Packaging Global Protect

[D.Davis329631]

Have questions regarding packaging Global Protect for distribution to both Windows and Mac. Using MSI for Windows and pkg for Mac.

1. How do we create a package to distribute Global Protect that sets the Portal and forces it to use a specified browser (Windows - Edge and for Mac - Safari) and not use the default browser that is set up on the OS?

2. How can we prevent Global Protect from automatically connecting the first time the user logs in if we use the switch on the MSI to include the portal by default?

3. On Windows are their registry settings that can be used to configure Global Protect to always use a specified browser for authentication?

4. On Mac is their configuration file that can be updated specify settings like portal and specified browser use for authentication.

Thanks

[TomYoung]

Hi @D.Davis329631 ,

Here is what I have seen.

1. How do we create a package to distribute Global Protect that sets the Portal and forces it to use a specified browser (Windows - Edge and for Mac - Safari) and not use the default browser that is set up on the OS?

You can set the portal via command line options.  https://docs.paloaltonetworks.com/globalprotect/10-1/globalprotect-admin/globalprotect-apps/deploy-t.... Click on the Deploy App Settings Transparently link to dig into it.  I believe that you can only set the default browser, and not a specific browser.

2. How can we prevent Global Protect from automatically connecting the first time the user logs in if we use the switch on the MSI to include the portal by default?

I don't believe that is possible.  The default mode for the GP client upon reboot/restart is always on.  https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClhZCAS

3. On Windows are their registry settings that can be used to configure Global Protect to always use a specified browser for authentication?

I did not see one, but you can dig through the links.  All I saw was the default browser.  That makes sense because otherwise they would have to add a LOT of browser support.

4. On Mac is their configuration file that can be updated specify settings like portal and specified browser use for authentication.

The portal, yes.

If you were going to deploy GP via software manager such as you could also set the default browser for the OS and possibly lock it or instruct the user not to change it.

Thanks,

Tom