactly what happens to me. Can't find entitlement to open a TAC case.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Thu, 12 Nov 2020 04:58:30 GMT

Contacted Cisco and learned that our active contract was never associated to any of our Cisco profiles. Got that resolved and was able to submit a case about this issue. @ckuwajima if you have any crash dumps or log files you want me to include in this case, send me a private message with your preferred email address. Other readers on this thread can do the same if you have apps crashing on macOS once you installed the 1.14 client.

Re: AMP for Mac 1.14 incompatible with other Mac software

ckuwajima — Thu, 12 Nov 2020 13:58:04 GMT

Thanks. Did you experience Time Machine backup corruption while using 1.14.0?

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Fri, 13 Nov 2020 03:33:28 GMT

We don't use Time Machine for our backup solution so I don't have any data to offer on that front. Sorry.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Tue, 17 Nov 2020 15:25:46 GMT

Just upgraded a few of our Mac machines to macOS 11 (Big Sur) and PostBox works just fine now. No crashes like before. Therefore, it appears that the incompatibility is only between macOS 10.15.x (Catalina) and the new AMP client 1.14. Not sure if Cisco intended the 1.14 client to be a "universal app" or if macOS 10 users are supposed to stay on version 1.12 until they upgrade. (I should have feedback on my open case shortly.) @ckuwajima, have you upgraded to Big Sur? Still experiencing issues?

Re: AMP for Mac 1.14 incompatible with other Mac software

ckuwajima — Tue, 17 Nov 2020 17:06:13 GMT

Good to know, Joshua. We will keep our Mac machines with Catalina for now. Will wait for a while until we see stability and more compatible apps.

With regards to 1.14.0 connector, the release notes states that it was supposed to be compatible not only with MacOS 11, but also with anything higher or equal to 10.15.5 using system extensions or 10.14 and 10.15.0 through 10.15.4 using kernel extensions.

Therefore, a bug and or compatibility there is, at least with MacOS 10.15.7.

I was able to open a TAC case and we are still in debugging process, no good news for now.

Re: AMP for Mac 1.14 incompatible with other Mac software

ckuwajima — Tue, 17 Nov 2020 17:12:51 GMT

I was able to repeat the Time Machine tests with 1.14 and 1.12. I am positive that 1.14 breaks Time Machine backups over the network to Time Capsule with MacOS 10.15.7.

After a while, the Time Machine scan concludes that the backup file is corrupt and asks for creation of a new one.

Re: AMP for Mac 1.14 incompatible with other Mac software

Joshua33489 — Wed, 18 Nov 2020 04:11:53 GMT

I hear you.

Took us a while to ensure that all of our core apps were Big-Sur-ready before we made the jump. We have some little one-off apps that are not there yet, but all the big ones were updated so we rolled it out to a few of our internal early adopters. AMP was one of the apps on our core list.

Good catch on the release notes regarding earlier versions of macOS. I'll keep the case open and press them on that front then. I was going to suggest, when you next update your case, have them cross-reference with mine (#690297757) and let them know these are likely to be addressing the same issue, but obviously we can't be 100% sure about that. I sent in a bunch of debug files yesterday, so that should keep them busy for a bit.

Cheers!

Re: AMP for Mac 1.14 incompatible with other Mac software

00unnajwlsDLfXzkX5d6 — Wed, 28 Apr 2021 15:32:48 GMT

The collaboration fashion are pretty plenty cloud offerings. WebEx Teams, MS teams. Webex calling services as well as MS group direct routing as you can see here. You need to also if you may hold an eye on matters evolving with Zoom.