GlobalProtect
Download and Install the GlobalProtect App for Linux
Table of Contents
Expand All
|
Collapse All
GlobalProtect Docs
-
- 10.1 & Later
- 9.1 (EoL)
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
-
- 6.1
- 6.0
- 5.1
-
- 6.3
- 6.2
- 6.1
- 6.0
- 5.1
Download and Install the GlobalProtect App for Linux
GlobalProtect offers you two different methods
to install the GlobalProtect app on your Linux device: a GUI-based
installation version and a CLI version. If you use a supported Linux
operating system that supports a graphical interface, you can install
the GUI version of the GlobalProtect; otherwise, download and install
the CLI version of the GlobalProtect app.
Download and Install the GUI Version of GlobalProtect for
Linux
If your Linux device supports a graphical
user interface, complete these steps to install the GUI version
of GlobalProtect for Linux.
- Download the GlobalProtect app for Linux.
- Log in to the Customer Support Portal. After you enter your username and password credentials, you are authenticated and you are logged in to the support site.
- Select.UpdatesSoftware Updates
- Filter by GlobalProtect Agent for Linux, and download the associated TGZ file.
- Extract the files from the package.user@linuxhost:~$tar -xvf ~/pkgs/PanGPLinux-5.1.0.tgz./ ./GlobalProtect_deb-5.1.0.0-62.deb ./GlobalProtect_deb_arm-5.1.0.0-62.deb ./GlobalProtect_rpm-5.1.0.0-62.rpm ./GlobalProtect_rpm_arm-5.1.0.0-62.rpm ./GlobalProtect_tar-5.1.0.0-62.tgz ./GlobalProtect_tar_arm-5.1.0.0-62.tgz./GlobalProtect_UI_deb-5.1.0.0-62.deb ./GlobalProtect_UI_rpm-5.1.0.0-62.rpm./GlobalProtect_UI_tar-5.1.0.0-62.tgz ./manifest ./relinfoYou will see multiple installation packages for supported operating system versions—DEB for Debian and Ubuntu and RPM for CentOS and Red Hat. The package for the GUI version is denoted by a GlobalProtect_UI prefix.
- (Optional) If your Linux endpoint must use a manual proxy server configuration, configure the proxy settings.The GlobalProtect app for Linux supports only a basic proxy server configuration but does not support the use of Proxy Auto-Configuration (PAC) files and proxy authentication.The GlobalProtect app for Linux obtains the proxy settings from theHTTP_PROXY,HTTPS_PROXYandNO_PROXYenvironment variables in the/etc/environmentfile. If you later change the system proxy configuration, verify that the terminal from which GlobalProtect runs uses the proxy environment variables. If you do not see the new settings, log out and back in for the new settings to take effect.If you have configured theHTTP_PROXYvariable or theHTTPS_PROXYvariable, make sure that the GlobalProtect portal matches the settings configured for theNO_PROXYvariable.
- To set your proxy on your Linux endpoint, edit theHTTP_PROXYenvironment variable orHTTPS_PROXYenvironment variable (for example,HTTPS_PROXY=”https://yourproxy.local:8080”).
- To configure the IP addresses or domain names that you want to exclude from the proxy, edit theNO_PROXYenvironment variable (for example,NO_PROXY=”www.gpqa.com”).Use commas to separate multiple IP addresses or domain names. Starting with GlobalProtect app 5.1.6, you can use the wildcard character (*) for IP addresses or domain names (for example,NO_PROXY=”*.domain.com”).
- (Optional) To import a certificate, complete the following steps.When you want to pre-deploy a client certificate to an endpoint for certificate-based authentication, you can copy the certificate to the endpoint and import it for use by the GlobalProtect app. Use theglobalprotect import-certificate --locationcommand to import the certificate on the endpoint. When prompted you must supply the certificate password.<location>user@linuxhost:~$globalprotect import-certificate --location /home/mydir/Downloads/cert_client_cert.p12Please input passcode: Import certificate is successful.
- Install the GUI version of the GlobalProtect app for Linux.Install the app using root privileges and use an installation method that will automatically add any missing packages that are required by the GlobalProtect app.For Debian and Ubuntu, use thesudo apt-get installcommand.<gp-app-pkg>For CentOS and Red Hat, use thesudo yum installcommand.<gp-app-pkg>
- After installation completes, the GlobalProtect app automatically launches. Specify your portal address and enter your credentials when prompted to begin the connection process.Because the GlobalProtect service supports only one socket connection to the GlobalProtect agent and to the GUI version of the GlobalProtect app, you must either log out of the Linux operating system or the SSH session depending on the installation method used as a root user after installing the app. You must log back in to the Linux endpoint as another user with non-privileged user privileges and the app launches.
Download and Install the CLI Version of GlobalProtect for
Linux
If your Linux device does not support a GUI,
install the GlobalProtect app for Linux by completing these steps.
The GlobalProtect app for Linux supports the DEB, RPM, and TAR installation
packages.
- Download the GlobalProtect app for Linux.
- Obtain the app package from your IT administrator and then copy the TGZ file to the Linux endpoint.For example, if you downloaded the package to a macOS endpoint, you can open a terminal and then copy the file:macUser@mac:~$scp ~/Downloads/PanGPLinux-5.1.0.tgz linuxUser@linuxHost:<DestinationFolder>where<DestinationFolder>~/pkgs/where you want to store the TGZ file.
- From the Linux endpoint, unzip the package.user@linuxhost:~$tar -xvf ~/pkgs/PanGPLinux-5.1.0.tgzAfter you unzip the package, you will see installation packages—DEB for Ubuntu and RPM for CentOS and Red Hat—and the scripts to install and uninstall the packages.
- (Optional) If your Linux endpoint must use a manual proxy server configuration, configure the proxy settings.The GlobalProtect app for Linux supports only a basic proxy server configuration but does not support the use of Proxy Auto-Configuration (PAC) files and proxy authentication.The GlobalProtect app for Linux obtains the proxy settings from theHTTP_PROXY,HTTPS_PROXYandNO_PROXYenvironment variables in the/etc/environmentfile. If you later change the system proxy configuration, verify that the terminal from which GlobalProtect runs uses the proxy environment variables. If you do not see the new settings, log out and back in for the new settings to take effect.If you have configured theHTTP_PROXYvariable or theHTTPS_PROXYvariable, make sure that the GlobalProtect portal matches the settings configured for theNO_PROXYvariable.
- To set your proxy on your Linux endpoint, edit theHTTP_PROXYenvironment variable orHTTPS_PROXYenvironment variable (for example,HTTPS_PROXY=”https://yourproxy.local:8080”).
- To configure the IP addresses or domain names that you want to exclude from the proxy, edit theNO_PROXYenvironment variable (for example,NO_PROXY=”www.gpqa.com”).Use commas to separate multiple IP addresses or domain names. Starting with GlobalProtect app 5.1.6, you can use the wildcard character (*) for IP addresses or domain names (for example,NO_PROXY=”*.domain.com”).
- Install the app package.There are two app packages available for GlobalProtect:
- CLI version (for example GlobalProtect_deb-5.1.0.0-19.deb)—Use either thesudo dpkg -ior<gp-app-pkg>sudo apt-get install<gp-app-pkg>
- UI version (for example GlobalProtect_UI_deb-5.1.0.0-19.deb)—Install using thesudo apt-get installcommand.<gp-app-pkg>
where<gp-app-pkg>user@linuxhost:~$sudo dpkg -i GlobalProtect_deb-5.1.0.0-19.debSelecting previously unselected package GlobalProtect. (Reading database ... 67776 files and directories currently installed.) Preparing to unpack GlobalProtect_deb-5.1.0.0-19.deb ... Start installing gp... Unpacking GlobalProtect (5.1.0-19) ... Setting up GlobalProtect (5.1.0-19) ... Enable gp service... Starting gp service... Create symlink for gp cli...user@linuxhost:~$sudo apt-get install GlobalProtect_deb-5.1.0.0-23.deb[sudo] password for gpqa: Reading package lists... Done Building dependency tree Reading state information... Done Note, selecting 'globalprotect' instead of '/home/gpqa/Downloads/GlobalProtect_deb-5.1.0.0-24.deb' The following packages were automatically installed and are no longer required: linux-headers-5.10.0-28 linux-headers-5.10.0-28-generic linux-image-5.10.0-28-generic linux-image-extra-5.10.0-28-generic Use 'sudo apt autoremove' to remove them. The following NEW packages will be installed: globalprotect 0 upgraded, 1 newly installed, 0 to remove and 73 not upgraded. After this operation, 0 B of additional disk space will be used. Get:1 /home/gpqa/Downloads/GlobalProtect_deb-5.1.0.0-24.deb globalprotect all 5.1.0-24 [1,334 kB] E: read, still have 59 to read but none left E: Error reading archive member header E: Prior errors apply to /home/gpqa/Downloads/GlobalProtect_deb-5.1.0.0-24.deb debconf: apt-extracttemplates failed: No such file or directory Selecting previously unselected package globalprotect. (Reading database ... 247210 files and directories currently installed.) Preparing to unpack .../GlobalProtect_deb-5.1.0.0-24.deb ... Start installing gp... Unpacking globalprotect (5.1.0-24) ... Setting up globalprotect (5.1.0-24) ... Enable gp service... Starting gp service... Create symlink for gp cli...The GlobalProtect app for Linux installs to the/opt/paloaltonetworks/globalprotectdirectory. After GlobalProtect first runs, the app also creates a GlobalProtect user folder$HOME/.globalprotectto save user registry configuration and other CLI related settings. - (Optional) Change CLI modes.You can run commands in either command-line or prompt mode. Command-line mode requires you to specify the full GlobalProtect command. Prompt mode requires you to specify only the command (without the app name) and displays more detailed output than command-line mode.
- To switch to prompt mode, enterglobalprotectwithout any arguments.user@linuxhost:~$globalprotect>>
- To exit prompt mode, enterquit.>>quituser@linuxhost:~$
- View the help for GlobalProtect app for Linux.Prompt mode:>>helpUsage: only the following commands aresupported: collect-log -- collect log information connect -- connect to server disconnect -- disconnect disable -- disable connection import-certificate -- import client certificate file quit -- quit from prompt mode rediscover-network -- network rediscovery remove-user -- clear credential resubmit-hip -- resubmit hip information set-log -- set debug level show -- show informationCommand-line mode:user@linuxhost:~$globalprotect helpUsage: only the following commands are supported: collect-log -- collect log information connect -- connect to server disconnect -- disconnect disable -- disable connection import-certificate -- import client certificate file quit -- quit from prompt mode rediscover-network -- network rediscovery remove-user -- clear credential resubmit-hip -- resubmit hip information set-log -- set debug level show -- show information