topic Globalprotect client config - force push portal config update? in General Topics

Globalprotect client config - force push portal config update?

welly_59 — Thu, 04 Oct 2018 17:08:47 GMT

We rolled out a vpn solution with “on-demand” login. This has proved successful and we now wish to convert the configuration to be “always on”

I have changed the portal configuration to “prelogon always on”, but the clients do not pick up this config change unless they manually initiate an “on-demand” connection first. Then the portal config changes get pushed to the client.

What I am looking for is a way to force the client config to update to be always on without the user initiating a manual on demand connection to pull the new config.

How can I achieve this?

Re: Globalprotect client config - force push portal config update?

Brandon_Wertz — Thu, 04 Oct 2018 17:25:04 GMT

The problem is the client has a set config and given that the current state or previous state was "on-demand" any change you make on the firewall side won't be made to the client until they connect.

The only way to get this update on the clients without them connecting in is to modify the client machine directly:

Here's the high level:

https://www.paloaltonetworks.com/documentation/71/globalprotect/globalprotect-admin-guide/set-up-the-globalprotect-infrastructure/deploy-agent-settings-transparently/deploy-agent-settings-to-windows-endpoints

Here's some more specific config parameters:

Finally (from the above link) here's the link on how to make the change to the client you want:

Re: Globalprotect client config - force push portal config update?

welly_59 — Thu, 04 Oct 2018 17:54:34 GMT

Excellent! I’ll liaise with the team tomorrow and see if we can get this pushed out via gp or something

Re: Globalprotect client config - force push portal config update?

Brandon_Wertz — Thu, 04 Oct 2018 18:23:05 GMT

I used these with my SCCM team and they pushed out the relevant config and it worked great.

Re: Globalprotect client config - force push portal config update?

welly_59 — Fri, 05 Oct 2018 08:29:59 GMT

where within the registry would i deploy these keys? for example if i wanted initial state to be prelogon always on:

connect-method on-demand | pre-logon | user-logon

Re: Globalprotect client config - force push portal config update?

dpeterson4 — Thu, 30 May 2019 15:15:26 GMT

The path to the registry setting is here.

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings

The key value is connect-method

The value data is either on-demand, pre-logon, or user-logon