Global protect

[PaloAltorrr]

Hello,

After upgrading the GlobalProtect client, will users still be able to connect properly if they are using an older version?

Additionally, how can I test the upgrade on a small group of users before deploying it across the entire production environment?

Could you also advise on the key points to ensure a smooth upgrade process?

Thank you,
PaloAltor-FR

[mshekh]

Hi @PaloAltorrr ,

Yes, user will be able to connect to old version and newly installed version.

You can manually install the Global protect on small group to test.

[M.Falk310364]

is it possible to block old version of clients?

[mshekh]

Hi @M.Falk310364 ,

You can create a HIP object that is used as a match condition in security policies to require a minimum GP client version, and this could be used to block access to any/all resources for the users on the old GP versions. They would still be able to connect to GP, but would not be able to access anything. If you'd like to set this up, Please refer the below link for more details.

https://live.paloaltonetworks.com/t5/general-topics/minimum-allowed-version-of-global-protect/td-p/2...

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5WCAS