Connect to GlobalProtect VPN from cmd.exe in Windows 10

[fhewiufhwefhwe]

How can I connect to Palo Alto Global Protect VPN from the windows command line?

I am trying to automate a logon script and have multiple steps that follow a successful Global Protect VPN connection.

[reaper]

you could configure GP in prelogon mode which allows scripts to run during logon because the tunnel is already established before the user logs on where traditional VPN would only establish after logon

[fhewiufhwefhwe]

Unfortunately that's not going to work.  The CEO does not want to be connected 100% of the time.

I need to have a simple script that he can double-click to run and automatically connect to the GlobalProtectVPN and automatically run subsequent commands unrelated to the firewall after that.

[reaper]

you could give OpenVPN a go (and install linux on his laptop) or you could hide the GP icon and let him believe everything just works 😉

the windows client doesn't have command prompt commands, unfortunately

[reaper · Accepted solution]

simple "connect" mode and then a desktop installed icon to click would be the way to go

he'd need to remember to connect first, then click the icon

[fhewiufhwefhwe]

Got it thanks.  He's not willing to click more than one thing.  Instead he is going to have his assistant do some additional work.

[OwenFuller]

It is possible to call additional commands (such as a batch file) using the post-vpn-connect registry key.  With this method, you could have him connect to GlobalProtect on-demand by selecting the icon in the system tray, and then GP will run whatever you reference in this registry key after it connects.

https://docs.paloaltonetworks.com/globalprotect/9-0/globalprotect-admin/globalprotect-apps/deploy-ap...

[fhewiufhwefhwe · Accepted solution]

Thanks, that works!  Appreciate the assistance.

[Taha]

Can we deploy the registry entries as part of agent install or push them remotely? We have user who use their personal devices to VPN via Global Protect and we do not have access to those devices to manually add registry entries to run post-connect scripts.