Jamf Pro

Jamf Pro is an enterprise mobility management tool that is used to enroll and manage devices such as iOS, iPad, and so on. This document describes the steps to deploy the Netskope Client app in the endpoint device using JAMF Pro.

To deploy client using Jamf Pro:

1. Log into Jamf Pro.

2. Click Devices.

3. On the left pane, click Configuration Profiles.

4. Click New > Options and provide the details to create a new profile.

   

5. Click VPN under the Options displayed on the left-pane.

6. Click Configure.

7. Provide the following details to configure VPN:

   1. Enter the connection name. For example, Netskope VPN.

   2. From the options displayed in the VPN Type dropdown, select VPN.

   3. From the options displayed under Connection Type, select Custom SSL.

   4. Enter com.netskope.Netskope in the Identifier field.

      The second Netskope in com.netskope.Netskope is case-sensitive and ‘ N’ must be in uppercase.

   5. Enter gateway-<tenant-URL> in the Server field.

      Replace <tenant-name> in the tenant URL with your tenant name.

   6. To enable zero-touch deployment, provide the following key-value pair in Custom Data:

      • OrgKey: <Your organization ID in the tenant>

      • AddonHost: addon-<tenant-URL>.

      • UserEmail: <Your email address>

   7. Click the checkbox to select the option Enable VPN On Demand.

   8. Provide On Demand Rules Configuration XML.

      <array>
      <dict>
      <key>Action</key>
      <string>Connect</string>
      <key>InterfaceTypeMatch</key>
      <string>WiFi</string>
      </dict>
      <dict>
      <key>Action</key>
      <string>Connect</string>
      <key>InterfaceTypeMatch</key>
      <string>Cellular</string>
      </dict>
      </array>

       Disabling VPN in iOS settings terminates the extension (this is iOS design), but it is reactivated by iOS automatically on network activity if OnDemandRules are configured.

   9. Click the checkbox to select the option Prohibit users from disabling on-demand VPN settings.

      

8. Click Certificate under the Options displayed on the left-pane.

9. Click Configure.

10. Provide the following details to configure certificates:

    Go to your Netskope account to download root and intermediate certificates.

    1. Enter the name in Certificate Name. For easy reference, you can enter names according to the certificate that you want to upload. For example, ‘Netskope root certificate’ as the certificate name for uploading the root certificate.

    2. Click Select > Upload.

    3. Click Upload Certificate > Choose File to select and upload the certificates to Jamf. You can upload the root certificate first and then click the + icon to upload the intermediate certificate and repeat steps b and c.

       To convert your .pem files to .cer files using openssl, use the following command in your terminal:
       openssl x509 -outform der -in rootcacert.pem -out rootcacert.der
openssl x509 -outform der -in cacert.pem -out cacert.der

       

11. Click Save to save the configuration profile.

12. Click Scope.

13. Click Edit at the bottom right corner of the UI.

14. Click Targets and select select a specific user (or a specific device).

15. Click Save.

    

16. Go to Devices > Content Management > Mobile Device Apps.

17. Click New to create a new app.

18. Choose one of the following  App Type options:

    • App store app or apps purchased in volume.

    •  In-house app

      This document goes with the option “App store app or apps purchased in volume”.

19. Click Next.

20. In the Search or Upload section, search for Netskope Client app and select the app store country origin.

21. Click Next.

22. In the Add App section, click Add to select Netskope Client app.

23. It navigates to the New Mobile Device App screen.

24. Under the General tab, enter the Display Name.

25. Select iOS as the category to add the app to.

26. Click the Scope tab in Mobile Device Apps.

27. Click Targets and select select a specific user (or a specific device).

    

28. Click the App Configuration tab under Mobile Device Apps and provide the configuration details. For example:

    

    <plist version=“1.0”>
    <dict>
    <key>OrgKey</key>
    <string>xxxxxxxxxxxxxx</string>
    <key>UserEmail</key>
    <string>$Email</string>
    <key>AddonHost</key>
    <string>addon-<tenant-URL></string>
    </dict>
    </plist>

    – To get the OrgKey, you can log into the Netskope tenant > Settings > Security Cloud Platform > Netskope Client > MDM Distribution. Here go to Deployment Resources for iOS and copy the Organization ID from the Create VPN Configuration.
    – Ensure to provide the same email address as added in your tenant.
    – Use variables like “<string>$EMAIL</string>” in the email string.

29. Click Save to save the new Mobile Device App.

30. The Mobile Device App screen displays the newly added app.