AMP for Mac 1.14 incompatible with other Mac software

[Joshua33489]

We are an Apple Mac shop that uses Cisco AMP for endpoint protection. Cisco just released the new 1.14 endpoint client which will be compatible with macOS 11 (Big Sur) when released, but is also supposed to be backwards compatible with earlier versions of macOS. Unfortunately, there seem to be incompatibilities with other Mac software when installed on macOS 10.15.7 (Catalina). For example, once 1.14 is installed, we can no longer use our email client PostBox (https://www.postbox-inc.com/), The app crashes on launch, across all our computers, every time. If we remove or downgrade to AMP to version 1.12, everything works just fine.

Anyone else seeing anything similar?

UPDATE (12-Nov): Case filed with Cisco (#690297757).
UPDATE (17-Nov): macOS 11 (Big Sur) released. Upgrade seems to resolve the problem. See post below.

[ckuwajima]

We do not use PostBox, but AMP for Mac 1.14.0.794 breaks Bitdefender VPN.

I am still investigating, but it seems to also break Time Machine backups on Time Capsule.

Both, Bitdefender VPN and Time Machine backups works perfectly with AMP for Mac 1.12.7.767 on MacOS 10.15.7.

[Joshua33489]

Interesting.

We are also running macOS 10.15.7 and are continuing to test. We eventually found a work-around for PostBox:

• After booting up, with AMP 1.14 enabled ...
• Disable WiFi (any network connectivity, really),
• Open PostBox in a disconnected state,
• Re-enable WiFi, and all seems OK.

However, if you close PostBox then you have to do this all over again, as it will crash on launch. And as noted above, downgrading 1.14 back to 1.12 solves all these problems directly. 

[DaphneG]

We haven't heard of any incompatibility issue with Mac 1.14.0 yet. Can you check if the necessary extensions and access has been granted: https://www.cisco.com/c/en/us/support/docs/security/amp-endpoints/216089-advisory-for-amp-for-endpoints-mac-conne.html

If you're still having some issues, please open a TAC case and submit a debug log so we can investigate.

[ckuwajima]

Of course, I did grant the necessary extensions and access for connector. The connector itself is working, shows up in console, but IT IS breaking aforementioned applications.

As for TAC case, sorry, I was not able to open, I guess because we are using an evaluation license.

[DaphneG]

The issue could probably be related to the new Network Content Filter extension however we won't be able to confirm or deny without logs. 

Can you reach out to your sales account team? They might be able to open a case for you. 

[Joshua33489]

Going to do it now. 

We have a production license, but the option to open a new case is disabled for some reason. See below. But I suppose that's a separate issue.

 

[ckuwajima]

That's exactly what happens to me. Can't find entitlement to open a TAC case.

[Joshua33489]

Contacted Cisco and learned that our active contract was never associated to any of our Cisco profiles. Got that resolved and was able to submit a case about this issue. @ckuwajima if you have any crash dumps or log files you want me to include in this case, send me a private message with your preferred email address. Other readers on this thread can do the same if you have apps crashing on macOS once you installed the 1.14 client.

[ckuwajima]

Thanks. Did you experience Time Machine backup corruption while using 1.14.0?

[Joshua33489]

We don't use Time Machine for our backup solution so I don't have any data to offer on that front. Sorry. 

[ckuwajima]

I was able to repeat the Time Machine tests with 1.14 and 1.12. I am positive that 1.14 breaks Time Machine backups over the network to Time Capsule with MacOS 10.15.7.

After a while, the Time Machine scan concludes that the backup file is corrupt and asks for creation of a new one.

[Joshua33489]

Thanks @DaphneG,

We also did installs with all the proper extensions enabled, including:

• Authorization for the extensions
• Full Disk Access for the AMP for Endpoints Service
• Full Disk Access for the AMP Security Extension

(I mean, the instructions were almost foolproof -- good on Cisco for that.) We did further testing by disabling the AMP client (right-click in the system tray, select "Quit the AMP for Endpoints Client") but PostBox still crashed. We also did another test where we installed the 1.14 client, but did NOT enable the extra security extensions, and it still crashed the mail client. Only when we do a full uninstall of the 1.14 client does our software work properly again.

Cheers.

[Joshua33489]

Just upgraded a few of our Mac machines to macOS 11 (Big Sur) and PostBox works just fine now. No crashes like before. Therefore, it appears that the incompatibility is only between macOS 10.15.x (Catalina) and the new AMP client 1.14. Not sure if Cisco intended the 1.14 client to be a "universal app" or if macOS 10 users are supposed to stay on version 1.12 until they upgrade. (I should have feedback on my open case shortly.) @ckuwajima, have you upgraded to Big Sur? Still experiencing issues?

[ckuwajima]

Good to know, Joshua. We will keep our Mac machines with Catalina for now. Will wait for a while until we see stability and more compatible apps.

With regards to 1.14.0 connector, the release notes states that it was supposed to be compatible not only with MacOS 11, but also with anything higher or equal to 10.15.5 using system extensions or 10.14 and 10.15.0 through 10.15.4 using kernel extensions.

Therefore, a bug and or compatibility there is, at least with MacOS 10.15.7.

I was able to open a TAC case and we are still in debugging process, no good news for now.