Getting Started with the Windows Client

Overview

The Cato Client is proprietary endpoint software that delivers secure access, advanced security enforcement, and monitoring capabilities. Downloading, installing, and connecting the Client is a simple process that enables you to quickly begin using its features and realizing value.

Depending on how your organization has configured the remote access policies and Client settings, the behavior and available features may vary. Some options described in this article might not apply to your specific installation.

Note: Before installing the Windows Client, review the Prerequisites (especially the minimum device operating system) listed in Preparing to Install the Cato Client.

Why Use the Cato Client?

The Client runs in the background on the device and contains a suite of features to secure your network, devices and identify and support your users.

The capabilities of the Client can be grouped into six key capabilities:

Identification and Authentication
Device Posture
Secured Remote Access (requires a ZTNA license)
Secured Internet Access (requires a ZTNA license)
Digital Experience (requires a DEM license)
User Engagement

For more information, see Understanding the Capabilities of the Cato Client.

How to Download, Install, and Connect with the Client

The Client may have been automatically installed on your device which means you can use the instructions below to add a user and connect. If the Client was not installed, you can download and install it following the steps below:

Downloading the Windows Client

To download the Windows Client from the Cato website:

From a browser, open the Client download portal, and select the Windows tab.
Click Download. The installation file is saved to your device.

Installing the Windows Client

To install the Windows Client on your device:

Open the Windows Client installation file that you downloaded in the previous section and follow the steps in the installation wizard.
After you install the Client, open Cato VPN Client from the desktop.

The Client can also be installed with the command line. For more information, see Installing the Cato Client.

Adding a New User

You can add more than one user to the Client. To add a new user, on the User tab, click Add User and sign in with your email and password (and MFA) or SSO

Signing into the Client

Once you have installed the Client, sign in to connect to the network. You can sign in with your email address and password (and MFA method) or with SSO.

Signing in with Email and Password (and MFA)

In the Client, click the Connect button and enter your email address. You will then be sent an email that explains how to create your password.

Once you have created your password you can sign into the Client and connect to the network.

Note:
You may have received the email the with an explanation on how to create your password before you click Connect.

Signing in with SSO

In the Client, click the Connect button and enter your email address. You can then choose to sign in with your SSO credentials.

Connecting to your Network

Once the Client is installed and a user is added, you can connect to your network with the Client.

To connect to your network:

Open the Client.
Click the connect button in the middle of the shield.

Connecting to a Specific PoP

By default, the Client automatically connects to the optimal PoP based on geolocation and connectivity metrics. For more information on the Client connection process, see Preparing to Install the Cato Client.

You can override this process by manually entering the IP address of a specific PoP you want the Client to connect to. To view the IP addresses of Cato's PoPs, see Production PoP Guide.

To select the PoP the Client connects to:

From the navigation menu in the Client, click Users.
Enter the IP address of the PoP you want the Client to connect to.
The Client connects to the manually selected PoP.

Understanding Connectivity Statuses

You can view the Client connectivity status in the Client or using the Windows tray icon. The symbols for each connectivity status are:

Symbol	Description
	The Client is connected.
	The Client is connected but has a warning.
	The Client is connected but has an error.
	The Client is disconnected.
	The Client is disconnected due to an error.
	The Client is bypassing the Cato Cloud. For more information, see Protecting Users with Always-On Security

Understanding Authentication Errors

Based on the configuration of the Client Connectivity policy the Client checks your device has the required software or updates installed before it allows you to connect to the network. For example, the Client checks if you have an up-to-date antivirus software installed. Only secure and compliant devices are allowed to connect. If the device doesn't comply with the Client Connectivity policy, the Client is blocked, and there is a notification with more details.

How Do I Know if a Device Isn't Compliant?

If your device doesn’t meet the security policy, the Client doesn't connect and shows a message explaining the issue. Common reasons include:

Out-of-date antivirus software version
An unsupported operating system
Need to update the Client to a newer version

Click Details in the message to see what failed.

Documentation Index