Create SSL VPN on PA-500

[Demong]

Hello. Week ago friend of mine gave me an old PA-500 w/o license and subscrption.

Software Version

6.0.2

Since I had no admin pass therefore device was factory reseted. As Internet firewall device work fine now. Do somebody know is it possible to make up SSL VPN outside connection with such conditions? Thanks in advance!

[Demong]

Also as far as I know were a problems with upgrade this device. So far I have a 6.0.2 s/w. There is a PanOS_500-8.1.0 downloaded file but it is impossible to install due to error. Somebody know how it is possible to upgrade?

[TomYoung]

Hi @Demong ,

The PA-500 is EoL.  https://www.paloaltonetworks.com/services/support/end-of-life-announcements/hardware-end-of-life-dat...

I am surprised you were able to download anything.  To upgrade from PAN-OS 6.0.2 to 8.1.0, you would have to upgrade to 7.x 1st.

With regard to SSL VPN, here are the instructions.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClFbCAK

No license is required for Windows and Mac devices to connect.  https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-overview/abou...

PAN-OS 6.0 supports GlobalProtect.  You can configure it without having to upgrade.  I am sure the GUI will be different from the doc since the PAN-OS is so old.

Thanks,

Tom

[BPry]

@Demong,

Just to touch specifically on the upgrade piece, I don't think you'll really find any support there to get the images that you would require to complete that upgrade. You can maybe find an image searching the internet that someone has posted here and there for the PA-500, but I wouldn't personally trust them to actually step the device through an upgrade. 

Normally on a device that is this old that's still under active support you would need to reach out to TAC and have them provide you the images so you can walk it through the upgrade path. In this scenario, there's no way that you'll get legitimate access to any of the PA-500 images anymore.

[Demong]

@TomYoung thanks a lot! I will track instructions you've sent. The problems I've faced with s/w 6.0.2 are it impossible to connect with current versions of browsers and to see in Certificate profile just created certs
@BPry thank you too, course would be nice if somebody gracefully shared me an offline image of some 7.x version for PA-500)))