Global Protect 6.2.X, HIP Match and Fedora 41

[LCMember4164]

Hello everyone,

I am opening this discussion due to a "compatibility" issue between Fedora 41, the 6.2.X GlobalProtect client and the HIP match function.

In our organization we are planning to move from GlobalProtect 6.1.X to 6.2.X.

We collect posture data from the GlobalProtect clients and evaluate them against some HIP Profiles (such as patch-management installed & enabled or real-time-protection enabled) to grant or deny access to some internal resources.

On Windows and Mac the Global Protect client preferred release is working fine, while on Linux we are testing the 6.2.1-c31 version.

However, while performing some tests, we noticed a strange behaviour with Fedora 41.

The user is able to connect and authenticate to the VPN portal and gateway, but the information contained in the Host Profile tab of the GlobalProtect client seems to be misleading.

In particular, under patch-management, the dnf package manager is characterized by the value is-enabled: no.

The issue has been noticed only on Fedora 41, instead with Fedora 42 or debian-based releases (Debian 12, Ubuntu from 18 to 24) the patch-management field is correctly populated.

Is there any workaround, other than create an exclusion via a dedicated HIP Object?

Thank you for your support.

[kiwi · Accepted solution]

Hi @LCMember4164 ,

I believe you might be running into bugID GPC-23405 which is related to a wrong location for the OPSWAT license, causing HIP to fail on Fedora 41 using GP 6.2.7

As far as I can see the fix versions is GP 6.3.3.

I'd recommend reaching out to TAC to confirm if you're hitting this exact bug and if it will be backported to GP 6.2.x

Kind regards,

-Kim.

[LCMember4164]

Hi @kiwi,

Thank you for the support, I will reach out to TAC to confirm your suggestion.

Kind Regards