Download The Latest GlobalProtect Client?

[carterg]

I find not being able to download the latest client very frustrating.  I work from home several days a week and the company I work for, has just switched to globalprotect for their vpn requirements.

However on my companies client download page...

https://mycompany.domain/global-protect/getsoftwarepage.esp

...they dont have the latest client available

https://live.paloaltonetworks.com/t5/Management-Articles/Software-Release-Notices-GlobalProtect-Agp ...

Is there any way an end user such as myself can obtain the latest version of the client, without having to jump through hoops?

Looking for the latest mac client 4.1.0

[vsys_remo]

Hi @carterg

No there is no way for you to get the latest version of global protect, as the company that uses global protect has to decide which version they want to use. For the company it also depends on what other computers they are using global protect, so they probably don't want to distribute the latest version as it may still contain bugs (4.1.0 is pretty new and I personally also wouldn't use it already in production environment).

So you probably have to stay with the version you have or talk to the responsible people in your company if/when they enable the new version.

Regards,

Remo

PS: What version do you have installed now? And you could also ask them if they can give just to you the latest version as they are able to download it ...

[carterg]

Currently have 4.0.6

I dont agree with the philisophy of not having the client available to download though. Granted for the average user, they will utilzie what they are provided with, however I personally get involved in testing within my role and would much prefer to be able to download direc ly from paloalto as apposed to going cap in hand to admins.... to test myself, possible bugs n all

But hey, it is what it is

[carterg]

and also there is no consitency with the policy as the latest version of the android client is available on the store!

[vsys_remo]

Hi @carterg

Yo're right with the point on android. But on it is how it is o n other os'es. So if you need to test global protect, then the responsible people in your company ned to give you the required files or create an account for you on the paloalto support portal, so you would be able to download all these files - but thats just what I think...

[kkrause]

I AM the responsible party for my organization. I've downloaded the latest client to my firewall, but don't want to activate it until I can test it. Is there any method for me to download it from my PAN 500 for testing?

[BPry]

@kkrause,

Go to the support portal and instead of installing the agent bundle, download the actual package for your operating system (.msi or .pkg, or apk) and install that on the machine that you wish to utilize for testing.

Your only other option is to spin up another Gateway for strictly testing purposes.

[kkrause]

Thanks for the response. I found the client and  got it installed for testing.

Thanks again!

[Sandeep_R]

Hello Dears, 

I am getting following error while downloading the GlobalProtect Client in PaloAlto device. I tried to search for the error in Community, but no Luck!! 

Has any one come across such error? 

Kindly suggest how to resolve this error. 

Regards, 

Sandeep 

[BPry]

@Sandeep_R,

Use the 'Check Now' button at the bottom of that screen; once the firewall checks in with the updates server you should be able to successfully download whatever image you wish. Sometimes you run into errors like this when you haven't let the firewall check for updates in a bit, it seems like something cached simply becomes out of date until you check in again. 

[Sandeep_R]

Dear @BPry,

Thanks and Appreciate the rapid response from you. I will follow your suggession. 

Regards,

sandeep 

[relayer]

Greetings!

I am currently running version 7.0.7 of the PAN-OS on a PA-3000 Series Firewall (HA pair) and I wish to perform an incremental update to 7.1 but have concerns regarding the GlobalProtect Client.

I'm new to Palo Alto and have understood that the GlobalProtect Client is made available through the appliance itself through an Internet-facing portal. As such, I control the version of the GlobalProtect Client from the appliance. Right now, we are serving version 3.0.3 of the GlobalProtect Client.

I would like to see if a more recent version of the GlobalProtect Client will work with version 7.0.7 of the PAN-OS. I would therefore like to download version 4.1.5 or 4.1.6 of the GlobalProtect Client to test it before updating the firewalls.

@BPry was saying that the GlobalProtect Client is available for download from the Support Portal, which I have access to, but I couldn't find a download link for it. Could anyone point me to that link please?

Moreover, am I going about this the wrong way? Any suggestions?

Thanks!

[BPry]

@relayer

7.0 is EoL, and has been since the end of 2017; I would highly recommend that you migrate to a supported version of PAN-OS. You'll be unable to run 4.1 as it requires a minimum software version of 7.1; you'll be able to update to 4.0.* until you upgrade PAN-OS. 

https://support.paloaltonetworks.com/Updates/SoftwareUpdates/ will get you to the right page; up top you can use the 'Filter By:' dropdown to limit the list to just the GP agent you wish to install. 

[relayer]

Thank you for clarifying and for the link to the Software Updates page!

So, is that how most administrators proceed? They update the firewall and then update the clients afterwards? Wouldn’t there be a period of time where clients that haven’t yet been updated fail to connect?

Or does the client fetch an update automagically when connecting to the firewall, which makes a little more transparent for the user?

Sorry for the entry-level questions, I’m replacing the main network engineer and simply haven’t done this before.

[aleksandar.astardzhiev]

Hi @relayer,

Upgrading the PanOS is independant to the GlobalProtect client. You control the GP version through Device -> GlobalProtect Client. The OS upgrade is not upgrading the GP automatically. More important - depending on your GP portal config you can connect with higher or lower version than the current active one, which gives you few availble options:

- Upgrade the PanOS to 7.1;

- leave the current GP active version as it is;

- confirm that your GP portal is not forcing user to update the client (network -> gp portal -> agent -> app -> allow user to upgrade gp app -> select allow manual or disable);

- download newer version and test it;

- once happy with result, change the app settings to upgrade all users