>
    Strata Copilot
    Host App Updates
    Focus
    Download PDF
    Focus
    1. Home
    2. GlobalProtect
    3. GlobalProtect Administrator's Guide
    4. GlobalProtect Apps
    5. Deploy the GlobalProtect App on Desktops
    6. Host App Updates
    Download PDF
    GlobalProtect

    Host App Updates

    Table of Contents

    Host App Updates

    Deploy GlobalProtect app updates on the portal by downloading and activating the software on the firewall hosting the portal. You can also reduce load on the firewall by hosting GlobalProtect app software images on a web server.
    Where Can I Use This?What Do I Need?
    • NGFW (managed by Panorama )
    • GlobalProtect Gateway license
    The simplest way to deploy the GlobalProtect app software is to download the new app installation package to the firewall that is hosting your portal, and then activate the software for download to the apps connecting to the portal. To do this automatically, the firewall must have a service route that enables it to access the Palo Alto Networks Update Server. If the firewall does not have internet access, you can Download the GlobalProtect App Software Package for Hosting on the Portal software package from the Palo Alto Networks Software Updates support site using an internet-connected computer, and then manually upload it to the firewall.
    If a large number of your endpoints must install and/or update the GlobalProtect app software, consider hosting the GlobalProtect app software images on an external web server. This helps reduce the load on the firewall when users connect to and download the app.

    Host App Updates on the Portal

    Deploy GlobalProtect app updates on the portal by downloading and activating the software on the firewall hosting the portal.
    Where Can I Use This?What Do I Need?
    • NGFW (managed by Panorama )
    • GlobalProtect Gateway license
    You define how the app software updates are deployed in the portal agent configurations—whether they occur automatically when the app connects to the portal, whether the user is prompted to upgrade the app, or whether the end user can manually check for and download a new app version. For details on creating an agent configuration, see Define the GlobalProtect Agent Configurations.
    1. On the firewall hosting the GlobalProtect portal, check for new app software images.
      Select DeviceGlobalProtect Client to view the list of available app software images.
      • If the firewall has access to the Update Server, click Check Now for the latest updates. If the value in the Action column is Download, it indicates that a new version of the app is available.
      • If the firewall does not have access to the Update Server, you must manually download the software image from the Palo Alto Networks Software Updates support site, as described in step 2.
    2. Download the app software image.
      • If the firewall has access to the Update Server, locate the app version you want, and then click Download. When the download completes, the value in the Action column changes to Activate.
      • If the firewall does not have access to the Update Server, Download the GlobalProtect App Software Package for Hosting on the Portal. After you download the software image, go back to the DeviceGlobalProtect Client page of the firewall to Upload it.
    3. Activate the app software image so that end users can download it from the portal.
      Only one version of the app software image can be activated at a time. If you activate a new version, but have some apps that require a previously activated version, you must activate the required version again to enable it for download.
      • If the software image was automatically downloaded from the Update Server, click Activate.
      • If you manually uploaded the software image to the firewall, click Activate From File, and then select the GlobalProtect Client File you uploaded from the drop-down. Click OK to activate the selected image. You may need to refresh the page before the version displays as Currently Activated.

    Host App Updates on a Web Server

    Reduce load on the firewall by hosting GlobalProtect app software images on a web server. Download, activate, publish, and redirect users to the server.
    Where Can I Use This?What Do I Need?
    • NGFW (managed by Panorama )
    • GlobalProtect Gateway license
    1. Download and activate the version of the GlobalProtect app that you plan to host on the web server to the firewall.
      Follow the steps for downloading and activating the app software on the firewall, as described in Host App Updates on the Portal.
    2. Download the GlobalProtect app software image that you want to host on your web server.
      Download the same image that you activated on the portal.
      From a web browser, Download the GlobalProtect App Software Package for Hosting on the Portal.
    3. Publish the software image files to your web server.
    4. Redirect end users to the web server.
      On the firewall hosting the portal, enter the following CLI commands in operational mode:
      > set global-protect redirect on 
> set global-protect redirect location <path>
      where <path> is the path is the URL to the folder hosting the image (for example, https://acme/GP).
    5. Test the redirect.
      1. From a web browser, go to the following URL:
        https://<portal address or name>
        For example, https://gp.acme.com.
      2. On the portal login page, enter your user Name and Password, and then click LOGIN. After successful login, the portal should redirect you to the download.

    © 2026 Palo Alto Networks, Inc. All rights reserved.