Activate a new GlobalProtect Client?

[OMatlock]

Hello folks,

Another first for me this week.  Before we upgrade our PANOS, I wanted to activate a new GlobalProtect client first.

It says here that it will download new client when users connect.

Is that true?  Will it download and install (upgrade) on the client automatically?

I was thinking it would just be made available on the Portal for download - separately.

I would test this, but have no test firewall to do it.

[OMatlock]

I found the setting in the GlobalProtect portal that prompts user or manual instead of transparent.

[jdprovine · Accepted solution]

@OMatlock

Just a thought but I wouldn't allow them to manually upgrade unless you are ready for users to upgrade. You can disallow users from upgrading portal\app (tab) , do this on all the portals, I used a test portal to use it on my test machine

[OMatlock]

Thank you jprovine!

From what I am reading, it seems that I must activate it first on my firewall to be able to download the .msi file to even put on an external web server for testing.  I am thinking my steps would be:

- Set Agent upgrade to disabled (for now).

- Activate 4.0.6.

- Download the .msi (or package).

- Upload to a test webserver or test individually until satisfied.

- Set Agent upgrade to manual (or whatever) to get the user clients updated.

Sound right?

[jdprovine]

@OMatlock

You can also download any of the Global protect clients from software repository  on the PA site.

In preparation I installed the client on my test laptop and made sure I could connects as is without the activate set on the firewall. Then I disabled other users from ugrading,  activated the new client, tested on my test portal which allowed upgrades, verified everything worked. Then I reactivated the old client, let everyone install again. Then I wrote up a document, with screenshots showing them what to expect, put it in the school news, sent it to the helpdesk and posted on our website.  If that all isn't enough, I also tested to see if the old client still worked with the new client activated. 

[OMatlock]

Thank you jprovine!

I've been trying to figure out how to get the .msi without activating on my firewall.

How did you do that?

I downloaded the PanGP-4.0.6 package file from Software Updates but been unable to extract it (no extension), and was assuming it was required to activate in the portal first.

[jdprovine]

@OMatlock

I am talking about the software updates on the Palo alto website I checked and there is a downloadable .msi package if you choose the windows 64 bit install

[OMatlock]

OMG!  Sorry for that spam.  I see it now.  Thank you jprovine!

[jdprovine]

@OMatlock

That's what we are here for!! keep on spamming