Global Protect Not working MacOs Ventura

[RuslanConk]

I use Macbook Pro 14 Inc M1 Pro with MacOS Ventura (13).

Running PAN OS 10.2.3 and Global Protect

But my global protect not working with this issue

P1772-T26627 11/01/2022 07:47:44:451 Error( 80): CPanSocket::Connect - Failed to connect to server at port:4767
P1772-T26627 11/01/2022 07:47:44:451 Error( 241): Cannot connect to service, error: 61
P1772-T26627 11/01/2022 07:47:44:451 Dump (1424): CPanCommand::Send - InitConnection failed again. return without sent.
P1772-T26627 11/01/2022 07:47:44:451 Dump (1339): Send command failed
P1772-T26627 11/01/2022 07:47:44:956 Debug(1329): Special command, expects no return msg: <request><type>setdebug</type><debuglevel>6</debuglevel></request>
P1772-T26627 11/01/2022 07:47:44:956 Dump (1422): CPanCommand::Send - not connected, and reintialized connection to service.
P1772-T26627 11/01/2022 07:47:44:956 Info ( 237): InitConnection ...
P1772-T26627 11/01/2022 07:47:44:956 Debug( 57): fd still open before connect
P1772-T26627 11/01/2022 07:47:44:958 Error( 80): CPanSocket::Connect - Failed to connect to server at port:4767
P1772-T26627 11/01/2022 07:47:44:958 Error( 241): Cannot connect to service, error: 61
P1772-T26627 11/01/2022 07:47:44:958 Dump (1424): CPanCommand::Send - InitConnection failed again. return without sent.
P1772-T26627 11/01/2022 07:47:44:958 Dump (1339): Send command failed

please help me.

[WilliamTheSE]

Generally those logs means there is an error with the service listening for the connection (on your workstation). On the MAC if you do the following from the terminal do you see this reply?

netstat -an | grep 4767

tcp4 0 0 127.0.0.1.4767 *.* LISTEN

[AnalysisMan · Accepted solution]

What is your GlobalProtect version?

Officially, macOS 13 (Ventura) is supported with GP 5.2.12 or later.

https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalp...

Hope this helps,

[RuslanConk]

58 / 5,000

Translation results

star_border

I am using globalprotect version 6.1 and pan os 10.2.3

[RuslanConk]

sh-3.2# netstat -an | grep 4767
sh-3.2#

no information listening port

and I try add rule on pf.cof like this

pass out inet proto tcp from any to any port 4767 no state

but global-protect client still not working

[AnalysisMan]

@RuslanConk,
I'm not sure whether you resolved the issue or not. If you still have the problem.

1. Check the Security & Privacy on the System Preferences.

Enable the kernel extension for GP under System Preferences > Security & Privacy > General by clicking the Allow button. The user then needs to restart after clicking Allow to start the service.

2. Run a command on the Recovery mode.
If the issue persists afterward, the Mac would need to be booted into Recovery mode and then run the following command from the Terminal:

 spctl kext-consent add PXPZ95SK77

PXPZ95SK77 is the unique identifier for Palo Alto Networks

Reboot the Mac and reinstall the GP client.

Hope this helps,

[steen.rabol]

How to enable the extension on MacOs Venture - the description above does not apply to latest version of MacOs

[jim_lumenti]

I am having a similar problem as once I installed Cortex XDR the new OS Ventura did not give me the option to Allow VPN config like back on Monterey.  The privacy section is different and I never saw an option for VPN config.

[jensstr]

Hi, 

I have the same issue. Ventura 13.5 (same on earlier Ventura versions). M1. Client Version is 6.2.0-89.

1. reinstalled the client multiple times (alowed extension in System / preferences)
2. lowered security profile in recovery console
3. executed  spctl kext-consent add PXPZ95SK77 in recovery console

Still the kexts are not loaded

System Extensions:

    [Running] GlobalProtectExtension - version 6.2.0-89 (Palo Alto Networks - 2023-07-27)
        Application: /Applications/GlobalProtect.app - version 6.2.0-89 (Palo Alto Networks - 2023-07-27)

        Description: System Extensions for GlobalProtect Split Tunnel and Enforcer

Kernel Extensions:

    /Applications/GlobalProtect.app

        [Not Loaded] gplock.kext - com.paloaltonetworks.GlobalProtect.gplock (Palo Alto Networks, 6.2.0 - SDK 10.10)

        [Not Loaded] gpsplit.kext - com.paloaltonetworks.GlobalProtect.gpsplit (Palo Alto Networks, 6.2.0 - SDK 10.10)

        [Not Loaded] pangpd.kext - com.paloaltonetworks.kext.pangpd (Palo Alto Networks, 6.2.0 - SDK 10.10)

Any idea? 

[TanoWashington]

version 6.0.0-38