Frequently asked questions regarding the Linux GlobalProtect VPN client as it relates to the the bSecure Remote Access service.
NOTE: While the Network Services Team provides a Linux-compatible VPN client, Linux based desktop operating systems are not officially supported by Berkeley IT. Due to limited resources, only wide impact issues can be investigated.
Where Can I Download the GlobalProtect Linux Client?
The GlobalProtect client can be downloaded from the following Google Drive. The compressed download files contain multiple installation formats so no matter what platform you use there is only one file to download.
https://drive.google.com/drive/folders/19O8zU9WHcUFw944DrQR5a9xMA76cTzP8?usp=sharing
You have to use your @berkeley.edu account to access the files.
Does GlobalProtect for Linux Support my Linux Distribution?
The following matrix shows the recommended GlobalProtect clients for each 64bit Linux distribution. This support list is for the manufacturers software packages themselves and not what Berkeley IT support. If your distribution is not listed the software may still work, but has not been tested by the manufacturer.
NOTE: At this time bIT allows the use of, but does not provide support for, the Linux releases of GlobalProtect.
| Linux Distribution | Release | GlobalProtect Version |
| CentOS | v8.3 | v6.1+ |
| RedHat Enterprise | v8.3 & v8.4 | v6.0.x |
| RedHat Enterprise | v8.7 | v6.0.x |
| RedHat Enterprise | v8.9 | v6.2+ |
| RedHat Enterprise | v9.1 | v6.1.1+ |
| RedHat Enterprise | v9.3 | v6.2.1+ |
| Ubuntu LTS | v16.04 & v18.04 | v6.0.x and v6.1.x Only |
| Ubuntu | v19.04 | v6.0.x and v6.1.x Only |
| Ubuntu | v20.04 | v6.1.x and v6.2.1+ |
| Ubuntu | v22.04 | v6.1+ |
| Ubuntu | v24.04 | v6.2+ |
| Fedora Linux | 38 | v6.2+ |
| Fedora Linux | 40 | v6.2.1+ |
Does GlobalProtect for Linux Support 32bit or ARM Architectures?
No, GlobalProtect for Linux only supports AMD64/i64 releases of linux. 32bit and ARM Linux distributions are not supported.
GlobalProtect Reports an unsafe legacy SSL error on Ubuntu and other distributions
Changes in the configuration of the OpenSSL software distributed as part of Linux distributions have disabled some legacy communications methods.
More information on this issue can be found in the StackOverflow post: SSL error unsafe legacy renegotiation disabled
Why do I have to install globalprotect-ui instead of just globalprotect?
The GlobalProtect UI for Linux software package includes support for web based authentication, which is required for the UC Berkeley remote access service. Attempting to use the regular "globalprotect" client will end up with the client hanging during the authentication process because it does not support launching a web browser on your desktop.
How do I enable the default browser instead of the built-in browser for logins?
Palo Alto Networks hosts an instruction page (no login required) that describes how to enable use of the default browser: How to change GlobalProtect SAML Authentication from embedded browser to System Default Browser on Linux
Once the client is configured to do initial connections with default browser it will retrieve the bSecure config, which will set the site profile to use default browser as well.