Script to set up Cisco Umbrella Roaming Client on Mac

The command-line installation of the Cisco Roaming client enables you to customize its behavior/appearance during the installation process. For example, you can use various custom parameters to redesign the single/standalone deployment of the Umbrella roaming client on Mac. However, when you want to deploy the Umbrella roaming client or modify its installation on numerous Mac endpoints, performing a command-line installation on each of them can be a gruesome task. Instead, by
executing custom scripts from Hexnode, you can push the configurations for the roaming client remotely. Further, distributing the roaming client to the device from the portal enables seamless mass deployments.

Deploying Cisco Roaming Client through Hexnode

You can remotely install the Cisco Umbrella Roaming client on macOS devices. The automatic installation of the roaming client from Hexnode involves a series of steps:

1. Push the configurations for the roaming client using scripts.
2. Upload the PKG file for the roaming client to the Hexnode app inventory.
3. Install the application on the target macOS devices.
4. Distribute root certificate to the devices.

1. Push the configurations for the roaming client using scripts.

Before configuring the attributes for the roaming client, it is necessary that you download the roaming client on an administrator’s Mac.

1. Log in to Cisco Umbrella.
2. Go to Deployments > Core Identities > Roaming Computers.
3. Select Roaming Client.
4. Click on Download.
5. Choose Download macOS Client.
6. Next, extract the .zip file.

Further, the configurations for the roaming client can be pushed to the devices using scripts. You can deploy all the customizations specific to your organization by modifying the OrgInfo.plist downloaded along with the roaming client ZIP file.

The ZIP file downloaded from the Cisco Umbrella portal consists of:

• OrgInfo.plist file
• PKG file for the roaming client.

The OrgInfo.plist contains the parameter values that can be used for pushing the configurations. For instance, the attribute values specified in this script, such as APIFingerprint, APIOrganizationID, and APIUserID, can be obtained from the .plist file. These values are unique to your organization, and only the privileged users can download the ZIP file for the roaming client.

After customizing the shell script, you can push the configurations to the macOS device directly from the Hexnode console using the Execute Custom Script action.

2. Upload the PKG file for the roaming client to the Hexnode app inventory.

Secondly, add the PKG file for the roaming client to the Hexnode app inventory.

1. Log in to the Hexnode console.
2. Navigate to the Apps tab.
3. Go to +Add Apps > Enterprise App.
4. Choose the app platform as macOS.
5. Provide a suitable App Name.
6. Specify a Category and Description for the app.
7. Choose the PKG file.
8. Click on Add.

3. Install the application on the target macOS devices.

After uploading the PKG file for the roaming client to the Hexnode app inventory, you can install the app on the devices either using the Mandatory Apps policy or Install Application action.

4. Distribute root certificate to the devices.

The advanced Cisco Umbrella features such as Block Page, Block Page Bypass, etc., require the installation of Cisco Umbrella root certificates on the devices. To distribute the root certificate:

1. Log in to Cisco Umbrella.
2. Navigate to Deployments > Configuration > Root Certificate and click Download Certificate.
3. Next, log in to the Hexnode portal.
4. Move to Policies > New Policy. Specify a policy name and description. You may also use the same Mandatory Apps policy configured for the app installation.
5. Go to macOS > Security > Certificates.
6. Click on Add Certificate.
7. Upload the certificate obtained in step 2.
8. Add Policy Targets.
9. Save the policy.

The root certificates installed on the devices avoid specific certificate warnings or related error pages. Though the error pages are expected during browsing, the messages might be ambiguous if the certificate is not installed.