GlobalProtect
Download and Install the GlobalProtect App for Linux
GlobalProtect Docs
GlobalProtect offers you two different methods to install the GlobalProtect app on your Linux device: a GUI-based installation version and a CLI version. If you use a supported Linux operating system that supports a graphical interface, you can install the GUI version of the GlobalProtect; otherwise, download and install the CLI version of the GlobalProtect app.
If your Linux device supports a graphical user interface, complete these steps to install the GUI version of GlobalProtect for Linux.
Log in to the Customer Support Portal. After you enter your username and password credentials, you are authenticated and you are logged in to the support site.
user@linuxhost:~$tar -xvf ~/pkgs/PanGPLinux-5.2.0.tgz./ ./GlobalProtect_deb-5.2.0.0-62.deb ./GlobalProtect_deb_arm-5.2.0.0-62.deb ./GlobalProtect_rpm-5.2.0.0-62.rpm ./GlobalProtect_rpm_arm-5.2.0.0-62.rpm ./GlobalProtect_tar-5.2.0.0-62.tgz ./GlobalProtect_tar_arm-5.2.0.0-62.tgz./GlobalProtect_UI_deb-5.2.0.0-62.deb ./GlobalProtect_UI_rpm-5.2.0.0-62.rpm./GlobalProtect_UI_tar-5.2.0.0-62.tgz ./manifest ./relinfo
You will see multiple installation packages for supported operating system versions—DEB for Debian and Ubuntu and RPM for CentOS and Red Hat. The package for the GUI version is denoted by a GlobalProtect_UI prefix.
The GlobalProtect app for Linux supports only a basic proxy server configuration but does not support the use of Proxy Auto-Configuration (PAC) files and proxy authentication.
file. If you later change the system proxy configuration, verify that the terminal from which GlobalProtect runs uses the proxy environment variables. If you do not see the new settings, log out and back in for the new settings to take effect.
Use commas to separate multiple IP addresses or domain names. Starting with GlobalProtect app 5.1.6, you can use the wildcard character (*) for IP addresses or domain names (for example,
When you want to pre-deploy a client certificate to an endpoint for certificate-based authentication, you can copy the certificate to the endpoint and import it for use by the GlobalProtect app. Use the
command to import the certificate on the endpoint. When prompted you must supply the certificate password.
user@linuxhost:~$globalprotect import-certificate --location /home/mydir/Downloads/cert_client_cert.p12Please input passcode: Import certificate is successful.
Install the app using root privileges and use an installation method that will automatically add any missing packages that are required by the GlobalProtect app.
The following example instructs the package manager to install the GlobalProtect_UI_deb-5.2.6.0-12.deb UI distribution package:
user@linuxhost:~$sudo apt-get install GlobalProtect_UI_deb-5.2.6.0-12.deb[sudo] password for gpqa: Reading package lists. Done Building dependency tree Reading state information. Done Note, selecting 'globalprotect' instead of '/home/gpqa/Downloads/GlobalProtect_UI_deb-5.2.6.0-12.deb' The following NEW packages will be installed: globalprotect 0 upgraded, 1 newly installed, 0 to remove and 90 not upgraded. After this operation, 0 B of additional disk space will be used. Get:1 /home/gpqa/Downloads/GlobalProtect_UI_deb-5.2.6.0-12.deb globalprotect all 5.2.6-12 [7,416 kB] E: read, still have 59 to read but none left E: Error reading archive member header E: Prior errors apply to /home/gpqa/Downloads/GlobalProtect_UI_deb-5.2.6.0-12.deb debconf: apt-extracttemplates failed: No such file or directory Selecting previously unselected package globalprotect. (Reading database . 318427 files and directories currently installed.) Preparing to unpack . /GlobalProtect_UI_deb-5.2.6.0-12.deb . Start installing gp. Unpacking globalprotect (5.2.6-12) . Setting up globalprotect (5.2.6-12) . Enable gp service. Starting gp service. Set default browser, errors other than gp.desktop can be ignored. enable ping net.ipv4.ping_group_range = 0 0 Starting gpa. start GPA for sudo user gpqa start PanGPUI for sudo gpqa Processing riggers for man-db (2.8.3-2ubuntu0.1).
The following example installs the GlobalProtect_UI_rpm-5.2.6.0-9.rpm UI distribution package from the repository to your system:
user@linuxhost:~$sudo yum install -y ./GlobalProtect_UI_rpm-5.2.6.0-9.rpm[sudo] password for gpqa: Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager Examining ./GlobalProtect_UI_rpm-5.2.6.0-9.rpm: globalprotect_UI-5.2.6-9.x86_64 Marking ./GlobalProtect_UI_rpm-5.2.6.0-9.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package globalprotect_UI.x86_64 0:5.2.6-9 will be installed --> Finished Dependency Resolution https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/optional/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden Trying other mirror. To address this issue please refer to the below knowledge base article https://access.redhat.com/solutions/69319 If above article doesn't help to resolve this issue please open a ticket with Red Hat Support. https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - ForbiddenTrying other mirror. Dependencies Resolved =============================================================================== Package Arch Version Repository Size =============================================================================== Installing: globalprotect_UI x86_64 5.2.6-9 /GlobalProtect_UI_rpm-5.2.6.0-9 31 M Transaction Summary===============================================================================Install 1 Package Total size: 31 M Installed size: 31 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Start installing gp. Installing : globalprotect_UI-5.2.6-9.x86_64 1/1 Enable gp service. Set default browser, errors other than gp.desktop can be ignored. enable ping /var/tmp/rpm-tmp.VLWi5h: line 23: $LOG: ambiguous redirect Starting gp service.. Starting gpa. Verifying : globalprotect_UI-5.2.6-9.x86_64 1/1 https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/c76c2299-12f3-4f9c-b7bd-03bacee2c363: [Errno 14] HTTPS Error 403 - ForbiddenTrying other mirror. Installed: globalprotect_UI.x86_64 0:5.2.6-9 Complete!
After installation completes, the GlobalProtect app automatically launches. Specify your portal address and enter your credentials when prompted to begin the connection process.
Because the GlobalProtect service supports only one socket connection to the GlobalProtect agent and to the GUI version of the GlobalProtect app, you must either log out of the Linux operating system or the SSH session depending on the installation method used as a root user after installing the app. You must log back in to the Linux endpoint as another user with non-privileged user privileges and the app launches.
If your Linux device does not support a GUI, install the GlobalProtect app for Linux by completing these steps. The GlobalProtect app for Linux supports the DEB, RPM, and TAR installation packages.
For example, if you downloaded the package to a macOS endpoint, you can open a terminal and then copy the file:
macUser@mac:~$scp ~/Downloads/PanGPLinux-5.2.0.tgz linuxUser@linuxHost:user@linuxhost:~$tar -xvf ~/pkgs/PanGPLinux-5.2.0.tgzAfter you unzip the package, you will see installation packages—DEB for Ubuntu and RPM for CentOS and Red Hat—and the scripts to install and uninstall the packages.
The GlobalProtect app for Linux supports only a basic proxy server configuration but does not support the use of Proxy Auto-Configuration (PAC) files and proxy authentication.
file. If you later change the system proxy configuration, verify that the terminal from which GlobalProtect runs uses the proxy environment variables. If you do not see the new settings, log out and back in for the new settings to take effect.
Use commas to separate multiple IP addresses or domain names. Starting with GlobalProtect app 5.1.6, you can use the wildcard character (*) for IP addresses or domain names (for example,
For installation of the CLI version on Linux Ubuntu 20.04 LTS, due to underlying operating system issues, you cannot use the
command to install the CLI version of the GlobalProtect app. For more information, see GlobalProtect 5.2.x or above fails to install package when using the apt-get utility on Ubuntu 20.04 .
user@linuxhost:~$sudo dpkg -i GlobalProtect_deb-5.2.0.0-25.debSelecting previously unselected package GlobalProtect. (Reading database . 265621 files and directories currently installed.) Preparing to unpack GlobalProtect_deb-5.2.0.0-25.deb . gp service is running and we need to stop it. Disable service. Start upgrading gp. Unpacking GlobalProtect (5.2.0-25) over (5.2.0-25). systemd is detected. Setting up GlobalProtect (5.2.0-25) . Enable gp service. Starting gp service. Starting gpa. Processing triggers for man-db (2.8.3-2ubuntu0.1).The following example instructs the package manager to install the GlobalProtect_deb-5.2.6.0-12.deb CLI distribution package:
user@linuxhost:~$sudo apt-get install ./GlobalProtect_deb-5.2.6.0-12.deb[sudo] password for gpqa: Reading package lists. Done Building dependency tree Reading state information. Done Note, selecting 'globalprotect' instead of '/home/gpqa/Downloads/GlobalProtect_deb-5.2.6.0-12.deb' The following NEW packages will be installed: globalprotect 0 upgraded, 1 newly installed, 0 to remove and 94 not upgraded. After this operation, 0 B of additional disk space will be used. Get:1 /home/gpqa/Downloads/GlobalProtect_deb-5.2.6.0-12.deb globalprotect all 5.2.6-12 [6,301 kB] E: read, still have 59 to read but none left E: Error reading archive member header E: Prior errors apply to /home/gpqa/Downloads/GlobalProtect_deb-5.2.6.0-12.deb debconf: apt-extracttemplates failed: No such file or directory Selecting previously unselected package globalprotect. (Reading database . 318427 files and directories currently installed.) Preparing to unpack . /GlobalProtect_deb-5.2.6.0-12.deb . Start installing gp. Unpacking globalprotect (5.2.6-12) . Setting up globalprotect (5.2.6-12) . Enable gp service. Starting gp service. enable ping net.ipv4.ping_group_range = 0 0 Starting gpa. start GPA for sudo user gpqa Processing riggers for man-db (2.8.3-2ubuntu0.1).The following example installs the GlobalProtect_rpm-5.2.6.0-9.rpm CLI distribution package from the repository to your system:
user@linuxhost:~$sudo yum install -y ./GlobalProtect_rpm-5.2.6.0-9.rpm[sudo] password for gpqa: Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager Examining ./GlobalProtect_rpm-5.2.6.0-9.rpm: globalprotect_UI-5.2.6-9.x86_64 Marking ./GlobalProtect_rpm-5.2.6.0-9.rpm to be installed Resolving Dependencies --> Running transaction check ---> Package globalprotect.x86_64 0:5.2.6-9 will be installed --> Finished Dependency Resolution https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/optional/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - Forbidden Trying other mirror. To address this issue please refer to the below knowledge base article https://access.redhat.com/solutions/69319 If above article doesn't help to resolve this issue please open a ticket with Red Hat Support. https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/repomd.xml: [Errno 14] HTTPS Error 403 - ForbiddenTrying other mirror. Dependencies Resolved =============================================================================== Package Arch Version Repository Size =============================================================================== Installing: globalprotect x86_64 5.2.6-9 /GlobalProtect_rpm-5.2.6.0-9 26 M Transaction Summary===============================================================================Install 1 Package Total size: 26 M Installed size: 26 M Downloading packages: Running transaction check Running transaction test Transaction test succeeded Running transaction Start installing gp. Installing : globalprotect-5.2.6-9.x86_64 1/1 Enable gp service. Starting gp service. Starting gpa. Verifying : globalprotect-5.2.6-9.x86_64 1/1 https://cdn.redhat.com/content/dist/rhel/server/7/7Server/x86_64/os/repodata/c76c2299-12f3-4f9c-b7bd-03bacee2c363: [Errno 14] HTTPS Error 403 - ForbiddenTrying other mirror. Installed: globalprotect.x86_64 0:5.2.6-9 Complete!