A knowledge base article about bSecure GlobalProtect VPN: Is U2F Supported for Logging In? provided by the UC Berkeley IT Service Hub - Knowledge Portal
GlobalProtect does not support U2F tokens at this time.
GlobalProtect relies on the operating system to provide a web browser window so users can log into the VPN using the CalNet web login. For Windows, the default system browser is Internet Explorer (IE) and for MacOS X the default browser is Safari. At this time neither IE or Safari support U2F, so the GlobalProtect client is blocked from supporting it.
People looking for an alternative to use Duo to meet the CalNet 2-Step requirement are recommended to review the options listed on the CalNet page, One Time Password (OTP) devices are a good alternative.