Arch Linux User Repository

Since this project requires some hacking on the PKGBUILD anyway (due to walled downloads of the binaries), I created a little PKGBUILD repo outside the AUR: https://github.com/Nukesor/globalprotect-pkg

That PKGBUILD works with version 6.2.9.1-407

There's also a README on how to start/enable the services. I got, however, stuck at the issue of the PanGPS server not accepting the PanGPA signature. I'm not sure what to do about it, as there's virtually no documentation/help/manpage regarding anything for PanGPA or PanGPS. The Certs are also in the installed /opt folder, but they're apparently, not used.

The following guide is compiled from multiple sources. I have added my personal experiences and solutions to provide a comprehensive guide:

The newer "GlobalProtect_UI_tar-6.XYZ.tgz" doesn't come with all files needed for the manual install. Instead, we can port the RPM package with the following guide. Other distros might work aswell, just choose the package closest to your distro and ajust step 7 to replace "Ubuntu" with "Arch L" (or whatever from lsb_release -ds, the first 6 characters) in PanGPS.

1. install dependencies (takes ages):

yay -S wmctrl qt5-webkit

1. Download and extract PanGPLinux-...tgz

2. mkdir tmp & cd tmp

3. cp ../GlobalProtect_UI_rpm-6.0.10.0-11.rpm

4. nano PKGBUILD & paste:

    pkgname="globalprotect"
    pkgver="0.0.1"
    pkgrel="1"
    pkgdesc="GlobalProtect_UI_rpm"
    arch=("x86_64")

    depends=('wmctrl' 'qt5-webkit')

    source=("GlobalProtect_UI_rpm-6.0.10.0-11.rpm")

    sha256sums=("SKIP")

    package() {
      find $srcdir/ -mindepth 1 -maxdepth 1 -type d | xargs cp -r -t "$pkgdir"
    }

1. makepkg -si

2. sudo sed -i "s/\x55\x62\x75\x6e\x74\x75/\x41\x72\x63\x68\x20\x4c/g" /opt/paloaltonetworks/globalprotect/PanGPS

3. sudo cp /opt/paloaltonetworks/globalprotect/gpd.service /lib/systemd/system/gpd.service

4. sudo systemctl enable gpd.service && sudo systemctl start gpd.service

5. sudo nano /lib/systemd/system/gpa.service & paste

    [Unit]
    Description=GlobalProtect VPN client Agent

    [Service]
    Type=simple
    ExecStart=/opt/paloaltonetworks/globalprotect/PanMSInit.sh
    Restart=on-failure
    RestartSec=1
    WorkingDirectory=/opt/paloaltonetworks/globalprotect

    [Install]
    WantedBy=default.target

1. sudo systemctl enable gpd.service && sudo systemctl start gpd.service

2. sudo cp /opt/paloaltonetworks/globalprotect/PanMSInit.sh /etc/profile.d/

The GUI might not work and crash for initial connection (username + pw). Just use the CLI for initial connection and create an alias for easier handling. Delete this file sudo rm /etc/xdg/autostart/PanGPUI.desktop to stop the GUI from auto starting.

Troubleshooting:

• reboot
• On Error "Cannot parse your input. The valid CLI commands that you can now use are" → the GUI is running, you can't use the CLI simultaneously. Kill the GUI first. (Delete this file: sudo rm /etc/xdg/autostart/PanGPUI.desktop).
• check if the PanGPS is crashing with sudo systemctl status gpd.service: if so, the string "s/\x55\x62\x75\x6e\x74\x75/\x41\x72\x63\x68\x20\x4c/g" might not be correctly replaced
• No internet after restart?: sudo systemctl restart systemd-resolved -> globalprotect replaces resolved with something custom. Is globalprotect not properly shut down, resolved will not comeback after restart

@slowbro doesn't work for me. I found a reddit post that works for me.

Replace "Ubuntu" with "Arch L" (or whatever from lsb_release -ds, the first 6 characters) in PanGPS

sed -i "s/\x55\x62\x75\x6e\x74\x75/\x41\x72\x63\x68\x20\x4c/g" /opt/paloaltonetworks/globalprotect/PanGPS

then restart gpd

@david-perez i finally found an SSL fix/workaround, see here: https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1960268/comments/32

On arch, this is /etc/ssl/openssl.cnf

I've managed to use GlobalProtect 6.2.0-625 with Arch Linux (in Cachy OS).

Here what I've done:

1) Copy supplied files in "/opt/paloaltonetworks/globalprotect"

2) Execute:

sudo paru qt5-webkit
sudo ln -s /opt/paloaltonetworks/globalprotect/gpd.service /etc/systemd/system/
sudo ln -s /opt/paloaltonetworks/globalprotect/globalprotect /usr/bin/
sudo ln -s /opt/paloaltonetworks/globalprotect/gpa.service /etc/systemd/user/
sudo systemctl daemon-reload
sudo systemctl enable --now gpd
sudo systemctl --global enable gpa.service
systemctl start --user gpa

3) Download https://archive.archlinux.org/packages/i/icu/icu-73.2-2-x86_64.pkg.tar.zst Extract files, and place libicu*.73.2 in /opt/paloaltonetworks/globalprotect

4) Client can be started in this way:

LD_LIBRARY_PATH=/opt/paloaltonetworks/globalprotect /opt/paloaltonetworks/globalprotect/PanGPUI start

5) The only problem I'm experiencing is:

Could not verify the server certificate of the gateway.  
If the issue persists, contact your administrator

I don't know if it is a problem with the gateway of the GP client. Any help will be welcome.

I've moved to globalprotect-openconnect-git instead so I will leave this package for someone else to adopt (who is hopefully actively using it)

I know that 6.2 exists as it is referenced on palo alto website, but I dont have it. Latest my it are giving me is 6.1.2.0, but its problematic for me as well, I have to keep another version of libicu just for vpn.

The latest version from my company server is 6.1.1.c4, is that the current version? I also don't get it to work properly, so don't want to submit update until I manage to fix. If anyone else want to adopt please let me know, you can probably do a better job than me :)

The company I work for mandated the use of a different distro. I'll be unable to continue maintaining this package.

Any chance to upgrade this to 6.2?