Configure MFA using Ziti Desktop Edge on MacOs

Ziti Overlay
1

Checking on the steps required for this.. I did have this working in the past.. but have forgotten how to do this.

Steps that I am following are..

1. create MFA posture check

Screenshot 2022-11-06 at 9.49.45 pm
Screenshot 2022-11-06 at 9.49.45 pm1420Ă—888 47.2 KB

2. Link the posture check to a service policy

Screenshot 2022-11-06 at 9.52.07 pm
Screenshot 2022-11-06 at 9.52.07 pm1876Ă—472 31.1 KB

  1. Active the MFA check on Ziti Desktop Edge

However.. when I get to this stage.. I don't have any options to setup the MFA..

any tips on how to do this?

Screenshot 2022-11-06 at 9.52.39 pm
Screenshot 2022-11-06 at 9.52.39 pm1656Ă—750 92.6 KB

2

What version of the Mac client are you running? It looks like you need to update it to the latest. It’ll be obvious when you do. There’ll be an mfa toggle in the upper right

3

I am using Version 2.24 (458).

I thought so… but for some reason… its not showing up.

Is there a change I need to make to an identity that I am missing?

4

You don’t see this toggle in the upper right?
image

5

in version 2.22, MFA support could be toggled on/off in the ZDE advanced settings (the gear icon in lower left corner). In versions 2.23 and 2.24 the MFA button you see in Clint’s screen shot should always be there. Can you try quitting and re-starting the app (and double checking the version from the About dialog)?

6

Just tried again… I must be doing something wrong

Screenshot 2022-11-07 at 9.13.46 pm
Screenshot 2022-11-07 at 9.13.46 pm1892Ă—1392 213 KB

Screenshot 2022-11-07 at 9.14.58 pm
Screenshot 2022-11-07 at 9.14.58 pm582Ă—668 94 KB

Any more tips on how to fix this?

7

It’s almost like the UI is stale. If you can force quit it maybe it’ll reload. Probably need @smilindave26 on this one. I don’t have enough Mac skillz to be tons if help unfortunately

1 Like
8

I just upgraded the MacOS over the weekend… not sure if that is causing an issue?

9

This is very strange. Is it possible that the ZDE app is running twice (e.g., do you see double icons for Ziti in your task bar or menu bar)?

If you go to the App Store page, does Ziti Desktop Edge still show as available for update or download?

As a final resort, try this:

  • make sure Ziti is disconnected (“Turn Ziti Off”)
  • quit the app via “Quit Ziti Desktop Edge” from the menubar
  • verify “Ziti Desktop Edge” and “PacketTunnelProvider” processes aren’t running (you can use Activity Monitor)
  • From Apple’s System Preferences/Network, select “Ziti Desktop Edge” and hit the “-” above the Lock icon (you may need to Unlock first), and make sure to push the Apply button.
  • Go to the App Store and re-install Ziti Desktop Edge
10

Hi All / @markamind,

The issue is one I encountered with MacOS a while back. What you’ll need to do to resolve it is the following:

  1. Disconnect and quit the ZITI Desktop Edge software. No need to uninstall it.
  2. Go into MacOS’ “system settings” and click on “network” for pre-ventura versions or “vpn” for ventura.
  3. Click the “-” icon after selecting Ziti Desktop Edge for pre-ventura versions or the “i” icon for ventura.
  4. Click “remove configuration” for ventura .
  5. Now click ZITI Desktop Edge from your apps and it will ask to reinstall the VPN configuration.

Once all that has been done, you should see the full set of toggles in the ZITI Desktop Edge.

1 Like
11

Perfect… that worked… I needed to remove the VPN connection which cleared the settings :slight_smile:

Thanks

12

You’re welcome! Thanks for asking on behalf of the community.

13

One discovery that I have is the scenario where you lose your mobile device… that will cause you to lose access to your network.

The traditional approach is to rely on back up codes… or migrate the authenticator app to another device.

My preference instead is to simply delete the users identity and have them walk through the re-enrollment process. I find this a much simpler way for users to recover access.

Keen to learn other’s viewpoints about this… as while adding security is good… we also need to have an equally easy way to recover when users lose access

14

One method is self-service by the user, one method requires administrator access. That’s the difference to me. Personally I want to be in control of my own destiny in that way and prefer to have the codes as a stop gap.

15

This will be addressed when the 2.29 Ziti Desktop Edge for Mac release hits the App Store. PR: Show MFA controls regardless of VPN profile setting by smilindave26 · Pull Request #137 · openziti/ziti-tunnel-apple · GitHub