How to Upgrade - GlobalProtect Agent Upgrade Process

Symptom

This document describes the GlobalProtect Agent Upgrade Process in the "Allow with Prompt" setting on Firewall.

Environment

• PAN-OS.
• Palo Alto Firewall.
• GlobalProtect configured.

Resolution

By default, the Agent Upgrade field is set to prompt the end-user to upgrade. This behavior can be modified by choosing different available options in the agent upgrade to connect method field.

To change the connect method, inside of the WebGUI go to to Network > GlobalProtect > Portals > (portal name) > Agent > (Agent selection) > App > Allow User to Upgrade GlobalProtect App .

Steps:

1. Download and install the GlobalProtect Client on the Palo Alto Networks firewall. To install and activate the GlobalProtect Client, Use GUI: Device > GlobalProtect Client. Use the checknow button at the bottom to check for updates followed by Download to download the same. Next, click Activate to activate the downloaded software.
2. When the user connects to the client after installation of the new version, they will be prompted with the following page stating a newer version of GlobalProtect is available for download.

3. Click on "Download" to download the new version.

4. Once downloaded, Click on "Install". It will start installing immediately.
5. During the installation, the VPN connection will be terminated and reestablished
6. After reconnecting to the Gateway, confirm the upgrade was complete by navigating to the hamburger icon in the top right corner of the Client and selecting Settings>About.
7. The version number displayed should now reflect the newly installed GlobalProtect Client.

Note:

• To allow automatic upgrades without interaction with the user, select the "Transparent" method in the app configuration listed above.
• To prevent agent upgrades, select the "Disabled" method.
• To allow end-users to initiate agent upgrades, select "Manual". In this case, the user would select the Check Version option in the agent to determine if there is a new agent version and then upgrade if desired. This option will not work if the GlobalProtect agent is hidden from the user.
• Automatic/transparent app upgrade during pre-logon is not supported.