GlobalProtect Upgrade Settings

mateuszga — Mon, 06 Feb 2023 14:28:04 GMT

Hello Team!

My organization runs several different windows systems, e.g. 7/8/10/11. Some versions of GP do not work on older type 8 systems, the upgrade passes correctly but GP stops working on that system and unsupported versions.
https://docs.paloaltonetworks.com/compatibility-matrix/globalprotect/where-can-i-install-the-globalprotect-app
Is there any way to specify which system will be able to upgrade to which versions? I know there is an option to configure based on OS or users, but users work on different machines and the system is limited to Windows and WindowsUWP only.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000CllpCAC

Do you have any ideas?

All the best!

Re: GlobalProtect Upgrade Settings

BPry — Mon, 06 Feb 2023 14:39:57 GMT

@mateuszga,

In a situation like this, you're better off managing the client off of the portal itself through another software deployment options (SCCM as an example). This way you can target specific collections however you want, without the limitations of what the firewall presents. This isn't the best solution honestly, and I've seen SCCM and similar solutions cause a few issues during the upgrade process.

If you choose to use the above method, I'd honestly split it across portals if you can get away with it. Have one portal for clients that can actually still receive updates directly through GlobalProtect (supported devices), and then have another one for everything else. You can direct the endpoints to the proper portal through Group Policy, but this allows you to actually keep using "normal" upgrade methods for the supported endpoints.

topic GlobalProtect Upgrade Settings in GlobalProtect Discussions

GlobalProtect Upgrade Settings

Re: GlobalProtect Upgrade Settings