topic Re: How to avoid GlobalProtect autostart on Mac in GlobalProtect Discussions

How to avoid GlobalProtect autostart on Mac

starless — Sat, 30 Mar 2024 17:35:44 GMT

Hello,

I just had to start using the GlobalProtect VPN client for connecting to the VPN of a customer.

I'm using macOS Sonoma 14.4.1, and I installed GlobalProtect 6.2.0-89.

Is there a way to avoid having it running constantly in the background, and showing the icon in the menu bar?

I will need to use it 2-3 times a year so I do not want to have it always active, it does not make sense.

I tried disabling its permissions to run in the background, but then it appears the VPN is totally unable to work, even after manually starting the application.

This **bleep** thing does not even have a "Quit" button, and it can't even be killed by a "force quit" or a "kill -9"!

(Let me say this is extremely bad UX development...)

Any clues?

Thanks!

Re: How to avoid GlobalProtect autostart on Mac

Claw4609 — Mon, 01 Apr 2024 19:19:46 GMT

Hello,

You would need to reach out to the customer that manages the GlobalProtect portal and work with them. It sounds like they may have the connect-method set to always-on and sounds like this is undesirable. Or depending on what is wanting to be achieved the admin would also have the option to set the flag "Display GlobalProtect Icon" to "No".

This would all depend on the companies polices and processes so you would have to reach out to them to see what the options are since it doesnt sound like you have control over the GlobalProtect portal.

Re: How to avoid GlobalProtect autostart on Mac

starless — Mon, 01 Apr 2024 21:42:03 GMT

Thank you Claw4609,

but I'm afraid you misunderstood me: my VPN connection is NOT always on.

My problem is that the application itself, the GlobalProtect client, is starting automatically on my Mac at boot time, and it stays always there, even if NOT connected to the VPN. Even if I do not enter my VPN configuration data at all.

So the issue in my humble opinion is not in the portal configuration, but in the client itself instead.

How can I prevent the client to start automatically at boot? I'm not even able to kill it.

For example, I previously used the FortiClient VPN client for another network, and even though it was automatically starting at boot, I could at least quit it by using an option from the menu bar icon, and then re-open it again when needed.

Thanks.

Re: How to avoid GlobalProtect autostart on Mac

SteveBrown808 — Fri, 20 Dec 2024 00:06:56 GMT

Bit late from original question, perhaps this will help someone else. I am our Prisma Access admin testing new GP App config that requires GP for network access: no GP no network. Today, I sit down to GP request authentication, no problem, happens all the time, except this time it failed several times. Now I have no network access to do anything, I later learned it was a silent expired AD password; macs get no love in Microsoft's world 🙂

You need to modify /Library/LaunchAgents/com/paloaltonetworks.gp.pangpa.plist:

RunAtLoad:[true/false]

KeepAlive:[true/false]

I rebooted after this mod, all good.

I want to make it clear that I do not recommend disabling GP, on the contrary I am further locked down our configuration, this was an unanticipated scenario (expired password) to which I required a solution, and now need to consider for other users in similar situation.

<key>RunAtLoad</key>
<false/>
<key>KeepAlive</key>
<false/>

Re: How to avoid GlobalProtect autostart on Mac

starless — Mon, 30 Dec 2024 21:54:07 GMT

Hi,

much time has passed since my request, and the recent comment reminded me of its existance 🙂.

I'll take the opportunity to report that in the meantime I found an easy way to avoid having the app/icon always running: in system preferences --> Login items there is a "Palo Alto Networks" item, which can be disabled to turn off the icon in the menu bar (and I guess it also shuts down the app). See attached screenshot.

When I need the VPN I can just enable the login item again, the menu bar icon appears again and I'm able to connect to the VPN without the need to reboot the Mac or anything else.

Kind regards.