Global Protect Upgrade queries

[pnorman]

Hi,

We are currently going through an upgrade procedure to upgrade the 5.2.4 GP clients to 5.2.8. The portal agent config "Allow user to upgrade GlobalProtect App" is set to 'Allow with prompt'. I am moreorless there just have a few Q's about expected behaviour as I have not done this before?

1. When I activate 5.2.8 in Panorama will it prompt me to deactivate the 5.2.4 version as I read that only one version can be active at one time?
2. If we decided that rollback of the 5.2.8 client was required; would it be a case of just re-activating the 5.2.4 client?
3. If I was activate the 5.2.8 client during the day for example am I correct in thinking that users will NOT get prompted to download the new client of they are at that time connected to the VPN? Ideally, I don't want them to get prompted at that time but want them to be prompted when they connect again to the VPN .

Thanks in advance

[BPry]

1. When I activate 5.2.8 in Panorama will it prompt me to deactivate the 5.2.4 version as I read that only one version can be active at one time?

You'll just be prompted if you're sure you want to activate the new package and it'll take care of the rest, you don't have to go through and de-activate 5.2.4. 

1. If we decided that rollback of the 5.2.8 client was required; would it be a case of just re-activating the 5.2.4 client?

The end-user will be prompted with a similar upgrade message that specifically calls out that it's an older package that would be installed. The basic premise is the same, but unless a user knows they should be installing the older package it could cause some to not install the old agent due to thinking the newer agent is obviously the one they would want. 

1. If I was activate the 5.2.8 client during the day for example am I correct in thinking that users will NOT get prompted to download the new client of they are at that time connected to the VPN? Ideally, I don't want them to get prompted at that time but want them to be prompted when they connect again to the VPN .

Correct. If you activate it, they wouldn't get the prompt to upgrade until the next time they connect.