topic Re: Activate a new GlobalProtect Client? in General Topics

Activate a new GlobalProtect Client?

OMatlock — Tue, 20 Feb 2018 16:55:53 GMT

Hello folks,

Another first for me this week. Before we upgrade our PANOS, I wanted to activate a new GlobalProtect client first.

It says here that it will download new client when users connect.

Is that true? Will it download and install (upgrade) on the client automatically?

I was thinking it would just be made available on the Portal for download - separately.

I would test this, but have no test firewall to do it.

Re: Activate a new GlobalProtect Client?

OMatlock — Tue, 20 Feb 2018 20:24:01 GMT

I found the setting in the GlobalProtect portal that prompts user or manual instead of transparent.

Re: Activate a new GlobalProtect Client?

jdprovine — Tue, 20 Feb 2018 20:55:26 GMT

@OMatlock

Just a thought but I wouldn't allow them to manually upgrade unless you are ready for users to upgrade. You can disallow users from upgrading portal\app (tab) , do this on all the portals, I used a test portal to use it on my test machine

Re: Activate a new GlobalProtect Client?

OMatlock — Tue, 20 Feb 2018 21:14:14 GMT

Thank you jprovine!

From what I am reading, it seems that I must activate it first on my firewall to be able to download the .msi file to even put on an external web server for testing. I am thinking my steps would be:

- Set Agent upgrade to disabled (for now).

- Activate 4.0.6.

- Download the .msi (or package).

- Upload to a test webserver or test individually until satisfied.

- Set Agent upgrade to manual (or whatever) to get the user clients updated.

Sound right?

Re: Activate a new GlobalProtect Client?

jdprovine — Tue, 20 Feb 2018 21:24:29 GMT

@OMatlock

You can also download any of the Global protect clients from software repository on the PA site.

In preparation I installed the client on my test laptop and made sure I could connects as is without the activate set on the firewall. Then I disabled other users from ugrading, activated the new client, tested on my test portal which allowed upgrades, verified everything worked. Then I reactivated the old client, let everyone install again. Then I wrote up a document, with screenshots showing them what to expect, put it in the school news, sent it to the helpdesk and posted on our website. If that all isn't enough, I also tested to see if the old client still worked with the new client activated.

Re: Activate a new GlobalProtect Client?

OMatlock — Tue, 20 Feb 2018 21:32:48 GMT

Thank you jprovine!

I've been trying to figure out how to get the .msi without activating on my firewall.

How did you do that?

I downloaded the PanGP-4.0.6 package file from Software Updates but been unable to extract it (no extension), and was assuming it was required to activate in the portal first.

Re: Activate a new GlobalProtect Client?

jdprovine — Tue, 20 Feb 2018 21:40:14 GMT

@OMatlock

I am talking about the software updates on the Palo alto website I checked and there is a downloadable .msi package if you choose the windows 64 bit install

Re: Activate a new GlobalProtect Client?

OMatlock — Tue, 20 Feb 2018 21:42:33 GMT

OMG! Sorry for that spam. I see it now. Thank you jprovine!

Re: Activate a new GlobalProtect Client?

jdprovine — Tue, 20 Feb 2018 21:44:25 GMT

@OMatlock

That's what we are here for!! keep on spamming