Global Protect Client .cfg file?

[dhargrave]

I would like to deploy the Global Protect Client pre-configured with the Portal IP address in it. Does Palo Alto have a client packager or is there a file that can edited and added with the client install file?

Thx

[kprakash]

After you have configured the portal and the gateway, and when you download the client from the portal the first time, the client always comes with the portal IP address or the hostname, as shown in the screenshot. The installer file also contains the information of the gateway/gateways. You will always authenticate against the portal first and then to the gateways. You have an option though to change the portal IP address or the hostname, if you want to connect to another portal.

[dhargrave]

So the only way to deploy the client is to have the users download it from the portal? Palo Alto doesn't have a C:\Program Files (x86)\Cisco Systems\VPN Client\Profiles\**portal.pcf file that can be sent with client? What is the file name that hold the Portal address on the client? We wanted to deploy via WSUS packager and and AD GP?

[Phoenix]

Hello dhargrave,

For mass deployments as you are mentioning, you can deploy a registry key "Portal" under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\GlobalProtect\PanSetup with the portal hostname in it.

Hope this is exactly what you were looking.

Thanks

[gcapuno]

Hello dhargrave,

Please refer to GlobalProtect_Admin_Guide_v6.0.pdf, page 55 section Deploy Agent Settings Transparently.

You can define a GPO to push the installation of the GP client using the msiexec.exe

msiexec.exe /i GlobalProtect.msi <SETTING>="<value>"

Also, you can define a GPO to push the Portal registry String Value with the Host FQDN or IP address of the Portal so the client can download the GP configuration.

String Value "Portal" under HKEY_LOCAL_MACHINE\Software\Palo Alto Networks\GlobalProtect\PanSetup with the portal hostname in it.

Regards,

Gerard Capuno

[gcapuno]

Link on how to Deploy MSI's through your network with GPO:

Deploy MSI's through your network with GPO. - Spiceworks

GlobalProtect.msi can be downloaded from Support Portal: https://support.paloaltonetworks.com/Updates/SoftwareUpdates/

Regards,

Gerard Capuno