## TL;DR
On managed Macs this is usually a stale portal config, a missing machine certificate, or macOS blocking the GlobalProtect system extension. Refresh the portal, confirm the certificate, and approve the extension in System Settings.

## The query
```text
globalprotect "could not connect to the gateway" on managed mac
```

## Use this when
- GlobalProtect on macOS cannot connect to the gateway
- Windows clients connect fine to the same gateway
- the error follows a macOS upgrade or reimage

## Not for
- GlobalProtect portal authentication failures
- gateway certificate warnings on all platforms
- pre-logon tunnel issues

## Steps
1. In the GlobalProtect app, refresh the portal connection to pull the current gateway list. Expected output: the portal refresh succeeds and gateways are listed.
2. Check the Mac has its machine certificate installed and not expired. Expected output: a valid client certificate is present.
3. Open System Settings, Privacy and Security, and confirm the GlobalProtect system extension is allowed. Expected output: the extension shows as allowed and active.
4. Verify the MDM pushed the current GlobalProtect configuration profile. Expected output: the profile is installed with the right portal address.
5. Retry the gateway connection. Expected output: the tunnel establishes and stays up.

## Applies to
Palo Alto GlobalProtect 6.x on macOS Ventura and later, managed via Jamf or Intune, Palo Alto gateways.

## Variant phrasings
### Extension allowed but still fails
Remove and reinstall the GlobalProtect app; the extension sometimes needs a fresh install to bind.

## Why it happens
GlobalProtect on macOS depends on a system extension and a client certificate that MDM provisions. OS upgrades and reimages break that chain while leaving the app itself installed.

## Edge cases
- macOS Sequoia tightened extension approvals; re-approval is commonly needed after upgrade.
- Split-tunnel exclusions pushed by MDM can look like a gateway failure; check the route table.
- Collect GlobalProtect logs from the app before escalating to the firewall team.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_RDkdJ9yklir6GxRtHoMn0g