Roll Back GlobalProtect

[RobertShawver]

Does palo seriously not provide a way to roll back GlobalProtect?  TAC told me there is no documentation on how to do that. 

[TomYoung]

Hi @RobertShawver ,

Unless things have changed in a new PAN-OS, I have found that by activating an older version on the portal, the client is prompted if they want to install the older version of GP.

Thanks,

Tom

[RobertShawver]

Hi @TomYoung 

I'm not sure what you mean by "activating an older version on the gateway".  I was under the impression that came from the Portal, not the gateway.

On the firewall, I have gone to Device > GlobalProtect Client downloaded and Activated a lower version.  I then connected to that Portal, but nothing.

[TomYoung]

Hi @RobertShawver ,

Yes, you are correct.  It is the portal.  I will go back and edit my post.  😁

What do you have configured under Network > Global Protect > Portal > Agent > Configs > App > Allow User to Upgrade GlobalProtect App?  I know it has prompted me in the past.  I don't remember what PAN-OS or GP version it was.  Maybe that "feature" has been removed.

I am curious.  What happens when you open GP Client > Settings > About > Check for Updates?

Thanks,

Tom

[RobertShawver]

@TomYoung 

Really appreciate your time!

Network > Global Protect > Portal > Agent > Configs > App > Allow User to Upgrade GlobalProtect App > "Allow Transparently"

What happens when you open GP Client > Settings > About > Check for Updates?

"Check for Updates" doesn't exist.  I was having some issues with 6.1.1, so I rolled the dice on 6.2.0-89 and came up craps.  

Users every few hours are getting this:

I found a "fix", which was to go to C:\Users\your user id\AppData\Local\Palo Alto Networks\GlobalProtect\ and delete all the dat files.

That only seems to fix them for a few hours however.  It's becoming a real issue for me.  I've talked to two different support people now and they don't know what to do.

EDIT: I also do not see any upgrade/downgrade even attempted in the Windows logs.

[RobertShawver]

It looks like it should be getting the new config:

But it isn't changing the version or doesn't even seem to be attempting to.

[TomYoung · Accepted solution]

Hi @RobertShawver ,

I am curious if the behavior would be different if you selected Allow Manually or Allow with Prompt for the Allow User to Upgrade GlobalProtect App option.  You probably know this, but once you change you will need to Refresh Connection or Logout/Login.

Thanks,

Tom

[RobertShawver]

Hey @TomYoung 

I think you got it!!!!  Well, sort of.  LOL!!!

I changed it to "Allow with Prompt" and now I get this:

Which is a FAR sight further than before!  It's not seamless, but I think i can make it work.

Because not everyone is having the issue, those with 6.2.0 will just keep on keeping on none the wiser.  Those that are having an issue, I can direct them to check for the update.

You are "The Man"!!  Thanks so much!!

[RobertShawver]

I am curious, do you know what "internal" means?

[TomYoung]

Hi @RobertShawver ,

Great news! 

With regard to your other questions, internal is listed here -> https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/globalprotect/network-globalp....

Thanks,

Tom

[Bisham]

I upgraded the GP version from 6.2.1 to 6.2.4 and after that users started getting connection issues. Its stuck in Finding the best available gateway message. I rolled back the version in Firewall but my client is already got upgraded and now its not connecting so how i can downgrade this now? to 6.2.1

[TomYoung]

Hi @Bisham ,

You can download the install files from (1) the portal login page or (2) the CSP under Updates > Software Updates > GlobalProtect Agent for ....

Thanks,

Tom

[RobertShawver]

Palo makes rolling back GP very difficult if not impossible natively.  You could do it via login script or something like Intune.  Other than that, you can look above to see how I was able to do it - it's a pain for sure though!

[Bisham]

But if i have a higher version 6.2.4 and on portal 6.2.1 is activated then will i be not able to connect to VPN?

[TomYoung]

Hi @Bisham ,

Yes, the client can be downgraded from the NGFW.

Thanks,

Tom