topic Re: Global Protect in Linux error in General Topics

Global Protect in Linux error

BigPalo — Thu, 13 Jun 2019 10:10:44 GMT

Hi,

We are trying to connect to our VPN using Global Protect client in a Fedora laptop. We have tested the following articles: https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-user-guide/globalprotect-app-for-linux.html#

but we are getting a certificate error:

pcdavid - david - / home / david
· Globalprotect connect --gateway 191.xx.xx.2xx -u David
Connecting ...
Connecting ...
Failed to connect to 191.xx.xx.2xx
Error: Gateway 191.xx.xx.2xx: The server certificate is invalid. Please contact your IT administrator.

We have tried to import the certificate and it seems that it has done it correctly.

We have also tested it with different certificate formats (crt and p12).

So do you have ny manual about working GP with linux? or what is wrong for getting this certificate error.

Re: Global Protect in Linux error

hshawn — Thu, 13 Jun 2019 14:43:31 GMT

AFAIK Fedora is not a supported distrobution. PAN actually hard codes the allowed distros into the compiled binary. There are ways around this but I will not post that informtion here (you can find it using a Google search)

Re: Global Protect in Linux error

AlexHampel — Fri, 21 Jun 2019 21:32:26 GMT

https://www.reddit.com/r/paloaltonetworks/comments/9hh9g0/does_globalprotect_work_with_linux_distributions/

Re: Global Protect in Linux error

ccscott — Wed, 08 Jul 2020 00:54:46 GMT

So I get this error too, but on Centos

Oddly enough I don't get this certificate error with connecting to the same gateways via another portal.

The main differences is the other portal has a GP license, which according to support is not needed.

No other OS has the issue.

Re: Global Protect in Linux error

BPry — Fri, 10 Jul 2020 15:00:58 GMT

@ccscott,

Support is definitely wrong on that one. The Linux GlobalProtect Agent is a licensed feature, if you don't have a GlobalProtect license the Linux agent isn't going to work.

Re: Global Protect in Linux error

AlexHampel — Fri, 10 Jul 2020 15:17:35 GMT

I stopped trying to make the GlobalProtect for Linux Client work several months ago. Any "programmer" hard coding specific Distribution uname match strings into their "Client" to narrow their Client to 2-3 distros, is not taking the subject seriously enough.

Simply switched to using NetworkManager with the NetworkManager-openconnect add-on. There is a Profile template built-in for GlobalProtect, it works like a charm on Fedora (32), and OpenSuSE (Tumbleweed).

Good luck out there!

Re: Global Protect in Linux error

ccscott — Fri, 24 Jul 2020 22:34:11 GMT

Correct support for this client is not great.