topic Re: Checking if GlobalProtect status is active (connected) via script or command line in GlobalProtect Discussions

Checking if GlobalProtect status is active (connected) via script or command line

Eljay123 — Fri, 17 Mar 2023 12:37:19 GMT

Hello Team,

I would like to find out if there's an way to check if GlobalProtect agent status is connected and VPN is active on Macintosh using bash or zsh command line or script.

Thanks.

Re: Checking if GlobalProtect status is active (connected) via script or command line

nikoolayy1 — Wed, 22 Mar 2023 14:26:18 GMT

Have you tested this?

"C:\Windows\system32\sc.exe" query pangps | find "STOPPED"

scquery pangps | find "STOPPED"

https://www.crowdstrike.com/blog/exploiting-escalation-of-privileges-via-globalprotect-part-1/

"sc" seems the command line tool for this job.

Re: Checking if GlobalProtect status is active (connected) via script or command line

aleksandar.astardzhiev — Wed, 22 Mar 2023 14:46:25 GMT

Hi @nikoolayy1 ,

I wouldn't agree you could determine the status of GP tunnel (connected or not connected), just by looking at PanGPS service status.

PanGPS service will still be running even if it is not currently connected to any GP gateway.

@Eljay123 ,

If you only need to know if GP is connected or not, you could probably just look at interfaces and see if tunnel interface for PanGP is present. You could also check routing table for routes pointing to the tunnel.

Re: Checking if GlobalProtect status is active (connected) via script or command line

nikoolayy1 — Wed, 22 Mar 2023 15:17:29 GMT

You are right. I tried to find if there are some documented windows terminal/powershell commands like the ones for Linux https://docs.paloaltonetworks.com/globalprotect/5-1/globalprotect-app-user-guide/globalprotect-app-for-linux/disable-the-globalprotect-app-for-linux but I found an old post:

https://live.paloaltonetworks.com/t5/globalprotect-discussions/checking-if-global-protect-is-active-connected-via-script-or/td-p/505980

Get-NetAdapter | Where-Object {$_.InterfaceDescription -like "PANGP Virtual Ethernet Adapter*"} | Select-Object Status