Upgrading GlobalProtect while on corp network

[ce1028]

Hi everyone,

I have a client who said every time they try to upgrade globalprotect, they have mixed results. The issue seems to be that they'll set the GP App to "Allow with prompt". However, the users will never get the prompt while they are on the corporate network. It seems possibly, when the users go home, they'll get the prompt to download and then install, but maybe they shutdown or restart their machines while the install is happening, which then causes issues.  This is an assumption of what might possibly be happening.

The real question is, what is the best way to allow the upgrade to happen in the office? 

Public DNS record -  gp.domainname.com pointing to public IP of firewall e1/1 interface  (ex 2.2.2.2)

e1/1 - untrust zone  IP 2.2.2.2/24

e1/2 - trust zone  IP 10.10.10.1/24

Client on corp network 10.10.10.100/24

[vsys_remo]

@ce1028

What about configuring the setting "Allow users to upgrade global protect app" to "Internal"?

This will update the agent transparently but only when the client is in the internal network and not connected by VPN.

[ce1028]

@vsys_remo I believe an Internal gateway is required for this option?  I'd also have to consider the remote workers who are never in the office

[vsys_remo]

No, internal gateway isn't required. Only internal host detection. But yes when you have remote workers who are never in the office then this option does not work. Maybe if it is clear who always works from remote, then you could put them into a group and give them another portal config than your default configuration which then would be to allow the update only internally.

[ce1028]

@vsys_remo That's a good suggestion, as an alternative.  Is there anyway for transparent or allow with prompt to work, while on the corporate LAN?