GlobalProtect Apps Overview

The GlobalProtect™ app runs on your users’ endpoints (desktop computer, laptop, tablet, or smart phone) to extend the security policy you use on your corporate network to your mobile users to ensure that their traffic is secured, whether they are accessing resources in your data center, private cloud, public cloud, or on the internet.

In addition to providing secure connectivity and remote access like traditional VPN products, the GlobalProtect app also:

• Protects your internal networks
• Provides app- and service-level control
• Secures IoT devices
• Protects against data loss and credential theft
• Provides advanced threat prevention
• Enables automatic quarantine of compromised devices

Deploy the GlobalProtect App to End Users

To connect to GlobalProtect™, an endpoint must be running the GlobalProtect app. Use the GlobalProtect app compatibility matrix to determine what version of the GlobalProtect app you want your users to run on their endpoints.

The app deployment method depends on the type of endpoint as follows:

As an alternative to deploying the GlobalProtect app software, you can configure the GlobalProtect portal to provide secure remote access to common enterprise web applications that use HTML, HTML5, and Javascript technologies. Users have the advantage of secure access from SSL-enabled web browsers without installing the GlobalProtect app software. Refer to GlobalProtect Clientless VPN.

The GlobalProtect app runs on a variety of operating systems. To determine the minimum GlobalProtect app version required for a specific operating system, refer to the Compatibility Matrix .

GlobalProtect App Minimum Hardware Requirements

The hardware requirements for each endpoint OS are detailed in the following sections:

• Minimum Hardware Requirements for GlobalProtect App on Windows
• Minimum Hardware Requirements for GlobalProtect App on macOS
• Minimum Hardware Requirements for GlobalProtect App on Linux

Minimum Hardware Requirements for GlobalProtect App on Windows

You can install the GlobalProtect app on Windows endpoints that meet the following hardware requirements:

Minimum Hardware Requirements for GlobalProtect App on macOS

You can install the GlobalProtect app on macOS endpoints that meet the following hardware requirements:

Minimum Hardware Requirements for GlobalProtect App on Linux

You can install the GlobalProtect app on Linux endpoints that meet the following hardware requirements:

Download the GlobalProtect App Software Package for Hosting on the Portal

Palo Alto Networks does not provide a direct download link for the GlobalProtect app for end users. To successfully connect to your network, end users must be running an app version that is compatible with your environment .

Before you can deploy the GlobalProtect app for your end users, you must upload the new app installation package to the firewall that is hosting your portal, and then activate the software for download to the apps connecting to the portal. This deployment method is available for all non-mobile app versions. To download the mobile version of the GlobalProtect app see the app store for your mobile device.

To download the latest app directly to the firewall, the firewall must have a service route that enables it to access the Palo Alto Networks Update Server. If the firewall does not have internet access, you can download the app software package from the Palo Alto Networks Software Updates support site using an internet-connected computer, and then manually upload it to the firewall.

To manually download the app software package:

1. Log in to the Palo Alto Networks Customer Support Portal ( https://support.paloaltonetworks.com/ ).

2. Select Updates > Software Updates .
3. Select the GlobalProtect app version by operating system.
4. Review the Release Notes for the app version, and then select the download link to proceed with the download.
5. Proceed to Deploy the GlobalProtect App to End Users (referencing the Deployment Methods section).

See the Palo Alto Networks Compatibility Matrix for the operating systems on which you can install each release of the GlobalProtect app.

Host App Updates on the Portal

The simplest way to deploy the GlobalProtect app software is to download the new app installation package to the firewall that is hosting your portal, and then activate the software for download to the apps connecting to the portal.

If the firewall does not have internet access, you must manually download the software image from the Palo Alto Networks Software Updates support site using an internet-connected computer, and then manually upload it to the firewall.

You define how the app software updates are deployed in the portal agent configurations—whether they occur automatically when the app connects to the portal, whether the user is prompted to upgrade the app, or whether the end user can manually check for and download a new app version. For details on creating an agent configuration, see Define the GlobalProtect Agent Configurations.

1. On the firewall hosting the GlobalProtect portal, check for new app software images.

Select Device > GlobalProtect Client to view the list of available app software images.

• If the firewall has access to the Update Server, click Check Now for the latest updates. If the value in the Action column is Download , it indicates that a new version of the app is available.
• If the firewall does not have access to the Update Server, you must manually download the software image from the Palo Alto Networks Software Updates support site, as described in the previous section. After you download the software image, go back to the Device > GlobalProtect Client page of the firewall to Upload it.

2. Download the app software image.

• If the firewall has access to the Update Server, locate the app version you want, and then click Download . When the download completes, the value in the Action column changes to Activate .
• If the firewall does not have access to the Update Server, manually download the package (as described previously). After you download the software image, go back to the Device > GlobalProtect Client page of the firewall to Upload it.

3. Activate the app software image so that end users can download it from the portal.

• If the software image was automatically downloaded from the Update Server, click Activate .
• If you manually uploaded the software image to the firewall, click Activate From File , and then select the GlobalProtect Client File you uploaded from the drop-down. Click OK to activate the selected image. You may need to refresh the page before the version displays as Currently Activated .

Host App Updates on a Web Server

If a large number of your endpoints must install and/or update the GlobalProtect app software, consider hosting the GlobalProtect app software images on an external web server. This helps reduce the load on the firewall when users connect to and download the app.

1. Download and activate the version of the GlobalProtect app that you plan to host on the web server to the firewall.

Follow the steps for downloading and activating the app software on the firewall, as described in Host App Updates on the Portal.

2. Download the GlobalProtect app software image that you want to host on your web server.

Download the same image that you activated on the portal.

From a web browser, manually download the GlobalProtect App Software Package for Hosting on the Portal.

3. Publish the software image files to your web server.
4. Redirect end users to the web server.

On the firewall hosting the portal, enter the following CLI commands in operational mode:

> set global-protect redirect on

> set global-protect redirect location <path>

where <path> is the URL to the folder hosting the image (for example, https://acme/GP ).

5. Test the redirect.

1. From a web browser, go to the following URL:

https://<portal address or name>

For example, https://gp.acme.com .

2. On the portal login page, enter your user Name and Password , and then click LOGIN . After successful login, the portal should redirect you to the download.

Test the App Installation

Use the following procedure to test the GlobalProtect app installation.

1. Create an agent configuration for testing the app installation.

As a best practice, create an agent configuration that is limited to a small group of users, such as administrators in the IT department responsible for administering the firewall:

1. Select Network > GlobalProtect > Portals .
2. Select an existing portal configuration that you want to modify or Add a new one.
3. On the Agent tab, select an existing configuration or Add a new one to deploy to the test users/group.
4. On the User/User Group tab, Add the User/User Group who will be testing the app.
5. On the App tab, set Allow User to Upgrade GlobalProtect App to Allow with Prompt . Click OK to save the configuration.
6. ( Optional ) On the Agent tab, select the agent configuration that you just created or modified, and then click Move Up so that it is higher on the list than the more generic configurations you have created.

7. Commit the changes.

2. Log in to the GlobalProtect portal.

1. Launch your web browser and go to the following URL:

https://<portal address or name>

For example, https://gp.acme.com .

2. On the portal login page, enter your user Name and Password , and then click LOG IN .

3. Navigate to the app download page.

In most cases, the app download page appears immediately after you log in to the portal. Use this page to download the latest app software package.

If you have enabled GlobalProtect Clientless VPN access, the applications page opens after you log in to the portal (instead of the agent download page) when you log in to the portal. Select GlobalProtect Agent to open the download page.

4. Download the app.

1. To begin the download, click the link that corresponds to the operating system running on your computer.

2. Open the software installation file.
3. When prompted to run or save the software, click Run .
4. When prompted, click Run to launch the GlobalProtect Setup Wizard.

5. Complete the GlobalProtect app setup.

1. From the GlobalProtect Setup Wizard, click Next .
2. Click Next to accept the default installation folder ( C:\Program Files\Palo Alto Networks\GlobalProtect ) and then click Next twice.

3. After the installation is complete, Close the wizard.

6. Log in to GlobalProtect.

1. Launch the GlobalProtect app by clicking the system tray icon. The status panel opens.
2. Enter the FQDN or IP address of the portal, and then click Connect .
3. ( Optional ) By default, you are automatically connected to the Best Available gateway, based on the configuration that the administrator defines and the response times of the available gateways. To connect to a different gateway, select the gateway from the Gateway drop-down (for external gateways only).

4. ( Optional ) Depending on the connection mode, click Connect to initiate the connection.
5. ( Optional ) If prompted, enter your Username and Password , and then click Sign In .

If authentication is successful, you are connected to your corporate network, and the status panel displays the Connected or Connected - Internal status. If you set up a GlobalProtect welcome page, it displays after you log in successfully.

Download and Install the GlobalProtect Mobile App

The GlobalProtect app provides a simple way to extend the enterprise security policies out to mobile endpoints. As with other remote endpoints running the GlobalProtect app, the mobile app provides secure access to your corporate network over an IPsec or SSL VPN tunnel. The app automatically connects to the gateway that is closest to the end user’s current location. In addition, traffic to and from the endpoint is automatically subject to the same security policy enforcement as other hosts on your corporate network. The mobile app also collects information about the host configuration and can use this information for enhanced HIP-based security policy enforcement.

There are two primary methods for installing the GlobalProtect app: You can deploy the app from your third-party MDM and transparently push the app to your managed endpoints; or, you can install the app directly from the official store for your endpoint:

• iOS endpoints— App Store
• Android endpoints and Chromebooks— Google Play
• Windows 10 phones and Windows 10 UWP endpoints— Microsoft Store

This workflow describes how to install the GlobalProtect app directly on the mobile endpoint.

1. Create an agent configuration for testing the app installation.

As a best practice, create an agent configuration that is limited to a small group of users, such as administrators in the IT department responsible for administering the firewall:

1. Select Network > GlobalProtect > Portals .
2. Select an existing portal configuration to modify or Add a new one.
3. On the Agent tab, either select an existing configuration or Add a new configuration to deploy to the test users/group.
4. On the User/User Group tab, Add the User/User Group who will be testing the app.
5. Select the OS for the app you are testing ( iOS , Android , or WindowsUWP ).
6. ( Optional ) Select the agent configuration that you just created/modified, and then click Move Up so that it is higher on the list than the more generic configurations you have created.
7. Commit the changes.

2. From the endpoint, follow the prompts to download and install the app.

• On Android endpoints, search for the app on Google Play.
• On iOS endpoints, search for the app at the App Store.
• On Windows 10 UWP endpoints, search for the app at the Microsoft Store.

3. Launch the app.

When successfully installed, the GlobalProtect app icon displays on the endpoint’s Home screen. To launch the app, tap the icon. When prompted to enable GlobalProtect VPN functionality, tap OK .

4. Connect to the portal.

1. When prompted, enter the Portal name or address, User Name , and Password . The portal name must be an FQDN and it should not include the https:// at the beginning.

2. Tap Connect and verify that the app successfully establishes a connection to GlobalProtect.

View and Collect GlobalProtect App Logs

You have two options for collecting GlobalProtect™ app logs from the end users’ endpoints:

• Collect logs—End users must manually collect the GlobalProtect app logs.
• Report an issue—End users report an issue directly to Strata Logging Service to which the administrator can access when they experience unusual behavior such as poor network performance or a connection is not established with the portal and gateway.

In order for the GlobalProtect app to send troubleshooting logs, diagnostic logs, or both to Strata Logging Service for further analysis, you must configure the GlobalProtect portal to enable the GlobalProtect app log collection for troubleshooting. Additionally, you can configure the HTTPS-based destination URLs that can contain IP addresses or fully qualified domain names of the web servers/resources that you want to probe, and to determine issues such as latency or network performance on the end user’s endpoint.

Use the following steps to view or collect GlobalProtect logs:

1. Launch the GlobalProtect app.
2. From the status panel, open the settings dialog.

3. Select Settings .
4. From the GlobalProtect Settings panel, select Troubleshooting .
5. Select either Debug or Dump from the Logging Level drop-down.
6. ( Optional — Windows only ) View your GlobalProtect logs:

1. Select Logs .
2. Choose a Log type.
3. Start viewing logs.

7. ( Optional ) Collect Logs to send to your GlobalProtect administrator for troubleshooting.

Deploy App Settings Transparently

As an alternative to deploying app settings from the portal configuration, you can define them directly from the following endpoints:

• Windows—Registry or Windows Installer (Msiexec)
• macOS—global macOS plist
• Linux—pre-deployment configuration file ( pangps.xml )

The benefit of this alternative is that you can enable deployment of GlobalProtect app settings to endpoints prior to their first connection to the GlobalProtect portal.

Some settings do not have a corresponding portal configuration setting on the web interface and must be configured using the Windows Registry, Msiexec, or macOS plist. These settings are listed in the Customizable App Settings as “Not in portal.”

If you define settings in the registry, plist, or pangps.xml , but the portal configuration specifies different settings, the settings that the app receives from the portal overrides the settings defined on the endpoint. This override also applies to login-related settings, such as whether to connect on-demand, whether to use single sign-on (SSO), and whether the app can connect if the portal certificate is invalid. Therefore, you should avoid conflicting settings. In addition, the portal configuration is cached on the endpoint, and that cached configuration is used anytime the GlobalProtect app restarts or the endpoint reboots.

The following sections describe what customizable app settings are available and how to deploy these settings transparently to Windows, macOS, and Linux endpoints:

• Customizable App Settings
• Deploy App Settings to Windows Endpoints
• Deploy App Settings to macOS Endpoints
• Deploy App Settings to Linux Endpoints

In addition to using the Windows Registry, macOS plist, or Linux pre-deployment configuration to deploy GlobalProtect app settings, you can enable the GlobalProtect app to collect specific Windows Registry or macOS plist information from the endpoints, including data on applications installed on the endpoints, processes running on the endpoints, and attributes or properties of those applications and processes. You can then monitor the data and add it to a security rule to use as matching criteria. Endpoint traffic that matches the registry settings you define can be enforced according to the security rule.

Customizable App Settings (Overview)

In addition to pre-deploying the portal address, you can also define the app settings. To Deploy App Settings to Windows Endpoints you define keys in the Windows Registry (path HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\ unless otherwise stated). To Deploy App Settings to macOS Endpoints you define entries in the Settings dictionary of the macOS plist ( /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist ). To Deploy App Settings to Linux Endpoints you define entries under <Settings> of the /opt/paloaltonetworks/globalprotect/pangps.xml pre-deployment configuration file. On Windows endpoints only, you can also use the Windows Installer to Deploy App Settings from Msiexec.

The following topics describe each customizable app setting. Settings defined in the GlobalProtect portal agent configuration take precedence over settings defined in the Windows Registry or the macOS plist.

Some settings do not have a corresponding portal configuration setting on the web interface and must be configured using the Windows Registry or Msiexec. These include, but are not limited to, settings such as the following: can-prompt-user-credential , wrap-cp-guid , and filter-non-gpcp . They are listed in the following options as “Not in portal.”

• App Display Options
• User Behavior Options
• App Behavior Options
• Script Deployment Options

App Display Options

The following table lists the options that you can configure in the Windows Registry or macOS plist to customize the display of the GlobalProtect app.

User Behavior Options

The following table lists the options that you can configure in the Windows registry and macOS plist to customize how the user interacts with the GlobalProtect app.

Some settings do not have a corresponding portal configuration setting on the web interface and must be configured using the Windows Registry, Msiexec, or macOS plist. These settings are listed in the table as “Not in portal.” They include, but are not limited to, settings such as the following: ShowPrelogonButton and can-save-password .

App Behavior Options

The following table lists the options that you can configure in the Windows Registry and macOS plist to customize the behavior of the GlobalProtect app.

Some settings do not have a corresponding portal configuration setting on the web interface and must be configured using the Windows Registry, Msiexec, or macOS plist. These settings are listed in the table as “Not in portal.” They include, but are not limited to, settings such as the following: portal <IPaddress> , prelogon 1 , and can-prompt-user-credential .

Script Deployment Options

The following table displays options that enable GlobalProtect to initiate scripts before and after establishing a connection and before disconnecting. Because these options are not available in the portal, you must define the values for the relevant key—either pre-vpn-connect , post-vpn-connect , or pre-vpn-disconnect —from the Windows registry or macOS plist.

Configure Conditional Connect Method Based on Network Type

Configure Conditional Connect to enable the GlobalProtect app to change the connect method dynamically based on whether the internal host detection determines that the user is on the internal network or working from a remote location. You deploy the conditional-connect setting transparently from the macOS plist or the Windows Registry. Before enabling Conditional Connect, make sure that you have:

• Enabled internal host detection
• Configured the endpoints to use the on-demand connect method

graph TD
    A[Endpoint Starts] --> B{Is Internal?};
    B -- Yes --> C[No VPN Connection Needed];
    B -- No --> D[Establish VPN Tunnel];
    D --> E[Access Resources Securely];
    C --> F[Monitor Internal Network];
    F --> B;
    E --> F;
    D --> G{Connection Mode?};
    G -- On-demand --> D;
    G -- User-logon --> D;
    G -- Pre-logon --> D;
                

• Deploy Conditional Connect to Windows endpoints.
1. In the Windows Registry, go to: \HKEY_LOCAL_MACHINE > SOFTWARE> Palo Alto Networks > GlobalProtect > Settings .
2. Set the key as conditional-connect and the value to Yes .
• Deploy Conditional Connect to macOS endpoints.
1. In the plist file ( /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist ), go to /Palo Alto Networks/GlobalProtect/Settings .
2. Set conditional-connect to Yes .

Deploy App Settings to Windows Endpoints (Overview)

Use the Windows Registry or Windows Installer ( Msiexec ) to transparently deploy the GlobalProtect app and settings to Windows endpoints.

• Deploy Agent Settings in the Windows Registry
• Deploy Agent Settings from Msiexec
• Deploy Scripts Using the Windows Registry
• Deploy Scripts Using Msiexec
• Deploy Connect Before Logon Settings in the Windows Registry
• Deploy GlobalProtect Credential Provider Settings in the Windows Registry
• SSO Wrapping for Third-Party Credential Providers on Windows Endpoints (Overview)
• Enable SSO Wrapping for Third-Party Credentials with the Windows Registry
• Enable SSO Wrapping for Third-Party Credentials with the Windows Installer

Deploy App Settings in the Windows Registry

You can enable deployment of GlobalProtect app settings to Windows endpoints prior to their first connection to the GlobalProtect portal by using the Windows Registry. Use the options described in the Customizable App Settings table to use the Windows Registry to customize app settings for Windows endpoints.

In addition to using the Windows Registry to deploy GlobalProtect app settings, you can enable the GlobalProtect app to collect specific Windows Registry information from Windows endpoints. You can then monitor the data and add it to a security rule to use as matching criteria. Endpoint traffic that matches registry settings you define can be enforced according to the security rule.

1. Locate the GlobalProtect app customization settings in the Windows Registry.

Open the Windows Registry (enter regedit on the command prompt) and go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\

2. Set the portal name.

If you do not want the end user to manually enter the portal address even for the first connection, you can pre-deploy the portal address through the Windows Registry.

If you want to define all other app settings, you can define keys in the Windows Registry ( HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\

1. In the Window Registry, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup

2. Right-click Portal and then select Modify .
3. Enter the portal name in the Value data field, and then click OK .

3. Deploy various settings to the Windows endpoint, including the connect method for the GlobalProtect app and SSO.

View Customizable App Settings for a full list of the commands and values you can set up using the Windows Registry.

You have the option to deploy connect before logon settings to the Windows endpoints prior to enabling end users to log in to the VPN before logging into the endpoint.

You have the option to deploy GlobalProtect credential provider settings to the Windows endpoints to delay the GlobalProtect credential provider Windows sign-in request or enforce the GlobalProtect credential provider as the default sign-in option.

4. Enable the GlobalProtect app to wrap third-party credentials on the Windows endpoint, allowing for SSO when using a third-party credential provider.

Refer to Enable SSO Wrapping for Third-Party Credentials with the Windows Registry .

Deploy App Settings from Msiexec

On Windows endpoints, you have the option of automatically deploying the GlobalProtect app and the app settings from the Windows Installer ( Msiexec ) by using the following syntax:

msiexec.exe /i GlobalProtect.msi <SETTING>="<value>"

Msiexec is an executable program that installs or configures a product from the command line. On endpoints running Microsoft Windows XP or a later OS, the maximum string length that you can use at the command prompt is 8,191 characters.

For a complete list of settings and the corresponding default values, see Customizable App Settings .

You can also Enable SSO Wrapping for Third-Party Credentials with the Windows Installer .

Deploy Scripts Using the Windows Registry

You can enable deployment of custom scripts to Windows endpoints using the Windows Registry.

You can configure the GlobalProtect app to initiate and run a script for any or all of the following events: before and after establishing the tunnel, and before disconnecting the tunnel. To run the script at a particular event, reference the batch script from a command registry entry for that event.

Depending on the configuration settings, the GlobalProtect app can run a script before and after the app establishes a connection to the gateway, and before the app disconnects. Use the following workflow to use the Windows Registry to customize app settings for Windows endpoints.

1. Open the Windows registry, and locate the GlobalProtect app customization settings.

Open the Windows registry (enter regedit in the command prompt) and go to one of the following key locations, depending on when you want to execute scripts (pre/post connect or pre disconnect):

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\pre-vpn-connect

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\post-vpn-connect

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\Settings\pre-vpn-disconnect

If the key does not exist within the Settings key, create it by right-clicking Settings and selecting New > Key ).

2. Enable the GlobalProtect app to run scripts by creating a new String Value named command .

The batch file specified here should contain the specific script (including any parameters passed to the script) that you want run on the device.

1. If the command string does not already exist, create it by right-clicking the pre-vpn-connect , post-vpn-connect , or pre-vpn-disconnect key, selecting New > String Value , and naming it command ).
2. Right click command , and then select Modify .
3. Enter the commands or script that the GlobalProtect app should run. For example:

%userprofile%\pre_vpn_connect.bat c: test_user

3. ( Optional ) Add additional registry entries as needed for each command.

Create or modify registry strings and their corresponding values, including context , timeout , file , checksum , or error-msg . For additional information, see Script Deployment Options .

Deploy Scripts Using Msiexec

On Windows endpoints, you can use the Windows Installer ( Msiexec ) to deploy the GlobalProtect app, app settings, and scripts that the app will run automatically (see Script Deployment Options ). To do so, use the following syntax:

msiexec.exe /i GlobalProtect.msi <SETTING>="<value>"

Msiexec is an executable program that installs or configures a product from a command line. On systems running Microsoft Windows XP or later releases, the maximum string length that you can use at the command prompt is 8,191 characters.

This limitation applies to the command line, individual environment variables (such as the USERPROFILE variable) that are inherited by other processes, and all environment variable expansions. If you run batch files from the command line, this limitation also applies to batch file processing.

For example, to deploy scripts that run at specific connect or disconnect events, you can use syntax similar to the following examples:

Example: Use Msiexec to Deploy Scripts that Run Before a Connect Event

For a script that you can copy and paste, go here .

msiexec.exe /i GlobalProtect.msi
PREVPNCONNECTCOMMAND="%userprofile%\pre_vpn_connect.bat c: test_user"
PREVPNCONNECTCONTEXT="user"
PREVPNCONNECTTIMEOUT="60"
PREVPNCONNECTFILE="C:\Users\test_user\pre_vpn_connect.bat"
PREVPNCONNECTCHECKSUM="a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599"
PREVPNCONNECTERRORMSG="Failed executing pre-vpn-connect action."
            

For a complete list of settings and the corresponding default values, see Script Deployment Options .

Example: Use Msiexec to Deploy Scripts that Run at Pre-Connect, Post-Connect, and Pre-Disconnect Events

For a script that you can copy and paste, go here .

msiexec.exe /i GlobalProtect.msi
PREVPNCONNECTCOMMAND="%userprofile%\pre_vpn_connect.bat c: test_user"
PREVPNCONNECTCONTEXT="user"
PREVPNCONNECTTIMEOUT="60"
PREVPNCONNECTFILE="C:\Users\test_user\pre_vpn_connect.bat"
PREVPNCONNECTCHECKSUM="a48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf599"
PREVPNCONNECTERRORMSG="Failed executing pre-vpn-connect action."
POSTVPNCONNECTCOMMAND="c:\users\test_user\post_vpn_connect.bat c: test_user"
POSTVPNCONNECTCONTEXT="admin"
POSTVPNCONNECTFILE="%userprofile%\post_vpn_connect.bat"
POSTVPNCONNECTCHECKSUM="b48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf598"
POSTVPNCONNECTERRORMSG="Failed executing post-vpn-connect action."
PREVPNDISCONNECTCOMMAND="%userprofile%\pre_vpn_disconnect.bat c: test_user"
PREVPNDISCONNECTCONTEXT="admin"
PREVPNDISCONNECTTIMEOUT="0"
PREVPNDISCONNECTFILE="C:\Users\test_user\pre_vpn_disconnect.bat"
PREVPNDISCONNECTCHECKSUM="c48ad33695a44de887bba8f2f3174fd8fb01a46a19e3ec9078b0118647ccf597"
PREVPNDISCONNECTERRORMSG="Failed executing pre-vpn-disconnect action."
            

For a complete list of settings and the corresponding default values, see Script Deployment Options .

Deploy Connect Before Logon Settings in the Windows Registry

You can deploy Connect Before Logon settings to Windows 10 endpoints prior to enabling end users to log in to the VPN before logging into the endpoint by using the Windows Registry. GlobalProtect retrieves the registry keys only once, when the GlobalProtect app initializes.

Follow these guidelines when deploying the Connect Before Logon settings:

• The Pre-logon and Pre-logon then On-demand connection methods are not supported simultaneously with Connect Before Logon.
• If you are using smart card authentication or username/password-based authentication for user login using an authentication service such as LDAP, RADIUS, or OTP, you must configure exclusions for specific fully qualified domain names for the portal and gateway by entering them to Allow traffic to specified FQDN when Enforce GlobalProtect Connection for Network Access is enabled and GlobalProtect Connection is not established as an app setting in the App Configurations area of the GlobalProtect portal. If you are using SAML authentication for user login and using the configured SAML identity providers (ldPs) such as Okta, you must also configure exclusions for *okta.com and *oktacdn.com. For other ldPs, you must configure exclusions for the URLs that contain IP addresses or fully qualified domain names only if the Enforcer status is enabled.

1. Configure the registry keys on the end user Windows endpoints.

You must change the Windows registry on the end users’ Windows endpoints before you can enable Connect Before Logon. You can automatically add the registry keys or manually add the keys.

1. To automatically add the registry keys for PanPlapProvider and PanPlapProvider.dll in PanGPS.exe ( C:\Program Files\Palo Alto Networks\GlobalProtect ), use the -registerplap command to run as an administrator by using the following syntax:

PanGPS.exe -registerplap

1. To automatically unregister the keys for PanPlapProvider and PanPlapProvider.dll in PanGPS.exe ( C:\Program Files\Palo Alto Networks\GlobalProtect ), use the -unregisterplap command to run as an administrator by using the following syntax:

PanGPS.exe -unregisterplap

To manually add the registry keys, open the Windows Registry Editor and enter regedit on the command prompt.

1. In the Windows Registry, go to HKEY_CLASSES_ROOT\CLSID\{20A29589-E76A-488B-A520-63582302A285} . Add the PanPlapProvider value in the format @=PanPlapProvider .
2. In the Windows Registry, go to HKEY_CLASSES_ROOT\CLSID\{20A29589-E76A-488B-A520-63582302A285}\InprocServer32@="PanPlapProvider.dll" . Verify that the ThreadingModel value is set to Apartment . This is the default value.
3. In the Windows Registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\PLAP Providers\{20A29589-E76A-488B-A520-63582302A285}@="PanPlapProvider" . Add the PanPlapProvider value in the format @=PanPlapProvider .

2. ( Optional ) Configure additional portal addresses or names to display.

If configured, Connect Before Logon will use the default portal address or name in the Windows Registry ( HKEY_LOCAL_MACHINE\SOFTWARE\PaloAlto Networks\GlobalProtect\PanSetup with key Portal ).

You can configure additional portal addresses or names that you want to display in the Portal drop-down by changing the registry keys on the end user Windows endpoints. You can add up to five portal addresses or names. You must change the Windows registry on the end users’ Windows endpoints before you can define the portal addresses or names.

Open the Windows Registry Editor and enter regedit on the command prompt.

1. In the Windows Registry, create the CBL folder under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect .
2. In the Windows Registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL .
3. Select Edit > New > String Value to create a registry entry for each portal that you want to add. You must specify each entry as Portal1 , Portal2 , Portal3 , Portal4 , and Portal5 . Each entry cannot contain spaces.
4. Right-click the portal registry value, and then select Modify .
5. Enter the IP address or name of the GlobalProtect portal in the Value Data field, and then click OK .
6. Repeat steps 3 and 4 for each portal that you want to add.

3. ( Optional ) Display the predefined portal addresses or names.

You must change the Windows registry on the end users’ Windows endpoints before you can display the portal addresses or names.

Open the Windows Registry Editor and enter regedit on the command prompt.

1. In the Windows Registry, create the CBL folder under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect .
2. In the Windows Registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL .
3. Select Edit > New > String Value to create a registry entry for AlwaysShowPortal .
4. Enter the value as yes in the Value Data field, and then click OK .

By default, Connect Before Logon does not display the portal address or name if only one portal is defined.

4. ( Optional ) Enable end users to authenticate using a smart card.

You must change the Windows registry on the end users’ Windows endpoints before you can enable smart card authentication.

Open the Windows Registry Editor and enter regedit on the command prompt.

1. In the Windows Registry, create the CBL folder under HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect .
2. In the Windows Registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\CBL .
3. Select Edit > New > String Value to create a registry entry for UseSmartCard .
4. Enter the value as yes in the Value Data field, and then click OK .

5. Reboot the endpoint.

6. Verify the configuration.

After you have configured the settings in the Windows registry and to use Connect Before Logon starting with GlobalProtect™ app 5.2, choose the authentication method:

• Connect Before Logon Using Smart Card Authentication
• Connect Before Logon Using SAML Authentication
• Connect Before Logon Using Username/Password-Based Authentication

Deploy GlobalProtect Credential Provider Settings in the Windows Registry

You can deploy the GlobalProtect credential provider settings to delay the GlobalProtect credential provider Windows sign-in request or to enforce the GlobalProtect credential provider as the default sign-in option for Windows 10 by using the Windows Registry.

1. Delay the GlobalProtect credential provider Windows sign-in request.

Establishing the GlobalProtect tunnel before Windows login can be useful in certain situations. For example, you may want to enforce the Windows device to synchronize data with the Active Directory or want to delay the GlobalProtect credential provider Windows sign-in request.

You can configure the amount of time (in seconds) that the GlobalProtect credential provider waits for the tunnel to be established before submitting a Windows sign-in request when single sign on (SSO) is enabled. By default, the GlobalProtect Credential Provider Support to Delay Windows Login Before Establishing the Tunnel Connection feature is disabled and the GlobalProtect credential provider submits the sign-in requests without any delay.

1. From the command prompt, enter the regedit command to open the Windows Registry Editor.
2. In the Windows Registry, go to HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetup
3. Right-click PreLogonState and then select New > DWORD (32-bit) Value .
4. Right-click New Value #1 and then select Rename .

Enter LogonWaitTime . Right-click LogonWaitTime and then select Modify . In the Value Data field, set the number of seconds (range is 5-30) for end users to wait to log in to Windows before establishing a tunnel connection. Click OK .

5. Repeat substeps 1, 2, and 3 to delay the GlobalProtect credential provider from submitting the Windows sign-in request after the tunnel is established.

Enter LogonPostWaitTime . Right-click LogonPostWaitTime and then select Modify . In the Value Data field, set the number of seconds (range is 3-10) for end users to wait to log in to Windows. Click OK .

2. Enforce GlobalProtect credential provider as the default sign-in option for Windows 10.

When GlobalProtect SSO is enabled on Windows devices, users can have more than one sign-in option in addition to using the GlobalProtect credential provider options such as a third-party credential, smart card, Windows Hello PIN, Windows Hello Password, or Windows Hello Fingerprint. Users can use any of these sign-in options to sign in to their Windows device and set it as the default sign-in option at the next Windows login making GlobalProtect SSO unavailable. Users must manually switch to the GlobalProtect credential provider again to enable GlobalProtect SSO. When the GlobalProtect credential provider is enabled as the default sign-in option even when users can login with any other sign-in option, the GlobalProtect credential provider sign-in option is selected at the next Windows login and for subsequent logins.

Follow these guidelines when you are enforcing the GlobalProtect credential provider to be the default-sign option on Windows devices:

• While the GlobalProtect app is installed or SSO is enabled, the GlobalProtect credential provider is set as the default sign-in option for all users even when the MakeGPCPDefault setting is disabled.
• When SSO is enabled and the MakeGPCPDefault setting is enabled, users can use any sign-in options such as a third-party credential provider, smart card, Windows Hello PIN, Windows Hello password, or Windows Fingerprint to sign in to their Windows device. Regardless of the sign-in option selected, the GlobalProtect credential provider will be used as the default sign-in option at the next Windows login.
• When SSO is enabled and the MakeGPCPDefault setting is disabled or empty, the user selected sign-in option will be used as the default at the next Windows login.
• When SSO is disabled, the GlobalProtect credential provider is unavailable. The Windows default sign-in option will work as expected.
• The Enforce GlobalProtect Credential Provider as the Default Sign-In for Windows 10 feature does not support the Other user login option. You can configure the Other user login option by using the Group Policy Object (GPO) on the Windows device.

1. From the command prompt, enter the regedit command to open the Windows Registry Editor.
2. In the Window Registry, go to:

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect

3. Right-click the GlobalProtect folder, then select New > String Value to add a new string value.
4. Enter the MakeGPCPDefault string value. Right-click MakeGPCPDefault and then select Modify .

In the Value data field, enter yes to enable the GlobalProtect credential provider to be the default sign-in option at the next Windows login. If you set the Value data to no , the MakeGPCPDefault setting is disabled and the user selected sign-in option will be used as the default at the next Windows login. Click OK .

SSO Wrapping for Third-Party Credential Providers on Windows Endpoints (Overview)

On Windows 7 endpoints, the GlobalProtect app utilizes the Microsoft credential provider framework to support single sign-on (SSO). With SSO, the GlobalProtect credential provider wraps the Windows native credential provider, enabling GlobalProtect to use Windows login credentials to automatically authenticate and connect to the GlobalProtect portal and gateway. In addition, SSO wrapping enables Windows 10 users to update their Active Directory (AD) password using the GlobalProtect credential provider when their password expires or an administrator requires a password change at the next login.

When other third-party credential providers also exist on the endpoint, the GlobalProtect credential provider is unable to gather the user's Windows login credentials. As a result, GlobalProtect fails to connect to the GlobalProtect portal and gateway automatically. If SSO fails, you can identify the third-party credential provider and configure the GlobalProtect app to wrap those third-party credentials, which enables users to successfully authenticate to Windows, GlobalProtect, and the third-party credential provider using only their Windows login credentials.

Optionally, you can configure Windows to display separate login tiles: one for each third-party credential provider and another for the native Windows login. This is useful when a third-party credential provider adds additional functionality that does not apply to GlobalProtect.

Use the Windows registry or the Windows Installer ( msiexec ) to allow GlobalProtect to wrap third-party credentials:

• Enable SSO Wrapping for Third-Party Credentials with the Windows Registry
• Enable SSO Wrapping for Third-Party Credentials with the Windows Installer

Enable SSO Wrapping for Third-Party Credentials with the Windows Registry

Use the following steps in the Windows Registry to enable SSO to wrap third-party credentials on Windows 7 endpoints.

1. Open the Windows Registry and locate the globally unique identifier (GUID) for the third-party credential provider that you want to wrap.

1. From the command prompt, enter the regedit command to open the Windows Registry Editor.
2. Go to the following Windows Registry location to view the list of currently installed credential providers:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

3. Copy the GUID key for the credential provider that you want to wrap (including the curly brackets — { and } — on either end of the GUID):

2. Enable SSO wrapping for third-party credential providers by adding the wrap-cp-guid setting to the GlobalProtect Registry.

1. Go to the following Windows Registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect:

2. Right-click the GlobalProtect folder, and then select New > String Value to add a new string value:

3. Configure the following String Value fields:

• Name : wrap-cp-guid
• Value data : {<third-party credential provider GUID>}

The following is an example of what a third-party credential provider GUID in the Value data field might look like:

{A1DA9BCC-9720-4921-8373-A8EC5D48450F}

4. For the new String Value , wrap-cp-guid is displayed as the string value’s Name and the GUID is displayed as the Value Data .
Figure: Windows Registry Editor showing the wrap-cp-guid string value and its data

3. Next Steps:

• With this setup, the native Windows logon tile is displayed to users on the logon screen. When users click the tile and log in to the system with their Windows credentials, that single login authenticates the users to Windows, GlobalProtect, and the third-party credential provider.
• ( Optional ) If you want to display multiple tiles on the logon screen (for example, the native Windows tile and the tile for the third-party credential provider), continue to step 4.
• ( Optional ) If you want to assign a default credential provider for users, continue to step 5.
• ( Optional ) If you want to hide a third-party credential provider tile from the logon screen, continue to step 6.

4. ( Optional ) Allow the third-party credential provider tile to be displayed to users at login.

Add a second String Value with the Name filter-non-gpcp and enter no for the string’s Value data :

After you add this string value to the GlobalProtect settings, two login options are presented to users on the Windows logon screen: the native Windows tile and the third-party credential provider’s tile.

5. Assign a default credential provider for user login.

1. Open the Windows Registry to locate the globally unique identifier (GUID) for the third-party credential provider that you want to assign as the default credential provider.

1. From the command prompt, enter the regedit command to open the Windows Registry Editor.
2. Go to the following Windows Registry location to view the list of currently installed credential providers:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

3. Copy the complete GUID key for the credential provider (including the curly brackets — { and } —on either end of the GUID).

2. Open the Local Group Policy Editor to enable and assign a default credential provider.

1. From the command prompt, enter the gpedit.msc command to open the Local Group Policy Editor.
2. Select Computer Configuration > Administrative Templates > System > Logon .
3. Under Setting , double-click Assign a default credential provider to open the Assign a default credential provider window.
4. Set the policy to Enabled .
5. Under Assign the following credential provider as the default credential provider , enter the GUID of the credential provider (copied from the Windows Registry).
6. Click Apply , and the click OK to save your changes.

6. ( Optional ) Hide a third-party credential provider tile from the Windows logon screen.

1. Open the Windows Registry to locate the globally unique identifier (GUID) for the third-party credential provider that you want to hide.

1. From the command prompt, enter the regedit command to open the Windows Registry Editor.
2. Go to the following Windows Registry location to view the list of currently installed credential providers:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers.

3. Copy the complete GUID key for the credential provider that you want to hide (including the curly brackets — { and } — on either end of the GUID).

2. Open the Local Group Policy Editor to hide the third-party credential provider.

1. From the command prompt, enter the gpedit.msc command to open the Local Group Policy Editor.
2. Select Computer Configuration > Administrative Templates > System > Logon .
3. Under Setting , double-click Exclude credential providers to open the Exclude credential providers window.
4. Set the policy to Enabled .
5. Under Exclude the following credential providers , enter the GUID of the credential provider you want to hide (copied from the Windows Registry).

To hide multiple credential providers, separate each GUID with a comma.

6. Click Apply , and then click OK to save your changes.

7. Finalize your changes.

Enable SSO Wrapping for Third-Party Credentials with the Windows Installer

Use the following options in the Windows Installer ( Msiexec ) to enable SSO to wrap third-party credential providers on Windows 7 endpoints.

• Wrap third-party credentials and display the native tile to users at login. Users can click the tile to log in to the endpoint using their native Windows credentials. With that single login, users can authenticate to Windows, GlobalProtect, and the third-party credential provider.

Use the following syntax from the Windows Installer ( Msiexec ):

msiexec.exe /i GlobalProtect.msi WRAPCPGUID=”{guid_value}” FILTERNONGPCP=”yes”

In the syntax above, the FILTERNONGPCP parameter simplifies authentication for the user by filtering the option to log in to the system using the third-party credentials.

• If you would like users to have the option of logging in using the third-party credentials, use the following syntax from the Windows Installer ( Msiexec ):
• msiexec.exe /i GlobalProtect.msi WRAPCPGUID=”{guid_value}”

FILTERNONGPCP=”no”

In the syntax above, the FILTERNONGPCP parameter is set to “no” , which filters out the third-party credential provider’s logon tile so that only the native tile displays. In this case, both the native Windows tile and the third-party credential provider tile are displayed to users when logging in to the Windows endpoint.

Deploy App Settings to macOS Endpoints (Overview)

Use the macOS global plist (property list) file to set the GlobalProtect app customization settings or to deploy scripts to macOS endpoints.

• Deploy App Settings in the macOS Plist
• Deploy Scripts Using the macOS Plist

Deploy App Settings in the macOS Plist

You can set the GlobalProtect app customization settings in the macOS global plist (Property list) file. This enables deployment of GlobalProtect app settings to macOS endpoints prior to their first connection to the GlobalProtect portal.

On macOS endpoints, plist files are either located in /Library/Preferences or in ~/Library/Preferences . The tilde ( ~ ) symbol indicates that the location is in the current user's home folder. The GlobalProtect app on a macOS endpoint first checks for the GlobalProtect plist settings. If the plist does not exist at that location, the GlobalProtect app searches for plist settings in ~/Library/Preferences .

In addition to using the macOS plist to deploy GlobalProtect app settings, you can enable the GlobalProtect app to collect specific macOS plist information from the endpoints. You can then monitor the data and add it to a security rule to use as matching criteria. Endpoint traffic that matches registry settings you define can be enforced according to the security rule.

1. Open the GlobalProtect plist file and locate the GlobalProtect app customization settings.

Use Xcode or an alternate plist editor to open the plist file:

/Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist

Then go to:

/Palo Alto Networks/GlobalProtect/Settings

If the Settings dictionary does not exist, create it. Add each key to the Settings dictionary as a string.

2. Set the portal name.

If you do not want the end user to manually enter the portal address even for the first connection, you can pre-deploy the portal address through the plist. In the PanSetup dictionary, configure an entry for Portal .

3. Deploy various settings to the macOS endpoint, including the connect method for the GlobalProtect app.

View Customizable App Settings for a full list of the keys and values that you can configure using the macOS plist.

4. ( Optional ) If you are using system extensions and need to switch to kernel extensions, set the key value to UseKextAnyway in the macOS plist ( /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist ) for the GlobalProtect app.

Follow these guidelines when you are using system extensions and need to switch to kernel extensions:

• After you have enabled system extensions, you must first uninstall the existing app to use the UseKextAnyway plist key to enable kernel extensions on macOS.
• You later have the option to revert to use system extensions. You must delete the UseKextAnyway plist key in the macOS plist. After you have deleted this plist key, you must restart the GlobalProtect app in order for the change to take effect.
• By switching to kernel extensions, you can no longer use the Split DNS and Enforce GlobalProtect Connections with FQDN Exclusions features.
• If you have configured split tunnel settings based on the application on macOS endpoints, all Safari-based traffic, Microsoft Teams-based traffic, or Slack-based traffic that are defined in the split tunnel configuration would be dropped. We recommend that you use Chrome instead of Safari so that traffic defined in the split tunnel configuration will not be dropped. All traffic that was created based on the WebKit framework such as Safari, Microsoft Teams, or Slack might have problems using kernel extensions.

Deploy Scripts Using the macOS Plist

When a user connects to the GlobalProtect gateway for the first time, the GlobalProtect app downloads the configuration file and stores app settings in a GlobalProtect macOS property file (plist). In addition to making changes to the app settings, you use the plist to deploy scripts at any or all of the following events: before and after establishing the tunnel, and before disconnecting the tunnel. Use the following workflow to use the plist to deploy scripts to macOS endpoints.

1. ( Endpoints running Mac OS X 10.9 or a later OS ) Flush the settings cache. This prevents the OS from using the cached preferences after making changes to the plist.

To clear the default preferences cache, run the killall cfprefsd command from a macOS terminal.

2. Open the GlobalProtect plist file, and locate or create the GlobalProtect dictionary associated with the connect or disconnect event. The dictionary under which you will add the settings determines when the GlobalProtect app runs the script(s).

Use Xcode or an alternate plist editor to open the plist file ( /Library/Preferences/com.paloaltonetworks.GlobalProtect.settings.plist ) and go to one of the following dictionary locations:

• /Palo Alto Networks/GlobalProtect/Settings/pre-vpn-connect
• /Palo Alto Networks/GlobalProtect/Settings/post-vpn-connect
• /Palo Alto Networks/GlobalProtect/Settings/pre-vpn-disconnect

If Settings dictionary does not exist, create it. Then, in Settings , create a new dictionary for the event or events at which you want to run scripts.

3. Enable the GlobalProtect app to run scripts by creating a new String named command .

The value specified here should reference the shell script (and the parameters to pass to the script) that you want run on your endpoints.

If the command string does not already exist, add it to the dictionary and specify the script and parameters in the Value field. For example:

$HOME/pre_vpn_connect.sh

/Users/username username

Environmental variables are supported.

4. ( Optional ) Add additional settings related to the command, including administrator privileges, a timeout value for the script, checksum value for the batch file, and an error message to display if the command fails to execute successfully.

Create or modify additional strings in the plist ( context , timeout , file , checksum , and/or error-msg) and enter their corresponding values. For additional information, see Script Deployment Options .

5. Save the changes to the plist file.

Save the plist.

Deploy App Settings to Linux Endpoints

You can set the GlobalProtect app customization settings in the pre-deployment configuration file ( pangps.xml ). This enables deployment of GlobalProtect app settings to Linux endpoints prior to their first connection to the GlobalProtect portal.

On Linux endpoints, the pre-deployment configuration file ( pangps.xml ) is located in /opt/paloaltonetworks/globalprotect .

The following table lists the pre-deployment settings for Linux endpoints that you can add to the pangps.xml file to customize the behavior of the GlobalProtect app and how the user interacts with the GlobalProtect app.

If you have already installed the GlobalProtect app on the Linux endpoint, follow these instructions:

1. Modify the pre-deployment setting you want to edit for the pangps.xml file in /opt/paloaltonetworks/globalprotect .
2. Reboot the Linux endpoint in order for the pre-deployment configuration changes to take effect.

If you are installing the GlobalProtect app for the first time, follow these instructions to deploy various settings to the Linux endpoint.

1. Create the /opt/paloaltonetworks/globalprotect/pangps.xml pre-deployment configuration file.
2. Add the pre-deployment settings to the pangps.xml file, including the connect method for the GlobalProtect app and the default browser for SAML authentication.

The following example shows the XML configuration of the pre-deployment changes that you deployed on the Linux endpoint, including the portal IP address (or hostname) under <PanSetup> .

<?xml version="1.0" encoding="UTF-8"?>
<GlobalProtect>
    <Settings>
        <connect-method>on-demand</connect-method>
        <can-continue-if-portal-cert-invalid>yes</can-continue-if-portal-cert-invalid>
        <can-change-portal>no</can-change-portal>
        <portal-timeout>100</portal-timeout>
        <connect-timeout>100</connect-timeout>
        <receive-timeout>100</receive-timeout>
        <default-browser>yes</default-browser>
    </Settings>
    <PanSetup>
        <Portal>portal.acme.com</Portal>
    </PanSetup>
    <PanGPS>
    </PanGPS>
</GlobalProtect>
            

3. Install the GlobalProtect app for Linux .

GlobalProtect Processes to be Whitelisted on EDR Deployments

To ensure seamless operation of GlobalProtect, we suggest configuring your antivirus, EDR (Endpoint Detection and Response), or firewall applications to recognize GlobalProtect processes as safe. These security applications may sometimes mistakenly identify GlobalProtect processes as malicious. To prevent this, it is advisable to whitelist or create security exceptions for the following GlobalProtect processes before installation.

Here are the GlobalProtect processes that you must whitelist on your EDR deployments.

GlobalProtect App Quiz