VPN Configuration prompt (OSX)

Overview

When installing or using the standalone roaming client software for OSX computers, a prompt appears asking users to allow or don't allow a VPN configuration. Select Allow to enable IP Layer Enforcement.

 

Known UI Issue:

 

Cause

This user prompt is triggered by Apple's System Integrity Protection feature, which is a part of OSX as of version 10.11 or newer when IP-layer Enforcement is enabled for roaming devices.

 

Note:

The popup does not occur on install of the roaming client, it's triggered when the VPN is dialed for the first time

 

For IP-layer enforcement to function, a IPSec VPN tunnel is established. Apple's SIP protection is meant to give more controls to the end user and this message is the systems way of saying: "This new program is trying to manage your VPN connections, are you ok with that?"

 

More information on SIP can be found on Apple.

 

Solution

This prompt is a one-time click to accept, per user. After the connection is allowed, the message will not return.

If a full silent deployment is required, turning off the IP-layer enforcement feature will allow the client to install and startup without this prompt appearing to the users. Although this will not stop the prompt from appearing later on if the feature is turned back on.