GP 6.1 for Mac not prompting for domain login unless GP 5.10 was previously installed

Slappy — Sat, 10 Jun 2023 03:37:43 GMT

To start with a little history. Our fleet was all Monterey and running GP 5.10. As we prepared for Ventura, we first pushed out GP 6.1 to the Monterey systems. Then they upgrade to Ventura and everything has been fine. That is for pre-existing machines. Here is where we are struggling.

On new devices with Ventura installed, we are trying to deliver GP 6.1. It installs fine but the user is never prompted to authenticate with our identity provider (Azure). The GP menu will display an error and then state "Retrieving portal configuration..." indefinitely. The user is never prompted for cloud identity credentials.

However, if I uninstall GP 6.1 and install GP 5.10, then the identity provider prompt is displayed, the user is able to authenticate, and the VPN connection is made. Once the initial connection with 5.10 is complete, I can immediately upgrade to 6.1 and the connection will establish.

On initial installation (before signing in), both com.paloaltonetworks.GlobalProtect.settings.plist and com.paloaltonetworks.GlobalProtect.client.plist show then same default values regardless of installed version. However, I did notice that only when installing version 5.10 do I get a ServerCert.pan file in /Users/<the_user>/Library/Application\ Support/PaloAltoNetworks/GlobalProtect.

Any hints on how to make version 6.1 work without first installing version 5.10? I see that 6.2 is available and I've requested it from the GP team (don't have it yet). We've been getting around this by delivering 5.10 to the machines, letting the users establish their first connection, and then upgrading them to 6.1. Ideally, I would like to simplify the deployment.

The Macs are managed by an MDM and we have one profile that contains the Content Filter, PPPC, and System Extension payloads. A second profile delivers the URL in a custom application payload. The settings are:

<dict>

<key>PanPortalList</key>

<array>

<string>host.server.domain</string>

</array>

<key>user-credential-saved</key>

</dict>

Anyone else experiencing the same issue? Any suggestions on what to try to allow version 6.1 to work without first installing version 5.10?

topic GP 6.1 for Mac not prompting for domain login unless GP 5.10 was previously installed in GlobalProtect Discussions

GP 6.1 for Mac not prompting for domain login unless GP 5.10 was previously installed