Content Filtering & Network Issues on macOS Sonoma

With the release of macOS Sonoma and its wider adoption, we have observed an issue where the devices seem to loose network connectivity when Content Filtering is applied or the policy is changed. Here is a brief description of the issue.

Issue

1. Enabling the Content Filtering for the first time results in some apps not working/not being able to connect to internet

   1. We have seen App Store, Slack, Google Chrome and curl command from Terminal not working, but this problem might be seen in other apps

2. Applying Content Filtering settings set to Limit Adult websites results in some apps not working/not being able to connect to internet

   1. We have seen App Store, Slack, Google Chrome and curl command from Terminal not working, but this problem might be seen in other apps

3. Disabling Content Filtering once it was enabled previously also results in some apps not being able to connect to internet.

4. Please note that, as per our observation, Safari browser continues to work in most cases

Impacted devices

Potentially any device upgraded to macOS Sonoma is impacted

Root Cause

After due debugging and analysing we have observed that it is the content filtering setting that triggers the issue. With Sonoma, though it is undocumented, the device needs to be rebooted once for the settings change to take effect and update the network stack to be fully operational.

Solution

In the absence of any clear guidelines from Apple or the Apple MDM protocol, there is no clear guidance, however basing on our observations we have deduced the following,

1. The Content Filtering Settings need to be sent regardless of whether the option is enabled or not

2. If the Content Filtering setting is disabled, then the MDM payload should be sent as false for restrictWebAccess key and if it is configured then it has to be sent to true.

Based on our observations and testing, we have made the required changes in our solution, so that the devices receive the correct settings. The devices would receive the appropriate settings based on your configuration the next time they sync with our backend servers.

Also, please note that if the Content Filtering settings are changed or edited, then the end users will have to reboot/restart their devices.

Remedying Impacted devices

As a result of the solution that we have added, OR if you have recently made changes to Content Filtering settings, then you may observe that macOS devices running Sonoma are loosing internet connection. In the event, such behavior is observed then we recommend Rebooting/Restarting the devices. A reboot/restart has been found to apply the settings properly.

Hence, the remedy for impacted devices or changes to the content filtering settings, will require the devices to be restarted/rebooted.

Conclusion

We completely understand the inconvenience that this issue may have caused, and apologise for the negative impact it may have had on operations. However we can assure you, that we have extensively tested the behavior and have consistently tried to expedite the solution.

If you are observing issues related to network and don’t use any third party network filtering solutions or observing that the content filtering setting is still causing issues, please do the following,

1. On an effected devices, please open a Terminal window and run the following command

   1. sudo /usr/bin/profiles list -output stdout-xml > ~/Desktop/Profile.txt

   2. This will copy all the policies currently applied to a file called Profile.txt on the Desktop

2. Please reach out to support@scalefusion.com and share the Profile.txt for further investigation.

Please note that if you are using 3rd party content filtering or network filtering or VPN solutions, then Scalefusion may not be able to provide technical support of issues arising due to such solutions.