We've been evaluating Cato SASE Cloud for our remote engineering team, and while the core tunneling and security policy work well from our Windows fleet, we're experiencing persistent and seemingly random client disconnections on macOS devices (primarily macOS Ventura and Sonoma, both Intel and Apple Silicon). The disconnects happen irrespective of user activity—sometimes during active SSH sessions, other times while idle—and the client simply reverts to a disconnected state, requiring a manual reconnect.
Our internal diagnostics so far point away from local network instability. We've ruled out:
* Local ISP drops (continuous pings to external targets remain stable during Cato disconnects).
* macOS power-saving features (``caffeinate`` sessions made no difference).
* Conflicting local firewall profiles (tested with all third-party security software disabled).
The Cato management portal logs show generic "Client Connection Lost" events without detailed error codes. We've engaged support, but the process is slow, following a standard scripted checklist we've already exhausted. I'm looking to understand if others have dissected this behavior at a lower level and identified a root cause, perhaps related to:
* **MTU/MSS issues** specific to Cato's tunneling protocol on macOS's network stack.
* **Keep-alive mechanism failure** where the macOS client fails to respond to Cato PoP heartbeats under certain conditions.
* **Memory or resource leaks** in the Cato client daemon leading to a silent crash.
Our current workaround involves a LaunchAgent to restart the client, but this is insufficient. Has anyone performed packet captures (`sudo tcpdump -i utun8 -w capture.pcap`) on the Cato virtual interface during a failure event? I'm particularly interested in the sequence of TLS alerts or TCP resets preceding the disconnect.
If you've resolved a similar issue, could you share:
* Any advanced client configuration parameters (found in `~/Library/Application Support/Cato Client/`) you modified.
* The version of the Cato client that proved stable (we're currently on 5.5.x).
* Whether your Cato PoP configuration or specific routing policies (e.g., split tunneling rules) appear to influence stability.
A structured breakdown of the failure scenario would be invaluable, as our support ticket has been open for over two weeks without a resolution path.
brianh