Global Protect is having issues with newer MACOS version.

[A.Alquicer]

Hi, 

I have problems trying to sign in some mac users that are running some SEQUOIA and TAHOE version, the only version that is working is 15.7.4 Sequoia version.

It seems that the gl client is unable to authenticate. I checked in logs and it seems that the gp client is not able to open a .dat file 

04/15/2026 17:06:14:954 [Info ]: Portal pre-login result received
04/15/2026 17:06:14:959 [Info ]: Portal Login starts
04/15/2026 17:06:14:959 [Info ]: Failed to open file /Users/xxxxxxx/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_4e1b226270df84fb5dd14ab621b71cb.dat
04/15/2026 17:06:14:959 [Info ]: Failed to UnserializePortalPrelogonAuthCookie.
04/15/2026 17:06:14:959 [Info ]: Unserialized empty cookie for portal dc3-gp-p.tychon.io and pre-logon user.
04/15/2026 17:06:14:959 [Info ]: Logging into portal
04/15/2026 17:06:14:991 [Info ]: Auth Failed during login
04/15/2026 17:06:14:991 [Info ]: portal status is User authentication failed.

Any ideas on how to solve this?

[A.Alquicer]

Just adding one more important point: I've already checked the compatibility matrix and the gp version is supposed to be compatible with the macos versions

[abayoumi21]

This issue is most likely related to GlobalProtect client compatibility and file permission/access changes in newer macOS versions (Sequoia / Tahoe). The failure to read the .dat file indicates the client cannot access or deserialize the pre-login cookie, which results in authentication failure.

Explanation

From the logs:

Failed to open file ... PanPUAC_xxx.dat
Failed to UnserializePortalPrelogonAuthCookie
Auth Failed during login

This means:

• The GlobalProtect client cannot read or access its local authentication cache file
• The pre-login cookie (used for authentication) cannot be processed
• Authentication to the portal fails as a result

This behavior is commonly seen with newer macOS versions (like Sequoia/Tahoe) due to:

• Stricter file system permissions (TCC / sandboxing)
• Changes in Application Support directory access
• Incompatibility with older GlobalProtect client versions

Recommended Troubleshooting

Verify GlobalProtect Version

Ensure you are using a version that supports newer macOS releases (very important).
Older GP clients often fail with new macOS security controls.

Check File Permissions

Verify the directory:

/Users/<user>/Library/Application Support/PaloAltoNetworks/GlobalProtect/

Ensure:

• Correct ownership (user)
• Read/write permissions
• No corruption of .dat files

---

Clear Corrupted Files

Delete the problematic file:

PanPUAC_*.dat

Then reconnect.

Reinstall GlobalProtect Client

A clean reinstall often resolves:

• File corruption
• Permission inheritance issues
• Compatibility problems

[melwin62carl]

This issue appears to be related to the GlobalProtect client failing to access or properly read a required local authentication file on newer macOS versions like Sequoia and Tahoe. The log clearly shows that the client cannot open the .dat file located in the user’s Library path, which leads to a failure in unserializing the pre-logon authentication cookie and ultimately causes the login attempt to fail. changehealthcare

[icedogm]

Happened to me on 11.1.14, downgrading to 11.1.13 fixed the issue without fixing anything on client's side.