How to Upgrade - GlobalProtect Agent Upgrade Process

How to Upgrade - GlobalProtect Agent Upgrade Process

Created On 09/25/18 20:40 PM - Last Modified 01/14/21 20:54 PM


This document describes the GlobalProtect Agent Upgrade Process in the "Allow with Prompt" setting on Firewall.

  • PAN-OS 7.1,8.1,9.0.
  • Palo Alto Firewall.
  • GlobalProtect configured.



By default, the Agent Upgrade field is set to prompt the end-user to upgrade. This behavior can be modified by choosing different available options in the agent upgrade to connect method field.

To change the connect method, inside of the WebGUI go to to Network > GlobalProtect > Portals > (portal name) > Agent > (Agent selection) > App > Allow User to Upgrade GlobalProtect App.


  1. Download and install the GlobalProtect Client on the Palo Alto Networks firewall. To install and activate the GlobalProtect Client, Use GUI: Device > GlobalProtect Client. Use the checknow button at the bottom to check for updates followed by Download to download the same. Next click Activate to activate the downloaded software.
  2. When the user connects to the client after installation of the new version, they will be prompted with the following page stating a newer version of GlobalProtect is available for download.

Global Protect Upgrade message

  1. After clicking on "Yes" it will start installing immediately. Once the installation is completed the following page will appear:

Global Protect Update message
  1. During the installation, the VPN connection will be terminated and reestablished
  2.  After reconnecting to the Gateway, confirm the upgrade was complete by navigating to the hamburger icon in the top right corner of the Client and selecting About from the dropdown menu.
GlobalProtect Settings

  1.  The version number displayed should now reflect the newly installed GlobalProtect Client.
GlobalProtect version displayed


• To allow automatic upgrades without interaction with the user, select the "Transparent" method in the app configuration listed above.

• To prevent agent upgrades, select the "Disabled" method.

• To allow end-users to initiate agent upgrades, select "Manual". In this case, the user would select the Check Version option in the agent to determine if there is a new agent version and then upgrade if desired. This option will not work if the GlobalProtect agent is hidden from the user.
• automatic/transparent app upgrade during pre-logon is not supported

  • Print
  • Copy Link

Choose Language