According to Technical Note TN2459 from Apple, "macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions (KEXTs)." Additionally, Technical Note TN2459 from Apple indicates, "[t]his feature enforces that only kernel extensions approved by the user will be loaded on a system."
When a request is made to load a KEXT that the user has not yet approved, the load request is denied and macOS presents the alert with a System Extension Blocked message.
Resolution
Enable Palo Alto Networks as a trusted developer.
- From your Mac endpoint, launch System Preferences
- Open the Security & Privacy preferences and then select General
- Click the lock icon on the bottom left of the window to make changes and modify preferences
- When prompted, enter your Mac User Name and Password and then Unlock the preferences
- Click "Allow" next to the message "System software from developer "Palo Alto Networks" was blocked from loading."
For users who have installed global protect, but are unable to connect the following steps have resolved the issues for most users.
- After installing Global Protect Open System Preferences -> Security & Privacy.
- Under the section “Allow applications downloaded from”, verify you have allow apps downloaded from “Mac App Store and identified developers” selected.
Users may see a more detailed screen, as in the example below. If you see this screen, verify that you have “App Store and identified developers” selected.
Verify that the software you are allowing is named where it says “System software from developer…” Here you should see “Global Protect”. Click Allow.
- Under the General Tab, look for an “allow or open anyway” button. If you do see this button click it. Typically a program will not run at all until you have allowed it, but in the csase of GlobalProtect software on a Mac, it will run the software before you allow it but it will not connect. Once you allow the software to run you will be prompted for your Auburn credentials and you should receive a Duo Push.
- Try connecting to the VPN again.
RELATED KNOWLEDGE BASE ARTICLES: Not registered for Duo? Do you need to install Global Protect? Please refer to the following KB Articles for assistance or call the IT Service Desk at 334-844-4944
- Register Duo on a New Device with the Same Phone Number
- Global Protect VPN Installation Instructions for Mac
- Using Global Protect VPN Client