GlobalProtect app on macOS 26.7/macOS 27 connects and immediately disconnects in a loop when local network access is disabled

The GlobalProtect app exhibits a continuous connection loop on affected macOS versions where authentication succeeds, but a stable tunnel cannot be maintained.

Observed Behavior:

• Continuous Connection Loop: Portal and gateway authentication succeed (e.g., via SAML/Okta), and the app briefly displays Connected. The tunnel immediately drops, switching to Disconnected, before automatically attempting to reconnect. This cycle repeats indefinitely.
• Immediate Onset: The loop is continuous rather than intermittent and begins immediately upon the first sign-in following the macOS update.
• Standard Troubleshooting Ineffective: Reinstalling GlobalProtect, disabling and re-enabling system extensions, rebooting the machine, or upgrading/downgrading to different GlobalProtect builds does not resolve the issue.

• Palo Alto Firewalls
• Supported PAN-OS versions
• GlobalProtect App 6.2.8-hx and 6.3.3-hx versions
• Affected clients: macOS 26.7 (including 26.7 beta 1) and macOS 27 (Golden Gate) beta builds up to 27.1
• Unaffected client: macOS 26.5 and macOS 26.6.1

This behavior is caused by an underlying routing update failure introduced in specific macOS versions (not a defect within the GlobalProtect app itself).

This issue occurs when all of the following conditions are met:

• The machine is running an affected macOS version.
• The GlobalProtect gateway configuration has local network access disabled (No direct access to local network).
• The tunnel's Include Routes contain a subnet that overlaps with the Mac’s local physical network (e.g., the Mac’s local network uses 192.168.68.0/24 with gateway 192.168.68.1, while the Include Routes contain 192.168.0.0/16).

When local network access is disabled alongside an overlapping include route, GlobalProtect must install system routes so the Mac can maintain reachability to its physical default gateway. On affected macOS builds, these OS route updates fail. Consequently, the Mac loses its network path to the GlobalProtect gateway, causing the tunnel to collapse and restart the connection process.

Workaround:

If an immediate macOS upgrade is not feasible, apply one of the following temporary configurations:

1. Modify Include Routes (Recommended)- Narrow down or remove the overlapping subnet from the gateway's Include Routes so it no longer encompasses the local user subnet and physical gateway. This maintains your security posture while resolving the loop.

2. Allow Local Network Access - Uncheck "No direct access to local network" (DLSA) in the gateway agent split tunnel configuration.

Note: Only use this if your organization's security and compliance policies allow local subnet access.

Resolution:

Upgrade to macOS 27.2 or later because this is an OS-level routing issue; no changes or updates to the GlobalProtect app are required.

The following recurring log entries in the GlobalProtect App logs indicate this routing failure:

• pan_gp_event.log -
  • Tunnel is down due to packet sending failure
• PanGPS.log -
  • DLSA: Failed writing to routing socket
  • DLSA: inet_pton failed for esp-tunnel
  • send(...) failed: 65(No route to host)
  • Default gateway masked by <subnet> [where the subnet is an include route that covers the Mac's local default gateway].