topic Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia in General Topics

Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

Salathiwe — Wed, 26 Jun 2024 08:58:18 GMT

Can you please provide some advise on this:

Our client has an issue with the new Apple MACOS Sequoia

The new Apple MacOS Sequoia seems to have changed some behaviour in how they check the local firewall. Currently Global Protect HIP does not detect if the local firewall is enabled.

I have attached the information above.

Apple Firewall:

Global Protect HIP:

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

abandey — Wed, 26 Jun 2024 22:52:15 GMT

Can you check what report is generated by the GP and then what is being sent to the firewall?

Take any user using that MAC version, and generate a dump report on the firewall CLI. Compare that with the previous MAC OS version, and notice the difference between the report generated and the report sent.

As such, I am not seeing anything reported yet, so once you have done the comparison and are convinced that this might be a bug, open a case and attach the collected logs and reports there.

Below are a few KB articles that you can follow:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClshCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boP1CAI

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

BPry — Wed, 26 Jun 2024 23:19:03 GMT

@Salathiwe,

Keep in mind that Sequoia is in beta and GlobalProtect isn't officially supported on this version of macOS yet. PAN will need to make some changes to facilitate this change, but if you open a support ticket you'll likely end up with the same response that I just gave you. For stuff like this, reaching out to your account team is what I personally find more useful so they can work internally to make sure engineers are aware of the issue without filtering through layers of support to just be told that betas aren't fully supported.

Should likely add, this is reproducible and isn't limited to you.

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

BarbarThomas — Tue, 23 Jul 2024 07:43:46 GMT

Thanks for the article links, I will check them.

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

jeffster — Tue, 23 Jul 2024 13:57:37 GMT

FWIW I was able to manually work around the firewall check but I haven't been able to figure out a way to work around the packet filter check. For the firewall, if you have an old copy of the alf plist file (/Library/Preferences/com.apple.alf.plist) you can manually set the global state flag as that is what global protect looks for it appears. I would love to figure out how to get around the packet filter but so far no luck.

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

J.Mahlman — Tue, 06 Aug 2024 12:14:53 GMT

The check should be `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`.

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

dfaust_92 — Tue, 17 Sep 2024 13:41:57 GMT

Hi do you have any updates ?

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

Salathiwe — Tue, 17 Sep 2024 13:47:09 GMT

Not on my end

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

losdelrock — Tue, 22 Oct 2024 22:00:59 GMT

All sorts of issues with Sequoia's Firewall. SSL/DNS/RDP/TimeMachine Backups - Google it. Looks like it has been resolved in Mac OS 15.1 RC (24B82).

I know because I have just upgraded to that and the issues are no longer there.

You need to enable beta updates on the Mac to get the RC or wait for the official release.

Oh and no word of acknowledgment from Apple.

Adrian.

Re: Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

Salathiwe — Wed, 23 Oct 2024 08:21:00 GMT

Hi Losdelrock

thank you for sharing this.
I will try this today