Palo Alto firewall - How to Push and Install GlobalProtect from the Panorama CLI

I recently encountered a problem when I upgraded Panorama from 10.2.4 to 11.0.2. The ‘Download’ link in Device Deployment -> GlobalProtect Client on Panorama disappeared! After some research, I found out that this is a bug that affects this version of Panorama. Unfortunately, there is no official fix for this issue yet as of July 17, 2023.

If you need to push GlobalProtect client from Panorama before Palo Alto Networks fixes this bug, you can use a workaround via CLI commands.

• Issue/Symptom

You don’t see the ‘Download’ link on PANORAMA → Device Deployment → GlobalProtect Client.

• Workaround

Step 1. Check available GlobalProtect client packages from PaloAlto Networks server

admin@panorama> request batch global-protect-client check

Step 2. Download GlobalProtect client packages to Panorama

admin@panorama> request batch global-protect-client download file PanGP-6.0.7 

 Download job enqueued with jobid 257320 257320

Step 3. Activate the version on Panorama GUI

Go to PANORAMA → Device Deployment → GlobalProtect Client and click 'Activate' and select the firewalls you want to push the new GP Client.

References

How to use Device Deployment in Panorama - Knowledge Base - Palo Alto Networks

Links

_Index_2_Firewall