GlobalProtect for Linux FAQ

Frequently asked questions regarding the Linux GlobalProtect VPN client as it relates to the the bSecure Remote Access service.

NOTE: While the Network Services Team provides a Linux-compatible VPN client, Linux based desktop operating systems are not officially supported by Berkeley IT. Due to limited resources, only wide impact issues can be investigated.

Where Can I Download the GlobalProtect Linux Client?

The GlobalProtect client can be downloaded from the following Google Drive.  The compressed download files contain multiple installation formats so no matter what platform you use there is only one file to download.

https://drive.google.com/drive/folders/19O8zU9WHcUFw944DrQR5a9xMA76cTzP8?usp=sharing

You have to use your @berkeley.edu account to access the files.

Does GlobalProtect for Linux Support my Linux Distribution?

The following matrix shows the recommended GlobalProtect clients for each 64bit Linux distribution. This support list is for the manufacturers software packages themselves and not what Berkeley IT support. If your distribution is not listed the software may still work, but has not been tested by the manufacturer.

NOTE: At this time bIT allows the use of, but does not provide support for, the Linux releases of GlobalProtect.

Linux Distribution	Release	GlobalProtect Version
CentOS	v8.3	v6.1+
RedHat Enterprise	v8.3 & v8.4	v6.0.x
RedHat Enterprise	v8.7	v6.0.x
RedHat Enterprise	v8.9	v6.2+
RedHat Enterprise	v9.1	v6.1.1+
RedHat Enterprise	v9.3	v6.2.1+
Ubuntu LTS	v16.04 & v18.04	v6.0.x and v6.1.x Only
Ubuntu	v19.04	v6.0.x and v6.1.x Only
Ubuntu	v20.04	v6.1.x and v6.2.1+
Ubuntu	v22.04	v6.1+
Ubuntu	v24.04	v6.2+
Fedora Linux	38	v6.2+
Fedora Linux	40	v6.2.1+

Does GlobalProtect for Linux Support 32bit or ARM Architectures?

No, GlobalProtect for Linux only supports AMD64/i64 releases of linux.  32bit and ARM Linux distributions are not supported. 

GlobalProtect Reports an unsafe legacy SSL error on Ubuntu and other distributions

Changes in the configuration of the OpenSSL software distributed as part of Linux distributions have disabled some legacy communications methods.

More information on this issue can be found in the StackOverflow post: SSL error unsafe legacy renegotiation disabled

Why do I have to install globalprotect-ui instead of just globalprotect?

The GlobalProtect UI for Linux software package includes support for web based authentication, which is required for the UC Berkeley remote access service.  Attempting to use the regular "globalprotect" client will end up with the client hanging during the authentication process because it does not support launching a web browser on your desktop.

How do I enable the default browser instead of the built-in browser for logins?

Palo Alto Networks hosts an instruction page (no login required) that describes how to enable use of the default browser: How to change GlobalProtect SAML Authentication from embedded browser to System Default Browser on Linux

Once the client is configured to do initial connections with default browser it will retrieve the bSecure config, which will set the site profile to use default browser as well.