GlobalProtect doesn't upgrade transparently.

[tjsrhkd8741]

In Prisma Access Mobile User, the user GP version was distributed as 6.2.0. However, due to an issue, I needed to upgrade to 6.2.3, so I set upgrade globalprotect to allow transparently in the app settings. However, there was no change for 6.2.0 users, so I installed 6.1.4 as a test and waited, and it was automatically upgraded to 6.2.3 within 5 minutes. What I'm curious about here is whether it only works if there is a difference in the A part from 6.A.B Does anyone know exactly?

[aleksandar.astardzhiev]

Hi @tjsrhkd8741 ,

I personally don't have practical experience with Prisma Access, but in nutshell it is the same technollogy for on-prem GlobalProtect.

I can confirm GlobalProtect transperant upgrade works for major, minor and patch version of GP agent. Meaning transparent upgrade should trigger agent upgrade from 6.2.0 to 6.2.3.

I am guessing the following has happened in your case:

1. You have activated the new GP agent 6.2.3 and enabled transparent upgrade in GP portal setting

2. Test machine has reconnected to VPN, but this didn't triggered upgrade. I assume this is because GP agent has reconnected using cached gateway config. For that reason GP agent "didn't got the message" that it should upgrade - using cached gateway config haven't the transperant upgrade enabled.

3. Manually uninstalling and installing GP 6.1.4 have force the GP agent to connect to portal first and got fresh copy of the config. Which has triggered the transparent upgrade.

When GlobalProtect is connecting to the tunnel it will first try to connect to the previous "known good gateway". If gateway is still reachable and authentication is successful, GP will not connect to portal first. The check for transparent upgrade is performed during GP portal login (when GP is taking the latest copy of the config). Once connected GP will periodically connect to portal to check for update, but in most cases this portal refresh timer is set to 4 or 8hour (or more). I have noticed that when user disconnect and reconnect, this timer is reset. So it is quite common for most of the users to not get latest portal config for long time.