MacOSX Tahoe 26.4.1 (25E253) / Global Protect 6.3.3: Network is unreachable

[Frederic_Ramage]

Hi, 

I've been facing an issue after upgrading my mac M3 to Tahoe 26.4.1 (25E253) (two days ago)

 When trying to connect to my portal/gateway, I always have the same response: Network is unreachable.

 Since I can browse to google or else, it's not a common/classic network issue.

 The fact is, even I send a good or wrong user/pass: the result is the same.

 Nothing on the logs in the Palo Alto.

I suspect it's a Mac os issue, since before the upgrade all was fine.

On my Palo Alto, no configuration has been changed.

If someone had this issue and was able to solve it, I would be happy to read about it.

Thanks a lot,

Fred

[BPry]

@Frederic_Ramage,

What PAN-OS version are you running? I've noticed issues with recent releases (IE: 12.1.16 and 11.2.11) when it comes to macOS, although I can't say for certain that it's actually tied to upgrading to macOS 26 in any way. You should still be able to see Portal authentication in what I've seen however, so you'll want to review your PanGPS logs and see exactly what error they are reporting. 

[Frederic_Ramage]

Hello,

  Thanks a lot for your reply.

  You're right. I'am able to login to portal (in web). 

 And we've had 2 upgrades:

   - Me with my mac

  - The Palo Alto has been upgraded to 12.1.16 last week...

 I may (try to) downgrade to previous 11.2.x version and see.

 I'll get back to you with thee result when done.

Regards,

Fred

[BPry]

@Frederic_Ramage,

The only non-working 11.2 release is 11.2.11 that I'm aware of, you can run any of the previous builds without issue. We've unfortunately seen some stability issues on 11.2.* outside of 11.2.11 in a couple of environments, so I've actually got a PA-440 operating as a macOS only VPN termination endpoint due to this issue. 

[Frederic_Ramage · Accepted solution]

Hi

 following your advice, we downgraded to 11.2.10-H5. All is working fine now.

 Previously, we ran 12.1.6 where Mac M3 and Mac Intel cannot connect.

 Many thanks for your help, faster than the Palo Alto support...

Regards,

Fred

[Pan_os]

we had same issue, any fix for 12.1.x ? we solved with downgrading to 11.2.x

[BPry]

@Pan_os,

At this point I think the hope is that 12.1.7 would include a fix for the issue, alongside 11.2.12 when they release on the 28th to fix the 11.2 train post 11.2.10. 

[MrugeshPatelCmp]

Hey all,

We ran into this exact issue in our environment and wanted to share what we found in case it saves someone else the headache.

We recently upgraded all our firewalls to PAN-OS 12.1.6 and our macOS Tahoe machines started getting "Network is Unreachable" errors with GlobalProtect. We spun up a lab, downgraded PAN-OS to 11.2.10, and tested across multiple GP versions — worked fine on all of them.

Ended up opening a TAC case, and that's when we found the real culprit: the Mac's hostname had special characters in it (think apostrophes, spaces — the classic "John's MacBook" style names that macOS sets by default). GlobalProtect doesn't play nice with those on macOS after any PanOS 11.2.11 or greater, regardless of which GP  version you're on.

---

First, check if your hostname is the problem.

Open Terminal (Cmd + Space → type "Terminal" → Enter) and run these:

# Basic system hostname

hostname

#local network hostnam

scutil --get LocalHostName

# User-friendly computer name (shown on your network)

scutil --get ComputerName

If you see any apostrophes, spaces, or special characters in the output — that's your issue.

Fix it by renaming the hostname (use only letters, numbers, and hyphens — no spaces):

sudo scutil --set HostName your-new-name

sudo scutil --set LocalHostName your-new-name

sudo scutil --set ComputerName your-new-name

Enter your admin password when prompted (nothing shows on screen while typing, that's normal). Then flush DNS and reboot:

dscacheutil -flushcache

sudo reboot

After the reboot GlobalProtect connected right away. No downgrade needed, no config changes on the firewall side.

This is also documented in the Palo Alto KB: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA1Ki000000kBP4KAM

Hope this helps someone — we burned a few days on this one!