topic Massive update of GlobalProtecr agents in GlobalProtect Discussions

Massive update of GlobalProtecr agents

aalfaro — Tue, 30 Jan 2024 21:17:52 GMT

Best regard

Equipment

Currently in the company we are with the task of updating the GP agent to a more recent version, however, we do not know how much impact there may be on end clients if we update the agent, since they will understand that there are many users.

Having said the above, I would like you to clarify the following information for me:

1. The agent configuration for the update is in Transparently mode. That said, when we give the order to update the agent from the FW, will the users who connect be updated immediately?
2. If they are updated, is it necessary to have admin credentials or is it done automatically? the above, taking into account that they are company computers, therefore, administrator passwords cannot be granted to users.
3. Could there be any impact when doing this procedure due to so many users or in theory should it be transparent for the user?

Thank you all very much and I look forward to your responses.

Re: Massive update of GlobalProtecr agents

reaper — Wed, 31 Jan 2024 10:09:26 GMT

@aalfaro wrote:
1. The agent configuration for the update is in Transparently mode. That said, when we give the order to update the agent from the FW, will the users who connect be updated immediately?
2. If they are updated, is it necessary to have admin credentials or is it done automatically? the above, taking into account that they are company computers, therefore, administrator passwords cannot be granted to users.
3. Could there be any impact when doing this procedure due to so many users or in theory should it be transparent for the user?

1. when you enable the new GP package, users will update when they connect or refresh their configuration. By default the config update is set to 24 hours, users will also connect/reconnect on all times of day so connected users will not all suddenly start the download.

2. if the agent was installed with proper credentials (you will notice if this was not done), it will update without needing admin credentials

3. yes, during the install procedure the connection will be interrupted for a moment for individual users. if you have a truly massive number of users, that all start their update at the same you will see a spike in bandwidth usage while everyone downloads the package.

Re: Massive update of GlobalProtecr agents

Mick_Ball — Wed, 31 Jan 2024 15:53:08 GMT

Hi, yes in my experience,,, exactly as Reaper explained... we usually see a new client connection 2 - 3 mins after they have logged in or refreshed GP. But the actual downtime is a few seconds whilst GP client is reconnected...

However, we do have over 6K user base and for this reason we created a new portal config above our default that had user groups added over a period of time with the allow transparently option set. we then added different departmental/admin/user groups during a couple of weeks or so to even things out.. (approx 500 every couple of days) and then finally added domain users as a catch all..

This caused no issue to our users and I would say that most of them never even noticed the upgrade was even taking place...

HTH

Re: Massive update of GlobalProtecr agents

aalfaro — Tue, 19 Mar 2024 15:35:34 GMT

Cordial greetings

@reaper y @Mick_Ball

Thank you for the response, we did the agent update and we are already seeing people connected with the new version.

However, I would like to take this opportunity to ask you a new question. Do you know of a technique that allows or limits connections from a specific agent version? It happens that we are seeing connections from versions 5.x.x, very old versions and even downloading the new version users have not been updated. The agent configuration is in update: allow transparent

Would you be so kind to let me know if you know anything about it?