topic Re: Globalprotect client in General Topics

Globalprotect client

jdprovine — Thu, 09 Mar 2017 16:07:12 GMT

I want to do some testing on new global protect clients but I don't want to make it update anyone tell I can test it, How do I get the software to test with out making it the default cleint on the firewall?

Re: Globalprotect client

TranceforLife — Thu, 09 Mar 2017 16:13:23 GMT

You always can download manually from the support site (not sure if you do have enough privileges):

Re: Globalprotect client

jdprovine — Thu, 09 Mar 2017 16:34:22 GMT

Thanks trance I found that and downloaded one of them, do you know if the client is a different version from what is offered on the firewall if it will still work

Re: Globalprotect client

TranceforLife — Thu, 09 Mar 2017 16:41:25 GMT

I believe the client is identical. So either you installing it manually or downloading over the PA GP portal = same

Re: Globalprotect client

jdprovine — Thu, 09 Mar 2017 16:44:44 GMT

no I mean I have 2.2 offered on my firewall. If I install a new version from downloading it from the software portal will it work with my firewall if I have only downloaded and offering 2.2 and the client installed on my pc is 3?

Re: Globalprotect client

TranceforLife — Thu, 09 Mar 2017 16:48:08 GMT

Good question :0 Give a go as l am not sure really. Never test this before

Re: Globalprotect client

jdprovine — Thu, 09 Mar 2017 17:42:41 GMT

I will let you know what I find out. I will download different GP versions and see if they can connect.

Re: Globalprotect client

BPry — Thu, 09 Mar 2017 18:38:17 GMT

Interesting; one would think that as long as the client falls within the usable packeges for the portal/gateway that you should be fine when you load things up manually. Please let us know if this actually works, I do this all the time on my AnyConnect clients but I've never tried on GP.

Re: Globalprotect client

BrianRa — Thu, 09 Mar 2017 19:44:12 GMT

jprovine,

One thing to consider and an option we've used for testing.

First any time you are doing testing make sure you change the GlobalProtect -> Portal -> Agent -> App setting for "Allow User to Upgrade GlobalProtect App" to either Disallow or Allow Manually. If you have anything else it may try to override what you are testing with the production version.

When we test a new client I set the above App setting to Disallow and Download/Activate the version I want to test. I then download it and install from vpn.firewall.com (your DNS name) manually. Once we have done this we just Activate the production version we are using again.

Brian

Re: Globalprotect client

jdprovine — Thu, 09 Mar 2017 20:06:57 GMT

well so far I manually installed version version 2.3.1-7 and I get this error "server certificate verification failure" The version enabled on the firewall is 2.2

Re: Globalprotect client

jdprovine — Fri, 10 Mar 2017 17:10:54 GMT

So have any one else done any upgrading of their globalprotect clients? How did you do it and was there is documentation? I did find out that you can not offer more than one globalprotect client at a time from the firewall. I am waiting to see if you can connect using a different version of globalprotect that what is being offered from the firewall. My initialize testin says that you can not but I have a ticket open asking that question in case their is something I missed.

Re: Globalprotect client

jdprovine — Mon, 13 Mar 2017 13:05:48 GMT

So Brian you downloaded and set the agent on the firewall to the new one and then downloaded the agent from the firewall to your test machine and I assume that in order to do that you have to set it to upgrade manually. So if I am understanding correctly there is no way to truly block anyone else from upgrading while you are testing?

Does changing the active globalprotect client on the firewall affect the users who are using an older version of globalprotect from connecting? Does it prompt them to upgrade?

So far I have found the upgrade of the client very poorly thought out by PA

Re: Globalprotect client

jdprovine — Tue, 14 Mar 2017 15:20:21 GMT

I found out that if you have a cert on your firewall for globalprotect that it will have issues if you download it from the PA site and it will also ask to remove the currently globalprotect client install before installing the new one. So testing the upgrade doesn't seem to be working. It appears you have to change to it on the firewall, make it active and available to everyone and then you won't have cert issue and it will upgrade a previous install

Re: Globalprotect client

BrianRa — Tue, 14 Mar 2017 20:13:19 GMT

jprovine,

That deals with the cert being used by the site you are connecting to. You can ignore that in the client/agent configuration in the Portal section if you want for testing.

Basically the certificate asociated with https://vpn.yoursite.com does not match what the client is looking for.

Brian

Re: Globalprotect client

BrianRa — Tue, 14 Mar 2017 22:03:56 GMT

jprovine,

You can use any supported version of the GlobalProtect client.

Another option would be to download the clients to the firewall you want to test with. Set them as active and download each one to your computer. Then set the one you are currently using back to active.

We have not had problems playing with multiple versions of the GlobalProtect client.

Brian

<EDIT>

I have never tried downloading the GlobalProtect client from Palo Altos web page and using it. We have always downloaded it to the firewalls.

</EDIT>

Re: Globalprotect client

jdprovine — Wed, 15 Mar 2017 13:24:52 GMT

yeah Brian we only have one firewall and its the one everyone goes through so if I download the newer globalprotect client and activate it, it would be available to all of the users not just me. I think I have found a way on the portal to set users to disable the ability to upgrade to the version. I just have to make sure they are still able to use the client they currently have installed and see if I can create another portal and gateway for me to test with

Re: Globalprotect client

BrianRa — Wed, 15 Mar 2017 16:05:12 GMT

jprovine,

Yes there is a way to disable their ability to upgrade.

GlobalProtect -> Portal -> Agent -> App setting for "Allow User to Upgrade GlobalProtect App" to Disallow

This will not stop them from using the portal only from being able to upgrade it. Remember this is a push when the connection is either created or updated. This is not an immediate change, you may want to set this and wait overnight for everyone to log back in and get the updated profile from the firewall.

Re: Globalprotect client

jdprovine — Wed, 15 Mar 2017 18:29:18 GMT

the since I am in the same group for VPN I am going to have to create another portal and allow it the rights to upgrade to order to test it effectively

Re: Globalprotect client

BrianRa — Thu, 16 Mar 2017 16:03:20 GMT

You do not need to create an additional portal but a new Agent within the existing portal. Then you can modify the settings I previously mentioned for your new group to allow download and install.

Re: Globalprotect client

jdprovine — Thu, 16 Mar 2017 16:55:10 GMT

I can't do that because the portal in question id all of the VPN users (staff) not just my group. The only way I can restrict it to only me is to have my own portal