Globalprotect msi

[dieter_b]

Hello

Is there a difference between the Globalprotect msi files you can download from the software support site and the Globalprotect msi files you can download from your own Globalprotect portal ?

The reason why I ask: I'm testing deployment of the GP client through Group Policy. I've noticed after installation, sometimes the portal address is not filled in on the Settings tab.

It would be nice to know where that value comes from (is it in the msi or somewhere else) to make deployment reliable.

[dieter_b]

On further investigation i found:

• no difference in file size for the msi's
• there is a registry key named Portal in HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup which seems to hold the portal address.

More testing being done...

[kalebw]

There should not be a difference as far as I am aware, as one is just loaded by the firewall and presented in the portal page.  You are correct that there is a registry key which actually holds the Portal

Regards,

Kaleb

[mbutt]

Hi,

You are correct there is no difference. When you install the GP client manually and login for the first time verify that the registry is being setup for it or not.
When you install from the portal you actually are going to the address and it picks it up from there and saves that information for you in the registry.

The files should be the same and there should be no difference between them,

Thank you

Numan

[panos]

We got a feedback from a customer that could not install from the device file but the file link worked.They were using Macos.Versions were the same.I could not understand why that happened because files are the same.

[dieter_b]

Thank you all.

It seems that the registry key for Portal is not enough for seamless deployment. My guess is the user needs to log on manually one time, so the GP client can get the correct config (and some handshaking using certificates).

After that, all is fine. We're doing SSO, and GP client never asks for credentials again.

This process is doable for our users, but ideally we would like to push the config with the deployment.