What am I doing wrong with Global Protect updates?

[inSync-MarkValpreda]

I am currently running GP 5.2.7 on a PA-3220 on 9.1.12-h3 and 99% of the time it is fine. I have an issue with a few of my developers with SQL Server Management Studio dropping connection.....but only SSMS. Was going to try newer versions of 5.2.x and see if that helps them out - just installing manually opposed to pushing through the firewall.

The issue I have is when I went from 5.2.2 to 5.2.7 the users would get a notification in Windows 10 that the application was updating in the background, but never did. It generated a lot of tickets and trying to avoid that next time.

I am doing split-tunnel for both network traffic and DNS. Changed Upgrade option from Allow with Prompt to Allow Transparently. The rest of the App config is default.

Am I doing something wrong with the GP client update?

[Adrian_Jensen]

We run 5.2.x (currently 5.2.10) with transparent client upgrade (though we have "Allow User to Disable" disallowed) and haven't had a problem pushing out updates, but there have been several bugs in the GP client fixed with respect to the upgrade failing. Perhaps most relevant to a 5.2.2 upgrade is:

GPC-10650 - "...the transparent software upgrade failed for the GlobalProtect app." - fixed in 5.2.6

GPC-11876 - "...pre-vpnconnect or post-vpn-connect contained arguments with one or more whitespace characters, which caused the built-in GlobalProtect app upgrade to fail." - fixed in 5.2.5

I also seem to remember something about needing to upgrade to 5.2.5 before moving on to higher GP versions... but I can't find that documented anywhere at the moment, so I may be wrong. Maybe try a transparent or manual upgrade to 5.2.5, then upgrade again to 5.2.7+?