Unable to launch global protect on osx 15 (sequoia)

[deliprao]

Hello, I am on Mac OS Sequoia (15.0 (24A5289h)) and when I launch globalprotect, nothing happens. I looked at the console for any log messages, but nothing in their too. My employer's VPN setup page is here:

https://vpn.upenn.edu/global-protect/getsoftwarepage.esp

Can someone confirm if the version of the software they have there work with Sequoia, and if not, how do I get the right version?

Thanks,

Delip

[JayGolf]

Hi @deliprao ,

macOS 15 Sequoia is currently not supported by GlobalProtect. Please check out the techdoc for current support.

[AaronRamsumair]

Need an ETA. 

[JayGolf]

The MacOS sequoia was released just two weeks back, so it might take sometime to announce the official support. It takes time because the latest and greatest GP versions (6.0.X , 6.1.X , 6.2. X, 6.3. X) have to be tested on the new OS. 

[AaronRamsumair]

Developer and public betas have been available all summer long.  This could and should have been found earlier and resolved by the final release. 

[BPry]

@AaronRamsumair,

That developer beta changed quite a bit throughout its release, and paired with bugs and Apple not coming out directly and just saying what was modified it doesn't make for a great development platform. One of the large reasons why you're seeing so many companies, including PAN, struggle to get out updates and announce full support.

That being said, GlobalProtect itself fundamentally does work with macOS Sequoia and has since the very first beta release. Due to changes and bugs in Sequoia there's some aspect that don't function properly. The first being that some of your HIP checks will fail and need your need to upgrade your profiles to account for Sequoia reporting the firewall isn't enabled. Second being that having the firewall itself enabled in Sequoia introduces issues with long-running connections like SMB and RDP sessions.

The one thing you could argue PAN should have done is fix the HIP check for having the firewall enabled, but HIP isn't really designed to change via the version of the operating system that you're running. If you perform the Sequoia check on non-Sequoia releases then those will fail, continuing to check how it's implemented currently breaks Sequoia. While saying "just change the check for Sequoia once you know the version" is easily said, it's a fairly massive change to the existing HIP process.

[Weston]

@BPry 

> Second being that having the firewall itself enabled in Sequoia introduces issues with long-running connections like SMB and RDP sessions.

Anywhere I can get more info on this?

[BPry]

@Weston,

https://discussions.apple.com/thread/255765230?sortBy=rank

https://www.reddit.com/r/MacOS/comments/1fizxc9/ms_rdp_broken_on_macos_sequoia/

https://www.reddit.com/r/MacOS/comments/1aq8e6p/sonoma_smb_connectivity_issues_with_firewall/

https://discussions.apple.com/thread/255766529?sortBy=rank

There's a couple of examples. You can tell from the age of some of these discussions, but this was reported and identified extremely early in the Sequoia beta track. I know I myself reported it many times in feedback and just kind of assumed that it would be something fixed later in the development cycle, as that's typical of Apple betas. You'll identify a ton of things early on and a flurry of major fixes will go out towards the end of the beta cycle or even in the initial release. Unfortunately this appears to be one of those bugs that Apple has left even after general release.

[JohnHogman]

Hi, 

Has there been any fixes for the HIP-Checks yet? 
Is it all HIP-Checks that fail or is it just Firewall?

We are having these problems where we do HIP-Checks for both Firewall and Anti-Malware.

[BPry]

@JohnHogman,

Firewall would be expected if you are checking if it's enabled, as that is still currently not able to be validated. How is your check for anti-malware configured? That should be showing current via Xprotect and real-time-protection should be showing as yes for both Xprotect and Gatekeeper.

[JohnHogman]

Hi,

There seemed to be multiple configuration errors on the Palo in this case, bypassing the Firewall check in HIP solved this issue.

There seems to be a fix in GP 6.2.5? Is this a valid and stable version for MacOS 15?