Endpoint Security VPN for macOS Safari 18 compatibility problems

[CzarMark]

We are seeing that Check Point Endpoint Security VPN for macOS appears to suffer compatibility problems with Safari 18. We use Azure for authentication. Azure logs show successful authentications. However, the client stalls for about a minute then fails and displays, “Negotiation with site failed." This occurs in both the recommended version (E88.40) and the latest version (E88.60). The only workaround we have identified is to 1) Change the default browser from Safari to Chrome or Edge; and 2) use version E88.60. We have found that E88.40 ignores the default browser setting and opens Safari anyways. It is not clear what Apple changed in Safari 18. We have tested toggling different privacy settings to no avail. We have replicated the problem and the fix on more than one Mac and on more than one version of macOS (Sonoma 14.7 and Sequoia 15.0). Consequently, we implemented a 90-day deferral on all software updates via MDM until Check Point fixes its broken client.

[PhoneBoy]

Current releases do not support Sequoia.
I suspect this will be addressed in an upcoming release in the coming weeks.

[CzarMark]

Please read posts carefully before replying. This is not a Sequoia issue. Apple is pushing Safari 18 to the three most-recent versions of macOS (Ventura, Sonoma, and Sequoia). For many of your customers, this will break Check Point Endpoint Security VPN functionality on all three.

[G_W_Albrecht]

Please rather read https://support.checkpoint.com/results/sk/sk115192 carefully to know what CP is commited to regarding new versions... Safari 18 would be covered by the disclaimer.

[the_rock]

Someone also mentioned in another post that option 1 you described was indeed the way to make it work.

Andy

[GianniPapetti]

Same here, 

MAC Sonoma 14.7 or Sequoia both with Safari 18 cannot connect to SAML RA VPN.

Chrome works fine.

Mitigation was to first disable CP autoprotection module; change  idp_browser_mode in Trac.default file then reboot the mac client (for ease of use).

Think CP must provide a fix ASAP.

[the_rock]

I believe someone from Israel mentioned last week in a different post that this should be supported in next release. I will see if I can find that post.

Andy

[PhoneBoy]

We just released E88.70 of Endpoint Security/VPN, which supports Sequoia as Early Availability: https://support.checkpoint.com/results/sk/sk182646 
It might also resolve the issues with the latest Safari as well.

[GianniPapetti]

We resolved using E88.x with Chrome.

Will give 88.70 a try.

Regards,

Gianni.

[wiseman]

On my first try, it doesn't seem like 88.70 with Safari v18 on Sonoma is working as advertised -- if anyone else has a different experience, let me know.

Is it possible to configure Checkpoint to use Chrome if Safari is the default browser?  It the idp_browser_mode only supports "default_browser" and "embedded", no?

[PhoneBoy]

I said it "may" fix the issue with Safari, no confirmation of that 🙂

The valid values for idp_browser_mode are listed here: https://support.checkpoint.com/results/sk/sk180395
Chrome cannot be directly specified, but it will work if it's the default browser in the OS.

[wiseman]

Absolutely, I know no-one on this thread has confirmed a solution using Safari v18, but I figured I'd report my own finding and see if anyone else had a different result.  

I'm not inclined to switch my default browser just to resolve this, but I might consider using one of those browser-selector tools to see if that works in the meantime, and we'll see how long it takes for CheckPoint and Apple to find a workable solution. Even if Checkpoint were to give me more options for `idp_browser_mode` so I could select Edge / Chrome just for the VPN sign-on, that might be enough to get me through this blip.

[vulkanino]

Thank you so much! With your instructions the solution worked for me, though I'm concerned for future updates that could break this tricky software.  

[PhoneBoy · Accepted solution]

E89.00 has been released, which should address the issue with Safari 18 and SAML: https://support.checkpoint.com/results/sk/sk182723 

[CzarMark]

Thank you for the update. Unfortunately, testing conducted this week revealed that while E89.00 restores client respect for Safari as the default browser, it does no resolve the SAML issues and popups whatsoever. 

[PhoneBoy]

Did you apply the gateway fix from: https://support.checkpoint.com/results/sk/sk182711 
I believe that's still necessary here.