Global Protect is having issues with newer MACOS version.

[A.Alquicer]

Hi, 

I have problems trying to sign in some mac users that are running some SEQUOIA and TAHOE version, the only version that is working is 15.7.4 Sequoia version.

It seems that the gl client is unable to authenticate. I checked in logs and it seems that the gp client is not able to open a .dat file 

04/15/2026 17:06:14:954 [Info ]: Portal pre-login result received
04/15/2026 17:06:14:959 [Info ]: Portal Login starts
04/15/2026 17:06:14:959 [Info ]: Failed to open file /Users/xxxxxxx/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_4e1b226270df84fb5dd14ab621b71cb.dat
04/15/2026 17:06:14:959 [Info ]: Failed to UnserializePortalPrelogonAuthCookie.
04/15/2026 17:06:14:959 [Info ]: Unserialized empty cookie for portal dc3-gp-p.tychon.io and pre-logon user.
04/15/2026 17:06:14:959 [Info ]: Logging into portal
04/15/2026 17:06:14:991 [Info ]: Auth Failed during login
04/15/2026 17:06:14:991 [Info ]: portal status is User authentication failed.

Any ideas on how to solve this?

[A.Alquicer]

Just adding one more important point: I've already checked the compatibility matrix and the gp version is supposed to be compatible with the macos versions

[abayoumi21]

This issue is most likely related to GlobalProtect client compatibility and file permission/access changes in newer macOS versions (Sequoia / Tahoe). The failure to read the .dat file indicates the client cannot access or deserialize the pre-login cookie, which results in authentication failure.

Explanation

From the logs:

Failed to open file ... PanPUAC_xxx.dat
Failed to UnserializePortalPrelogonAuthCookie
Auth Failed during login

This means:

• The GlobalProtect client cannot read or access its local authentication cache file
• The pre-login cookie (used for authentication) cannot be processed
• Authentication to the portal fails as a result

This behavior is commonly seen with newer macOS versions (like Sequoia/Tahoe) due to:

• Stricter file system permissions (TCC / sandboxing)
• Changes in Application Support directory access
• Incompatibility with older GlobalProtect client versions

Recommended Troubleshooting

Verify GlobalProtect Version

Ensure you are using a version that supports newer macOS releases (very important).
Older GP clients often fail with new macOS security controls.

Check File Permissions

Verify the directory:

/Users/<user>/Library/Application Support/PaloAltoNetworks/GlobalProtect/

Ensure:

• Correct ownership (user)
• Read/write permissions
• No corruption of .dat files

---

Clear Corrupted Files

Delete the problematic file:

PanPUAC_*.dat

Then reconnect.

Reinstall GlobalProtect Client

A clean reinstall often resolves:

• File corruption
• Permission inheritance issues
• Compatibility problems

[melwin62carl]

This issue appears to be related to the GlobalProtect client failing to access or properly read a required local authentication file on newer macOS versions like Sequoia and Tahoe. The log clearly shows that the client cannot open the .dat file located in the user’s Library path, which leads to a failure in unserializing the pre-logon authentication cookie and ultimately causes the login attempt to fail. changehealthcare

[icedogm]

Happened to me on 11.1.14, downgrading to 11.1.13 fixed the issue without fixing anything on client's side.

[DSloane]

I'm experiencing something very similar on a handful of Macs running OS 26.5.1 since upgrading from PANOS 11.1.13 to 11.1.15. Multiple GP Mac client versions, including 6.3.3.1016 and6.2.8.431, produce the same result.

Uninstalling, clearing the /Library and /$HOME GP directories with these commands, and re-installing, has not helped.

sudo rm -rf "/Library/Application Support/PaloAltoNetworks/GlobalProtect" 
rm -rf "$HOME/Library/Application Support/PaloAltoNetworks/GlobalProtect"

I have detailed logs from one machine, after a clean install and I get similar file open errors:

pan_gp_event.log:06/19/2026 16:46:58:927 [Info ]: Failed to open file /Users/username/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_ff4ba9c0dc7cddc85563cce5a98a52b4.dat
pan_gp_event.log:06/19/2026 16:47:20:711 [Info ]: Failed to open file /Users/username/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_16d4ceb8fe5ded3d7c7829da80e08767.dat
pan_gp_event.log:06/19/2026 16:47:20:711 [Info ]: Failed to open file /Users/username/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_16d4ceb8fe5ded3d7c7829da80e08767.dat

It seems like a new file is created for every connection attempt. 

I'm also seeing concurrent failures accessing some /Library application files

PanGPS.log:P71205-T21507 06/19/2026 16:47:20:711 Debug( 619): pan_read_text_from_file(): File does not exist. File: /Users/jgister/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPCD_16d4ceb8fe5ded3d7c7829da80e08767.dat
PanGPS.log:P71205-T21507 06/19/2026 16:47:20:711 Debug( 619): pan_read_text_from_file(): File does not exist. File: /Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPPAC_e7eff5c31cf79dd660fae4fac46dd49e.dat
PanGPS.log:P71205-T21507 06/19/2026 16:47:20:711 Debug( 619): pan_read_text_from_file(): File does not exist. File: /Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPortalCfgCriteria_16d4ceb8fe5ded3d7c7829da80e08767.dat
PanGPS.log:P71205-T21507 06/19/2026 16:47:20:711 Debug( 619): pan_read_text_from_file(): File does not exist. File: /Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPortalCfgCriteria_16d4ceb8fe5ded3d7c7829da80e08767.dat

I'd like to avoid rolling back to PANOS 11.1.13, since we upgraded to address the vulnerabilities announced in May. 

Have folks had success deleting these PanPUAC_*.dat files?

Is rolling back to 11.1.13 the only fix that has worked?

[V.Vishnu]

Hi Team,

Even we are facing the same issue after upgrading to 11.1.15 the MAC users are unable to connect to GP.
Apart from downgrade, were you able to find any other solution for this issue.

[dmitriyc]

Also had same issue... PAN OS version 11.1.13-h7, GP - 6.3.3-c999. 

One user with this log:

06/19/2026 12:00:50:501 [Info ]: GlobalProtect service started (client version: 6.3.3-999, OS version: Apple Mac OS X 26.5.1).
06/19/2026 12:02:01:256 [Info ]: Started the Portal pre-login
06/19/2026 12:02:01:256 [Info ]: CPanMSService::PreloginPortal CheckServerCert return 0x2000
06/19/2026 12:02:01:471 [Info ]: Portal pre-login result received
06/19/2026 12:02:01:474 [Info ]: Portal Login starts
06/19/2026 12:02:01:474 [Info ]: Failed to open file /Users/XXX/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_b1fe8a4c7e3d3f2a16eb62ceb8d399.dat
06/19/2026 12:02:08:933 [Info ]: Troubleshooting log is generated with the error stage (Portal login) and the error detail (Authentication Failed.).
06/19/2026 12:02:30:847 [Info ]: Started the Portal pre-login
06/19/2026 12:02:30:847 [Info ]: CPanMSService::PreloginPortal CheckServerCert return 0x2000
06/19/2026 12:02:31:090 [Info ]: Portal pre-login result received
06/19/2026 12:02:31:093 [Info ]: Portal Login starts
06/19/2026 12:02:31:093 [Info ]: Failed to open file /Users/XXX/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_b1fe8a4c7e3d3f2a16eb62ceb8d399.dat
06/19/2026 12:02:37:233 [Info ]: Troubleshooting log is generated with the error stage (Portal login) and the error detail (Authentication Failed.).

Another example with this log: 

06/23/2026 09:37:45:262 [Info ]: Started the Portal pre-login
06/23/2026 09:37:45:262 [Info ]: CPanMSService::PreloginPortal CheckServerCert return 0x2000
06/23/2026 09:37:45:664 [Info ]: Portal pre-login result received
06/23/2026 09:37:45:669 [Info ]: Portal Login starts
06/23/2026 09:37:45:670 [Info ]: File is successfully decrypted. File: /Users/XXXX/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_5e79fd3476f56944e9e81405cfc86b2.dat
06/23/2026 09:37:45:670 [Info ]: Unserialized non-empty cookie for portal portal.com and user XXXX.com
06/23/2026 09:37:45:670 [Info ]: File is successfully decrypted. File: /Users/XXXX/Library/Application Support/PaloAltoNetworks/GlobalProtect/PanPUAC_5e79fd3476f56944e9e81405cfc86b2.dat
06/23/2026 09:37:45:670 [Info ]: Unserialized non-empty cookie for portal portal.com and user user XXXX.com
06/23/2026 09:37:45:671 [Info ]: Unserialized empty cookie for portal portal.com and pre-logon user.
06/23/2026 09:37:45:671 [Info ]: Failed to get portal login password.
06/23/2026 09:37:45:671 [Info ]: Logging into portal
06/23/2026 09:37:45:733 [Info ]: Auth Failed during login
06/23/2026 09:37:45:735 [Info ]: Cleared user auth cookie for portal06/23/2026 09:37:55:935 [Info ]: Troubleshooting log is generated with the error stage (Portal login) and the error detail (Authentication Failed.).
06/23/2026 09:37:59:790 [Info ]: Troubleshooting log is generated with the error stage (Portal login) and the error detail (Authentication Failed.).

So first of all try to change in systyem setting default browser - in my case i changed from Chrome to Safari. After such change user was able to connect without any issues. 

After that i just started to check each chrome extensions one by one... and guess what? Problem was in AdBlock extension... after we disabled it - both users were able to connect to GP without any issues... 

[DSloane]

We found that about half of our Macs were appending numbers, like "computername (35)", to their hostnames. Renaming the host to "computername" fixed the GlobalProtect login issue.

This seems to be caused by Bonjour Advertising Services, when a Mac has active Ethernet and Wireless network connections at the same time. The Mac sees there's another Mac with the same name, and adds a number to the hostname, to avoid duplication.

This is the least-bad Apple article I could find on this topic - Change your computer’s name or local hostname on Mac - Apple Support - but I don't think it's current.
You can see a better description of the hostname-suffix problem here - [Bug]: Bonjour hostname conflict loop causes thousands of mDNS re-registrations · Issue #3238 · open...

And a good summary of the root cause here https://www.reddit.com/r/paloaltonetworks/comments/1tv8vfj/comment/opfjgzc/ 

I expect to disable Bonjour Advertising Services whenever this becomes a problem.