GlobalProtect doesn't upgrade

[ToniE]

Our current version in clients is 5.2.7. Now I have activated 5.2.8 but clients doesn't upgrade. Our setting for upgrade is allow transparently. Client machines shows pop up that GlobalProtect agent upgrade is in progress please wait etc... but nothing happens.

Previous update to 5.2.7 couple of month ago went smoothly. This is first time this kind of behavior.

[ColeDenton]

I get the same issue trying to upgrade to 5.2.8. Endpoints get a message about the upgrade in progress, but nothing ever actually happens. Are there some logs we can find to tell us what's going on?

[AnalysisMan]

I didn't get the same issue when I activated 5.2.8 from 5.2.7. However, several users failed to upgrade the GP client, so they followed the following KB. The typical uninstallation/installation GP client didn't work in this case.

Error: Failed to find PANGP virtual adapter interface when connecting to GlobalProtect
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Cm5eCAC&lang=en_US

Hope this helps!

[TomYoung]

I have macOS Catalina, and I ran into the same issue.  So, it is not the issue in the KB article for Windows.  Previous upgrades worked fine.  For 5.2.8, I would get a popup, then nothing.  I chose to download the software from the portal and manually upgrade.  That process worked fine.

[ColeDenton · Accepted solution]

Figured out the problem for my environment. The agent download was failing (found by opening GP Agent -> Settings -> Troubleshooting ->  Agent Logs)

Internal DNS records for our GP Portal were incorrect. Fixed them up so the portal was reachable from inside the network, then the upgrade immediately started working.

[MikeSangray2019]

Did you use the internal portal IP address for DNS? We're using a loopback address and are having a similar issue and I'm wondering if it's a misconfigured DNS entry.

[TomYoung]

Hi @MikeSangray2019 ,

I run into a similar issue with many customers.  After you connect via GP, your endpoint no longer uses an external DNS server.  You need to create an internal DNS A record for your GP public IP address.  Then the upgrade will work fine.

Thanks,

Tom

[MikeSangray2019]

Thanks, Tom! This got it working for us.