# Cisco Secure Client Installation (macOS)

## Description

Use this recipe to package and deploy Cisco Secure Client to managed Macs with FileWave. You will import the FileWave templates, replace the example Cisco package and XML with your files, approve the required macOS extensions, and test the result before broad deployment.

## Ingredients

- FileWave Central
- Cisco Secure Client DMG file, example file name from your Cisco portal:
    
    
    - `cisco-secure-client-macos-<version>-predeploy-k9.dmg`
- MDM profile for Cisco security extensions and permissions 
    - Older macOS versions for Kernel Extension TCC profile:
    - [Profile - Cisco Secure Client Kernel Extensions.fileset.zip](https://kb.filewave.com/attachments/499)
    - macOS 11 (and later) for System Extension TCC profile:
    - [Profile - Cisco Secure Client System Extensions macOS 11 (and after).fileset.zip](https://kb.filewave.com/attachments/500)
- Template Install Cisco Secure Client Fileset 
    - [Install Cisco Secure Client.fileset.zip](https://kb.filewave.com/attachments/501)

## Directions

1. Download and import the installation template plus the extension profile that matches your target macOS version. Create a Fileset Group named **Cisco Secure Client Install** or similar.
2. Open the **Install CiscoSecureClient** Fileset. It contains two scripts and placeholders for your customized DMG and XML files.
    
    [![CSCFilesetContents.png](https://kb.filewave.com/uploads/images/gallery/2026-03/BKgyDtGbFTuABz8V-cscfilesetcontents.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/uOY2nOlzbTj4ZARt-filesetconents.png)
3. Follow Cisco's current [Customize macOS Installation of Cisco Secure Client](https://securitydocs.cisco.com/docs/csa/olh/121444.dita) instructions to prepare the DMG and choose the modules your organization needs. The DMG and XML in the template are examples and must be replaced with your deployment files.
4. Replace the example DMG in the Fileset with the DMG you prepared.
5. Open the install script and update the DMG name and Cisco Secure Client PKG name to match your files. Escape spaces in the script path, for example `Cisco\ Secure\ Client.pkg`.  
      
    The script mounts the DMG, locates the PKG, extracts it to the root directory, installs the client, waits 30 seconds, and detaches the DMG. If you use a customized `install_choices.xml`, replace the example XML in the Fileset as well.
    
    [![CSCInstallScript.png](https://kb.filewave.com/uploads/images/gallery/2026-03/wJuOqQYVsrHtWpns-cscinstallscript.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/2woDbot6LbZdga7J-ciscosecureclientinstallscript.png)
6. Use the System Extension profile for macOS 11 and later; it also includes the Web Content Filter and Managed Login Items settings. Use the Kernel Extension profile only for older macOS versions that still require it.  
      
    Update the `check_profile` script and its Launch Argument to match the profile bundle ID or IDs you deploy. The template checks only the macOS 11-and-later profile bundle ID.
    
    <table style="border-collapse:collapse;width:110.18%;height:393px;"><colgroup><col style="width:33.2903%;"></col><col style="width:33.2903%;"></col><col style="width:33.2903%;"></col></colgroup><tbody><tr><td>[![CSCProfileBundleID.png](https://kb.filewave.com/uploads/images/gallery/2026-03/8KEHdz5Jd9Y8ii9h-cscprofilebundleid.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/MqXaAI0Xp4FCBvU7-csctccprofile.png)</td><td>[![check_profileedit.png](https://kb.filewave.com/uploads/images/gallery/2025-05/scaled-1680-/80PA0YUUqnXTnj4u-check-profileedit.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/80PA0YUUqnXTnj4u-check-profileedit.png)</td><td>[![bundleID.png](https://kb.filewave.com/uploads/images/gallery/2025-05/scaled-1680-/nz99LgHgmP1S9Fny-bundleid.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/nz99LgHgmP1S9Fny-bundleid.png)</td></tr></tbody></table>
7. Save the changes and assign the Fileset Group to a small pilot. The group deploys the profile and installation Fileset; after the required profile is installed, the Cisco Secure Client installation can proceed.  
      
    [![CSCFilesetGroup.png](https://kb.filewave.com/uploads/images/gallery/2026-03/47TfRFXv2MnESMmj-cscfilesetgroup.png)](https://kb.filewave.com/uploads/images/gallery/2025-05/odoMkfNRbTrJeRNR-filesetgroup.png)

## Notes

On the pilot Macs, confirm the profile is installed, the selected Cisco modules are present, the client opens correctly, and the expected network connection works before expanding the assignment.

## Related Content

- [Cisco Secure Client Mass Deployment (macOS) Guide](https://securitydocs.cisco.com/docs/csa/olh/121475.dita)
- [Customize macOS Installation of Cisco Secure Client](https://securitydocs.cisco.com/docs/csa/olh/121444.dita)
- [Creating MDM approved System/Kernel Extensions Guide](https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/Cisco-Secure-Client-5/admin/guide/b-cisco-secure-client-admin-guide-5-1/macos11-on-ac.html)