When users run the GlobalProtect app for Android, the app reports a

Required Client Certificate not found

error for the first time and failed when users switched between portals configured with different client certificate profiles. The client certificate authentication is successful when users attempt to connect to the app again.

Safari cannot be added to the application-based split tunnel rule on macOS endpoints.

When the split tunnel settings based on the destination domains are configured on the GlobalProtect gateway and either Chrome or the Edge browser is used to navigate to these domains on macOS endpoints running macOS Catalina 10.15.4 or later, the

connection reset

errors appear for a few seconds before the website launches.

When the split tunnel settings are configured to exclude application traffic such as Microsoft Teams and Skype, some excluded traffic are still forwarded through the tunnel.

GPC-9415

For the GUI version of the GlobalProtect app for Linux, SAML authentication with Microsoft Azure does not work on Ubuntu 1804 or greater versions.

Workaround

: Refresh the configuration again to trigger the connection.

GPC-7017

When users run the GlobalProtect app for Android on their Chromebooks, the app cannot connect to GlobalProtect gateways based on the source IP address of the user because it runs within the Android container on Chrome OS. The Android container uses a network bridge to connect the app to the network, so it is assigned a different IP address from the source IP address of the Chromebook user.

Workaround

: Ensure that gateway selection for the Android operating system is not based on the source IP address of the user by leaving both the

Region

and

IP Address

fields empty in the config selection criteria for your client settings configuration (

Network

GlobalProtect

Gateways

<gateway-config>

Agent

Client Settings

<client-settings-config>

Config Selection Criteria

).

GPC-6878

When users run the GlobalProtect app for Android on their Chromebooks, the app cannot connect to GlobalProtect portals using IPv6 because it runs within the Android container in Chrome OS, which does not currently support IPv6.

Workaround

: Set the

IP Address Type

for your GlobalProtect portal to

IPv4 Only

(

Network

GlobalProtect

Portals

<<portal-config>

General

).

GPC-6792

The GlobalProtect app does not support portal hostnames with non-English characters.

GPC-6456

When users establish a GlobalProtect connection for the first time on iPads running iOS 11.1, and they

Don’t Allow

GlobalProtect to send them notifications, the

Settings -> GlobalProtect

link on subsequent notification permission reminders does not open.

Workaround

: Upgrade your iPad to iOS 11.3 or a later version.

If you remain on iOS 11.1, you can enable GlobalProtect to send you notifications by going to the GlobalProtect notification settings on your iPad (

Settings

Notifications

GlobalProtect

) and then selecting

Allow Notifications

.

GPC-4856

On macOS endpoints, the GlobalProtect app can’t detect the following

Anti-Malware

information for the HIP Match log details of the Gatekeeper security feature (

Monitor

Logs

HIP Match

<hip-match-log>

):

PAN-109759

The firewall does not generate a notification for the GlobalProtect app when the firewall denies an unencrypted TLS session due to an authentication policy match.

DEM-2048

When performing a new installation of GlobalProtect 5.2.10 or later on an M1 MacBook device that does not have Rosetta 2 installed, the Autonomous DEM agent does not get installed even though the message that GlobalProtect displays indicates that the agent installed successfully.

Workaround:

Manually install Rosetta 2 on the M1 MacBook device and then refresh the GlobalProtect connection to enable GlobalProtect to re-initiate the install of the Autonomous DEM agent.

DEM-183

When you install GlobalProtect app 5.2.6 on macOS devices and the portal is configured to install the Autonomous DEM (ADEM) endpoint agent for the first time, the pop-up prompt appears, prompting end users for administrative privileges to modify system settings.

Workaround

: Select

OK

so that the pop-up prompt does not appear again.

GPC-14532

GlobalProtect users on Windows devices are unable to log in to the device using the User Principal Name (UPN)- for example,

username@domain

- when the GlobalProtect credential provider is selected and the device is offline.

GPC-14528

Fixed in GlobalProtect App 5.2.11

On macOS endpoints, the HIP check incorrectly identifies the Symantec Endpoint Protection as version 99.0.1.0000 instead of version 14.3RU2, causing the device to fail the HIP check .

GPC-14428

After upgrading the GlobalProtect app for macOS, system extensions may not be automatically enabled at times, preventing access to applications (for example, excluding Zoom traffic from the GlobalProtect tunnel). An Apple Feedback case (FB974069) has been filed to track this limitation with the Apple system/network extension SDK.

Workaround:

To re-enable the system extensions after upgrading the GlobalProtect app for macOS, reboot the system.

GPC-14375

The GlobalProtect app is unable to detect Jamf version 10.32.2 in the HIP check , causing the endpoints to fail the check.

GPC-14334

When the GlobalProtect app was installed on Linux devices, the users were unable to logon to the app due to authentication failure in the gateway pre-login stage.

GPC-14104

Fixed in GlobalProtect App 5.2.9

In a Split DNS configuration, if you have configured the GlobalProtect app

Split-Tunnel Option

to send

Both Network Traffic and DNS

in the dynamic app configuration on the portal, after upgrading to GlobalProtect app version 5.2.8 there is an issue where DNS queries are being sent out on both the virtual adapter and the physical adapter.

GPC-13870

Fixed in GlobalProtect App 5.2.9

On ARM-based MacBooks running macOS M1, after upgrading to agent version 5.2.8 the GlobalProtect app was unable to detect HIP information for

Anti-Malware

,

Disk Backup

,

Disk Encryption

,

Firewall

, and

Patch Management

.

GPC-13855

Fixed in GlobalProtect App 5.2.9

On macOS endpoints the GlobalProtect app is unable to detect Jamf version 10.31.0 in the HIP check , causing the endpoints to fail the HIP check.

GPC-13009

When you upgrade GlobalProtect app 5.2.5 to GlobalProtect app 5.2.5-c84, the error message

Unable to install because a newer version of this product is already installed

displays on the app.

Workaround

: When upgrading from GlobalProtect app 5.2.5 to GlobalProtect app 5.2.5-c84, use either the transparent software upgrade or prompt users when a new version is activated. If you are using the Windows Installer (Msiexec), you must unintall GlobalProtect app 5.2.5 and install GlobalProtect app 5.2.5-c84.

GPC-12107

On macOS endpoints running macOS Big Sur, the

Host Profile

displayed the

OS

in the HIP report as Mac OS X 10.16 instead of 11.0.1.

GPC-11730

The default system browser for SAML authentication does not work on 32-bit versions of Window devices.

GPC-11479

Fixed in GlobalProtect App 5.2.2

The GlobalProtect app took more than two minutes to establish a connection when users installed the app for the first time on macOS endpoints running macOS Catalina 10.15.4 or later.

Workaround:

The administrator must select the

GlobalProtect System Extensions

check box during the installation.

GPC-11347

Fixed in GlobalProtect App 5.2.1

After GlobalProtect was installed on a Windows device and a connection was established, high CPU usage (around 30 percent) was detected for the system process.

GPC-11316

Fixed in GlobalProtect App 5.2.1

The GlobalProtect filter driver on Windows hangs in

STOP_PENDING

state when users switched between the portals enabled and disabled for Enforce GlobalProtect Connections with FQDN Exclusions .

Workaround

: Users must restart the GlobalProtect service by logging out of the system, logging in to the system, or rebooting the system.

GPC-10995

When Firefox is used as the default system browser , the

Open GlobalProtect System

dialog does not appear and the GlobalProtect app fails to launch when clicking

Click here to launch GlobalProtect

on Firefox. The app continues to stay in the connecting state.

Workaround

: Launch the app and refresh the connection. Firefox opens a new tab when authentication is completed and GlobalProtect is connected.

GPC-10839

Safari cannot be added to the application-based split tunnel rule on macOS endpoints.

Users cannot install the GlobalProtect app on Linux devices with Ubuntu 20.04 LTS.

Workaround

: Install the GlobalProtect app on Linux devices using the

dpkg

utility of the Debian package along with the

apt-get

utility.

To install the GlobalPtotect app CLI, use

$ sudo dpkg -i <gp-app-pkg>

. For example:

$ sudo dpkg -i GlobalProtect_deb-5.3.3.0-3.deb

.

GPC-10603

When the split tunnel settings based on the destination domains are configured on the GlobalProtect gateway and either Chrome or the Edge browser is used to navigate to these domains on macOS endpoints running macOS Catalina 10.15.4 or later, the

connection reset

errors appear for a few seconds before the website launches.

GPC-10613

When you change the

Use Default Browser for SAML Authentication

option from

Yes

to

No

and then end users sign out of the GlobalProtect app, the app opens a new tab on the default system browser instead of the embedded browser.

Workaround

: Users must refresh the connection, disable or enable the GlobalProtect app, or disconnect the app to open the embedded browser for SAML authentication and connect to GlobalProtect.

GPC-6792

The GlobalProtect app does not support portal names with non-English characters.

GPC-4856

On macOS endpoints, the GlobalProtect app can’t detect the following

Anti-Malware

information for the HIP match log details of the Gatekeeper security feature (

Monitor

Logs

HIP Match

<hip-match-log>

):

PAN-109759

The firewall does not generate a notification for the GlobalProtect app when the firewall denies an unencrypted TLS session due to an authentication policy match.

When you install the CLI version of the GlobalProtect app 5.3.1 on Ubuntu Linux devices, the warning message

Warning: gpa.service changed on disk. Run ‘systemctl --user daemon-reload’ to reload units.

displays on the terminal.

GPC-14334

Fixed in GlobalProtect App 5.3.2

When the GlobalProtect app was installed on Linux devices, the users were unable to logon to the app due to authentication failure in the gateway pre-login stage.

When end users use the GUI version of the GlobalProtect app on Red Hat Enterprise Linux 8.4 Linux devices and they launch the app, sign in, and try to lock or sign out from the RHEL 8 client system, the GlobalProtect system tray icon is missing from the taskbar.

Workarounds

:

On Red Hat Enterprise Linux 8.4 Linux devices, when the extended display is set as the left monitor, the GlobalProtect system tray icon and the GUI version of the GlobalProtect app are not displayed on the same monitor.

If you did not add or modify the pre-deployment settings correctly to the pre-deployment configuration file (

pangps.xml

) for the Linux devices, you might have issues to unistall the GlobalProtect app.

When you uninstall the GlobalProtect app 5.2.5 and install 5.3.0 on Linux devices, the version of the GlobalProtect is not displayed correctly on the

About GlobalProtect

window.

Workaround

: End users must reboot and log out of their device.

When you attempt to establish a connection with the portal on Linux devices, the portal is down or unreachable. The GlobalProtect app continues to stay in connecting state.

After end users can successfully authenticate with the Identity Provider (IdP) on Linux devices using Chrome or any Chromium-based browser, the callback window sometimes does not automatically appear.

Users cannot install the GlobalProtect app on Linux devices with Ubuntu 20.04 LTS.

Workaround

: Install the GlobalProtect app on Linux devices using the

dpkg

utility of the Debian package along with the

apt-get

utility.

To install the GlobalPtotect app CLI, use

$ sudo dpkg -i <gp-app-pkg>

. For example:

$ sudo dpkg -i GlobalProtect_deb-5.3.3.0-3.deb

.

GPC-18964

The GlobalProtect tunnel disconnects after 10 minutes on app versions 6.0.8 and 6.2.1, when SAML authentication is used and the GlobalProtect app is running on macOS devices.

GPC-18467

In 6.0.8, when SAML authenticates a user that is not in the allow list, authentication fails. However, the SAML assertion is still used for subsequent authentication.

GPC-17226

After upgrade to GlobalProtect app version 6.0.5, macOS Ventura users are unable to refresh the connection when connected to an external gateway because the refresh menu disappears when the user hovers over it.

GPC-17099

Fixed in GlobalProtect app 6.0.5-c35 and GlobalProtect app 6.0.7

When the GlobalProtect app for Windows is upgraded to GlobalProtect app version 6.0.5, devices with Driver Verifier enabled and configured to monitor the PAN virtual adapter driver (pangpd.sys) display the

DRIVER_VERIFIER_DETECTED_VIOLATION

Blue Screen error.

GPC-15088

When the GlobalProtect app is installed on Android devices, the GlobalProtect notification is persistent and continues to stay on the screen even when the app is closed. This issue is not applicable for Android devices with Android 13 and later version.

Fixed the issue where the GlobalProtect notification displayed on the screen was unresponsive and this is listed under the Addressed Issues section.

GPC-14820

If you change the setting for

Connect with SSL Only

in the portal configuration , when the user views the Preferences in the GlobalProtect app, the Connect with SSL setting retains the previous setting.

GPC-14819

The first time end users connect using the GlobalProtect 6.0 app they may see an authentication failed message if their SSO credentials are different from the credentials they used to log in to their computer.

GPC-14705

Fixed in GlobalProtect app 6.0.5

On macOS endpoints, when connected to an internal gateway the endpoint may not send a HIP report or receive HIP notifications, and the HIP reports are not available on the Host Information Profile tab in the app.

GPC-14640

Fixed in GlobalProtect app 6.0.1

In pre-logon deployments , the GlobalProtect enforcer remains enabled even after disabling GlobalProtect.

GPC-14578

Fixed in GlobalProtect app 6.0.3

After connecting to GlobalProtect using Connect Before Logon (CBL) with SAML authentication, the GlobalProtect app keeps opening and closing after the user logs in.

GPC-14453

Fixed in GlobalProtect app 6.0.1

In some cases, TCP Option lookup for IP fragmented TCP packets can cause the endpoint to lose access to internal resources.

GPC-14329

Fixed in GlobalProtect app 6.0.1

macOS devices are able to bypass the GlobalProtect tunnel using the physical adapter even when

No direct access to local network

is enabled .

GPC-14063

In cases where the GlobalProtect gateway does not push a DNS suffix to the endpoint, the endpoint incorrectly pushes the DNS suffix from the physical adapter to the virtual adapter.

When connected to GlobalProtect with

Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)

set to

Yes

in the App Configurations area of the GlobalProtect portal configuration, performance is slow in the Windows Active Directory Users and Computers console.

Workaround:

Set

Resolve All FQDNs Using DNS Servers Assigned by the Tunnel (Windows Only)

to

No

.

GPC-13970

Fixed in GlobalProtect app 6.0.1

DNS queries for excluded domains are sent out on both the GlobalProtect app virtual adapter and the device's physical adapter when the

Split-Tunnel Option

is set to

Both Network Traffic and DNS

in the App Configurations area of the GlobalProtect portal configuration.

GPC-13774

Fixed in GlobalProtect app 6.0.1

In some cases the GlobalProtect tunnel cannot send traffic after the system wakes up from sleep mode.

GPC-13757

In a configuration where the

Welcome Page

is set to

None

and

Have User Accept Terms Of Use before Creating Tunnel

is set to

Yes

, the endpoint gets stuck in the connecting state.

Workaround:

Enable the Welcome Page or set

Have User Accept Terms Of Use before Creating Tunnel

to

No

.

GPC-13575

When the user is prompted to select a certificate to use to connect to GlobalProtect, if the user instead clicks Cancel without selecting a client certificate the app shows the

no network connectivity

error message.

GPC-13106

If the end user sets a preferred gateway in the GlobalProtect app and the administrator later disables the manual gateway option in the portal configuration, the app will still display the option to set a gateway as preferred after the end user refreshes the connection even though manual gateway selection is no longer an available option.

The GlobalProtect app stops working when the app is upgraded from version 5.2.8 to 6.0.3.

Users cannot install the GlobalProtect app on Linux devices with Ubuntu 20.04 LTS.

Workaround

: Install the GlobalProtect app on Linux devices using the

dpkg

utility of the Debian package along with the

apt-get

utility.

To install the GlobalPtotect app CLI, use

$ sudo dpkg -i <gp-app-pkg>

. For example:

$ sudo dpkg -i GlobalProtect_deb-5.3.3.0-3.deb

.

GPC-19499

On Linux endpoints, the Firefox browser stops working when you try to connect the GlobalProtect app with the SAML default browser.

GPC-17099

Fixed in GlobalProtect app 6.1.2

When the GlobalProtect app for Windows is upgraded to version 6.1.1, devices with Driver Verifier enabled and configured to monitor the PAN virtual adapter driver (pangpd.sys) display the DRIVER_VERIFIER_DETECTED_VIOLATION Blue Screen error.

GPC-15969

On Windows endpoints, the GlobalProtect app sometimes fails to send the Diagnostic report when the end user uses the option to Report an Issue . The Troubleshooting logs are sent successfully.

GPC-16570

When using the embedded browser for SAML authentication with the GlobalProtect app for Linux while installed on operating systems using OpenSSL 3 as the system version and using a portal or gateway running PAN-OS 10.2 or earlier versions, authentication does not work as expected.

Workaround:

Use the default system browser for SAML authentication.

GPC-19339

When the GlobalProtect app is upgraded from version 6.1.4-c1 to 6.2.0-c4 on Linux devices, the GlobalProtect web interface displays the upgraded version only after a system reboot.

GPC-19180

When the GlobalProtect app is installed on Linux devices and the app is upgraded or downgraded, the GlobalProtect web interface and the command-line interface display the new version only after a system reboot.

GPC-18964

Fixed in GlobalProtect App 6.2.2 Windows and macOS Addressed Issues

The GlobalProtect tunnel disconnects after 10 minutes on app versions 6.0.8 and 6.2.1, when SAML authentication is used and the GlobalProtect app is running on macOS devices.

GPC-18025

In 6.2.1, after a refresh connection, the HIP patch exclusion isn't visible on the GlobalProtect UI. However, the HIP patch exclusion logs are visible on the

Pangphip.log

file.

GPC-17820

Firefox is not supported for proxied traffic in Tunnel and Proxy mode or proxy mode .

GPC-17816

After entering CIE SAML authentication credentials to refresh an expired explicit proxy token or cookie when connected in Tunnel and Proxy mode or proxy mode , the GlobalProtect app gets stuck while retrieving the portal configuration.

Workaround:

Refresh the GlobalProtect connection or disconnect and reconnect the GlobalProtect app.

GPC-17727

When the GlobalProtect app is connected in Tunnel and Proxy mode or proxy mode , SSH traffic cannot be sent over the proxy.

GPC-17513

When GlobalProtect is configured in Tunnel and Proxy mode or proxy mode , if the admin-defined PAC file has an HTTP URL, the GlobalProtect app will not download the PAC content.

GPC-17447

GPC-17663

Workaround:

Use GlobalProtect in proxy mode for better compatibility with third-party VPNs.

GPC-17555

In Tunnel and Proxy mode , the GlobalProtect agent tunnel on macOS does not coexist well with Cisco Anyconnect VPN due to an IP forwarding table issue.

Workaround:

Use GlobalProtect in proxy mode for better compatibility with third-party VPNs.

GPC-17854

The GlobalProtect app does not prompt the users to extend the login lifetime user session when the device woke up from sleep or hibernation mode.

A fix was made to address an OpenSSL infinite loop vulnerability in GlobalProtect app software ( CVE-2022-0778 ).

Fixed an issue where users were able to successfully use SAML to authenticate and establish a connection to Prisma Access but failed to connect to a manually selected Prisma Access gateway.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running Big Sur, the app was unable to establish a connection when the Netskope Client was installed on the system.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app was disconnected from the tunnel and performed a network discovery after waking up from Modern Standby mode.

Fixed an issue where, when the gateway was manually selected for the first time instead of the Best Available gateway, any subsequent connections to the Best Available gateway allowed end users to connect to the manually selected gateway rather than the Best Available gateway.

Fixed an issue where the

Custom Password Expiration Message (LDAP Authentication Only)

notification displayed grammatical errors when the system language was German.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS 10.15 or 11.0, the GlobalProtect HIP check did not detect the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and split tunnel was configured based on the application, some traffic did not follow the split tunnel configuration on applications such as Microsoft Teams.

Fixed an issue where the GlobalProtect client on the end user’s endpoint did not connect to the Best Available gateway after the endpoint woke up from sleep mode. This issue occurred when SAML authentication was used and in the auto-scaled gateway scenario. With this fix, the GlobalProtect client can also connect to the Best Available gateway in the auto-scaled gateway scenario.

Fixed an issue where the GlobalProtect HIP check did not correctly detect the

Last Full Scan Time

information for the Windows Defender on Windows endpoints, which caused the endpoints to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and used a smart card for client certificate authentication, the number of prompts used between the portals were different.

Fixed an issue where the GlobalProtect HIP check incorrectly detected the

Anti-Malware

information for the

Definition Version

for Cisco Advanced Malware Protection (AMP).

Fixed an issue where the GlobalProtect HIP check incorrectly detected the

Anti-Malware

information for the

Definition Version

for Sophos Endpoint Protection version 10.0.0.

Fixed an issue where the GlobalProtect HIP check incorrectly detected the

Anti-Malware

information for the

Last Full Scan Time

for the McAfee Total Protection Antivirus software application.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the

Custom Password Expiration Message (LDAP Authentication Only)

notification is blank after you changed the message setting.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the command string for

pre-vpn-connect

or

post-vpn-connect

contained arguments with one or more whitespace characters, which caused the built-in GlobalProtect app upgrade to fail.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.7, the GlobalProtect HIP check did not detect the

Anti-Malware

information for the

Last Full Scan Time

for the McAfee Total Protection Antivirus software application version 4.9.2, which caused the device to fail the HIP check.

Fixed an issue where the

GlobalProtect Update

pop-up dialog displayed grammatical errors.

Fixed an issue where the GlobalProtect app could not properly exclude multicast routes specified in the exclude list.

Fixed an issue where the GlobalProtect app was configured with

Pre-logon then On-demand

mode and if the network was changed or the network connection was lost during pre-logon tunnel mode, the pre-logon tunnel was not able to reconnect to the app after the machine was connected to the network.

Fixed an issue where, when the GlobalProtect app was installed on Linux devices, DNS resolution failed when the app was connected on Ubuntu 20.04.

Fixed an issue where the HIP report did not contain the correct

Last Full Scan Time

information for the AVG Internet Security software.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect the

Patch-Management

software for the JAMF Pro software application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the Avast Antivirus software version 20.x. After upgrading from Antivirus software version 18.x, the GlobalProtect HIP check did detect the Avast Antivirus software version 20.x.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the

Anti-Malware

information for the

Last Full Scan Time

for the McAfee Total Protection Antivirus software.

Fixed an issue where the GlobalProtect HIP check incorrectly detected the

Anti-Malware

information for the

Definition Version

for Cybereason.

Fixed a rare issue where the PanGPS log file was not rotated and it caused the PanGPS.log file to consume a large amount of disk space.

Fixed an issue where, when the GlobalProtect app was installed on macOS Big Sur devices and split tunnel was configured based on the application, the app was unable to connect to applications such as Zoom.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app was disconnected from the tunnel after the

Pre-logon Tunnel Rename Timeout

expired even when users successfully authenticated to the gateway through either SAML authentication or RADIUS for two-factor authentication.

Fixed an issue where, after you installed the GlobalProtect app on macOS devices using the client upgrade prompt, a kernel panic occurred on the macOS device.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect tunnel could not send traffic after the system woke up from sleep mode.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect virtual interface was locally unreachable.

Fixed an issue on the GlobalProtect agent when the response from the gateway pre-login included the error status and an empty message, but the GlobalProtect client was not expected to receive the response from the pre-login with the error status and an empty message. With this fix, the GlobalProtect client is configured to handle the error status and the empty message response from the gateway pre-login when the minimum version is set to TLSv1.2 in the SSL/TLS service profile.

Fixed an issue where, after you upgraded the GlobalProtect app to release 5.2.1 or release 5.2.2 on macOS devices using the client upgrade prompt, a kernel panic occurred on the macOS device.

Fixed an issue where the GlobalProtect HIP check did not detect Symantec Endpoint Protection 14.3 real-time protection, which caused the device to fail the HIP check.

Fixed an issue where the HIP report did not contain the correct

Last Full Scan Time

information for the AVG Internet Security software.

Fixed an issue where, when the GlobalProtect app was installed on Windows 10 devices and network connectivity was enabled in Modern Standby, the tunnel failed to be restored after waking up from sleep mode.

Fixed an issue where, when the GlobalProtect app was installed on Linux devices, the GUI version of GlobalProtect sometimes was unresponsive (for example, when the GNOME Shell was replaced).

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect

Anti-Malware

information for Sophos Endpoint Protection version 10.0.0.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the speed limit of the GlobalProtect adapter was set to a maximum of 100Mbps, With this fix, the speed limit of the GlobalProtect adapter is now set to a maximum of 2Gbps.

Fixed an issue where, when the GlobalProtect app was installed on Linux devices, the GUI version of GlobalProtect hangs when multiple terminals were launched (in a multi-user target) or when one terminal had to be launched for the GUI version to launch.

Fixed an issue on Windows endpoints where, if the GlobalProtect app is configured with the Pre-logon (Always On) Connect Method with the

Pre-logon Tunnel Rename Timeout

value set to

-1

(or any other value) and users disable the app and reboot their endpoint, the pre-logon tunnel is up after they login. After the system reboots, the app is disabled but the virtual interface is enabled. With this fix, the app and the virtual interface are disabled after a system reboot.

Fixed an issue where the GlobalProtect app failed to connect to the portal or gateway in the Prisma Access network through the proxy.

Fixed an issue where the GlobalProtect HIP check did not detect

Patch Management

information for the Microsoft Intune management extension software.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and the

No direct access to local network

option was enabled on the gateway, the access route to the default gateway was not properly masked.

Fixed an issue where, after you upgraded and installed the GlobalProtect app, the app was unable to connect to the gateway due to the

Failed to get default route entry

error message.

Fixed an issue where the GlobalProtect app was unable to establish a connection to the gateway because the fully qualified domain name (FQDN) specified for the gateway mapped to a different IP address during network discovery and pre-login. With this fix, the app performed a network discovery again and connected to the

Best Available

gateway.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.4, the GlobalProtect HIP check did not detect Symantec Endpoint Protection 14.3 real-time protection, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app performed a second network discovery after gateway authentication was successful. This issue resulted in two authentication prompts (for example, the SAML authentication type) right after waking up from sleep mode.

Fixed an issue where the GlobalProtect app selected the geographically distant gateway instead of the gateway with the faster response time. With this fix, the

Best Available

gateway is now determined by the assigned weight of the gateway.

Fixed an issue where the GlobalProtect HIP check incorrectly detected the

Anti-Malware

information for the

Engine Version

,

Definition Version

, and

Date

for the CrowdStrike Falcon application.

Fixed an issue where portal authentication failed due to the authentication failure during the

GlobalProtect App Config Refresh

configuration, which caused users to be locked out of the RSA device.

Fixed an issue where the GlobalProtect HIP check did not detect Symantec Endpoint Protection 14.3 real-time protection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app was configured with

On-Demand

mode and continued to stay in connecting state even when manually switching to a different gateway failed. With this fix, the app will now display an error message when switching to a different gateway failed.

Fixed an issue in GlobalProtect for macOS endpoints where installing or upgrading the package using a MDM system such as JAMF Pro resulted in a GlobalProtect app initialization failure.

Fixed an issue where the original DNS suffixes were removed from the client machine and only the DNS suffixes from the gateway were applied.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect service modified the DNS suffix system list even when the gateway pushed an empty DNS suffix list.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and the pre-logon connect method was configured, client certificate authentication failed when the machine certificate either did not contain a Common Name (CN) or

Extended Key Usage OID

value. This issue resulted in pre-logon tunnel failure.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina, the GlobalProtect service restarted after a system reboot or when users logged out and logged in to the endpoint.

Fixed an issue where, when the GlobalProtect app was installed on Windows endpoints and split tunnel was configured based on the application, handle leaks were observed by the GlobalProtect service.

Fixed an issue on Windows 10 endpoints where the Active Directory Users and Computers (ADUC) application experienced high latency when users established a GlobalProtect connection.

Fixed an issue where when the GlobalProtect app was enabled to

Collect HIP Data

in the GlobalProtect portal agent configuration, the GlobalProtect HIP process activated the subprocess (PanGpHipMp.exe) even when the

Patch Management

category was excluded.

Fixed an issue where, when the GlobalProtect app was installed on Windows endpoints, the app was disconnected from the VPN tunnel after the pre-logon tunnel grace period expired even when users logged in to the endpoint and the pre-logon tunnel was successfully renamed. This issue occurred when two-factor authentication (2FA) was used.

Fixed an issue where when the GlobalProtect app was installed on macOS devices, the network extensions were not loaded successfully after a system reboot.

Fixed an issue where, when the GlobalProtect app was installed on Linux, the GlobalProtect client hangs after the session timed out.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina, the app was unable to establish a pre-logon tunnel.

Fixed an issue where, when the GlobalProtect app was installed on Windows endpoints, the pan_gp_event.log file displayed the date in a different format when compared to the GlobalProtect agent and GlobalProtect service logs.

Fixed an issue where the GlobalProtect app failed to connect to the portal or gateway in the Prisma Access network when the client machine was connected only to the IPv6 network.

Fixed an issue where the GlobalProtect app failed to connect to the portal when the client machine was behind the proxy and the DNS server was not able to resolve the fully qualified domain name (FQDN) of the portal.

Fixed an issue where the GlobalProtect HIP check did not detect real-time protection for Traps version 4.2.2.

Fixed an issue where the GlobalProtect driver caused the Blue Screen of Death errors on Windows endpoints when the third-party antivirus software was installed on the system.

Fixed an issue where the GlobalProtect app did not prevent users from dismissing the welcome page even when the

Allow User to Dismiss Welcome Page

option was set to

No

.

Fixed an issue where, when the GlobalProtect app was installed on Linux, users were not able to authenticate through SAML authentication when Microsoft Azure was used as the identity provider (ldP).

Fixed an issue where, when the GlobalProtect app was installed on Windows endpoints, the HIP report did not contain

Anti-Malware

information for the CrowdStrike Falcon application.

Fixed an issue where the GlobalProtect HIP check did not detect the status as “enabled” in the

Firewall

setting for the F-Secure Client Security software.

Fixed an issue where the GlobalProtect app tried to establish a connection without a user initiated connection even when the connect method was set to

Pre-logon then On-demand

.

Fixed an issue where, when the GlobalProtect app was installed on Linux, the domain name of the Linux device was not displayed in the

Domain

field of the HIP report.

Fixed an issue where, when the GlobalProtect app was installed on macOS endpoints and running the Blackberry Workspaces app, the GlobalProtect app stopped running.

Fixed an issue where the GlobalProtect app sometimes displayed the notifications in the system tray even when the

Show System Tray Notifications

option was set to

No

.

Fixed an issue where split tunnel rules based on destination domain was applied to Windows and macOS endpoints even with an invalid GlobalProtect license.

Fixed an issue where, when the GlobalProtect app was installed on Windows 10 endpoints and when users initiated the pre-logon connection, the

GlobalProtect Connect

button did not display in the Windows logon screen.

Fixed an issue where the GlobalProtect app was not able to establish a tunnel because the third-party software delayed enabling the virtual adapter used by GlobalProtect.

Fixed an issue where, when the GlobalProtect app was installed on macOS endpoints, the HIP report included

Disk Backup

information that contained invalid characters in the

version

attribute for the MEGAsync application.

Fixed an issue, when the GlobalProtect app was installed on macOS endpoints running macOS Catalina 10.15 or later and HIP checks were enabled, the macOS endpoint displayed additional pop-ups to the user when GlobalProtect requested to access your Desktop, Documents, and Downloads folders.

Fixed an issue where, when the GlobalProtect app was installed on Android endpoints, client certificate authentication failed even when a valid client certificate was present.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.4 or later and split tunnel was configured based on the application, file handle leaks were detected after a few weeks of usage.

Fixed an issue where, when the GlobalProtect app was installed on Linux, connection to the portal went through the proxy server even when the portal address was included in the no proxy list.

Fixed a rare issue where the PanGPS log file was not rotated and it caused the PanGPS.log file to consume a large amount of disk space.

Fixed an issue where, when the

No direct access to local network

option was enabled for split tunnel traffic on macOS Catalina 10.15.4 endpoints, some local network traffic leaked through the physical interface.

Fixed an issue where, when the HIP report incorrectly displayed the

Real-Time Protection

status of the

Heimdal Thor Agent Anti-Malware

as

no

instead of

yes

.

Fixed an issue where the HIP report incorrectly displayed the

Real-Time Protection

status of the ESET Antivirus as

no

instead of

yes

.

Fixed an issue where the GlobalProtect app was not able to authenticate to the internal gateway even when the FQDN specified in the

DHCP Option 43 Code

and associated IP address were resolved correctly.

Fixed an issue where the GlobapProtect app included a default route with a metric that was less than the system default route when split tunnel based on the destination domain was configured as inclusions. This issue caused traffic to leak through the tunnel.

Fixed an issue where, when the GlobalProtect app was installed on Windows and connected to the gateway that had split tunnel configured based on the domain and application, traffic sent through the tunnel stopped for a few minutes even when GlobalProtect was still connected.

Fixed an issue where, when data was not exchanged between the GlobalProtect service and GlobalProtect agent for more than 2 hours because the TCP connection was not validated and blocked. This issue caused GlobalProtect to fail.

Fixed an issue where the

Kaspersky Endpoint Security Virus Definition Date

in the GlobalProtect HIP report did not match the actual date of the definition in the antivirus software.

Fixed an issue where the GlobalProtect app failed to retrieve the client configuration that was defined in the portal using the configuration selection criteria when the Common Name (CN) of the certificate contained special characters.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.4, the app was unable to connect to the gateway after a reboot of the GlobalProtect client.

Fixed an issue where the GlobalProtect app in pre-logon mode tried to connect to the portal every five seconds when the pre-logon cookie authentication expired. With this fix, the app does not retry the connection to the portal until after 30 minutes.

Fixed an issue where the GlobalProtect client failed to refresh the portal configuration after 1 hour even though the

refresh-config-interval

value was set to 1 hour. This issue occurred when the user tunnel was established after pre-logon with the

Pre-Logon-Tunnel-Rename-Timeout

value was set to 0.

Fixed an issue where, when the GlobalProtect app was installed on Windows, the app did not connect to the preferred gateway after a system reboot.

Fixed an issue where, when the GlobalProtect app was installed on Windows, the app retained the tunnel after switching Windows users even when the

GlobalProtect Tunnel Preservation on User Logout

value was set to 0.

Fixed an issue where the GlobalProtect HIP check did not correctly detect real-time protection and the Windows Defender version on Windows endpoints, which caused the endpoints to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect real-time protection for Traps version 6.1.x and 7.0.x.

Fixed an issue where, when the gateway was configured to include split tunnel traffic based on the destination domain, some packets still leaked through the physical adapter.

Fixed an issue where, when the GlobalProtect app was installed on iOS endpoints, the app did not automatically reconnect to the external gateway when users moved from the internal network to the external network.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the HIP process restarted multiple times.

Fixed an issue where the

Only with User Fingerprint

option was enabled on the GlobalProtect client even though this option was not configured on the portal.

Fixed an issue where authentication to the GlobalProtect gateway failed as the challenge response for multi-factor authentication was sent to the portal and not to the gateway. This issue occurred when the pre-logon tunnel was not renamed to the user tunnel and the user tried to authenticate to the gateway. With this fix, GlobalProtect authentication is now successful.

Fixed an issue where the GlobalProtect client on macOS endpoints did not select the client certificate when the certificate did not have the client authentication enabled for the

Extended Key Usage

.

Fixed an issue where, when the GlobalProtect app was installed on Linux,

domain.com

was sent in the HIP profile instead of the correct domain.

Fixed an issue where, when the GlobalProtect app was installed on macOS, the GlobalProtect client tried to connect to the portal after the installation when the

On-Demand

connect method was defined in the property list (plist).

Fixed an issue where, when the GlobalProtect app was installed on Windows using Security Assertion Markup Language (SAML) authentication and the

Allow user to Sign Out from GlobalProtect App

option was set to

Yes

, the username and

Sign Out

button were not displayed on the app even when the

Save User Credentials

option was set to

No

.

Fixed an issue where, when the GlobalProtect app was installed on Linux, GlobalProtect failed to send an XML compliant HIP report to the firewall.

Fixed an issue where the

GlobalProtect Refresh Connection

window displayed the wrong French characters when the system language was French.

Fixed an issue where, when the GlobalProtect app was installed on Windows, the app failed to download the software from the portal when the proxy auto-configuration files were used.

Fixed an issue where, when the GlobalProtect app was installed on Windows UWP, the app failed to connect to the portal or gateway when multi-factor authentication (MFA) was used.

Fixed an issue where the GlobalProtect client failed to authenticate to the Prisma Access gateway when multi-factor authentication was used.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.4, the app restarted multiple times and was not able to connect to the gateway.

Fixed an issue where, when the GlobalProtect app was installed on Windows, the

Pre-logon then On-demand

connect method did not work properly. When you set the

Pre-logon Tunnel Rename Timeout

value to 0, GlobalProtect established a user tunnel after users logged in to the endpoint instead of remaining disconnected (On-Demand mode).

Fixed an issue where, when the GlobalProtect app was installed on Linux, the app did not send the complete HIP report due to many missing patch management entries and caused parsing issues on the gateway.

Fixed an issue where, when the GlobalProtect app was installed on Windows in On-Demand mode, the app was disconnected from the tunnel, and the HIP report was not sent to the gateway even when the gateway was selected manually after the device reboot.

Fixed an issue where users were prompted to enter their credentials on the GlobalProtect app 5.0.9 every time their macOS device running macOS Catalina 10.15.3 reboots.

Fixed an issue where the GlobalProtect HIP check did not detect real-time protection for Traps version 7.0.1 on Windows 10 endpoints, which caused the endpoints to fail the HIP check.

Fixed an issue on Windows endpoints where, if the GlobalProtect app is configured with the

Pre-logon (Always On) Connect Method

and users disable the app and reboot their endpoint, the pre-logon tunnel is up after they login.

Fixed an issue where, after you upgraded the GlobalProtect app from 5.0.x release to 5.1.1 release on Windows endpoints, the username displayed Chinese characters instead of English characters.

Fixed an issue where, when a split tunnel based on the destination domain was configured on macOS Catalina 10.15.4 endpoints, all Safari-based traffic and all Mac App Store-based traffic that were defined in the split tunnel configuration were dropped. The same issue also occurred when you configured a split tunnel based on the applications downloaded from the Mac App Store. All traffic that was created for the configured applications were dropped. With this fix, traffic defined in the split tunnel configuration will not be dropped using Safari.

Fixed an issue where the grace period decreased and GlobalProtect is disconnected even after gateway authentication was successful for the switch to the new user.

Fixed an issue where, when the GlobalProtect app was installed on Android devices, the app failed to reconnect and continued to stay in connecting state. Users had to close and launch the app to establish the connection.

Fixed an issue where the GlobalProtect HIP process (PanGpHip) on Windows endpoints caused high CPU usage on the endpoint even when users remain idle.

Fixed an issue where, when the GlobalProtect app was installed on Windows with a different language other than English (for example, Spanish), the GlobalProtect agent was continuously restarted.

Fixed an issue where, after you upgraded the GlobalProtect app from 5.0.x release to 5.1.1 release on a macOS device, users were prompted to re-enter their password even when the saved password was set to

Yes

. With this fix, users will not be prompted to re-enter their password after the upgrade. For GlobalProtect to access user credentials from the login keychain, the following Keychain Pop-Up message will appear:

Fixed an issue where, when the GlobalProtect app was installed on Windows, two OpenSSL DLL files in 64-bit were not signed by a Palo Alto Networks certificate. This issue caused a problem for some endpoint protection applications.

Fixed an issue where the GlobalProtect app for macOS was disabled and the

Disable Timeout (min)

value expired, GlobalProtect could reconnect and user credentials were not preserved.

Fixed an issue where the GlobalProtect app for macOS version 5.1.1 could not be properly installed because the GlobalProtect service failed to launch.

Fixed an issue where the GlobalProtect app on macOS displayed the following error message when all the gateways were configured as

Manual Only

priority:

Please select a gateway to connect manually

Fixed an issue on Windows endpoints where, after the endpoint woke up from sleep mode, the GlobalProtect app was disconnected and then attempted to reconnect to the portal or gateway.

Fixed an issue where, when the GlobalProtect app was installed on macOS and Windows, cookie authentication was successful even when the wrong password was used and GlobalProtect was still connected after users sign out of the app. With this fix, authentication cookies are now deleted from the system when users sign out of the app.

Fixed an issue where, when GlobalProtect was installed using the Windows Installer (Msiexec) with on-demand as the connect method, GlobalProtect automatically tried to connect to the portal.

Fixed an issue where the GlobalProtect app displayed the customized

Captive Portal Detection Message

in the wrong format when a different language was used other than English.

Fixed a connectivity issue where, when the GlobalProtect app was installed for macOS Catalina, the GlobalProtect connection was periodically lost.

Fixed an issue where the GlobalProtect app detected the presence of a captive portal even though it was not present.

Fixed a periodic issue where the GlobalProtect tunnel failed to be restored after waking up from sleep mode. This issue occurred when on-demand was used as the connect method.

Fixed an issue where, after upgrading to GlobalProtect 5.0.6, the GlobalProtect HIP check did not detect that Symantec Endpoint Protection 14.2 real-time protection was enabled, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app on macOS failed to find the correct certificate for authentication to the gateway, when the object identifier (OID) was specified in the plist.

With this fix, when you provide the Key Usage OID in the plist, the GlobalProtect app uses the correct certificate.

Fixed an issue where the portal configuration selection criteria failed when the certificate was signed with the version 2 template.

Fixed an issue that caused the GlobalProtect app to install a default route with the same metric as the system default route, when split-tunneling based on access route and destination domain was enabled. This issue caused some excluded traffic to go through the tunnel.

Fixed an issue where GlobalProtect failed to connect to the external gateway when the proxy was not reachable outside of the corporate network until the GlobalProtect service or the desktop was restarted.

Fixed an issue in GlobalProtect for macOS endpoints where installing or upgrading the package using a Mobile Device Management (MDM) solution such as JAMF Pro resulted in a GlobalProtect app initialization failure.

Fixed an issue with the GlobalProtect app on iOS that occurred when two VPN profiles (one device-level VPN profile and one per-app VPN profile) were pushed from the mobile device management (MDM) server. This issue occurred when users initiated the per-App VPN connection using one iOS app that was on the allow list. The GlobalProtect app displayed the status as “Disconnected” and the app did not respond to

TAP TO CONNECT

. This prevented users from disconnecting from the per-App tunnel and establishing a device-level VPN tunnel.

Fixed an issue where, when GlobalProtect was installed on iOS endpoints, the GlobalProtect app displayed the

Can’t end Background Task

error message from the GlobalProtect agent logs. This issue occurred periodically when

TAP TO CONNECT

was used to establish the GlobalProtect connection from the home screen.

Fixed an issue where, when GlobalProtect was installed on iOS endpoints, the GlobalProtect app failed to perform a successful network discovery when there was a region mismatch between the portal and the gateway.

Fixed an issue where, when GlobalProtect was installed on iOS devices, the GlobalProtect app did not display a specific notification message when the GlobalProtect session has timed out.

Fixed an issue where, when the GlobalProtect Android app was installed on Chromebooks, the GlobalProtect app failed to connect to the tunnel because GlobalProtect was not running.

Fixed an issue where, when the GlobalProtect app was installed on Android endpoints, the app hangs and the VPN connection failed to be restored. This issue occurred when users switch from an external network to an internal network after the

Automatic Restoration of VPN Connection Timeout

option was set to

Yes

.

Fixed an issue where client certificate authentication was failing on Android 10 devices even when the certificate was manually selected.

Fixed an issue where, when the GlobalProtect app was upgraded to 5.1.1 on an Android device, the client could no longer connect to the gateway with the custom port configuration.

Fixed an issue where, when GlobalProtect was installed on Android devices, the GlobalProtect app did not display a specific notification message when the GlobalProtect session has timed out.

Fixed a graphical user interface issue with the GlobalProtect app that occurred when the device-level VPN profile and the per-app VPN profile were pushed from the mobile device management (MDM) server. This issue occurred when users initiated the VPN connection from the iOS VPN settings (

Settings

General

VPN

), and the GlobalProtect app automatically transitioned to “Connected”. After a VPN connection was established and the app was launched, the graphical user interface still displayed “Disconnected” even though the VPN connection was actually running in the background.

Fixed an issue where, when GlobalProtect was installed for iOS and Security Assertion Markup Language (SAML) was used to authenticate mobile users, the GlobalProtect app did not send information about the mobile device such as the operating system and the browser User-Agent string.

Fixed an issue where the GlobalProtect app was upgraded to 5.1.0 on an iOS device. This issue occurred because the GlobalProtect was restarted during portal or gateway authentication.

Fixed an issue where, when GlobalProtect was installed for Android 10, the GlobalProtect app was not able to use the client certificate for authentication. This issue occurred when the client certificate was created with an algorithm other than RSA.

Fixed an issue where, when GlobalProtect was installed for Windows UWP, the GlobalProtect app crashed when traffic was sent through the IPSec tunnel.

Fixed an issue where, when GlobalProtect was installed for Android and Security Assertion Markup Language (SAML) was used to authenticate mobile users, the GlobalProtect app did not send the complete information about the mobile device such as the User-Agent string for the web browser. With this fix, the GlobalProtect app can now send the device information while performing SAML authentication.

Fixed an issue where, when GlobalProtect was installed for macOS, the GlobalProtect client used the expired certificate instead of the new certificate for portal authentication. This issue occurred when both expired and new certificates were installed for macOS. With this fix, the GlobalProtect client will no longer use the expired certificate for authentication.

Fixed an issue where, when GlobalProtect was installed on CentOS, the GlobalProtect portal or gateway authentication prompt did not display the customized authentication messages that were configured in the portal configuration. With this fix, the customized authentication messages are now displayed correctly.

Fixed a connectivity issue where GlobalProtect failed to reconnect to the network. This issue occurred when different portal configurations were pushed from a mobile device management (MDM) system one at a time.

Fixed an issue where the GlobalProtect client was not enabled automatically after a reboot even when the duration timer has expired. This issue occurred when the GlobalProtect client was disabled and your system was rebooted. With this fix, the GlobalProtect client will now be enabled automatically even after a reboot.

Fixed an issue where GlobalProtect crashed on macOS devices when the Automatic Proxy Configuration was enabled.

Fixed an issue where, when the GlobalProtect Android app was installed on Chromebooks with

On-Demand

mode, the GlobalProtect app failed to connect to the tunnel after the device was in “sleep” mode.

Fixed an issue where the IPSec connection failed on a dual stack environment. This issue occurred when the IPv6 preferred option was set to

No

.

Fixed an issue where, when the GlobalProtect Android app was installed on Chromebooks with

Always On

mode and managed using the Google Admin console, the device did not reconnect after a reboot.

Fixed an issue where macOS users could not connect to the GlobalProtect gateway during manual gateway selection. This issue occurred because the portal and gateway were configured to authenticate users through Security Assertion Markup Language (SAML) authentication with the On-Demand connect method. With this fix, users can now connect to the manual gateway upon the first attempt.

Fixed an issue where the GlobalProtect App for macOS did overwrite the local DNS search domains with the tunnel DNS search domains. This occurred when the “Append Local Search Domains to Tunnel DNS Suffixes (macOS Only)” app setting was set to “No” in the portal agent configuration. With this fix, the tunnel DNS search domains are now appended with the local DNS search domains when the “Append Local Search Domains to Tunnel DNS Suffixes (macOS Only)” app setting is set to “Yes” in the portal agent configuration.

Fixed an issue where Ubuntu 19.04 did not display the GlobalProtect system tray icon or the app could not be launched by clicking the system tray icon.

Fixed an issue where the GlobalProtect app was frequently generating the pop-up dialog to request that you change your password even when the password was not set to expire.

Fixed an issue where GlobalProtect app for Android could not be properly connected with two-factor authentication due to a change in the default value for the

TCP Receive Timeout (sec)

option. With this fix, the default is now 30 seconds.

Fixed an issue where the GlobalProtect HIP check incorrectly detected Definition Version for Cortex XDR, which caused the device to fail the HIP check.

Fixed an issue where

Connect Before Logon

would unexpectedly fall back to username and password authentication after a failed SAML authentication attempt to the gateway.

Fixed an issue where connect before logon would get stuck at

Connecting

if on an internal network with internal gateways.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS, the GlobalProtect cookie stopped working when CIS Benchmark 5.1.1 (Center for Internet Security) was applied for mac OS 12 Monterey to safeguard internet services.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS with split tunnel based on domain, the split tunnel did not work as expected after the system woke up from sleep mode.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check took longer than expected to collect the HIP information and also displayed HIP pop-up error messages for antivirus software, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was configured with split tunnel to exclude traffic, users could not access the excluded Airtel 4G PPP dongle application since the Airtel PPP default traffic route was removed.

Fixed an issue where the GlobalProtect app failed to detect Cisco Secure Endpoint anti-malware software installed on the device.

Fixed an issue where the GlobalProtect app connection failed when Windows 10 21H2 users tried to switch to another Windows user account on the device.

Fixed an issue where the GlobalProtect app was installed on devices running macOS, the GlobalProtect HIP check failed to detect the Real time protection status for Symantec Endpoint Protection.

Fixed an issue where GlobalProtect HIP check did not detect the name of the Trellix Agent correctly which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS, the app did not display 'Authentication Failed' when the user entered an incorrect RSA SecureID.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS, users were prompted for certificate selection even when the

Extended Key Usage OID for Client Certificate

was configured in the App Configurations area of the GlobalProtect portal configuration.

Fixed an issue where the GlobalProtect HIP check did not detect the Real-Time Protection status correctly for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed and connected on devices, the HIP check process was delayed and the tunnel was disconnected after 2 hours.

Fixed an issue where the GlobalProtect app did not detect real-time protection status for Sophos Endpoint Protection, which caused the device to fail the HIP check.

Fixed an issue where the split tunnel feature did not work as expected on devices running macOS Monterey 12.X and Chrome Browser 104.0.5112.79

Fixed an issue where the GlobalProtect HIP check did not detect the McAfee antivirus software, causing the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS, and when the user executed the command to disable the app, a new line break was added after the timestamp value in the command which caused parsing issues and created incorrect GlobalProtect log messages.

Fixed an issue where when the GlobalProtect app was deployed for pre-logon and when users tried to change their Windows password, users were prompted to enter only a new password. The app did not prompt users to enter their old password while changing the password.

Fixed an issue where the GlobalProtect app was connected to a different gateway and not the preferred gateway when the device woke up from sleep mode. The users had to select the preferred gateway manually to connect to the GlobalProtect app.

Fixed an issue where the GlobalProtect HIP check failed to detect the Real time protection status for Sophos Endpoint Protection.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS and the app did not start right away after a system reboot.

Fixed an issue where the GlobalProtect HIP check failed to detect the Definition Version for Sophos Endpoint Protection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app got disconnected after 3 hours.

Fixed an issue where users were unable to connect to the GlobalProtect app when users restarted the device from the hibernation mode.

Fixed an issue where the GlobalProtect HIP check did not detect the correct Anti-Malware information for the Last Full Scan Time for Sophos Endpoint Protection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the Real-Time Protection status for the FireEye Endpoint Agent, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app was installed on iOS devices and the GlobalProtect app failed to collect HIP data and the Host Information tab on the device failed to display information.

For the app to display the HIP information, user must update or remove expired certificates from the system.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and when the user tried to start the GlobalProtect app using Windows Start menu, the Windows Installer (Msiexec) did not work as expected due to which the app was getting reinstalled on the device.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS and when the GlobalProtect gateway was configured to exclude routes, the excluded routes were removed from the original routing table when users disconnected the app.

Fixed an issue where the GlobalProtect HIP check detected incorrect Anti-Malware information for Definition Date for Sophos Endpoint Protection.

Fixed an issue where, when the GlobalProtect app was installed on devices running macOS and GlobalProtect enforcer was configured with allowed FQDNs, users were still able to access the internet and other public domains.

Fixed an issue where the GlobalProtect HIP check detected the device as Windows firewall enabled even though the firewall was disabled on the device.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and split tunnel was configured to exclude application traffic for Zoom, excluded Zoom traffic was still forwarded through the tunnel.

Fixed an issue where the HIP check process stopped running and the tunnel was disconnected after 3 hours.

Fixed an issue where the GlobalProtect app did not save the username after Kerberos SSO authentication following which the app could not use the GlobalProtect cached portal configuration. Users had to manually add the username to the Windows registry.

Fixed an issue where the GlobalProtect app got disconnected due to an incorrect HIP check after the system woke up from sleep mode or when the system was restarted.

Fixed an issue where, when the GlobalProtect app was installed on Windows 11, version 22 H2 devices, the HIP information for patch management was not collected and the Patch Management section of the Host Profile tab failed to display the HIP details.

Fixed an issue where the GlobalProtect HIP check did not detect the Anti-Malware information for Sophos Endpoint Protection and Microsoft Monitoring Agent, which caused the device to fail the HIP check.

Fixed an issue where the users were not prompted for Multi-Factor Authentication (MFA) even after entering their credentials using IdP (Identity Providers).

Fixed an issue where the GlobalProtect app stopped working abruptly.

Fixed an issue where the HIP check process stopped running and the tunnel was disconnected after 3 hours.

Fixed an intermittent issue where the users were unable to connect to the GlobalProtect app, when the app used cached portal configuration.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and No direct access to local network option was enabled with access routes excluded from the GlobalProtect VPN tunnel, the excluded traffic was not sent through the physical adapter on the endpoint. Following this, users were unable to access the local physical network devices such as printers.

Fixed an issue where the HIP check did not detect the Sentinel One RTP and definition date properly, which caused the HIP check to fail.

Fixed an issue where, when split tunnel was configured on the GlobalProtect app to exclude destination domain traffic that included a slash character (/) for sub-page domain names, the slash character (/) was not displayed in the sub-page domain names in the exception list.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the SAML login page to authenticate Network Discovery was not properly displayed.

Fixed an issue where the GlobalProtect app failed to connect when the embedded browser was closed after Okta authentication.

Fixed an issue where, when the

No Direct Access to local network

option was enabled on GlobalProtect gateway, the GlobalProtect users’ loopback interface network was masked causing connection failure.

Fixed an issue where, when the

Allow GlobalProtect UI to Persist for User Input

was enabled and the machine was restarted, the GlobalProtect app did not show up on the screen. The browser directly opened the SAML login page and the app worked only in the background after successful authentication.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and the language was set to Japanese, the password field for disabling the app was not properly displayed.

A fix was made to address an OpenSSL infinite loop vulnerability in GlobalProtect app software ( CVE-2022-0778 ).

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the connection became unstable when the user clicked the

Click here

or

Retry

button on the default browser page for SAML authentication.

Fixed an issue where the GlobalProtect HIP check did not detect the Last Scan Date for Cortex XDR, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app prompted users to re-enter the gateway login credentials even though the save-user credentials was configured.

Fixed an issue where the GlobalProtect app displayed the incorrect copyright year on the app.

Fixed an issue where GlobalProtect users were unable to connect using

Connect Before Logon

because the app got stuck during the SAML authentication stage.

Fixed an issue where, when the GlobalProtect app was installed on Linux devices, the GlobalProtect logs displayed password information when the password contained the (<) character.The password characters succeeding the (<) character were displayed in the logs.

Fixed an issue where the GlobalProtect app connection failed after the app was upgraded to Windows 10 21H2.

Fixed an issue where the GlobalProtect app could not connect to the Prisma Access gateway when a FQDN was used instead of an IP address in the Proxy Auto-Configuration (PAC) file.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the device displayed a blue screen when users tried to connect to the GlobalProtect app.

Fixed an issue where the GlobalProtect app got disconnected after HIP check.

Fixed an issue where the HIP check did not detect the Sentinel One RTP and definition date properly, which caused the HIP check to fail.

GPC-14578

Fixed an issue where, after connecting to GlobalProtect using Connect Before Logon (CBL) with SAML authentication, the GlobalProtect app kept opening and closing after the user logged in.

Fixed an issue where GlobalProtect app users were prompted to re-enter the password when the connection was refreshed.This issue occurred only when the password contained non-English characters.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP report displayed encryption status even when the encryption feature was disabled.

Fixed an issue where the Azure IDP page was not displayed properly when

Connect Before Logon

was used.

Fixed an issue where multiple spelling and translation errors were observed in the GlobalProtect app for French localization.

Fixed an issue where, during a transparent upgrade of the GlobalProtect app, if the system rebooted or woke up from hibernation, the upgrade failed due to competing resources between the system reboot and transparent upgrade. The previous version of the GlobalProtect app was completely uninstalled.

Fixed an issue where the users were unable to connect applications such as TESSY to a local database when GlobalProtect was connected.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect app tried to restore the gateway connection even when the device was on Modern Standby mode. The users were prompted to authenticate using multi-factor authentication (MFA) authentication.

Fixed an issue where, when Connect Before Logon using Security Assertion Markup Language (SAML) authentication was used to login to the endpoint, the users could not authenticate as the authentication process stopped when redirected to the organization’s sign-in page.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and the Autonomous Digital Experience Management (ADEM) was not enabled in the app, the agent took more time than expected to establish a connection.

Fixed an issue where the GlobalProtect IPV6 static route for the gateway was getting removed shortly after establishing the connection causing unexpected GlobalProtect disconnections.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect credentials that were saved earlier were lost when the user faced network connectivity issues and the users had to re-enter the credentials.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and

No direct access to local network

option was enabled with access routes excluded from the GlobalProtect VPN tunnel, the excluded traffic was not sent through the physical adapter on the endpoint. Following this, the users were unable to access the local physical network devices such as printers.

Fixed an issue where the GlobalProtect agent (PanGPA) stopped running when Client Certificate authentication along with SAML authentication method was used to authenticate users. This issue resulted in GlobalProtect connection failures.

Fixed an issue where, when the user entered their credentials in the Connect Before Logon SAML authentication page, a blank screen was displayed instead of prompting the users to authenticate using a Two-Factor Authentication (2FA) authentication method as expected.

Fixed an issue where the GlobalProtect HIP check did not detect patch management properly, which caused the device to fail the HIP check.

Fixed an issue where, when pre-logon was configured for the GlobalProtect app, the users were still prompted to authenticate using multi-factor authentication (MFA) during the GlobalProtect gateway pre-logon stage.

Fixed an issue where, when the GlobalProtect app was installed on devices running on macOS High Sierra and split tunnel was configured to exclude application traffic such as Microsoft Teams and Zoom, some excluded traffic was still being forwarded through the tunnel.

Fixed an issue where, when the GlobalProtect app was deployed for pre-logon, the GlobalProtect Enforcer remained enabled even after the app was disabled.

Fixed an issue where the GlobalProtect HIP check did not detect HCL BigFix version 10.0.3, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the Anti-Malware information for Windows Defender and McAfee Anti-Malware Detection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect HCL BigFix version 10.0.3, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app did not detect real-time protection and the correct definition date and definition version for Microsoft Defender Advanced Threat Protection (ATP), which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the app failed to reconnect and continued to stay in the connecting state even after restarting the device.

Fixed an issue where, when the GlobalProtect app was configured to use the end user’s default system browser for SAML authentication, the app displayed the following warning message while enrolling with PingID.

Assignment to read-only properties is not allowed in strict mode.

Fixed an issue where, when Connect Before Logon using Security Assertion Markup Language (SAML) authentication was used to log in to the endpoint, users were unable to complete the authentication process as the SAML login page got stuck after they entered their credentials.

Fixed an issue where the GlobalProtect HIP check did not detect HCL BigFix version, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect Symantec Endpoint Protection 14.3 real-time protection, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect was configured with split tunnel to include traffic based on the destination domain by overriding the DNS server manually, the DNS queries were still being sent to the DHCP configured server.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and split tunnel was configured to exclude or include any application traffic that relied on the loopback connection source IP address, the split tunnel configuration based on the application did not work.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, a pop-up message

Connected - You are securely connected to the corporate network

was displayed and the message continued to stay on the screen even though the users tried to close it.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices with

No direct access to local network

option enabled on the gateway and split tunnel feature configured to exclude specific access routes, traffic for those access routes continued to go through the VPN tunnel.

Fixed an issue where the TCP Option lookup for IP fragmented TCP packets caused the endpoint to lose access to internal resources.

Fixed an issue where, when split tunnel was configured on the GlobalProtect app to exclude destination domain traffic that included a slash character (/) for sub-page domain names, the slash character (/) was not displayed in the sub-page domain names in the exception list.

Fixed an issue where the GlobalProtect HIP check did not detect the Trend Micro Apex One Endpoint Security, which caused the device to fail the HIP check.

Fixed an issue where, when the IPv6 Sinkhole feature was enabled to block the GlobalProtect app from accessing the local network devices using IPv6 address, the GlobalProtect gateway still allowed the GlobalProtect app to send IPV6 traffic to local network devices instead of blocking them.

Fixed an issue where GlobalProtect HIP check incorrectly detected the encryption stage for Trend Micro Full Disk Encryption as ‘Unknown’.

Fixed an issue where, when the GlobalProtect portal was set to authenticate users through Security Assertion Markup Language (SAML) authentication, the users were prompted to re-enter their credentials whenever they tried to connect to the GlobalProtect app even when the Authentication override cookie was enabled.

Fixed an issue where, when the GlobalProtect service (PanGPS) stopped running unexpectedly causing IP address-to-username mapping issues on the firewall. Users were unable to create user-based access policies due to the issue.

Fixed an issue where the GlobalProtect HIP check did not detect the real-time protection for the FireEye Endpoint Agent, which caused the device to fail the HIP check.

Fixed an issue where, when split tunnel was configured on the GlobalProtect gateway to include routes, the traffic which was not included was also sent over the VPN tunnel intermittently.

Fixed an issue where DNS queries for excluded domains were sent out on both the GlobalProtect app virtual adapter and the device's physical adapter with the

Split-Tunnel Option

set to

Both Network Traffic and DNS

in the App Configurations area of the GlobalProtect portal configuration.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the correct definition version and definition date for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect tunnel could not send traffic after the system woke up from sleep mode.

Fixed an issue where the hamburger menu icon on the GlobalProtect app was not highlighted when the users selected the menu using the tab key on the keyboard. Users were unable to identify the difference whether they were using the menu or not since the highlight was not visible to them due to the issue.

Fixed an issue where, when a device connected to GlobalProtect would establish an Remote Desktop Protocol (RDP) connection to another device connected to GlobalProtect, the RDP connection would time out and disconnect.

Fixed an issue where the GlobalProtect HIP report displayed incorrect OS version Windows 10 instead of the correct version Windows 11.

Fixed an issue where GlobalProtect users were prompted to install the Rosetta 2 compatibility package along with the GlobalProtect app on ARM64-based MacBook devices running macOS M1. The system prompted for Rosetta 2 installation despite the GlobalProtect app having native support for the M1 processor (ARM64, Apple silicon).

Fixed an issue where the

Check for Updates

option in the GlobalProtect app failed to display the recent GlobalProtect version updates. The users had to refresh the GlobalProtect connection to get the latest version updates.

Fixed an issue where, when the GlobalProtect portal was set to authenticate users through Security Assertion Markup Language (SAML) authentication, the users were prompted to re-enter their credentials whenever they tried to connect to the GlobalProtect app even when Authentication override cookie was enabled.

Fixed an issue where, when the GlobalProtect app was installed on Android devices, the app failed to reconnect and continued to stay in the connecting state. Users had to close and launch the GlobalProtect app again to establish the connection.

Fixed an issue where the GlobalProtect HIP check did not detect the correct status for Sophos Endpoint Protection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app continued to stay in the connecting state when users tried to log in to the gateway by entering their usernames without providing a password. Users were not prompted to re-enter credentials on authentication failure.

Fixed an issue where the GlobalProtect HIP check did not detect the Anti-Malware information for the Bitdefender Endpoint Security for macOS, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not correctly detect the Anti-Malware information for McAfee Endpoint Security on devices running macOS, which caused the devices to fail the HIP check.

Fixed an issue where macOS devices were able to bypass the GlobalProtect tunnel using the physical adapter even when

No direct access to local network

was enabled.

Fixed an issue where the Apple MacBook Pro failed to reconnect to the GlobalProtect app after hibernation.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect the Patch Management software for the Jamf Pro application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the app could not send the Kerberos SSO support properly during the pre-login stage.This issue resulted in two authentication prompts when devices were connected to a corporate network.

Fixed an issue where the GlobalProtect app failed to fetch the configuration from the portal during the automatic configuration refresh.

Fixed an issue where when SAML was used with the default browser for authentication, GlobalProtect could not establish a tunnel to the gateway with a cached portal configuration.

Fixed an issue where DNS queries for excluded domains were sent out on both the GlobalProtect app virtual adapter and the device’s physical adapter with the

Split-Tunnel Option

set to

Both Network Traffic and DNS

in the App Configurations area of the GlobalProtect portal configuration.

Fixed an issue where the GlobalProtect app for macOS allowed users to enter extra spaces after the portal IP address or FQDN, causing the connection to fail.

Fixed an issue where the GlobalProtect app did not launch the SAML login page correctly to complete the authentication sequence.

Fixed an issue where the GlobalProtect app did not detect real-time protection and the correct definition date for Microsoft Defender Advanced Threat Protection (ATP), causing the HIP check to fail.

Fixed an issue where the GlobalProtect app displayed the wrong version when fetched from Workspace One.

Fixed an issue where, when the GlobalProtect HIP check did not detect the Anti-Malware information for Malware Definition Date for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details of the Malware Definition Version and Malware Definition Date for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect user was unable to sign in to the portal by pressing the ‘Enter’ key after entering the credentials on the GlobalProtect embedded browser.

Fixed an issue where the DNS UDP checksum was incorrectly calculated, causing latency in the GlobalProtect connection.

Fixed an issue where multiple spelling and translation errors were observed in the GlobalProtect app for French localization.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details for Symantec Endpoint Protection on Windows endpoints, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on ARM-based MacBook devices running macOS M1, the GlobalProtect app was unable to detect HIP information for Anti-Malware, Disk Backup, Disk Encryption, Firewall, and Patch Management.

Fixed an issue where, if GlobalProtect was configured for domain-based split tunneling and the domain name resolved to the loopback address (127.0.0.1), the GlobalProtect app would disconnect on devices running macOS 11.5 or later.

Fixed an issue where the GlobalProtect app for macOS was unable to detect Jamf version 10.31.0 in the HIP check, causing the endpoints to fail the HIP check.

Fixed an issue where the GlobalProtect app did not start right away after a computer reboot.

Fixed an issue where, when the GlobalProtect app was installed on Linux devices, the GlobalProtect HIP report displayed encryption status as unencrypted even when encryption was complete.

Fixed an issue that caused the GlobalProtect app to restart when using the MacBook keyboard to navigate through the GlobalProtect GUI.

Fixed an issue where the GlobalProtect login screen displayed an incorrect Spanish translation.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the firewall state of McAfee Endpoint Security v10.7.0.1961.

Fixed an issue where the GlobalProtect users on macOS 11 Big Sur were unable to use the Spotify application properly, when application-based split tunneling was configured on the gateway and Spotify was excluded from the VPN tunnel.

Fixed an issue where the GlobalProtect HIP check did not correctly detect the McAfee DLP information on Windows 10 devices, which caused the devices to fail the HIP check.

Fixed an issue where DNS resolution to internal host detection got delayed because of mDNS.

Fixed an issue where GlobalProtect authentication failed when the SAML username contained special characters.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details for Cortex XDR, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the details for Forcepoint Data Loss Prevention (DLP) and FireEye Advanced Malware, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details of the Anti-Malware information for the Sentinel Agent, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP report displayed erroneous warning messages, such as whole disk encryption failed, after an upgrade.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details of the Anti-Malware information for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices, the app consumed a large amount of storage space under

Documents & Data

.

Fixed an issue where the GlobalProtect app took a long time to connect when the internal host detection DNS query failed.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect information for Signature Version and Last Updated for the Carbon Black Cloud application, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app GUI would disappear to the system tray or menu bar during authentication prompts thereby preventing the users from entering their credentials.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices, the app was unable to establish a connection for the second user using Security Assertion Markup Language (SAML) authentication when cookie authentication was configured on the portal.

Fixed an issue where the upgrade to a newer version of GlobalProtect app failed if the

Allow User to Uninstall GlobalProtect App (Windows Only)

was set to

Disallow

or

Allow with Password

.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices and configured in

Always-On

mode, the app was unable to send the HIP report to the firewall after the device was turned off and turned on in locked mode. When the device was turned on in locked mode, users connected to the app in

Always-On

mode but GlobalProtect failed to send the HIP report to the firewall.

Fixed an issue where the remote desktop connection via GlobalProtect tunnel got disconnected at times.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details of the

Anti-Malware

information for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows (32-bit) devices and the portal was set up to authenticate end users through the default system browser for Security Assertion Markup Language (SAML) authentication, the default system browser for SAML authentication did not work as expected.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the Microsoft Defender ATP real-time protection, which caused the device to fail the HIP check.

Fixed an issue where, where the GlobalProtect HIP check did not detect the correct details of the

Malware Definition Version

and

Malware Definition Date

for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the status of

Disk Encryption

and the presence of Bitlocker Drive Encryption after upgrading to GlobalProtect app 5.2.6, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and configured with On-Demand mode, a new portal authentication including a RADIUS challenge caused the app to hang in

Connecting

state.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the status of

Disk Encryption

and the presence of Bitlocker Drive Encryption, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was enabled for FIPS-CC mode, the app failed to connect to the portal because the app attempted to perform an OCSP check for the root CA certificate.

Fixed an issue where, where the GlobalProtect HIP check did not detect the correct details of the

Malware Definition Version

,

Malware Definition Date

, and

Last Full Scan Time

for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the

General

tab of the

GlobalProtect Settings

panel displayed a spelling error when the system language was French.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the app used the tunnel assigned IPv6 address as the source address for the physical interface for the excluded IPv6 traffic. This issue occurred when the physical adapter did not have any IPv6 addresses.

Fixed an issue where the GlobalProtect HIP check did not detect the correct details of the

Anti-Malware

information for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was deployed for Pre-logon then On-demand, the pre-logon tunnel took 2-3 minutes to connect to GlobalProtect when switching from disconnecting to connecting states. With this fix, the pre-logon tunnel was able to connect to GlobalProtect without changing connection states.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP process (PanGpHip) completely stopped running after the GlobalProtect service (PanGPS) crashed.

Fixed an issue where, where the GlobalProtect HIP check did not detect the

Anti-Malware

information for the Malware Definition Date and the software version for the 360 security guard and 360 Antivirus, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the Anti-Malware information for the Malware Definition Date for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect the

Anti-Malware

information for the FireEye Endpoint Agent, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on non-English Windows devices, the GlobalProtect HIP check did not detect real-time protection for Cisco Advanced Malware Protection for Endpoints, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and another application with system extensions were installed, issues with web-browsing and network activity were observed.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the correct definition date for Kaspersky Endpoint Security, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and deployed for Pre-logon then On-demand with user initiated Pre-logon enabled,

Start GlobalProtect Connection

was displayed at the Windows login page when the system was locked. This option should be displayed only during a system restart or when users logged out from the device.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the user was unable to save the gateway as the

Preferred Gateway

because this setting was removed from the Windows registry after a system reboot.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the embedded browser (WKWebView) did not send the client certificate to the SAML identity provider configured with mutual TLS authentication.

Fixed an issue where, where the GlobalProtect HIP check did not detect the correct details of the

Malware Definition Version

and the

Malware Definition Date

for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where when the GlobalProtect app was installed on ARM-based and Intel-based MacBooks, the app continued to stay in connecting state after the device woke up from sleep mode.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and split tunnel (optimized split tunneling) was configured to exclude any application traffic that relied on the loopback connection source IP address to be 127.0.0.1, the excluded application did not work as expected.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the blue screen was displayed on the device after users logged in and connected to the app.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and exclusions for destination domain traffic were not enforced, the app did not open the browser for SAML authentication that was blocked by the GlobalProtect enforcer.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app was not disconnected from the tunnel when a user removed a smart card even when

Retain Connection on Smart Card Removal

was set to

No

in the GlobalProtect portal configuration.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices, the app was unable to establish the connection on an IPv6 LTE network.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices, users were prompted multiple times to enter their user credentials.

Fixed an issue where, when the GlobalProtect app was installed on iOS devices, the app displayed a connection failed error message and the device was reconnecting by itself to GlobalProtect.

Fixed an issue where, when the GlobalProtect app was deployed on managed Android devices through a mobile device management (MDM) system such as Microsoft Intune, the app was unable to automatically fetch a certificate after upgrading from GlobalProtect app 5.2.5 to GlobalProtect app 5.2.6.

Fixed an issue where the GlobalProtect HIP check did not detect the

Anti-Malware

information for the

Malware Definition Date

for the Carbon Black Cloud Sensor, which caused the device to fail the HIP check.

Fixed an issue where after a

Fresh Install

of GlobalProtect app 5.2.6 and using the embedded browser for Security Assertion Markup Language (SAML) authentication, authentication failed due to a script error when end users attempted to access the identity provider (IdP) web page. With this fix, after you installed GlobalProtect app 5.2.7, end users can access the idP web page using the embedded browser for SAML authentication without any script errors and connect to GlobalProtect.

Fixed an issue where after upgrading to GlobalProtect 5.2.6, the GlobalProtect client on the end user’s endpoint did not connect to the Best Available gateway.

Fixed an issue in GlobalProtect app for Android devices where the documented syntax of app_list key for Per-App VPN was not in sync with the App.

Fixed a performance issue where the GlobalProtect HIP process (PanGpHip) caused high CPU usage on devices.

Fixed an issue where, when the GlobalProtect app was installed on Windows 10 devices, the GlobalProtect HIP check did not detect the correct definition version, definition date, and year for the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect information for

Signature Version

and

Last Updated

for the Carbon Black Cloud application, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect the

Anti-Malware

information for the

Malware Definition Version

and

Malware Definition Date

for the FireEye Endpoint Agent, which caused the device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina 10.15.7 and Big Sur, the GlobalProtect HIP check did not detect the Microsoft Defender ATP real-time protection, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect HIP check did not detect did not detect real-time protection for Traps version 4.2.3.41131, which caused the device to fail the HIP check.

Fixed an issue where the GlobalProtect app was configured to exclude application traffic such as Cisco Webex for split tunnel, excluded traffic was still forwarded through the tunnel. This issue occurred when the

Pre-logon Tunnel Rename Timeout

value was set to

-1

in the GlobalProtect portal configuration.

Fixed an issue where, when the GlobalProtect app was installed on Windows 10 devices and if the

Exceptions to Enforce GlobalProtect

list was configured with a subnet, existing connections to those hosts were not allowed even when the Enforcer status was enabled.

Fixed an issue where, when the GlobalProtect tunnel was established on macOS devices, the default route was installed before the excluded routes and then excluded traffic leaked into the tunnel periodically.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the GlobalProtect HIP check did not detect the correct ESET Endpoint Antivirus definition version.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices and when the tunnel disconnected and reestablished immediately, the split tunnel configuration based on the application was not adhered.

Fixed an issue where the GlobalProtect app received a notification when the connection falls back from IPSec to SSL even after setting

Display IPSec to SSL Fallback Notification

to

No

to disable the app from displaying the notification.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running Big Sur, end users were unable to access the internal domains when split tunnel based on the destination domain was configured with port 53.

Fixed an issue where the GlobalProtect HIP check did not detect the CrowdStrike Falcon application, which caused the device to fail the HIP check.

Fixed an issue where, after upgrading to GlobalProtect 5.2.6, the GlobalProtect HIP report was not complete, which caused the GlobalProtect client host device to fail the HIP check.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running macOS Catalina, the Configurable Maximum Transmission Unit for GlobalProtect Connections feature did not support fallback to kernel extension mode.

Fixed an issue where the GlobalProtect client version was transparently upgraded even when

Allow User to Upgrade GlobalProtect

was changed to

Disallow

from

Allow Transparently

.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the

Choose An Identity

pop-up prompted end users to

Select a valid client certificate to connect to GlobalProtect

even when the

certificate-store-lookup

value was set to

machine

on the GlobalProtect portal.

Fixed an issue where, when the GlobalProtect app was installed macOS devices, did not detect the correct state for the Microsoft Defender ATP real-time protection, which caused the device to fail the HIP check.

Fixed an issue where the PanGPA.log file displayed the user credentials in (clear-text) data when the SAML identity provider such as Enforce Enboard was used for portal and gateway authentication.

Fixed an issue where the GlobalProtect service restarted multiple times when DLSA was configured in a dual stack environment.

Fixed an issue where the Server Name Indication (SNI) was not set in the requests used for the HIP reports and client logout messages.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices, the app displayed that the end user was connected to the corporate network even when their device was not connected to

Internal Network

.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the HIP check process was delayed and the tunnel was disconnected after 3 hours.

Fixed an issue where the GlobalProtect HIP check was unable to detect the

Anti-Malware

information for the

Last Full Scan Time

for the McAfee Total Protection Antivirus software application.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the gateway did not generate the HIP report within a reasonable time period after upgrading to GlobalProtect app 5.2.5-c84.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app failed to connect to the GlobalProtect gateway using a cached configuration if the GlobalProtect portal was unreachable using client certificate authentication.

Fixed an issue where the GlobalProtect app displayed the following HIP notification even when Forcepoint Data Loss Prevention (DLP) was installed:

Forcepoint DLP agent is not installed into your system.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and the default browser was used for SAML authentication, the app opened the default browser for SAML authentication twice.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and configured in a full tunnel deployment, the GlobalProtect virtual adapter was activated with the default gateway set to 0.0.0.0. Starting with GlobalProtect app 5.2.7, you can set a valid default gateway on the adapter using one of the following methods:

Fixed an issue where the GlobalProtect client was unable to establish a connection when the proxy domain name had the “HTTP” keyword.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices and by changing the registry settings, the end user was able to connect to a different portal even when

Allow User to Change Portal Address

was set to

No

in the GlobalProtect portal configuration.

Fixed an issue where the GlobalProtect HIP check excluded the

Anti-Malware

information for FireEye but some data was still collected from the FireEye agent and actions were performed on the data in PanGPHip.exe.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices while third-party software was running, the filter driver failed to load.

Fixed an issue where the routing flags for the Address Resolution Protocol (ARP) route were not reverted once GlobalProtect was disconnected. This issue caused the third-party VPN connections to fail.

Fixed an issue where, when the GlobalProtect app was deployed for pre-logon and if a pre-logon tunnel was not established, the subsequent gateway login using RADIUS two-factor authentication (2FA) failed.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the app did not use the system proxy server to connect to the SAML identity provider.

Fixed an issue where, when the GlobalProtect app was installed on macOS devices running Catalina, end users experienced issues when connecting to Zoom on the internal network.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the HIP Report was significantly delayed while checking information for the Windows Defender.

Fixed an issue where, when the GlobalProtect app was installed on Windows devices, the GlobalProtect HIP check did not detect the

Anti-Malware

information for the Carbon Black Response application.