Deploy scripts using the macOS plist in GlobalProtect to make app setting changes and
run scripts at different events.
When a user connects to the GlobalProtect
gateway for the first time, the GlobalProtect app downloads the
configuration file and stores app settings in a GlobalProtect macOS
property file (plist). In addition to making changes to the app
settings, you use the plist to deploy scripts at any or all of the
following events: before and after establishing the tunnel, and
before disconnecting the tunnel. Use the following workflow to use
the plist to deploy scripts to macOS endpoints.
The
macOS plist settings that enable you to deploy scripts are supported
on endpoints running GlobalProtect App 2.3 and later releases.
(
Endpoints running Mac OS X 10.9 or a later
OS
) Flush the settings cache. This prevents the OS from using
the cached preferences after making changes to the plist.
To clear the default preferences cache, run the
killall cfprefsd
command
from a macOS terminal.
Open the GlobalProtect plist file, and locate or create
the GlobalProtect dictionary associated with the connect or disconnect
event. The dictionary under which you will add the settings determines
when the GlobalProtect app runs the script(s).
Use Xcode or an alternate plist editor to open the plist
file (
,
create a new dictionary for the event or events at which you want
to run scripts.
Enable the GlobalProtect app to run scripts by creating
a new
String
named
command
.
The value specified here should reference the shell script
(and the parameters to pass to the script) that you want run on
your endpoints.
If the
command
string
does not already exist, add it to the dictionary and specify the
script and parameters in the
Value
field.
For example:
$HOME/pre_vpn_connect.sh
/Users/username username
Environmental
variables are supported.
As
a best practice, specify the full path in commands.
(
Optional
) Add additional settings related to
the command, including administrator privileges, a timeout value
for the script, checksum value for the batch file, and an error
message to display if the command fails to execute successfully.
Create or modify additional strings in the plist (
