SNX SSL VPN for Macintosh Users: Is there a workaround now that Safari 12 no longer supports Java?

[Chris_Butler]

Safari 12 and above no longer supports NPAPI (technology required for Java applets)

Apple forum post regarding Java and Safari 12

Does this mean that SNX will no longer work for anyone but Windows users with Internet Exporer 11?

Edit:

Called TAC and they can’t seem to give me a definitive answer, and I can’t see much, if any, details in the hotfix sk as to whether this supports Safari 12, and also how it gets around Java Plug-Ins being unavailable.

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Leads me to this link:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

Which says that there isn’t even a released hotfix for 80.20 (contact them for a manual fix of some sort) so it is probably a good thing that we didn’t upgrade yet.

Though it suggests, right after the "Solution" heading, that it is based on a new Mobile Access Portal Agent technology, the requirements section for Mac OS It says it requires the Java Development Kit (JDK) 8u171 to be installed.

I think, if I am not mistaken, your general "do I have Java" download page is only the Java JRE package, right?

So, for the executives in question I will probably need them to bring in their Macbooks so I can do it in person if I want to avoid trouble

I can only guess, given all this, that maybe the hotfix makes Safari download and save a JNLP file and then launch it outside of Safari?

The TAC engineer says they don’t get many calls about Mac and VPN and after conferring with her colleagues seemed to suggest that the hotfix has Safari use ActiveX instead of Java (????)

SNX does that it with Windows / IE 11, so ActiveX doesn’t sound right… 

Anyway, I need some help from someone who can give me a definitive answer as to how to use a Mac with the latest Safari (12) and SSL VPN mobile access, and whether this will have some kind of mainstream support and full documentation soon?

[PhoneBoy]

For any level of support, you need to install the hotfix here: Mobile Access Portal and Java Compatibility - New Mobile Access Portal Agent technology 

Your clients will still need to have JRE installed (version listed in the SK or higher).

It's definitely not using ActiveX--a Microsoft Windows technology--but rather starting a Java Web Start application.

I imagine it will be integrated in the next major version (or a future JHF) but do not know the timelines for this. 

[Chris_Butler]

Thanks Dameon!

Release notes said JDK not JRE, I was curious as to whether that was a different animal. If it is the JRE (which our Mac users definitely update whenever one is available) that means less headaches, as they already will have this pre-req installed.

[Chris_Butler]

Hey Dameon,

Confirmed with my boss over the phone just now after installing the MABDA hotfix, (he's a particularly sharp IT pro so I asked him to give it a go on his Mac), you must locate and install the latest Java Development Kit, not just the usual JRE.

Having other end users bring their Macbooks in after all I guess

Good news is, it works!

[PhoneBoy]

Interesting it requires the JDK, not just JRE.

But I guess the SK is right

[Chris_Butler · Accepted solution]

Hello Again Dameon,

So, I decided that I would paraphrase your answer, include the bit about needing to download the JDK and a link to the Oracle Roadmap for Java SE (which includes the JDK). It is difficult to digest, I am not sure if what they are saying is that come January 2019 we won't be able to use / update the JDK anymore as a Commercial User or not, but if I am going to mark anything as an answer it should be a complete answer.

Dameon Welch-Abernathy wrote:

For any level of support, you need to install the hotfix here: Mobile Access Portal and Java Compatibility - New Mobile Access Portal Agent technology 

Your clients will still need to have JRE installed (version listed in the SK or higher).

It's definitely not using ActiveX--a Microsoft Windows technology--but rather starting a Java Web Start application.

I imagine it will be integrated in the next major version (or a future JHF) but do not know the timelines for this. 

JDK requirement, not just JRE:

Safari 12 (or later) users on MacOS must FIND and download the Java SE Development Kit (JDK)

• When you first attempt to login to the vpn page on a gateway that has had the MABDA hotfix installed, you will get a dialog box with a link to the installer for the MABPortalAgent. This installer will fail and tell you you need to install the JDK.
• It also will say: click here to be taken to the Java SE JDK page, however It does not take you there, It takes you instead to the JRE page.
• At this point, you must search for the Java Development Kit, and hopefully find and install the right one

I used this page and downloaded the Java SE 11 package

• Java SE Development Kit 11- - Downloads 
• It had a warning about changes in the licensing coming up very soon

However, the page I landed on preceding that one includes confusing information about which version to install, end of life and end of support, and commercial users licensing changing in January 2019, etc.

Java SE - Downloads | Oracle Technology Network | Oracle 

I am not sure whether or not VPN access for our Mac users will continue to work after January, and I am not sure whether I should have downloaded the Java SE 8u191 / Java SE 8u192 package instead. All very confusing.

Either way, I installed Java SE 11 JDK and was able to then re-launch the MABPortalAgent installer

Once that completed, the vpn finished connecting and worked.

I wonder if anyone can tell us

1. what will happen with the JDK going forward, as I don't think it has an automatic update reminder mechanism like the JRE,
2. What version and what package SHOULD we be installing,
3. Should we be installing the OpenJDK branch or the mainstream Java SE one?
4. Will the new Mobile Access Portal Agent keep working after January 2019 if you install Java SE 11 as I did?
5. Please refer to the following Oracle White Paper: https://www.oracle.com/technetwork/java/javase/javaclientroadmapupdate2018mar-4414431.pdf 

[PhoneBoy]

The licensing changes should not have an effect on functionality for existing installed versions, only availability of the JDK itself for various purposes.

It's possible OpenJDK will work, but I'm not sure it's tested/supported.

[Chris_Butler]

By the way, JDK and JRE are now behind an Oracle Licensing Login wall.. Looks like we have to find a confirmed OpenJDK distribution and update this post 😞

[PhoneBoy]

OpenJDK 11 and above are supported per: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...