GlobalProtect toggle (start/quit)

global-protect.md

Regain control over the annoying GlobalProtect macOS install

I need to use GlobalProtect because it's becoming the only VPN to access resources in my school. The VPN client is simple enough, but it does two annoying things:

1. Registers itself to autostart on login
2. Doesn't provide you with a simple 'quit' action

Here I'll show you how I fixed both issues in macOS 12.2 (Monterey).

1. Disable autostart on login

This behavior is set by two files with filepaths /Library/LaunchAgents/com.paloaltonetworks.gp.pangp[a|s].plist. We need to edit both (with root privileges) in order to disable autostart.

I did it with nvim, but of course you can use any editor that you like. In my case, I run

sudo nvim /Library/LaunchAgents/com.paloaltonetworks.gp.pangpa.plist

Locate the RunAtLoad key in line 11. Below that, change the value in line 12, which should be true in your file, to false. When you save it should read like the screenshot below.

Do the same in line 14 of the com.paloaltonetworks.gp.pangps.plist file, like shown below. Make sure to save all these changes, and you should be set!

2. Create a script to quit (and start) the client

I created a simple bash script to launch/start and stop/unload the service(s) which spawn the VPN client. The contents of the script are

#!/bin/bash
# check args
if [ $# -ne 1 ]; then
    echo "provide a single argument; must be either 'load' or 'unload'"
    exit 22
elif ! [[ "$1" =~ ^(load|unload)$ ]]; then
    echo "argument must be either 'load' or 'unload'"
    exit 22
fi
# toggle program
launchctl $1 /Library/LaunchAgents/com.paloaltonetworks.gp.pangp*

I named this file globalprotect and saved it in ~/bin/globalprotect, where I usally store my custom scripts. To execute it, make sure to make it, well, executable:

chmod u+x ~/bin/globalprotect

If you want to be able to run this from any directory in your machine, make sure to add ~/bin to your path. In modern macOS versions this is normally done in your ~/.zshrc file with a line like

export PATH=${PATH}:$HOME/bin

globalprotect

#!/bin/bash
# check args
if [ $# -ne 1 ]; then
    echo "provide a single argument; must be either 'load' or 'unload'"
    exit 22
elif ! [[ "$1" =~ ^(load|unload)$ ]]; then
    echo "argument must be either 'load' or 'unload'"
    exit 22
fi
# toggle program
launchctl $1 /Library/LaunchAgents/com.paloaltonetworks.gp.pangp*