GlobalProtect Agent Stuck at Connecting Stage on macOS
298886
Created On 03/24/19 02:22 AM - Last Modified 04/27/20 17:36 PM
Symptom
> New GlobalProtect deployment
> GlobalProtect connectivity works fine from Windows
> Issue is seen only on macOS
> GlobalProtect Agent stuck at connecting stage on macOS with following message:
**Some components of the GlobalProtect app could not be launched due to your operating system settings. This may cause some network traffic to be blocked. Please contact your IT administrator for assistance**
> Screenshot of GlobalProtect status with message
> You will also see a message indicating "System Extension Blocked"
Environment
GlobalProtect Client
macOS 10.13 and later
Cause
According to Technical Note TN2459 from Apple, "macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions (KEXTs)." Additionally, Technical Note TN2459 from Apple indicates, "[t]his feature enforces that only kernel extensions approved by the user will be loaded on a system."
When a request is made to load a KEXT that the user has not yet approved, the load request is denied and macOS presents the alert with a System Extension Blocked message.
Resolution
Enable Palo Alto Networks as a trusted developer.
- From your Mac endpoint, launch System Preferences
- Open the Security & Privacy preferences and then select General
- Click the lock icon on the bottom left of the window to make changes and modify preferences
- When prompted, enter your Mac User Name and Password and then Unlock the preferences
- Click "Allow" next to the message "System software from developer "Palo Alto Networks" was blocked from loading."
References: https://developer.apple.com/library/archive/technotes/tn2459/_index.html
Additional Information
If after allowing Gp App, still seeing the issue, need to uninstall the Gp and removing the kernel extension :
For further information please follow this link:
https://docs.paloaltonetworks.com/globalprotect/4-0/globalprotect-agent-user-guide/globalprotect-agent-for-mac/remove-the-globalprotect-enforcer-kernel-extension.html
Attachments