GlobalProtect
macOS System Extensions Support
Table of Contents
macOS System Extensions Support
Software Support
: Starting with GlobalProtect™
app 5.1.4OS Support
: macOS The GlobalProtect App can now use system extensions on macOS Catalina 10.15.4 or macOS Big Sur 11
endpoints for enabling capabilities such as split tunnel on the GlobalProtect gateway
based on the destination domain name and application process name and to enforce
GlobalProtect connections for network access (see GlobalProtect App Customization) without
requiring kernel extensions. When users install the
GlobalProtect app for the first time on a macOS device running macOS Catalina
10.15.4, macOS Big Sur 11, or later or upgrade to GlobalProtect app 5.1.4, they must
now enable the system extensions. If you have configured
split tunnel on the gateway or enforced GlobalProtect connections for network access
on the portal, the
System Extension Blocked
notification
message displays on the app during the installation, prompting users to enable and
allow the system extensions in macOS that are blocked from loading to use these
GlobalProtect features.- (Optional)Allow GlobalProtect app users to automatically load the system extensions without receiving theSystem Extension Blockednotification.
- Enable theGlobalProtect System Extensionsto allow the system extensions in macOS to load.
- Complete the GlobalProtect app setup using the GlobalProtect installer.
- When prompted, select theGlobalProtect System Extensionscheck box on theInstallation Typescreen if the administrator has configured the split tunnel on the gateway or enforced GlobalProtect connections.
- SelectOpen Security Preferencesto enable the system extensions in macOS that was blocked from loading from theSystem Extension Blockednotification.
- Enable the network extensions configuration in macOS to use split tunnel and Enforce GlobalProtect for Network Access.
- (macOS Catalina 10.15.4 or later only) If you have configured split tunnel on the gateway, selectAllowin the following pop-up prompt:
- (macOS Catalina 10.15.4 or later only) If you have enabled the Enforce GlobalProtect Connections for Network Access feature, selectAllowin the following pop-up prompt:
- (macOS Big Sur 11 or later only) If you have configured split tunnel based on domains and applications on the GlobalProtect gateway and enabled the Enforce GlobalProtect Connections for Network Access feature, selectAllowin the following pop-up prompt:
If you have suppressed the network extensions configuration notifications by using the mobile device management system (MDM) such as Jamf Pro, you can automatically load the network extensions without receiving these notifications. Refer to the knowledge base article at https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HAW8 for information on how to enable system and network extensions using Jamf Pro.