CylanceGATEWAY known issues
Items marked with an asterisk (*) are new for this release.
Access control list (ACL)
In some scenarios, an ACL rule might be expected to block a connection to a destination, but it isn't when the following combined ACL properties are used to create the rule. (BIG-6511)
Consider the following scenario, this ACL rule will allow users to access to *.example.com when the following ACL properties are specified because the DNS request for http://example.com will be resolved to an IP address (for example, 172.16.10.55) and the request to the IP address on port 80 is not blocked.
To block access to the destination in the above scenario, best practice is to enter the FQDN without a wildcard or enter the FQDN with a wildcard and not specify a port number. To have this rule block access to the destination as expected, you must update the ACL rule to one of the following:
The ACL tab is not displayed in the
Cylance Endpoint Securityconsole immediately after
CylanceGATEWAYis enabled for the tenant. (BIG-7059)
Workaround: Log out of the
Cylance Endpoint Securityconsole, and log in again.
macOSdevices when split tunneling is enabled and a DNS query is made for an unqualified hostname, the DNS suffixes may not be applied or used as defined in Settings > Network > Client DNS. (BIG-11180)
Workaround: Complete one of the following:
Windowsdevices are configured to use Safe Mode and Work Mode is not enabled, if third-party solutions that control DNS such as VPN are enabled, they may not work as expected. When enabled, Safe mode intercepts and evaluates all DNS queries and may have conflicts with other solutions that also control DNS. For more information on Safe Mode, see CylanceGATEWAY release notes. (BIG-11098)
If the component that is handling active connections through the
CylanceGATEWAY Connectoris restarted within the
BlackBerry Infrastructure, the number of active connections for the connector may not return to zero when the connector is disabled. (BIG-8614)
Restricted apps can't open loopback sockets when "Block network traffic from restricted apps" is set to "No" in the
CylanceGATEWAYservice policy, for
IntelKiller Prioritization Engine may drop
Workaround: Give BlackBerryGatewayService.exe a priority of "1" in the Killer Prioritization Engine console.
If a device's local network IP range (for example, a home
Wi-Finetwork) overlaps with the customer's private network,
CylanceGATEWAYwork mode does not allow access to the private network resources for the IPs that fall in the overlap range. For example, if a user’s home
Wi-Finetwork range uses 10.0.0.0/24 and the customer’s private network uses 10.0.0.0/8, the user will not be able to access 10.0.0.100 on the private network as it falls under 10.0.0.0/24 and will be routed to the local network. (BIG-5389)
Workaround: Complete one of the following actions:
BlackBerry UEM Connector
After upgrading to
Windowsversion 220.127.116.11, DNS tunneling does not enable split DNS when a Group Policy Object (GPO) that sets a DNS name resolution policy table (NRPT) or an empty NRPT exists. When split DNS is not enabled, all DNS lookups are performed through the tunnel. (BIG-11032)
To confirm if a GPO exists, verify whether the
Windowsregistry key "DnsPolicyConfig" is present at
After you connect the
Cylance Endpoint Securityto your
BlackBerry UEM Cloudinstance, the status of the BlackBerry UEM Connector remains at "In progress". (UES-12931)
Workaround: Refresh the Connectors screen.
iOSdevices that are running
CylancePROTECT Mobileapp version 18.104.22.16852 or later and
BlackBerry UEM Clientversion earlier than 12.47.3265, and the UEM Client is updated to 12.47.3265 or later the
BlackBerry Infrastructureidentifies the device as a new activation. (UESAPP-3841)
Workaround: Deactivate and reactivate the
Windowsusers might experience notifications that rapidly appear and disappear when they attempt to enable Work Mode. Work Mode cannot be enabled. (BIG-11432)
Workaround: The Windows Management Instrumentation (WMI) cannot be accessed or it is corrupt. Repair the WMI. For more information, see KB 112135.
If Work Mode is enabled when the
CylancePROTECT Mobileapp for
iOSupdates, a "
CylanceGATEWAYis disconnected" message is displayed and users are unable to connect to
Workaround: Start the
CylancePROTECT Mobileapp or tap the pop-up message.
When you try to reauthenticate the
CylanceGATEWAYagent, you might receive a "Sign-in failed" error. (EID-19203)
Workaround: Temporarily change your default browser or clear the browser cache.
Windowsusers only receive the Connection Blocked notification popup message the first time they try to access a blocked website. (BIG-8578)
When environments are configured for device posture validation,
macOSusers receive an error message when they try to enable work mode if the
CylancePROTECT Mobileapp is installed but not activated. The
CylanceGATEWAYagent log file logs a 403 and the following error message: "error":"NotEntitled","detail":"Endpoint requires protect". (BIG-7848)
Workaround: Complete the following steps:
Users may experience connectivity issues when the
CylanceGATEWAYagent is installed on a computer running
Linux(WSL) due to a known issue where WSL does not accommodate the MTU of the network interfaces in
Workaround: Users with WSL2 can work around this issue using the following commands.