topic Re: Globalprotect and Linux in General Topics

Globalprotect and Linux

jmrodriguez — Fri, 15 Jun 2012 09:06:24 GMT

Hi everybody.

Is it possible to use the client GlobalProtect on a Linux operating system?
Is there a "workaround" or some free Linux VPN client that can be used for it?

Thank you very much.

Re: Globalprotect and Linux

jmrodriguez — Wed, 20 Jun 2012 10:49:26 GMT

Please, anyone could help me?

Thank you very much.

Re: Globalprotect and Linux

mikand — Wed, 20 Jun 2012 11:11:29 GMT

I think any IPsec based VPN clientsoftware will work for you if its just the VPN stuff you want.

Globalprotect includes sort of a HIPS aswell (to keep track of which antivirus and db etc the clients are using and based on if they are up2date Globalprotect can let a client in or quarantine it etc) which a regular IPsec VPN software doesnt deal with.

Re: Globalprotect and Linux

Retired Member — Fri, 22 Jun 2012 18:43:25 GMT

At present time there are no Linux IPSec clients that we support. I would recommend checking with your Sales contact to get roadmap information for upcoming support.

Re: Globalprotect and Linux

mikand — Sat, 23 Jun 2012 12:37:38 GMT

Perhaps not officially support (as in getting help if setting up a support case) but shouldnt they still work in real life because the vpn client in iphone/ipads works aswell as if you setup a vpn-tunnel towards a cisco ASA as described in: ?

I mean as long as it is pure IPsec then it should work, shouldnt it?

Re: Globalprotect and Linux

dmartin — Thu, 05 Jul 2012 17:22:00 GMT

I feel your pain! I have reached out to my sales channel for the improvement to incorporate a Linux Global Protect client for two years now and still absolutely NOTHING. They know that this isn't where they need to support their resources but "come on." I would be greatly happy for an "unsupported" way of getting any Linux client to work over VPN. I have about a dozen clients that I would setup a dozen "site-to-site" VPN configurations, if I could figure out the exact way to get it working. I tried a couple options but troubleshooting the VPN not establishing connection was very difficult.

I'm still waiting for PA to come up with something... good thing I am not holding my breathe.

Re: Globalprotect and Linux

jacek.urban — Thu, 16 Aug 2012 21:57:03 GMT

It is possible to establish VPN IPsec to GP from Linux. We have used Ubuntu with vpnc (and additionaly GUI network-manager-vpnc).

From Linux side you should use "Compatible with Cisco VPN" option.

Form GP side (soft ver 4.1.6):

GlobalProtect-> Gateway -> General

Tunnel Mode -> Enable IPsec option on and Enable X-auth option on -> Group Name and password

Skip Auth on IKE Rekey option on

GlobalProtect - >Portal -> Client conf -> General

Third party vpn client -> add cisco systems vpn adapter

Re: Globalprotect and Linux

jmrodriguez — Fri, 17 Aug 2012 06:18:34 GMT

Hi Jacek.

Yes, It is possible, but there is a serious problem with split-tunneling. You can see the discussion in: . Are you using more than one access routes in your configuration?

Thank you.

Re: Globalprotect and Linux

jacek.urban — Fri, 17 Aug 2012 08:15:49 GMT

Yes, we are using 2 injected routes - they were summarized to network 128.0.0.0 128.0.0.0 :-).

Workaround - in the vpnc we have configured to ignore routes sent by PA, and manually added routes (without setting default route (only net/mask).

And it works 🙂

I think the same option is possible in Shrew client

Re: Globalprotect and Linux

jmrodriguez — Fri, 31 Aug 2012 10:41:00 GMT

Hi.

Thank you Jacek. Finally I've created a shell script using vpnc command to connect and add the routes. It works.

In my opinion, PaloAlto should offer a solution for GlobalProtect VPN on Linux platforms, in case they want to take advantage over their competitors.

Bye!