topic Re: Roll Back GlobalProtect in General Topics

Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 16:48:38 GMT

Does palo seriously not provide a way to roll back GlobalProtect? TAC told me there is no documentation on how to do that.

Re: Roll Back GlobalProtect

TomYoung — Thu, 24 Aug 2023 17:52:59 GMT

Hi @RobertShawver ,

Unless things have changed in a new PAN-OS, I have found that by activating an older version on the portal, the client is prompted if they want to install the older version of GP.

Thanks,

Tom

Re: Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 17:32:49 GMT

Hi @TomYoung

I'm not sure what you mean by "activating an older version on the gateway". I was under the impression that came from the Portal, not the gateway.

On the firewall, I have gone to Device > GlobalProtect Client downloaded and Activated a lower version. I then connected to that Portal, but nothing.

Re: Roll Back GlobalProtect

TomYoung — Thu, 24 Aug 2023 17:52:38 GMT

Hi @RobertShawver ,

Yes, you are correct. It is the portal. I will go back and edit my post. 😁

What do you have configured under Network > Global Protect > Portal > Agent > Configs > App > Allow User to Upgrade GlobalProtect App? I know it has prompted me in the past. I don't remember what PAN-OS or GP version it was. Maybe that "feature" has been removed.

I am curious. What happens when you open GP Client > Settings > About > Check for Updates?

Thanks,

Tom

Re: Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 18:11:20 GMT

@TomYoung

Really appreciate your time!

Network > Global Protect > Portal > Agent > Configs > App > Allow User to Upgrade GlobalProtect App > "Allow Transparently"

What happens when you open GP Client > Settings > About > Check for Updates?

"Check for Updates" doesn't exist. I was having some issues with 6.1.1, so I rolled the dice on 6.2.0-89 and came up craps.

Users every few hours are getting this:

I found a "fix", which was to go to C:\Users\your user id\AppData\Local\Palo Alto Networks\GlobalProtect\ and delete all the dat files.

That only seems to fix them for a few hours however. It's becoming a real issue for me. I've talked to two different support people now and they don't know what to do.

EDIT: I also do not see any upgrade/downgrade even attempted in the Windows logs.

Re: Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 18:30:47 GMT

It looks like it should be getting the new config:

But it isn't changing the version or doesn't even seem to be attempting to.

Re: Roll Back GlobalProtect

TomYoung — Thu, 24 Aug 2023 19:53:11 GMT

Hi @RobertShawver ,

I am curious if the behavior would be different if you selected Allow Manually or Allow with Prompt for the Allow User to Upgrade GlobalProtect App option. You probably know this, but once you change you will need to Refresh Connection or Logout/Login.

Thanks,

Tom

Re: Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 21:09:24 GMT

Hey @TomYoung

I think you got it!!!! Well, sort of. LOL!!!

I changed it to "Allow with Prompt" and now I get this:

Which is a FAR sight further than before! It's not seamless, but I think i can make it work.

Because not everyone is having the issue, those with 6.2.0 will just keep on keeping on none the wiser. Those that are having an issue, I can direct them to check for the update.

You are "The Man"!! Thanks so much!!

Re: Roll Back GlobalProtect

RobertShawver — Thu, 24 Aug 2023 21:11:05 GMT

I am curious, do you know what "internal" means?

Re: Roll Back GlobalProtect

TomYoung — Fri, 25 Aug 2023 11:26:21 GMT

Hi @RobertShawver ,

Great news!

With regard to your other questions, internal is listed here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalprotect-portals/globalprotect-portals-agent-configuration-tab/globalprotect-portals-agent-app-tab.

Thanks,

Tom

Re: Roll Back GlobalProtect

Bisham — Fri, 16 Aug 2024 03:25:25 GMT

I upgraded the GP version from 6.2.1 to 6.2.4 and after that users started getting connection issues. Its stuck in Finding the best available gateway message. I rolled back the version in Firewall but my client is already got upgraded and now its not connecting so how i can downgrade this now? to 6.2.1

Re: Roll Back GlobalProtect

TomYoung — Fri, 16 Aug 2024 20:49:11 GMT

Hi @Bisham ,

You can download the install files from (1) the portal login page or (2) the CSP under Updates > Software Updates > GlobalProtect Agent for ....

Thanks,

Tom

Re: Roll Back GlobalProtect

RobertShawver — Mon, 19 Aug 2024 14:07:46 GMT

Palo makes rolling back GP very difficult if not impossible natively. You could do it via login script or something like Intune. Other than that, you can look above to see how I was able to do it - it's a pain for sure though!

Re: Roll Back GlobalProtect

Bisham — Mon, 19 Aug 2024 14:15:41 GMT

But if i have a higher version 6.2.4 and on portal 6.2.1 is activated then will i be not able to connect to VPN?

Re: Roll Back GlobalProtect

TomYoung — Mon, 19 Aug 2024 17:48:49 GMT

Hi @Bisham ,

Yes, the client can be downgraded from the NGFW.

Thanks,

Tom

Re: Roll Back GlobalProtect

MP18 — Mon, 19 Aug 2024 20:29:35 GMT

@TomYoung

Follow up question we are upgrading GP client from 6.0.5 to 6.1.4 as it is Recommended one.

Any known issues with this GP Client?

Also, on PA side we have activated the GP client 6.0.5 only and if we test with few users using GP Client 6.1.4 will they able to connect?

Idea is to test the GP client with few test users then roll it out via Intune.

Regards

Re: Roll Back GlobalProtect

TomYoung — Tue, 20 Aug 2024 14:24:02 GMT

Hi @MP18 ,

Yes, they will still be able to connect. I have connected to customers with lower versions of GP many times.

Thanks,

Tom

Re: Roll Back GlobalProtect

MP18 — Tue, 20 Aug 2024 15:02:14 GMT

@TomYoung Thanks for confirmation.

Regards