Global Protect HIP Does Detect Firewall with New Apple MacOS Sequoia

[Salathiwe]

Can you please provide some advise on this:

Our client has an issue with the new Apple MACOS Sequoia 

 The new Apple MacOS Sequoia seems to have changed some behaviour in how they check the local firewall. Currently Global Protect HIP does not detect if the local firewall is enabled.

I have attached the information above.

Apple Firewall:

Global Protect HIP:

[abandey]

Can you check what report is generated by the GP and then what is being sent to the firewall?

Take any user using that MAC version, and generate a dump report on the firewall CLI. Compare that with the previous MAC OS version, and notice the difference between the report generated and the report sent.

As such, I am not seeing anything reported yet, so once you have done the comparison and are convinced that this might be a bug, open a case and attach the collected logs and reports there. 

Below are a few KB articles that you can follow:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClshCAC

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000boP1CAI

[BPry]

@Salathiwe,

Keep in mind that Sequoia is in beta and GlobalProtect isn't officially supported on this version of macOS yet. PAN will need to make some changes to facilitate this change, but if you open a support ticket you'll likely end up with the same response that I just gave you. For stuff like this, reaching out to your account team is what I personally find more useful so they can work internally to make sure engineers are aware of the issue without filtering through layers of support to just be told that betas aren't fully supported.

Should likely add, this is reproducible and isn't limited to you. 

[BarbarThomas]

Thanks for the article links, I will check them.

[jeffster]

FWIW I was able to manually work around the firewall check but I haven't been able to figure out a way to work around the packet filter check. For the firewall, if you have an old copy of the alf plist file (/Library/Preferences/com.apple.alf.plist) you can manually set the global state flag as that is what global protect looks for it appears. I would love to figure out how to get around the packet filter but so far no luck. 

[J.Mahlman]

The check should be `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`.

[dfaust_92]

Hi do you have any updates ? 

[Salathiwe]

Not on my end