Preparing to Install the Cato Client

The Cato Client is proprietary software that extends Cato's network and security capabilities to remote users in any location. This article lists the prerequisites and explains how to install the Client.

Overview

The Cato Client can identify and authenticate users, enforce your network rules, and inspect remote traffic based on security policies. To ensure your users benefit from these features, the Cato Client must be installed on their device. Before you install the Client on any device, ensure that the prerequisites are met and the required processes and URLs are added to the allowlists of your security software. You can then download the Client and install it on an individual device or distribute it with an MDM.

After you install the Client on a device, you can configure features and policies to meet your requirements. Users can authenticate and securely connect to your network. For more information on the Client Connection process, see Understanding the Cato Client Connection Flow.

Prerequisites for Installing the Cato Client

Before the Client is installed on a device, ensure the following prerequisites are met:

• Install the Client on a device running a supported operating system.

• IP routing should be disabled before installing the Cato Client and enabled after the installation completes.

• The Cato CA certificate is installed on the device or computer

  • For Windows Clients, the Cato certificate is automatically added to the Windows certificate store and supports the Chrome and Edge browsers

    You can manually install the Cato certificate for other browsers (such as Firefox), or use an MDM to install it with the browser, see Installing the Cato Certificate on Windows Devices

  • For macOS Clients, for organizations that use an MDM, the Cato certificate is automatically installed as part of the CA keychain

    Otherwise, the SDP user manually installs the Cato certificate. For more information, see Installing the Cato Certificate on macOS Devices.

  • For iOS and Android Clients, the SDP user manually installs the Client or use an MDM to install the certificate with the Client. For more information, see Installing the Cato Certificate on iOS Devices or Installing the Cato Certificate on Android Devices.

  • The Cato certificate and Client installation files can be downloaded from:

    • The Client download portal in CER format

    • The Security > Certificate Management page in PEM and DER format

• Internet browser requirements:

  • Use an Internet browser that supports SSL (such as Chrome or Edge)

  • For external authentication, make sure that a default browser is configured in the device OS settings

• A PPPoE connection is not used. PPPoE is not supported

• For iOS, Android, and Linux Clients, we recommend that you disable IPv6 on all physical adapters

  • IPv6 is supported for Last Mile Connections on Windows Client v5.11 and higher and macOS Client v5.7 and higher

• Make sure that the IP addresses for PoPs in the Cato Cloud are allowlisted on any firewalls or similar devices

  For a list of the PoP IP ranges, see: Production PoP Guide

• The Client uses cipher suites to establish a DTLS handshake with the Cato Cloud. Ensure the device uses one of the cipher suites that Cato supports.

• On Windows devices, IP forwarding is disabled. For more information, see IP Routing Prevents Windows Client Authentication

• On macOS devices:

  • Full Disk Access permission

  • No other enterprise VPN is running on the device

• If Bandwidth Management is used in your account, we recommend that you give the IP address 10.254.254.1 at least the same priority as any other address you have added

• To receive user notifications, notifications must be enabled on the device. For more information, see Creating the Data Control Policy and Managing the Application Control Policy

• Review the Known Limitations of the Client version. For more information, see Summary of Cato Client Releases

Allowlisting Processes and URLs for the Cato Client

For more information about processes and URLs to allowlist for all security endpoint software and solutions, see Allowlisting Processes and URLs for the Cato Client.

Minimum Supported Device Operating Systems

The following sections show the operating systems on which you install the Cato Client.

Notes:

• Any Client version that is not listed as supported is considered End of Support

• The Client does not support operating systems that vendors have declared EoL (End of Life)

• Android EoL is based on the date from which Google no longer provides security updates or patches for a version

• New device OS versions are not supported automatically for all Cato Client versions. Official support begins only after Cato announces which Client versions have been validated and are supported on the new OS version

Understanding the Next Steps After Installing the Client

Once the Client is installed on a device, you can configure features and policies to meet your secure remote access requirements. The Client enforces the features configured in the Cato Management Application. This lets you simply manage and enforce your requirements and ensure the protection of your network.

Understanding Key Client Features and Policies

Here are some key features we recommend you enable. For more information about all the Client features, see the Access documentation.

• User Awareness: Identify the user signed into the device at any point in time to control user access, and monitor user activity

• Client Connectivity Policy: To check the posture of devices before they connect to the network

• Always-On Policy: To ensure all traffic always goes through the Cato Cloud and Cato security engines inspect the traffic to ensure it complies with your security policies

Analyzing Client Events

You view and analyze data from users connecting with the Client from the Remote User Dashboard.