Global Protect in Linux error

[BigPalo]

Hi,

We are trying to connect to our VPN using Global Protect client in a Fedora laptop. We have tested the following articles: https://docs.paloaltonetworks.com/globalprotect/4-1/globalprotect-app-user-guide/globalprotect-app-f...

but we are getting a certificate error:

pcdavid - david - / home / david
· Globalprotect connect --gateway 191.xx.xx.2xx -u David
Connecting ...
Connecting ...
Failed to connect to 191.xx.xx.2xx
Error: Gateway 191.xx.xx.2xx: The server certificate is invalid. Please contact your IT administrator.

We have tried to import the certificate and it seems that it has done it correctly.

We have also tested it with different certificate formats (crt and p12).

So do you have ny manual about working GP with linux? or what is wrong for getting this certificate error.

[hshawn]

AFAIK Fedora is not a supported distrobution. PAN actually hard codes the allowed distros into the compiled binary. There are ways around this but I will not post that informtion here (you can find it using a Google search) 

[AlexHampel]

https://www.reddit.com/r/paloaltonetworks/comments/9hh9g0/does_globalprotect_work_with_linux_distrib...

[ccscott]

So I get this error too, but on Centos

Oddly enough I don't get this certificate error with connecting to the same gateways via another portal. 

The main differences is the other portal has a GP license, which according to support is not needed. 

No other OS has the issue. 

[BPry]

@ccscott,

Support is definitely wrong on that one. The Linux GlobalProtect Agent is a licensed feature, if you don't have a GlobalProtect license the Linux agent isn't going to work.

[AlexHampel]

I stopped trying to make the GlobalProtect for Linux Client work several months ago.  Any "programmer" hard coding specific Distribution uname match strings into their "Client" to narrow their Client to 2-3 distros, is not taking the subject seriously enough.

Simply switched to using NetworkManager with the NetworkManager-openconnect add-on.  There is a Profile template built-in for GlobalProtect, it works like a charm on Fedora (32), and OpenSuSE (Tumbleweed).

Good luck out there!

[ccscott]

Correct support for this client is not great.