topic Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess. in GlobalProtect Discussions

Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Pete_Blackett — Wed, 31 Mar 2021 12:30:30 GMT

5.2.5 has a nasty bug in which has affected a few hundred remote worker staff as we rolled it out..

Problem 1 - Hotfix now available

The IP6 and IP4 conflict for DNS resolution when sending AAAA and A requests

Problem 2 - Hotfix is seen as older version and will not auto update users

we then see the Hotfix is released to fix this issue, however the Hotfix is seen as a LOWER version of 5.2.5.

It doesn't deploy from the firewall with Allow Transparent upgrade.

When you do the MSI it says there is a new version of Global Protect already installed!

Can Palo Alto Fix this?

Other random Problem related to this

we also tested rolling out to 5.2.5 on a number of users with no issues except for anyone on 5.2.4 got caught in an update/download loop with allow transparent upgrades.

I think reading the Hotfix notes this is fixed, but not a major problem for us as we only had a small number of users on 5.2.4.

I personally can't wait for 5.2.6 but part of me tells me this will have major issues given the recent disruption 5.2.5 has given us!

This has caused so much stress for all afflicted by this. Maybe Palo Alto can widen their test pools to avoid such issues?

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Sahir_Algharibih — Wed, 31 Mar 2021 15:39:02 GMT

I totally agree with your post. We have lots of issues on GlobalProtect 5.2.5. Split tunnel, Captive Portal, Client sometimes lock access to the network, repair issues. I just wish PaloAlto put the time and effort to make sure their next client release well tested and work as advertised. There should be at least one client release that works without issues.

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

jdelio — Wed, 31 Mar 2021 22:17:00 GMT

I was able to research this a little.. and found this info..

You cannot directly run 5.2.5-c84 on top of another 5.2.5 because they are the same product id and on the same release.

The only way you can upgrade to 5.2.5-c84 from another 5.2.5-x is to uninstall the old 5.2.5 first, and then install 5.2.5-c84. But if is using portal upgrade, it will be OK.

Further more, if the machine installed 5.2.4 or older release, and run 5.2.5-c84 on top of it, it should be OK. but again, there is always some risk by directly clicking on a msi if you have GP running already, also need be sure the user has the administrative privilege.

Directly click on msi should be only recommended for the initial installation when there is no other GP in the system.

I hope this helps a little

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

sebastianvd — Thu, 01 Apr 2021 11:23:26 GMT

I did try the hotfix on several users because of the issues we have currently.

As stated, an uninstall is needed as the product versions seem the same.

After installing things looked better but only for a short amount of time, we have issues again 😕

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Pete_Blackett — Thu, 01 Apr 2021 14:44:15 GMT

To me it sounds like a Bug, how am i supposed to update 3700+ laptops in the field in an enterprise environment where users do not have adm rights. with remote working we have 200 + users we cannot really call into sites. (we are disabling IP6 as a quick fix on both PANGP and the wifi adapters!)

We opted to use the firewalls to update so users have a brief disconnect/reconnect upon logon before they got too engrossed in work.

Once we started getting a number of calls in we stopped the updates to users, but as the bug is so random it can affect a working user half way trough the day, or allow a broken user to come to life half way through the day where as some users are permanently broken.

Extremely frustrating this hotfix not being a newer version than it's major release version. Please Palo Fix!

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

emr_1 — Mon, 05 Apr 2021 01:27:51 GMT

I heard GP 5.2.6 will be planned to release in this week. (Information is from my openning ticket)

Even I don't have any information related to addressed issue in this version, I can say it will be 'newer version'.

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

Pete_Blackett — Tue, 06 Apr 2021 09:25:38 GMT

yes, Enterprise Support/Palo told me that and I was severely unimpressed! something so simple and yet they have not recognised it as a bug !

PLEASE FIX BUG !

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

jdelio — Wed, 07 Apr 2021 18:50:00 GMT

As an update.. not sure about the release of 5.2.6, but for now here is a KB article that talks about the upgrade here:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000sY1G

Re: Global Protect 5.2.5 and 5.2.5 Hotfix - Allow Transparent upgrade doesn't work - what a mess.

sebastianvd — Fri, 09 Apr 2021 11:08:25 GMT

5.2.6 is out