GlobalProtect On-Demand Control Setup

Why This Script Was Developed

System & macOS Requirements

This script is compatible with both Apple Silicon (M1–M4) and Intel Macs.

Installation Instructions

1. Set your default web browser:
   Ensure your preferred web browser (e.g., Firefox or Safari) is selected as system default in System Settings > Desktop & Dock > Default web browser.
2. Create the script file:
   Open Terminal and execute:
   sudo nano /usr/local/bin/vpn.sh
3. Paste and configure the script content:
   Copy the script block below into the editor.
   If you are not using University of Alaska VPN, edit line 4 (PORTAL="...") to use your organization's portal address.
   #!/bin/bash # GlobalProtect On-Demand Control Script for macOS # CHANGE THIS ADDRESS to match your organization's portal if not using University of Alaska PORTAL="vpn.alaska.edu" APP_BINARY="/Applications/GlobalProtect.app/Contents/MacOS/GlobalProtect" CLI_SYMLINK="/usr/local/bin/globalprotect" # Enforce default system browser for SAML/SSO authentication configure_browser_pref() { defaults write com.paloaltonetworks.GlobalProtect.settings.plist "Palo Alto Networks" -dict-add GlobalProtect "<dict><key>Settings</key><dict><key>User</key><dict><key>use-system-browser</key><string>yes</string></dict></dict></dict>" 2>/dev/null } # Ensure GlobalProtect CLI symlink exists check_symlink() { if [ ! -L "$CLI_SYMLINK" ] && [ ! -f "$CLI_SYMLINK" ]; then if [ -f "$APP_BINARY" ]; then sudo ln -s "$APP_BINARY" "$CLI_SYMLINK" 2>/dev/null fi fi } configure_browser_pref check_symlink case "$1" in start) echo "Starting GlobalProtect services..." sudo launchctl load -w /Library/LaunchDaemons/com.paloaltonetworks.gp.pangps.plist 2>/dev/null launchctl load -w /Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist 2>/dev/null echo "GlobalProtect started. Complete login in your default browser if prompted." ;; connect) echo "Triggering connection to $PORTAL..." if [ -L "$CLI_SYMLINK" ]; then "$CLI_SYMLINK" connect -portal "$PORTAL" & else "$APP_BINARY" connect -portal "$PORTAL" & fi echo "Authentication request sent. Complete login in your default browser." ;; stop) echo "Stopping GlobalProtect services..." launchctl unload -w /Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist 2>/dev/null sudo launchctl unload -w /Library/LaunchDaemons/com.paloaltonetworks.gp.pangps.plist 2>/dev/null sudo pkill -9 -f PanGPS 2>/dev/null sudo pkill -9 -f PanGPA 2>/dev/null sudo pkill -9 -f GlobalProtect 2>/dev/null echo "GlobalProtect stopped." ;; status|check) if pgrep -f "PanGPS" > /dev/null; then echo "GlobalProtect Service: RUNNING" TUNNEL_ACTIVE=false if scutil --nc list 2>/dev/null | grep -i "GlobalProtect" | grep -q "(Connected)"; then TUNNEL_ACTIVE=true elif ifconfig 2>/dev/null | grep -q -E "gpd|utun.*flags=.*POINTOPOINT"; then if netstat -rn 2>/dev/null | grep -q -E "vpn|10\.|172\.|192\.168\."; then TUNNEL_ACTIVE=true fi elif pgrep -f "PanGPA" > /dev/null && netstat -rn 2>/dev/null | grep -q "gpd"; then TUNNEL_ACTIVE=true fi if [ "$TUNNEL_ACTIVE" = true ]; then echo "VPN Tunnel Status: CONNECTED" else echo "VPN Tunnel Status: DISCONNECTED (Service active, waiting for authentication)" fi else echo "GlobalProtect Service: STOPPED" echo "VPN Tunnel Status: DISCONNECTED" fi ;; *) echo "Usage: vpn.sh {start|connect|stop|status}" exit 1 ;; esac
4. Save and exit:
   Press Control + O, then Enter to save. Press Control + X to exit.
5. Make the script executable:
   Grant system execution permissions:
   sudo chmod +x /usr/local/bin/vpn.sh

Command Reference