topic Re: GlobalProtect client script options in GlobalProtect Discussions

GlobalProtect client script options

Jamesy — Tue, 23 Oct 2018 15:11:18 GMT

I want to create a script or some other option if it is available that will present an icon on the users desk so that they can quickly disable/ enable the GP client without the reason prompt. I had a quick look but I don't see any CLI oprtions available tha I can use in a script.

Is this possible?

Re: GlobalProtect client script options

Mick_Ball — Tue, 23 Oct 2018 16:46:16 GMT

can you not just select "allow" in the Portal/App setting. perhaps you have it set to "Allow with comment".

maybe i have missed your point so please elaborate....

Re: GlobalProtect client script options

Jamesy — Tue, 23 Oct 2018 18:11:02 GMT

Hi Mick,

Thanks for for the response. This is an option and one that was presented to management who requested this, but I guess they want to make it even simpler by having an icon that users can double click.

Re: GlobalProtect client script options

LukeBullimore — Tue, 23 Oct 2018 18:35:42 GMT

Hey @Jamesy

If you set your connect method to "on-demand" - instead of having to disable the app there would literally be a disconnect button 😉 Sounds pretty simple to me!

Re: GlobalProtect client script options

Jamesy — Wed, 24 Oct 2018 09:07:08 GMT

Hey Luke,

Thanks for this. I am aware of this option and I agree it does seem pretty easy. This has been requested from the top, so I have to make sure I confirm there is no option for a command line that would facilitate a desktop shortcut to quickly diconnect when required.

I haven't seemn anything n teh docs and none while testing in teh CLI on a Windows PC. Am I correct in saying at this point that one does not exist?

Cheers,

Jamesy

Re: GlobalProtect client script options

LukeBullimore — Wed, 24 Oct 2018 09:23:50 GMT

Hey @Jamesy

My only thoughts are going to be the scripting options using the Msiexec - but I don't think disabling the app or disconnecting is possible entirely through a script. I've been reading the below documentation and it doesn't look to be possible.

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/deploy-agent-settings-to-windows-clients/deploy-scripts-using-msiexec

https://www.paloaltonetworks.com/documentation/80/globalprotect/globalprotect-admin-guide/globalprotect-clients/deploy-agent-settings-transparently/customizable-agent-settings#idd39ecf6d-6771-4ee3-a4d1-2ba5bbbad1bc

Re: GlobalProtect client script options

Jamesy — Wed, 24 Oct 2018 10:56:24 GMT

Thanks Luke,

I wil ltake a look at these.

Cheers,

Jamesy

Re: GlobalProtect client script options

Remo — Wed, 24 Oct 2018 17:09:06 GMT

Hi @Jamesy

For the windows client there is no CLI to script global protect actions. The only nice way is to use the options provided by global protect.

(A not so nice way is to write a little program (that needs hardcoded credentials for an account with administrator permissions). With this little program you could disable the PanGPS service which does kind of the same as diconnect/disable GP with the integrated options)

Re: GlobalProtect client script options

Jamesy — Wed, 24 Oct 2018 19:18:38 GMT

Thanks everyone for the input. It’s pretty clear at this point that there is no way to do it. I will mark this one as answered.

Re: GlobalProtect client script options

nikoolayy1 — Sun, 17 Oct 2021 09:05:59 GMT

You can just use Windows powershell as you can see my article below for how to do such things as I have dscribed this in my latest edit in the Knowledge sharing article:

https://live.paloaltonetworks.com/t5/general-topics/knowledge-sharing-globalprotect-troubleshooting-investgation/m-p/441311#M99994