See the users version of Global Protect in Panorama

[Bo_Olsen]

I am getting ready to test upgrading GlobalProtect using the "Allow Transparently" option of the upgrade for a small subset of users. I want to verify the upgrade worked from Panorama without reaching out to the user for verification that it worked. I can't seem to locate where I would see the user's client version for GP in Panorama. My initial thought was in HIP or Remote User.

I feel like I am just missing something but haven't had any luck looking through articles so any advice or direction is appreciated. 

[PavelK]

Thank you for the post @Bo_Olsen

Could you go in Panorama to: Monitor > Logs > GlobalProtect, then click on arrow to add: "Client Version":

Your Firewall has to be configured for log forwarding under: Device > Log Settings > GlobalProtect > Forward Method > Panorama.

Could you please check whether the above meets your requirements?

Kind Regards

Pavel 

[Bo_Olsen]

Hi Pavel, I think that might be the issue, I don't seem to have an option for either one. When I look under  Device > Log Settings > "GlobalProtect" isn't an option to set up the forward. 

[PavelK]

Thank you for the reply @Bo_Olsen

I believe the reason why you do not see this option is PAN-OS version. Global Protect log was introduced in PAN-OS 9.1. If you happen to be on PAN-OS 8.1 or 9.0, I would recommend you to upgrade Panorama as well as managed Firewall to 9.1 as versions 8.1 and 9.0 will be end of life on 1st March 2022. This upgrade should resolve your issue with GlobalProtect log forwarding.

For the upgrade itself, the order of operation is to upgrade Panorama first, then managed Firewalls. Also watch out for changes to default behavior: https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-release-notes/pan-os-9-0-release-information/cha...

Kind Regards

Pavel