Ability to fallback to KEXT instead of SE on macOS Catalina 10.15.4+ with GlobalProtect 5.2.5-H1+

Customers could stay on Catalina but configure GlobalProtect to use KernalExtensions on 5.2.5 HF and above builds , as opposed to GlobalProtect using SystemExtensions by default for customers using Enforce Globalprotect for network access and split-tunneling capabilities.

• GlobalProtect App Version 5.1.4+ upto 5.2.5
• Catalina version 10.15.4 +
• This Article is not valid for Bigsur version and higher version

PLEASE do not run the command on any other macos version !!!this is only valid for Catalina macos 10.15.x.

With GP 5.1.4 and later , Globalprotect started to use only System extensions on Catalina 10.15.4 and above ( only catalina) . Many customers are running into issues on split-tunneling and enforcer and other issues like kernal panic when using System Extension. 

Please take a look at this link for understanding the side issue when using the system extension and configure exclude domain multiple applications are freezing or erroring out on macOS Catalina 10.15.x.

https://knowledgebase.paloaltonetworks.com/kcSArticleDetail?id=kA14u000000HBqE




   

• We need to add <key>UseKextAnyway</key> in the pre-deployed .plist file (/Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist).

> cd /Library/Preferences/
> vi com.paloaltonetworks.GlobalProtect.settings.plist

adding these 2 line under the setting :

<key>UseKextAnyway</key>
<integer>1</integer>

save the changes.

You can run these command for checking the changes:

>defaults read com.paloaltonetworks.GlobalProtect.settings.plist

• You can also run this command for changing the plist :

plutil -insert "Palo Alto Networks".GlobalProtect.Settings.UseKextAnyway -integer 1 /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist

• You can also navigate to Application folder > Globalprotect > Right-click the app and select the ‘Show Package Contents’ option from the context menu.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>Palo Alto Networks</key>
	<dict>
		<key>GlobalProtect</key>
		<dict>
			<key>Settings</key>
			<dict>
				<key>UseKextAnyway</key>
				<integer>1</integer>
			</dict>
		</dict>
	</dict>
</dict>
</plist>

ser1@user1s-Mac-3 Preferences % kextstat -l | grep 'palo'                     

  158    0 0xffffff7f82c02000 0x4000     0x4000     com.paloaltonetworks.kext.pangpd (5.2.5f84) 6445D143-37E4-3DCD-95DE-62588A81A4D1 <6 5 3 1>

• The new key must be deployed before installing or upgrading GP.
• If already installed and systemExtensions are enabled, then uninstall the GlobalProtect Application, pre-deploy the new key for kext fallback to work. Otherwise, you will see a log in PanGPS.log like

“PanGPS set to explicitly use kext. However system extension is enabled already. Please contact your administrator.”

• The new key is only recognized and taken effect in the new GP version (5.2.5 HF+).
• It won’t take effect on macOS Big Sur. Meaning if you upgrade macOS to Big Sur later, GP will use System Extension on Big Sur.

• Removing the new key from .plist first
• Then restarting GP

• The kext version won’t support FQDN based Enforcer Exceptions and Split DNS features.
• If the System Extensions has already been enabled, you must uninstall GP first to use the new key to enable kext. Otherwise, you will see a log in PanGPS.log like “PanGPS set to explicitly use kext. However system extension is enabled already. Please contact your administrator.”

• Any include/exclude domains accessed through Safari may encounter issues. So, it would be advisable to use other browsers like Chrome. Firefox etc.
•  app that uses webkit (native macOS framework) may have a problem with kernel extensions (webkit examples, Safari).