Global Protect VPN installation on manjaro

merlins — Fri, 16 Dec 2022 12:30:47 GMT

Hello,
I am a manjaro(arch linux based distro) user, and I need to use this Global Protect VPN for some reason. But I can't install. I am looking for an alternative installation or solution. I installed my own AUR repository and defined versions with openconnect. I provide connection but no access. I can't download the files in the .tgz file from their site. I am waiting for your help, best regards...

#manjaro#globalprotectvpn

Re: Global Protect VPN installation on manjaro

aleksandar.astardzhiev — Mon, 16 Jan 2023 22:35:43 GMT

Hi @merlins ,

As you have already figured out, the official GlobalProtect agent is not supported on Arch based distributions.

Having that said there is unofficial project that is using the Openconnect VPN agent and configure it in a way to look like a GP agent - https://github.com/yuezk/GlobalProtect-openconnect

I didn't understand quite understand you, but you probably already have found the same software in the AUR repository.

Based on your description - "provide connection but no access", I would guess that the VPN to which you are connecting is enforcing HIP check - https://docs.paloaltonetworks.com/globalprotect/9-1/globalprotect-admin/host-information/about-host-information.

Basically VPN is established, which will logically connect you to the PAN FW, where you still need to match firewall rule to allow to pass over the firewall. Probably the FW rule allowing traffic for GP users to internal resources is using HP profiles. This means that FW will allow only traffic if the VPN user is connecting for compliant machine (meaning your laptop cover some basic checks like, have AV, disk encrypted, not running outdated OS, etc). It is possible that your Openconnect successfully authenticates you and establish the tunnel to the FW, but it doesn't submit HIP (host information) report to the FW, so you don't match the allow rule.

As you can see here Openconnect support HIP submission - https://wiki.archlinux.org/title/OpenConnect

The question is what HIP profile is configured on the FW? What requirements you need to fulfill to consider your machine complaint, but this is completely based on what the FW admin has configured, so you may need to check with FW team supporting this FW.

topic Re: Global Protect VPN installation on manjaro in GlobalProtect Discussions

Global Protect VPN installation on manjaro

Re: Global Protect VPN installation on manjaro