GlobalProtect
Deploy Scripts Using the macOS Plist
Table of Contents
Deploy Scripts Using the macOS Plist
Deploy scripts using the macOS plist in GlobalProtect to make app setting changes and
run scripts at different events.
When a user connects to the GlobalProtect
gateway for the first time, the GlobalProtect app downloads the
configuration file and stores app settings in a GlobalProtect macOS
property file (plist). In addition to making changes to the app
settings, you use the plist to deploy scripts at any or all of the
following events: before and after establishing the tunnel, and
before disconnecting the tunnel. Use the following workflow to use
the plist to deploy scripts to macOS endpoints.
The
macOS plist settings that enable you to deploy scripts are supported
on endpoints running GlobalProtect App 2.3 and later releases.
- (Endpoints running Mac OS X 10.9 or a later OS) Flush the settings cache. This prevents the OS from using the cached preferences after making changes to the plist.To clear the default preferences cache, run the killall cfprefsd command from a macOS terminal.Open the GlobalProtect plist file, and locate or create the GlobalProtect dictionary associated with the connect or disconnect event. The dictionary under which you will add the settings determines when the GlobalProtect app runs the script(s).Use Xcode or an alternate plist editor to open the plist file (/Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist) and go to one of the following dictionary locations:
- /PaloAlto Networks/GlobalProtect/Settings/pre-vpn-connect
- /Palo Alto Networks/GlobalProtect/Settings/post-vpn-connect
- /Palo Alto Networks/GlobalProtect/Settings/pre-vpn-disconnect
If Settings dictionary does not exist, create it. Then, in Settings, create a new dictionary for the event or events at which you want to run scripts.Enable the GlobalProtect app to run scripts by creating a new String named command.The value specified here should reference the shell script (and the parameters to pass to the script) that you want run on your endpoints.If the command string does not already exist, add it to the dictionary and specify the script and parameters in the Value field. For example:$HOME/pre_vpn_connect.sh /Users/username usernameEnvironmental variables are supported.As a best practice, specify the full path in commands.(Optional) Add additional settings related to the command, including administrator privileges, a timeout value for the script, checksum value for the batch file, and an error message to display if the command fails to execute successfully.Create or modify additional strings in the plist (context, timeout, file, checksum, and/or error-msg) and enter their corresponding values. For additional information, see Customizable App Settings.Save the changes to the plist file.Save the plist.
