End-of-Life (EoL)

Upgrade/Downgrade Considerations

This section lists the features that have upgrade or downgrade impacts. Make sure you understand all potential issues before you upgrade to or downgrade from GlobalProtect app 4.0.On Mac endpoints, if you configure the GlobalProtect portal app to
Enforce GlobalProtect for Network Access
and you downgrade from GlobalProtect app 4.0 (or from GlobalProtect agent 3.1) to an earlier release, the enforcement configuration is not removed and continues to block all traffic. To avoid this issue, Palo Alto Networks recommends that you uninstall GlobalProtect app 4.0 (or GlobalProtect agent 3.1) completely before you install an earlier release.If connection issues persist after you downgrade, use the following procedure to locate and manually remove the GlobalProtect enforcer kernel extension:
  1. Determine if the GlobalProtect enforcer kernel extension exists.
    On the Mac endpoint, type the following command:
    kextstat | grep gplock
  2. If the extension exists, unload the enforcer.
    Type the following command to unload the enforcer:
    sudo kextunload -b com.paloaltonetworks.GlobalProtect.gplock
  3. Prevent the enforcer from reloading after a reboot.
    Type the following command to remove the enforcer from the Mac hard disk:
    sudo rm -r "/System/Library/Extensions/gplock*.kext"

Recommended For You