GlobalProtect through Intune

VPN
1

Hi Guys,

Looking for a bit of help here. I am trying to automate the deployment of Globalprotect and the relevant VPN profile through Intune to windows 10 laptops, however, whatever I have tried I cannot get it working although all Palo Alto / Microsoft documentation states it should work without issue.

I have ensured that on my test device I can access the server and I can connect through to the vpn when using the app on from the portal.

When automating through Intune the issue seems to be that you have to use the windows 10 store version of global protect rather than the executable from the portal. The windows 10 version uses the VPN profile from Intune which sets up the VPN as sstp which does not seem to work. The globalprotect app from the portal installs the VPN as a PANGP Virtual Ethernet Adapter.

Does anyone have a clue what I am doing wrong or what I am missing? Any help at this point would be appreciated.

2

Have you tried creating a Win32 app in Intune for GlobalProtect?

You’ll need to prep the .msi using the Microsoft Win32 Content Prep Tool to create the app as Win32 rather than LOB. The below configuration has worked well for me so far and takes into account agent auto-upgrade. Hope this helps!

Win32 app management in Microsoft Intune | Microsoft Docs

Install command
msiexec /i “GlobalProtect_5.2.3.msi” /q PORTAL=prisma.company.com

Uninstall command
msiexec /x “{1BF3B5DE-B996-4AE8-B790-589143B06A3D}” /q

Install behavior
System
Device restart behavior
Determine behavior based on return codes

Return codes
0 Success
1707 Success
3010 Soft reboot
1641 Hard reboot
1618 Retry
1603 Retry
Requirement rule
File C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
File or Folder does not exist
Detection rule
File C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe
File or Folder exists

Assignment
Required

End user notification
Hide all toast notifications

3

We deploy the MSI via intune and use switches to configure the gateway\pre-logon settings etc and it seems to work fine. Any reason why you aren’t using the MSI installer?

4

commenting to follow

5

Also commenting to follow

6

I can’t help with Intune. What I can say is deploying GP via Kace has proved to be a nightmare (according to the Kace people trying to do it). They get a 30% failure rate, in which the client fails to run in some way on the endpoint, with various issues. As they put it, (and I’m not a Kace person, so I must take their word for it) they have to install it, uninstall it, and reinstall it all as part of the process, I don’t know enough to call bullshit on it or not.

I will say for me, putting it on the Palo portal for download and running the autoupdate manually seems to work for me. But we don’t allow local admin, and we’ve run into issues with that in the past, and now the support team on the helpdesk doesn’t want to use that (although the last couple of times I’ve done it without local admin it seems to work), I think it was only the initial install that didn’t. I only manage the firewalls, I don’t support the clients.

7

Hi People, as a follow on to this, we are experiencing an issue where GP associates itself with “Unidentified Network” (Public) where the device is Azure AD Joined. Do I need to configure Azure AD Named Network Locations with the VPN IP Range (as part of Azure AD Conditional Access Policy) so that GP will associate itself with a Trusted/Known Location based on compliant device?

8

Ooh this is very interesting! I will have a test of this and see how I get on. Thank you!

9

This worked and was absolutely perfect! Thank you so much!

10

Can you help me with one question??? I am using the following MSI installation command: msiexec /i “GlobalProtect64-5.2.2.msi” /q PORTAL=URL.com CONNECTMETHOD=on-demand PRELOGON=1

What I am hoping to get is the connection method to be on-demand (user initiates the connection when they are ready), but at the same time give a user the ability to establish the connection before logging into their laptop. Do I still need to to issue the registry edits on the laptop or will using the PRELOGON=1 switch enable it for me during the installation process?

11

I know this is a few months old but have you ever had issues where the shortcut in the start menu tries reinstalling the app and gives errors like:

The feature you are trying to use is on a network resource that is unavailable.
click ok to try again, or enter an alternate path to a folder containing the installation package for GlobalProtect64.msi in the box below

The app is installed and I can see it in the taskbar but searching for it in the start menu does this.

12

r/Antivirus

r/ComputerSecurity

r/Crypto

r/CyberSecurity

r/Hacking

r/InfoSec

r/Malware

Question, does this autoupdate the previous version of Global protect? or do we need to uninstall the previous version in order to install the new version?

13

I am doing the same. Found that packaging the .msi as a win32 app works best. Gateway parameter would not work when I tried it as a MSI LoB app.

14

I’m having the same issue on my InTune devices. GlobalProtect launches automatically upon login and runs on the taskbar, but if you try to launch the program from the Start Menu the same error is thrown.

Are you assigning the install of GlobalProtect via a device group or a user group?

15

Sounds interesting. Do you guys have any example scripts that you are using for this? Have got it working with the msi previously but could not figure out how to automatically put in the gateway etc.

16

I actually solved this. I created an install script that deletes and creates a new shortcut. I can share my script later if you’re interested.

17

I would love it if you would! Thanks much!

18

msiexec /i $PSScriptRoot\GlobalProtect64-5.2.8.msi /q

Start-Sleep -Seconds 10

Remove-Item -Path “C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk”

$Shell = New-Object -ComObject (“WScript.shell”)
$ShortCut = $Shell.CreateShortcut(“C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Palo Alto Networks\GlobalProtect\GlobalProtect.lnk”)
$ShortCut.TargetPath=“C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.exe”
$ShortCut.WorkingDirectory = “C:\Program Files\Palo Alto Networks\GlobalProtect”
$ShortCut.WindowStyle = 1;
$ShortCut.IconLocation =“C:\Program Files\Palo Alto Networks\GlobalProtect\PanGPA.ico, 0”;
$ShortCut.Description = “GlobalProtect”
$ShortCut.Save()

19

On mobile so the formatting is a bit ugly but basically I just change the installer to whatever version I’m pushing, wrap this script up with the .msi in .intunewin file then set the install command to run the script. I also use supersedence to remove previous versions of GlobalProtect. The key to having this working is to set the detection rule to the version number in registry.