Deploy Scripts Using the macOS Plist
When a user connects to the GlobalProtect gateway for the first time, the GlobalProtect app downloads the configuration file and stores app settings in a GlobalProtect macOS property file (plist). In addition to making changes to the app settings, you use the plist to deploy scripts at any or all of the following events: before and after establishing the tunnel, and before disconnecting the tunnel. Use the following workflow to use the plist to deploy scripts to macOS endpoints.
The macOS plist settings that enable you to deploy scripts are supported on endpoints running GlobalProtect App 2.3 and later releases.
- (Endpoints running Mac OS X 10.9 or a later
OS) Flush the settings cache. This prevents the OS from using
the cached preferences after making changes to the plist.To clear the default preferences cache, run the killall cfprefsd command from a Mac terminal.
- Open the GlobalProtect plist file, and locate or create
the GlobalProtect dictionary associated with the connect or disconnect
event. The dictionary under which you will add the settings determines
when the GlobalProtect app runs the script(s).Use Xcode or an alternate plist editor to open the plist file (/Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist) and go to one of the following dictionary locations:
If Settings dictionary does not exist, create it. Then, in Settings, create a new dictionary for the event or events at which you want to run scripts.
- /Palo Alto Networks/GlobalProtect/Settings/pre-vpn-connect
- /Palo Alto Networks/GlobalProtect/Settings/post-vpn-connect
- /Palo Alto Networks/GlobalProtect/Settings/pre-vpn-disconnect
- Enable the GlobalProtect app to run scripts by creating
a new String named command.The value specified here should reference the shell script (and the parameters to pass to the script) that you want run on your endpoints.If the command string does not already exist, add it to the dictionary and specify the script and parameters in the Value field. For example:
$HOME\pre_vpn_connect.sh /Users/username usernameEnvironmental variables are supported.As a best practice, specify the full path in commands.
- (Optional) Add additional settings related to
the command, including administrator privileges, a timeout value
for the script, checksum value for the batch file, and an error
message to display if the command fails to execute successfully.Create or modify additional strings in the plist (context, timeout, file, checksum, and/or error-msg) and enter their corresponding values. For additional information, see Customizable App Settings.
- Save the changes to the plist file.Save the plist.
Deploy App Settings in the Mac Plist
Deploy App Settings in the macOS Plist You can set the GlobalProtect app customization settings in the macOS global plist (Property list) file. This enables ...
Deploy App Settings to macOS Endpoints
Deploy App Settings to macOS Endpoints Use the macOS global plist (property list) file to set the GlobalProtect app customization settings or to deploy scripts ...
Customizable App Settings
Customizable App Settings In addition to pre-deploying the portal address, you can also define the app settings. To Deploy App Settings to Windows Endpoints you ...
Script Deployment Options
Script Deployment Options The following table displays options that enable GlobalProtect to initiate scripts before and after establishing a connection and before disconnecting. Because these ...
Deploy Scripts Using the Windows Registry
Deploy Scripts Using the Windows Registry You can enable deployment of custom scripts to Windows endpoints using the Windows Registry. You can configure the GlobalProtect ...
Collect Application and Process Data From Endpoints
Collect Application and Process Data From Endpoints The Windows Registry and macOS plist can be used to configure and store settings for Windows and Mac ...
Deploy App Settings Transparently
Deploy App Settings Transparently As an alternative to deploying app settings from the portal configuration, you can define them directly from the Windows Registry, global ...
Customize the GlobalProtect App
Customize the GlobalProtect App The portal agent configuration allows you to customize how your end users interact with the GlobalProtect apps installed on their endpoints. ...
Deploy Scripts Using Msiexec
Deploy Scripts Using Msiexec On Windows endpoints, you can use the Windows Installer (Msiexec) to deploy the GlobalProtect app, app settings, and scripts that the ...