Pulse Secure Desktop Client: Always-on

VPN and VPN Only Access

Deployment Guide

Published September 2020

Document Version 5.0

Pulse Secure Desktop Client: Always-on VPN and VPN Only Access

Pulse Secure, LLC

2700 Zanker Road,
Suite 200 San Jose
CA 95134

www.pulsesecure.net

© 2019 by Pulse Secure, LLC. All rights reserved.

Pulse Secure and the Pulse Secure logo are trademarks of Pulse Secure, LLC in the United States.
All other trademarks, service marks, registered trademarks, or registered service marks are the
property of their respective owners.

Pulse Secure, LLC assumes no responsibility for any inaccuracies in this document. Pulse Secure, LLC
reserves the right to change, modify, transfer, or otherwise revise this publication without
notice.

Pulse Secure Desktop Client: Always-on VPN and VPN Only Access

The information in this document is current as of the date on the title page.

END USER LICENSE AGREEMENT

The Pulse Secure product that is the subject of this technical documentation consists of (or is
intended for use with) Pulse Secure software. Use of such software is subject to the terms and
conditions of the End User License Agreement (“EULA”) posted at
http://www.pulsesecure.net/support/eula/. By downloading, installing or using such software,
you agree to the terms and conditions of that EULA.

© 2019 Pulse Secure, LLC.

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access

Revision History
The following table lists the revision history for this document.

Document Version Date Description

5.0 September 2020 Added “System Extensions Support”.

4.0 October 2019 Updated “Prerequisites” and “Related Features”

section.

3.0 July 2019 Added “Updating Pulse Secure Client with New
Connection Set” section.

2.0 May 2019 Initial Publication - 9.0Rx

1.0 December 2017 Initial Publication

© 2019 Pulse Secure, LLC. 3

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Contents
REVISION HISTORY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3

PURPOSE OF THIS GUIDE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

PREREQUISITES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

OVERVIEW . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
ALWAYS-ON VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
VPN ONLY ACCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2
RELATED FEATURES. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

CONFIGURATION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
ENABLING ALWAYS-ON VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
ENABLING VPN ONLY ACCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
ALWAYS-ON VPN AND VPN ONLY ACCESS OPTIONS SETTINGS . . . . . . . . . . . . . . . . . . . . . . . . 8
CONFIGURING LOCK-DOWN MODE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
CONFIGURING LOCK-DOWN EXCEPTION RULES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
CONFIGURING LOCK-DOWN EXCEPTION TYPES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
CONFIGURING LOCATION AWARENESS RULES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .14
SYSTEM EXTENSIONS SUPPORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
ACTIVATING PULSE SECURE SYSTEM EXTENSIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
SYSTEM EXTENSIONS DURING PULSE CLIENT UNINSTALLATION . . . . . . . . . . . . . . . . . . . . 18

UPDATING PULSE SECURE CLIENT WITH NEW CONNECTION SET . . . . . . . . . . . . . . . . . . 19

© 2019 Pulse Secure, LLC. i

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Purpose of This Guide

This guide describes how to configure Always-on VPN and VPN Only Access features on the Pulse Desktop
Client using the Pulse Connect Secure administrator console.

Prerequisites
This guide assumes you are familiar with the use of the following products or documents and their related
terminology.

• Windows Operating System

• macOS Operating System
• Pulse Desktop client
• Pulse Secure Desktop Client Administration Guide

© 2019 Pulse Secure, LLC. 1

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Overview
Always-on VPN
Always-on VPN feature allows the Pulse Desktop Client to establish a VPN connection that is always active, and
all traffic passes through the VPN tunnel. If the VPN tunnel is disconnected, for any reason, the machine has
limited connectivity required to re-establish the VPN tunnel. The feature restricts the users to manually
connect/disconnect a tunnel or disable/uninstall the Pulse Secure service.

The administrator controls and manages all the user activities.

VPN Only Access

VPN Only Access feature is an enhancement to the Always-on VPN feature.

This feature allows the users to connect/disconnect a connection and add/delete a connection.

Note: Delete option is applicable only to the manually added connections.

Related Features
Always-on VPN and VPN Only Access features work well along with the following additional features:

• Lock-down mode: Lock-down mode is applicable to connections where Always-on VPN or VPN Only
Access features are enabled. Lock-down mode prohibits network communication outside the VPN
tunnel when a VPN tunnel is in the process of being created.
Note: “Lock-down” mode is a new aspect of Always-on functionality that was added to 5.2r5 Pulse
Desktop Client for Windows and to 9.0R1 Pulse Desktop Client for macOS.
• Location Awareness Rules: The location awareness rules enable an endpoint to connect conditionally.
If the location awareness rules are not defined, Pulse Desktop Client attempts to connect to each
connection that is defined as an automatic connection until it connects successfully.

For example, you can define rules to enable Pulse Desktop client to automatically establish a secure
tunnel to the corporate network through Pulse Connect Secure when the user is at home, and to
establish a Pulse Policy Secure connection when the user is in the office and connected to the
corporate network over the LAN. Pulse does not re-establish a VPN tunnel when the endpoint re-
enters the trusted/corporate network. Location awareness rules are based on the client’s IP address
and network interface information.

Lock-down mode is intended to use along with Location Awareness rules to ensure that the user is
connected over VPN when the end machine is not plugged in with the corporate network.
• Lock-down Exception Rules: Lock-down exception rules allow the administrator to configure the
rules for which traffic needs to be exempted when Lock-down mode is applied at the user end.

For example, when a Lock-down exception rule is defined for NetLogon, the user can login to the
domain even when Lock-down mode is enabled, and the user is not connected to VPN.

© 2019 Pulse Secure, LLC. 2

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Note: “Lock-down Exception Rules” was added to 5.1R3 Pulse Desktop Client for Windows and to 9.0R2
Pulse Desktop Client for macOS.
• Captive Portal Detection and Enable Embedded Browser: Captive Portal Detection feature helps to
detect if connectivity is hampered by a captive portal. The Pulse Desktop Client then automatically
displays an embedded browser so that the end user can traverse the captive portal to obtain the
network connectivity required to establish a VPN connection.
When the Always-on VPN or the VPN Only Access feature is enabled, the Enable captive portal
detection and Enable embedded browser for captive portal are automatically checked and cannot be
edited.
• Machine Authentication: Machine authentication uses machine credentials (machine name and
password or machine certificate) to authenticate the endpoint. On Windows endpoints, a Pulse client
connection accesses client certificates to provide machine authentication. The certificates are available
in the Local Computer personal certificate store, or in a user’s personal certificate store, or on a smart
card.
Pulse supports the following machine authentication types:
• machine-only—The connection is established using machine credentials when no user is logged
in. The connection is maintained after user login.
• user-after-desktop—The connection is established using machine credentials when no user is
logged in. After user login, the machine connection is disconnected. Once the user logs out, the
user connection is disconnected, and the machine connection is re-established.
For more detailed information on the related features, refer to Pulse Secure Desktop Client Administration
Guide.

© 2019 Pulse Secure, LLC. 3

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Configuration
A high-level overview of the configuration steps to set up Always-on VPN or VPN Only Access feature is shown
below. Click each step to directly jump to the related instructions.

Enabling Always-on VPN

By default, the Always-on VPN option is disabled. There are many possible configuration options within the
Always-on feature.

To configure the Connection Set, use the following steps:

1. Log in to Pulse Connect Secure administrator console.

2. Select Users > Pulse Secure Client > Connections.

3. Click New to display the New Connection set configuration page.

© 2019 Pulse Secure, LLC. 4

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Figure 1 New Connection Set Configuration for Always-on VPN

© 2019 Pulse Secure, LLC. 5

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

4. Select Always-on Pulse Client and complete other Machine Setting configurations as described in
Table 1.

5. Configure the Connections and Lockdown mode exception rules. For more information see,
“Configuring Lock-down Mode” on page 10 and “Configuring Lock-down Exception Rules” on
page 10.

6. Click Save Changes.

Note: Admin can configure Always-on VPN options using wizards also. For more information, refer to
Configuring Always-on VPN Options using Wizards section in Pulse Secure Desktop Client
Administration Guide.
Note: Lock-down mode exceptions rules are not supported for Configuring Always-on VPN options
using wizards for only Mac and All.

Enabling VPN Only Access

By default, the VPN only access option is disabled. There are many possible configuration options within the
feature.

To configure the Connection Set, use the following steps:

1. Log in to Pulse Connect Secure administrator console.

2. Select Users > Pulse Secure Client > Connections.

3. Click New to display the New Connection Set configuration page.

© 2019 Pulse Secure, LLC. 6

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Figure 2 New Connection Set Configuration for VPN Only Access

© 2019 Pulse Secure, LLC. 7

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

4. Select VPN only access and complete other Machine Setting configurations as described in Table 1.

5. Configure the Connections and Lockdown mode exception rules. For more information see,
“Configuring Lock-down Mode” on page 10 and “Configuring Lock-down Exception Rules” on
page 10.

6. Click Save Changes.

Always-on VPN and VPN Only Access Options Settings

The Pulse Connect Secure (PCS) administrator console provides a simplified way to configure the possible
Always-on VPN and VPN Only Access options. Enabling some options restricts or automatically modifies
several other options in the Machine Settings.

Table 1 Machine Settings Configuration

Settings Description When Always-on When VPN Only

VPN is enabled Access is enabled

Always-on Pulse Client Prevents end users from circumventing Enabled; Disabled;
Pulse connections. Editable Editable
This option disables all configuration
settings that allow the end user to disable
or remove Pulse connections, services, or
software.
Default: Disabled
VPN Only Access Prevents any traffic flow through unless a Enabled; Enabled;
Locked-down VPN connection is in Not editable Editable
connected state.
Default: Disabled
Allow saving logon Saves the certificate trust and password Enabled; Enabled;
information information. Editable Editable
Default: Enabled
Allow user connection Allows to add user connections. Disabled; Disabled;
Not editable Editable
Default: Disabled
Display Splash Screen  Displays the splash screen on Pulse Enabled; Enabled;
connection. Editable Editable
Default: Enabled
Dynamic certificate trust  Allows to trust unknown certificates. Enabled; Enabled;
Editable Editable
Default: Enabled
Dynamic connections  Allows devices to automatically deploy Enabled; Enabled;
connections. Editable Editable
Default: Enabled

© 2019 Pulse Secure, LLC. 8

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Settings Description When Always-on When VPN Only

VPN is enabled Access is enabled

EAP Fragment Size  Indicates the maximum number of bytes Enabled; Enabled;
in an EAPoL message from the Pulse Editable Editable
Desktop client for 802.1x connections.
Range: 450 - 3000 bytes
Default: 1400
Enable captive portal Allows the Pulse Desktop client to notify Enabled; Enabled;
detection the end user that a VPN connection Not editable Not editable
cannot be established until the
requirements of a captive portal are
fulfilled.
Default: Disabled
Enable embedded browser Allows the Pulse Desktop Client to use an Enabled; Enabled;
for captive portal embedded web browser for captive portal Not editable Not editable
pages.
Default: Enabled and not editable when
Enable captive portal detection is
enabled.
FIPS mode enabled Deploy Pulse Desktop Client with FIPS Disabled; Disabled;
enabled. Editable Editable
Default: Disabled
Wireless suppression Disconnects all wireless interfaces when a Disabled; Disabled;
wired interface gets connected to a Editable Editable
network.
Default: Disabled
Prevent caching smart card Ensures the smart card PIN value is not Disabled; Disabled;
PIN cached by the Pulse Desktop Client Editable Editable
process.
Default: Disabled

Note: When Always-on Pulse Client is enabled, VPN Only Access option is automatically enabled in machine
settings and cannot be edited.

When Always-on Pulse Client is enabled, the Connection Set and the Connections have the following
effects.

• Impeding the end user’s ability to disconnect or disable VPN connections

• Ensuring that captive portals can still be traversed even when connectivity is locked-down.
• “Always-on Pulse Client” check box does not prevent end users (with administrator privileges) from
stopping endpoint services (the Pulse Secure Service and the Base Filtering Engine (BFE)) which are
required to establish the VPN connections.

© 2019 Pulse Secure, LLC. 9

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Configuring Lock-down Mode

To enable Lock down this connection option, follow the below steps:

1. On the Pulse Connect Secure administrator console, select Users > Pulse Secure Client >
Connections.

2. Click a Name and select a connection from the list of Connections.

For example, use a Connect Secure L3 connection for a Layer 3 connection to Pulse Connect Secure.

3. Select the Lock down this connection option to disable network access when VPN is enabled until
connected.

4. Under Connection is established, select the mode. By default, user is selected.

5. Create Location Awareness rules. See “Configuring Location Awareness Rules” on page 14.

6. Click Save Changes.

Figure 3 Lock-down Connection Mode

Note: Administrator can enable Allow user to override connection policy only when VPN Only
Access is selected.

Configuring Lock-down Exception Rules

Lock-down exception rules section is enabled by selecting Always-on Pulse Client or VPN Only Access options.

From 9.0R2 release onwards, administrator can also select the platform from ‘Platform’ tab.

© 2019 Pulse Secure, LLC. 10

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

In the New Configuration section, administrator can add Lock-down mode exception rules for Windows and
for 9.0R2 release onwards for macOS. Administrator must configure these rules for which traffic need to be
exempted when Lock-down mode has applied at user end.

To configure Lock-down exception rules, use the following steps. This feature is supported from PCS 8.3R3/
PDC 5.3R3 onwards.

1. On the Pulse Connect Secure administrator console, select Users > Pulse Secure Client >
Connections.

2. Click a Name and select New under Lock-down mode exception rules.

Figure 4 Connection Settings

3. Enter the rule Name and Description. Select the traffic type.

• Inbound traffic is always directed towards user’s machine (Example: RDP).

• Outbound traffic is always directed towards outside the machine (Example: Skype for Business
Application).
Figure 5 New Lock down exception rule

4. Select the exception type from Resources. Fill in appropriate details. For more information, see
“Configuring Lock-down Exception Rules” on page 10.

5. Click Save Changes.

© 2019 Pulse Secure, LLC. 11

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Configuring Lock-down Exception Types

The Lock-down exception rules can be configured in the following ways for both Inbound and Outbound
traffic separately.

• Program-based Resource Access: Select Program in the New Always-on VPN exception rules page.
Enter the absolute path for the program that needs to be exempted and optionally provide SHA-256
checksum.
Figure 6 Windows - Program-based Resource Access

Figure 7 macOS - Program-based Resource Access

An administrator has to provide absolute path for the program that needs to be exempted and optionally
provide SHA-256 checksum.
Following are the examples for Lockdown Exception rules for macOS.

1. MAC Update program path:

/Applications/App Store.app/Contents/MacOS/App Store

/System/Library/PrivateFrameworks/StoreXPCServices.framework/Versions/A/XPCServices/
com.apple.appstore.PluginXPCService.xpc/Contents/MacOS/com.apple.appstore.PluginXPCService
/System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/
HIServices.framework/Versions/A/XPCServices/com.apple.hiservices-xpcservice.xpc/Contents/MacOS/
com.apple.hiservices-xpcservice
/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/
com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

2. Safari browser program path:

/Applications/Safari.app/Contents/MacOS/Safari
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/Versions/A/
com.apple.Safari.SafeBrowsing.Service
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/
com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking

© 2019 Pulse Secure, LLC. 12

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

/System/Library/StagedFrameworks/Safari/WebKit.framework/Versions/A/XPCServices/
com.apple.WebKit.Networking.xpc/Contents/MacOS/com.apple.WebKit.Networking -> Mac 11 & Mac 12

3. Facetime program path:

/System/Library/PrivateFrameworks/ApplePushService.framework/apsd
/Applications/FaceTime.app/Contents/MacOS/FaceTime
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/IDS.framework/identityservicesd.app/Contents/MacOS/
identityservicesd
/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/
com.apple.iCloudHelper.xpc/Contents/MacOS/com.apple.iCloudHelper
/usr/libexec/avconferenced
/usr/libexec/nsurlsessiond

4. Symantec Norton security program path:

/Applications/Norton Security.app/Contents/MacOS/Norton Security

/Library/Application Support/Symantec/Silo/NFM/Daemon/SymDaemon.bundle/Contents/MacOS/
SymDaemon
/Library/Application Support/Symantec/Silo/NFM/LiveUpdate/com.symantec.SymLUHelper
/Library/Application Support/Symantec/Silo/NFM/SymUIAgent/Norton.app/Contents/MacOS/Norton
Each process needs to configure with different process rules, and not with single process.

Figure 8 macOS - Program-based Resource Access

When a lockdown is applied. Use below command to ping IPv6 address.

ping6 -S (Source IPv6) (destination IPv6)

• Port-based Resource Access: Select Port in the New Always-on VPN exception rules page. Select TCP
or UDP and enter the respective port number.
Figure 9 Port-based Resource Access

• Custom-based Resource Access: Select Custom in the New Always-on VPN exception rules page.
Configure the rules as applicable.

© 2019 Pulse Secure, LLC. 13

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Figure 10 Custom-based Resource Access

Once Custom is selected, administrator can configure any of the applicable rules. (Example: administrator can
configure Local or Remote IPv4/IPv6 addresses or Ports or Absolute Program Path or Type of protocol).

Note: In custom-based resource access, it is not mandatory to configure all the options. Default value
for all configurable fields are “*”.
Note: Post Pulse Desktop Client upgrade, user needs to make at least one successful connection to the
Pulse Connect Secure, so that the configured Lock-down exception rules can be applied on the client
machine.

Configuring Location Awareness Rules

To configure location awareness rules, use the following steps.

1. Ifnot already created, create a connection or open an existing connection.

Location Awareness rules are applicable for SRX connections and Connect Secure or Policy Secure (L3)
connections. Location awareness rules do not apply to UAC (802.1X) connections.

2. Click the Mode list, and select the mode, User, Machine, or Machine or user.

3. For User Mode, manually select Connect automatically under options. For Machine or User or
Machine modes, Connect automatically option is enabled by default.

© 2019 Pulse Secure, LLC. 14

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

4. Under Location awareness rules, click New.

Alternatively, select the check box next to an existing rule, and then click Duplicate to create a new rule
that is based on an existing rule.

5. Specify a Name and Description for the rule.

6. In the Action list, select one of the following and specify a network interface as Physical, Pulse Secure,
or Any.

• DNS server—Specify the DNS server IP address in the IP address box.

• Resolve address—Specify the hostname in the DNS name box and the IP address or addresses in the
IP address box.
• EndpointAddress—Specify the IP address or addresses in the IP address box. Also specify a network
interface on which the condition must be satisfied.

1. Click Save Changes.

2. Enabling Location Awareness Rules

To enable location awareness rules, use the following steps.

1. Specify how to enforce the selected location awareness rules by selecting one of the following options:

• All of the above rules—The connection is attempted only when all selected location awareness
rules are satisfied.
• Any of the above rules—The connection is attempted when any of the selected location
awareness rules is satisfied.
• Custom—The connection is attempted only when all selected location awareness rules are
satisfied according to the Boolean logic you specify in the Custom box. The accepted Boolean
operators are AND, OR, NOT, and ( ).
For example, connect to Pulse Connect Secure where Rule-1 and Rule-2 are defined. To set a
custom rule where, Rule-1 is false and Rule-2 is true. The Boolean logic in the custom box would be
NOT Rule-1 AND Rule-2.

2. Click Save Changes.

System Extensions Support

Apple introduced the concept of System Extensions (SysExt) as an alternate to Kernel Extensions (Kext).
System Extensions / Network Extensions allow to extend the functionality of macOS without requiring kernel-
level access.

This feature is applicable for Pulse Client version 9.1R8.2 and above and version Catalina onwards. This feature
is applicable when Traffic enforcement and Lockdown mode are enabled.

When installing Pulse Client version previous to 9.1R8.2 a message displays when installing the
PulseSecure.dmg. MacOS cannot recognise the PulseSecure.pkg and displays that the package could be a
malicious software.

© 2019 Pulse Secure, LLC. 15

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Pulse Client 9.1.R8.2 and later versions are notarized and Pulse Client installation do not display this warning
on MacOS.

Click Open to install the package despite the warning.

Figure 11 Malicious Software warning

Activating Pulse Secure System Extensions

The following procedure provides steps to activate Pulse Secure System extensions on MacOs when Traffic
enforcement and Lockdown mode are enabled. Pulse Client release 9.1R8.2 includes support to System
Extension-based firewall required to use network filtering.

1. When adding new connections, few warnings may appear. On the System Extension Blocked
message, click Open security Preferences.

Figure 12 System Extension Warning

2. Under General tab, unlock permissions to make changes and click Allow to unblock the software.

© 2019 Pulse Secure, LLC. 16

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Figure 13 Security and Privacy settings

3. Under Privacy tab, unlock permissions to make changes and Select Pulse Secure.

Figure 14 Privacy Settings

© 2019 Pulse Secure, LLC. 17

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

4. On setting the system extensions and when Traffic Enforcement and Lock-down mode are enabled, the
following message appears when establishing a connection. Click Allow to filter Network Content

Figure 15 Filter confirmation during Network Connection

To ensure system extensions are activated and enabled on a terminal, use the following command:
systemextensionsctl list | grep pulse

System Extensions during Pulse Client Uninstallation

When uninstalling the Pulse Client, the system extensions are also removed. The following confirmation
message appears, click Continue to remove system extension settings.

Figure 16 Remove System Extension

© 2019 Pulse Secure, LLC. 18

 Pulse Secure Desktop Client: Always-on VPN and VPN Only Access Deployment Guide

Updating Pulse Secure Client with New

Connection Set
To deploy the above mentioned configuration at end-user machine, please refer to the section “Deploying
Pulse Secure Client” of Pulse Secure Desktop Administrator Guide.

© 2019 Pulse Secure, LLC. 19