Skip to main content

Hi Folks,

I'm putting this here to try to be a little helpful. We just moved from v5 to v6 for GlobalProtect, and basically, the setup that we had that, installed the stock pkg from paloalto and relied on a config profile to set our default portal stopped working. I also couldn't get the app to stop an endless "connecting" loop. 

So for anyone who is having the same issue, I hope this is helpful. Long story short, you need to package an XML file that installs the system extension with the app pkg and then run a script to install both.

The GP release notes for 6.0.1 speak of a new Simplified and Seamless macOS GP app deployment Using Jamf MDM integration feature. The documentation is helpful but not comprehensive so I'll put it together here.

 

Sources: https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-jamf/deploy-the-globalprotect-mobile-app-using-jamf

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-jamf/enable-system-and-network-extentions-on-macos-endpoints-using-jamf-pro

https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/mobile-endpoint-management/manage-the-globalprotect-app-using-jamf/enable-system-and-network-extentions-on-macos-endpoints-using-jamf-pro/enable-system-extensions-on-macos-endpoints-using-jamf-pro

 

  1. Download the pkg and create the script that sets the preferred portal. You can find the script in step 3 of this page. (of course you'll need to change the your.portalhere.com stuff)
  2. Upload script to jamf pro, don't upload the pkg yet.
  3. Follow step 1 and 2 in this article to create a config profile to allow the system extension.
  4. Create an XML file called install_system_extensions.xml with the XML in step 3 of this article. 
  5. Make the XML file executable.

 

sudo chmod +x /path/to/file/​

 

  • Pick a temporary location to install the stock pkg and XML file... for example /usr/local/ works.
  • Create a directory in that area and name it something like GP, drop the pkg and the XML file in that folder.
  • Open Composer and drag the GP folder in the left side, rename your folder on the left side of composer. (so that the pkg name that you create is something more useful than just "GP")
  • Change the owner and group of the pkg and XML file so it's root:wheel and apply to all contents on both the pkg and XML file.
  • Create the pkg.
  • Upload the pkg to jamf pro.
  • Create a script that will install GlobalProtect and the SystemExtension, then deletes the directory that jamf installs from the package that you created. Upload this to jamf pro. #2 in Step 3 of this page has the install command... or I threw it in the script below.

 

#!/bin/bash

#install pkg with system extension
sudo installer -pkg /path/to/globalprotectapppkg -applyChoiceChangesXML /path/to/xml/file -target /

#Delete directory
rm -rf /path/to/directory/that/was/installed

exit 0

 

  • Create a jamf policy and do the following...
    1. Add the package that you compiled in composer and set it to install.
    2. Add the script that sets the portal address to run before the pkg install.
    3. Add the script that does the installation of both the pkg and system extension to run after the pkg install.

This should do the trick! Again hopefully this is helpful! Good Luck!

For us its about the same or faster.Once you expand, you copy in the text file, then flatten


I'm not sure how that can be faster than simply uploading the new package to Jamf without any extra steps, but I guess I'll take your word for it.

Terms & ConditionsCookie settings