Content 9108-10079 preventing GlobalProtect App to parse Enforcer IP/FQDN Exclusion List configured under Portal Agent Configuration

• GlobalProtect App is unable to parse and apply Enforcer IP and FQDN Exclusion Lists configured under Portal Agent Configuration (App tab). 
• IP exceptions are configured within "Allow traffic to specified hosts/networks when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established" field under Portal Agent config App tab.
• FQDN exceptions are configured within "Allow traffic to specified fqdn when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established" field under Portal Agent config App tab.

• NGFW Firewalls
• Supported GlobalProtect (GP) App versions
• Content 9108-10079 or 9109 installed on the firewall hosting GlobalProtect Portal
• GlobalProtect Enforcer configuration with IP or FQDN Exception List

• Content Release 9108-10079 introduces a regression that prevents the GlobalProtect (GP) App from parsing and applying Enforcer IP and FQDN Exclusion Lists configured under Portal Agent Configuration.
• Consequently, the GlobalProtect enforcer would block unintended traffic when GP is not connected, potentially causing production disruptions (depending on the setup).
• GlobalProtect client logs would show empty lists for IP and FQDN exceptions applied:

Debug: enforcer ip exception is
Debug: enforcer exception: FQDN is

• Dump level logs would show failure to apply received enforcer rules:

Dump: Enforcer fail to applied rules

• When running Content version 9108-10079 on the firewall, the enforcer-exception-list and enforcer-exception-list-domain elements within the GlobalProtect portal app configuration XML are generated without any <member> tags.
• Consequently, the exclusion lists fails to be parsed by the client, resulting in the absence of Enforcer exclusions even though they are configured properly on the portal side.

Content version 9110 reverts the changes made in 9107 that caused the regression. Content versions 9108 and 9109 have been pulled out from the updates server.

1. To restore enforcer exception functionality, revert the content on the firewall hosting GlobalProtect Portal to a version 9107-10077 or earlier, or move to a version 9110 or later and then perform a commit.
   1. Firewall hosting GlobalProtect Portal (or Panorama managing the content version for the device):
      1. Navigate to Device > Dynamic Updates.
      2. Revert the Content version to 9107-10077 or earler, or move to a version 9110 or later.
      3. Perform a commit for the changes to take effect. 
2. Additionally, if endpoints cannot reconnect and authenticate to the Portal while the enforcer is running without exceptions and fetch newly formatted configuration, apply the workaround on the endpoint side as well. This can happen if the enforcer is running without exceptions and the client is unable to perform SAML authentication via default browser to re-connect to Portal as it can't reach IdP.
   1. Endpoint Remediation - only if clients can't reconnect to the Portal to fetch newly formatted config (admin rights required):
      1. Uninstall and then install GlobalProtect App and reconnect to Portal OR
      2. Reboot the machine OR
      3. Disable GP Enforcer (via registry), clear the portal cached configuration file, and restart the PanGPS service for the changes to take effect.
         1. Windows Registry Key: HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings, Value Name: "enforce-globalprotect", set Value Data to "no".
         2. For macOS: sudo /usr/libexec/PlistBuddy -c "Set Palo\ Alto\ Networks:GlobalProtect:Settings:enforce-globalprotect no" /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist
         3. Portal cached config is stored in files with naming convention: PanPortalCfg_<hash>.dat under user data directories:
            1. Windows - C:\Users\%Username%\AppData\Local\Palo Alto Networks\GlobalProtect\
            2. macOS - /Users/$USER/Library/Application Support/PaloAltoNetworks/GlobalProtect/

Viewing configuration change caused by content version 9108:

• Execute firewall CLI command show gp-broker panos-config and search enforcer-exception-list.
• Generated XML while running content version 9108 (no <member> tag).

<enforcer-exception-list>1.1.1.1/32,8.8.8.8/32,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8</enforcer-exception-list>\n 
<enforcer-exception-list-domain>*.gtlaw.com,*.pingone.com,*.zoom.us,*.digicert.com,www.msftconnecttest.com</enforcer-exception-list-domain>\n

• PanGPA log also doesn't showed any <member> tags.
• Generated XML while running content version 9107.

traffic-enforcement>yes</traffic-enforcement>
<enforce-globalprotect>yes</enforce-globalprotect>
<enforcer-exception-list>
  <member>1.1.1.1/32,8.8.8.8/32,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8</member>
</enforcer-exception-list>
<enforcer-exception-list-domain>
  <member>*.gtlaw.com,*.pingone.com,*.zoom.us,*.digicert.com,www.msftconnecttest.com</member>
</enforcer-exception-list-domain>

• PanGPA.log shows the same:

        <enforcer-exception-list>
            <member>1.1.1.1/32,8.8.8.8/32,192.168.0.0/16,172.16.0.0/12,10.0.0.0/8</member>
             </enforcer-exception-list>
        <enforcer-exception-list-domain>
            <member>*.gtlaw.com,*.pingone.com,*.zoom.us,*.digicert.com,www.msftconnecttest.com</member>
          </enforcer-exception-list-domain>