GlobalProtect App download fails with the error "This site can't be reached"

• Endpoint clients connect to GlobalProtect Portal and they are presented with GP app download options.

• Once the desired app is selected, it fails with error: This site can't be reached.

• Next-Gen Firewalls
• Supported PAN-OS versions
• Redirect to GlobalProtect Host Apps on Web Server
• Supported GlobalProtect (GP) App versions
• Windows and macOS clients

Misconfiguration of redirect location in the firewall to a wrong URL causes this issue.

1. Update the redirect URL location using following steps:
   
   • Check the configured redirect URL location on the firewall using following command ->

> set global-protect redirect show

cfg.global-protect.redirect.flag: True                                                    
cfg.global-protect.redirect.location: https://gp.paloalto.com  => wrongly configured URL

1. • Replace the URL to the correct location which hosts the GP app software using following command ->

> set global-protect redirect location https://redir.gp.paloalto.com

cfg.global-protect.redirect.location: https://redir.gp.paloalto.com => corrected URL location

2. Disable GlobalProtect redirect using following CLI command. This will set the Host App Download back to default settings where the App is downloaded from the GlobalProtect Portal.

> set global-protect redirect off
> set global-protect redirect show

cfg.global-protect.redirect.flag: False                                                    
cfg.global-protect.redirect.location: https://redir.gp.paloalto.com

NOTE: These commands take into effect immediately and will survive a reboot of the firewall. Commit operation is not required.