GlobalProtect automatic updates.

[N.Nicolaides]

Hello,

I have around 1000 users on Prisma access both Windows and Mac.

I have enabled version 6.3.1 (the previous version was 6.2.3) and I can see that users are getting the upgrades.

My questions are:
How is the rollout managed?

Does the client gets pushed to all users at the same time?

Is it a push or a pull method?

Why do I still see the previous version although the upgrade was set 10 days ago and the user has connected multiple times since?

[reaper]

you configure how the agents receive the updates in the portal > app configuration or in the Prisma access plugin. the default behavior is that whenever you activate a newer agent, users will receive and install it the next time they log on or when the config refresh rolls around

it's a pull method: the agent detects there's a new agent bundle and pulls it down

did you allow users to decline upgrades? (also default, they will get a prompt)

you can set the method to transparent, that way it gets installed without interaction from the user

[N.Nicolaides]

Hello,

The policy is set to Allow transparently. However, I see in the logs that some users are still being connected with the old client.

I have a feeling because these are mostly Mac users and they almost never reboot their computers. Which means the connection may be still active (since MacOS does not fully sleep, it keeps wifi and bluetooth up) and the user is not technically disconnected from the VPN.