Add a Configuration Profile for the GlobalProtect Enforcer by Using Jamf Pro 10.26.0

Where Can I Use This?	What Do I Need?
NGFW (managed by Panorama or Strata Cloud Manager) Prisma Access (managed by Panorama or Strata Cloud Manager)	GlobalProtect Gateway license or Prisma Access license with the Mobile User subscription

If you are using Jamf Pro 10.26.0, and you configured the GlobalProtect app 6.0.4 and later or 6.1 releases with the enforce GlobalProtect connections for network access feature (enforcer), you must add a configuration profile to filter network content and deploy it to your macOS endpoints.

Upon installation or upgrade of the GlobalProtect app, the following notification message appears:

To allow this network extension and suppress the pop-up automatically, you must add a configuration profile to filter network content using Jamf Pro 10.26.0.

For deploying GlobalProtect apps to macOS Big Sur 11 endpoints, you can also use the following instructions on any version of Jamf Pro to allow network extensions and suppress notification messages automatically.

1. In Jamf Pro, select ComputersConfiguration ProfilesNew.

2. Select Content Filter in the Options tab and configure the following values on the page:

   • FilterName = GlobalProtectEn
   • Identifier = com.paloaltonetworks.GlobalProtect.client
   • Socket Filter Bundle Identifier = com.paloaltonetworks.GlobalProtect.client.extension
   • Socket Filter Designated Requirement = anchor apple generic and identifier "com.paloaltonetworks.GlobalProtect.client.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77)
   • Network Filter Bundle Identifier = com.paloaltonetworks.GlobalProtect.client.extension
   • Network Filter Designated Requirement = anchor apple generic and identifier "com.paloaltonetworks.GlobalProtect.client.extension" and (certificate leaf[field.1.2.840.113635.100.6.1.9] /* exists */ or certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = PXPZ95SK77)

3. Save the configuration profile.