Add a Configuration Profile for the GlobalProtect Enforcer by Using Jamf Pro 10.26.0

Where Can I Use This?	What Do I Need?
Prisma Access PAN-OS GlobalProtect Subscription	Prisma Access Mobile Users license (for use with Prisma Access) GlobalProtect Gateway license (for use with PAN-OS) GlobalProtect app for macOS 6.0.4 and later and 6.1 and later releases Endpoints running macOS 11 (Big Sur), macOS 12 (Monterey), or macOS 13 (Ventura)

If you are using Jamf Pro 10.26.0, and you configured the GlobalProtect app 6.0.4 and later or 6.1 releases with the enforce GlobalProtect connections for network access feature (enforcer), you must add a configuration profile to filter network content and deploy it to your macOS endpoints.

Upon installation or upgrade of the GlobalProtect app, the following notification message appears:

To allow this network extension and suppress the pop-up automatically, you must add a configuration profile to filter network content using Jamf Pro 10.26.0.

For deploying GlobalProtect apps to macOS Big Sur 11 endpoints, you can also use the following instructions on any version of Jamf Pro to allow network extensions and suppress notification messages automatically.

In Jamf Pro, select
Computers
Configuration Profiles
New
.

Select
Content Filter
in the
Options
tab and configure the following values on the page:
FilterName
=
GlobalProtectEn
Identifier
=
com.paloaltonetworks.GlobalProtect.client
Socket Filter Bundle Identifier
=
com.paloaltonetworks.GlobalProtect.client.extension
Socket Filter Designated Requirement
=
anchor apple generic and identifier "com.paloaltonetworks.GlobalProtect.client.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77)
Network Filter Bundle Identifier
=
com.paloaltonetworks.GlobalProtect.client.extension
Network Filter Designated Requirement
=
anchor apple generic and identifier "com.paloaltonetworks.GlobalProtect.client.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77)


Save
the configuration profile.