GlobalProtect App 5.2 Known Issues

When performing a new installation of GlobalProtect 5.2.10 or later on an M1 MacBook device that does not have Rosetta 2 installed, the Autonomous DEM agent does not get installed even though the message that GlobalProtect displays indicates that the agent installed successfully.

Workaround: Manually install Rosetta 2 on the M1 MacBook device and then refresh the GlobalProtect connection to enable GlobalProtect to re-initiate the install of the Autonomous DEM agent.

When you install GlobalProtect app 5.2.6 on macOS devices and the portal is configured to install the Autonomous DEM (ADEM) endpoint agent for the first time, the pop-up prompt appears, prompting end users for administrative privileges to modify system settings.

Workaround: Select OK so that the pop-up prompt does not appear again.

GlobalProtect users on Windows devices are unable to log in to the device using the User Principal Name (UPN)- for example, username@domain- when the GlobalProtect credential provider is selected and the device is offline.

On macOS endpoints, the HIP check incorrectly identifies the Symantec Endpoint Protection as version 99.0.1.0000 instead of version 14.3RU2, causing the device to fail the HIP check.

After upgrading the GlobalProtect app for macOS, system extensions may not be automatically enabled at times, preventing access to applications (for example, excluding Zoom traffic from the GlobalProtect tunnel). An Apple Feedback case (FB974069) has been filed to track this limitation with the Apple system/network extension SDK.

Workaround: To re-enable the system extensions after upgrading the GlobalProtect app for macOS, reboot the system.

The GlobalProtect app is unable to detect Jamf version 10.32.2 in the HIP check, causing the endpoints to fail the check.

When the GlobalProtect app was installed on Linux devices, the users were unable to logon to the app due to authentication failure in the gateway pre-login stage.

In a Split DNS configuration, if you have configured the GlobalProtect app Split-Tunnel Option to send Both Network Traffic and DNS in the dynamic app configuration on the portal, after upgrading to GlobalProtect app version 5.2.8 there is an issue where DNS queries are being sent out on both the virtual adapter and the physical adapter.

On ARM-based MacBooks running macOS M1, after upgrading to agent version 5.2.8 the GlobalProtect app was unable to detect HIP information for Anti-Malware, Disk Backup, Disk Encryption, Firewall, and Patch Management.

On macOS endpoints the GlobalProtect app is unable to detect Jamf version 10.31.0 in the HIP check, causing the endpoints to fail the HIP check.

When you upgrade GlobalProtect app 5.2.5 to GlobalProtect app 5.2.5-c84, the error message Unable to install because a newer version of this product is already installed displays on the app.

Workaround: When upgrading from GlobalProtect app 5.2.5 to GlobalProtect app 5.2.5-c84, use either the transparent software upgrade or prompt users when a new version is activated. If you are using the Windows Installer (Msiexec), you must unintall GlobalProtect app 5.2.5 and install GlobalProtect app 5.2.5-c84.

On macOS endpoints running macOS Big Sur, the Host Profile displayed the OS in the HIP report as Mac OS X 10.16 instead of 11.0.1.

The default system browser for SAML authentication does not work on 32-bit versions of Window devices.

The GlobalProtect app took more than two minutes to establish a connection when users installed the app for the first time on macOS endpoints running macOS Catalina 10.15.4 or later.

Workaround: The administrator must select the GlobalProtect System Extensions check box during the installation.

After GlobalProtect was installed on a Windows device and a connection was established, high CPU usage (around 30 percent) was detected for the system process.

The GlobalProtect filter driver on Windows hangs in STOP_PENDING state when users switched between the portals enabled and disabled for Enforce GlobalProtect Connections with FQDN Exclusions.

Workaround: Users must restart the GlobalProtect service by logging out of the system, logging in to the system, or rebooting the system.

When Firefox is used as the default system browser, the Open GlobalProtect System dialog does not appear and the GlobalProtect app fails to launch when clicking Click here to launch GlobalProtect on Firefox. The app continues to stay in the connecting state.

Workaround: Launch the app and refresh the connection. Firefox opens a new tab when authentication is completed and GlobalProtect is connected.

Safari cannot be added to the application-based split tunnel rule on macOS endpoints.

Users cannot install the GlobalProtect app on Linux devices with Ubuntu 20.04 LTS.

Workaround: Install the GlobalProtect app on Linux devices using the dpkg utility of the Debian package along with the apt-get utility.

To install the GlobalPtotect app CLI, use $ sudo dpkg -i <gp-app-pkg>. For example: $ sudo dpkg -i GlobalProtect_deb-5.3.3.0-3.deb.

When the split tunnel settings based on the destination domains are configured on the GlobalProtect gateway and either Chrome or the Edge browser is used to navigate to these domains on macOS endpoints running macOS Catalina 10.15.4 or later, the connection reset errors appear for a few seconds before the website launches.

When you change the Use Default Browser for SAML Authentication option from Yes to No and then end users sign out of the GlobalProtect app, the app opens a new tab on the default system browser instead of the embedded browser.

Workaround: Users must refresh the connection, disable or enable the GlobalProtect app, or disconnect the app to open the embedded browser for SAML authentication and connect to GlobalProtect.

The GlobalProtect app does not support portal names with non-English characters.

On macOS endpoints, the GlobalProtect app can’t detect the following Anti-Malware information for the HIP match log details of the Gatekeeper security feature (MonitorLogsHIP Match<hip-match-log>):