Sometimes removing the .dat files from the GlobalProtect application folder is a good first troubleshooting step when looking into GlobalProtect client issues. The .dat files hold the authentication cookie (pre-auth and user auth) and portal configuration file. Folder locations can depend on if the portal is using pre-auth or not as pre-auth is not user specific.

Windows⌗

The main user specific folder location to remove the .dat files can be found at the following folder path:

%AppData%\..\Local\Palo Alto Networks\GlobalProtect

Just delete any files matching *.dat. Then from the GlobalProtect system tray app right click on settings and choose “Refresh Connection”.

The default GlobalProtect installation folder is located here:

C:\Program Files\Palo Alto Networks\GlobalProtect

This path contains the update script and various log files. You will also find .dat files relating to HIP and pre-auth. A useful log file here is pan_gp_event.log which is quite human readable and gives you an overview of what is going on. Collecting the GlobalProtect logs direct from the app is easiest as it pull all the relavent files and put them into a zip.

macOS⌗

To remove the cookies from macOS vpn client, go to the path below and delete all the *.dat files:

/Users/$USER/Library/Application Support/PaloAltoNetworks/GlobalProtect/

The pre-auth cookie (PanPPAC_*.dat) is held in the following location along with pan_gp_event.log:

/Library/Application Support/PaloAltoNetworks/GlobalProtect/

Linux⌗

Linux has a slightly similar layout to mac OS. For the user location:

~/.GlobalProtect/

The pre-auth cookie can be found here along with the HIP and other application files. (Note this was only really tested on Ubuntu):

/opt/paloaltonetworks/globalprotect/